@mysten-incubation/devstack 0.1.0 → 0.2.0

package/dist/plugins/wallet/server.mjs

@@ -1,12 +1,11 @@
-import { SpanAttr } from "../../substrate/runtime/observability/spans.mjs";
 import { decodeJsonText } from "../../substrate/runtime/runtime-decode.mjs";
+import { LogAttr } from "../../substrate/runtime/observability/log-attrs.mjs";
 import { WALLET_AUTH_HEADER, WalletHttpPath } from "../../contracts/wallet-protocol.mjs";
 import { formatUnknownError } from "../../substrate/runtime/format-unknown-error.mjs";
 import { walletBootError, walletRequestError } from "./errors.mjs";
-import { WalletSpans } from "./spans.mjs";
+import { checkOrigin, corsHeadersFor } from "./origin-policy.mjs";
 import { SignRequestSchema } from "./protocol.mjs";
 import { parseBearerHeader, safeBearerEquals } from "./pairing.mjs";
-import { checkOrigin, corsHeadersFor } from "./origin-policy.mjs";
 import { listenScopedHttpServer } from "../../substrate/runtime/scoped-http-server.mjs";
 import { Cause, Effect } from "effect";
 import { randomUUID } from "node:crypto";
@@ -62,8 +61,8 @@ const startHttpServer = (config) => Effect.gen(function* () {
 		})
 	});
 	yield* Effect.logInfo("wallet HTTP server listening").pipe(Effect.annotateLogs({
-		[SpanAttr.host]: config.bindAddress,
-		[SpanAttr.port]: config.port
+		[LogAttr.host]: config.bindAddress,
+		[LogAttr.port]: config.port
 	}));
 	return {
 		url: handle.url,
@@ -118,8 +117,8 @@ const makeRequestListener = (config, runDispatch) => (req, res) => {
 		};
 		runDispatch(dispatch(config, walletReq).pipe(Effect.matchCauseEffect({
 			onFailure: (cause) => Effect.logError("wallet dispatcher defect").pipe(Effect.annotateLogs({
-				[WalletSpans.requestMethod]: walletReq.method,
-				[WalletSpans.requestUrl]: walletReq.url,
+				"wallet.request.method": walletReq.method,
+				"wallet.request.url": walletReq.url,
 				cause: Cause.pretty(cause)
 			}), Effect.flatMap(() => Effect.sync(() => {
 				writeServerError(res);
@@ -198,11 +197,6 @@ const text = (status, body, extraHeaders = {}) => ({
 */
 const dispatch = (config, req) => Effect.gen(function* () {
 	const requestId = randomUUID();
-	yield* Effect.annotateCurrentSpan({
-		[WalletSpans.requestId]: requestId,
-		[WalletSpans.requestMethod]: req.method,
-		[WalletSpans.requestUrl]: req.url
-	});
 	const path = req.url.split("?")[0] ?? "";
 	if (!path.startsWith("/api/v1/devstack/")) return text(404, "not found");
 	if (req.method === "OPTIONS") {
@@ -217,31 +211,30 @@ const dispatch = (config, req) => Effect.gen(function* () {
 	const originResult = checkOrigin(config.policy, req.headers["origin"]);
 	if (originResult === "missing") {
 		yield* Effect.logWarning("wallet origin missing").pipe(Effect.annotateLogs({
-			[SpanAttr.requestId]: requestId,
-			[SpanAttr.httpMethod]: req.method,
-			[SpanAttr.httpPath]: path
+			[LogAttr.requestId]: requestId,
+			[LogAttr.httpMethod]: req.method,
+			[LogAttr.httpPath]: path
 		}));
 		return text(403, "Origin header required");
 	}
 	if (originResult === "forbidden") {
 		yield* Effect.logWarning("wallet origin forbidden").pipe(Effect.annotateLogs({
-			[SpanAttr.requestId]: requestId,
-			[WalletSpans.origin]: req.headers.origin ?? "(missing)",
-			[SpanAttr.httpMethod]: req.method,
-			[SpanAttr.httpPath]: path
+			[LogAttr.requestId]: requestId,
+			"wallet.origin": req.headers.origin ?? "(missing)",
+			[LogAttr.httpMethod]: req.method,
+			[LogAttr.httpPath]: path
 		}));
 		return text(403, "forbidden origin");
 	}
 	const origin = req.headers["origin"];
 	const bearer = parseBearerHeader(req.headers[WALLET_AUTH_HEADER]);
 	const bearerValid = bearer !== null && safeBearerEquals(bearer, config.token);
-	yield* Effect.annotateCurrentSpan({ [WalletSpans.bearerValid]: bearerValid });
 	if (!bearerValid) {
 		yield* Effect.logWarning("wallet bearer check failed").pipe(Effect.annotateLogs({
-			[SpanAttr.requestId]: requestId,
-			[WalletSpans.bearerValid]: bearerValid,
-			[SpanAttr.httpMethod]: req.method,
-			[SpanAttr.httpPath]: path
+			[LogAttr.requestId]: requestId,
+			"wallet.auth.bearerValid": bearerValid,
+			[LogAttr.httpMethod]: req.method,
+			[LogAttr.httpPath]: path
 		}));
 		return errorEnvelope(walletRequestError({
 			phase: "unauthorized",

package/dist/plugins/wallet/server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"server.mjs","names":[],"sources":["../../../src/plugins/wallet/server.ts"],"sourcesContent":["// Wallet plugin — in-process HTTP server.\n//\n// Responsibilities:\n//\n//   1. Bind a `node:http` server on a substrate-allocated port (the\n//      port broker hands the port in; we don't pick it here).\n//   2. Dispatch by `(METHOD, path)` to the four handlers below\n//      (health, accounts, sign-transaction, sign-personal-message).\n//   3. Enforce the auth gate: mandatory Origin in policy.allowed +\n//      constant-time bearer compare.\n//   4. Body-cap enforcement: 64 KiB before buffering — protects the\n//      supervisor from OOM via streaming payloads.\n//   5. Per-request span + log annotation under the captured\n//      supervisor context — so handler errors hit the TUI logger\n//      sink instead of bare stderr.\n//   6. Scope-finalizer teardown: `closeAllConnections()` →\n//      `close()` awaited → port release (the substrate's scope\n//      finalizer chain handles release; we just close).\n//\n// Wiring status (15-wallet.md alignment): both the per-route handler\n// bodies (auth + decode + dispatch to `AccountValue` sign closures)\n// AND the in-process `node:http.Server` listen loop are real. The\n// listener buffers each request body up to `MAX_BODY_BYTES`, forks the\n// dispatcher Effect under the captured supervisor context (so handler\n// logs flow to the TUI logger sink), while the substrate scoped HTTP\n// listener owns bind/close lifecycle.\n\nimport { Cause, Context, Effect, Schema } from 'effect';\nimport type { Scope } from 'effect';\nimport { randomUUID } from 'node:crypto';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\n\nimport { listenScopedHttpServer } from '../../substrate/runtime/scoped-http-server.ts';\nimport { SpanAttr } from '../../substrate/runtime/observability/spans.ts';\nimport { decodeJsonText } from '../../substrate/runtime/runtime-decode.ts';\nimport { formatUnknownError } from '../../substrate/runtime/format-unknown-error.ts';\nimport { WalletSpans } from './spans.ts';\nimport type { AccountValue } from '../account/index.ts';\nimport {\n\twalletBootError,\n\twalletRequestError,\n\ttype WalletBootError,\n\ttype WalletRequestError,\n} from './errors.ts';\nimport { checkOrigin, corsHeadersFor, type OriginPolicy } from './origin-policy.ts';\nimport { parseBearerHeader, safeBearerEquals, type PairingToken } from './pairing.ts';\nimport {\n\tAccountsResponseSchema,\n\tHealthResponseSchema,\n\tSignRequestSchema,\n\tSignResponseSchema,\n\tWALLET_AUTH_HEADER,\n\tWALLET_PROTOCOL_PREFIX,\n\tWalletHttpPath,\n\ttype AccountSummary,\n} from './protocol.ts';\n\n// ----------------------------------------------------------------------\n// Server config + handle\n// ----------------------------------------------------------------------\n\n/** Inputs the substrate hands to `startHttpServer`. The plugin's\n *  acquire body builds this from its resolved inputs (port broker,\n *  origin policy, accounts map, token). */\nexport interface WalletServerConfig {\n\treadonly bindAddress: string;\n\treadonly port: number;\n\treadonly token: PairingToken;\n\treadonly policy: OriginPolicy;\n\treadonly accountsByAddress: ReadonlyMap<string, AccountValue>;\n}\n\n/** Opaque server handle. The substrate's scope finalizer chain\n *  invokes `.close()`; callers don't dispatch into it directly. */\nexport interface WalletServerHandle {\n\treadonly url: string; // direct loopback URL — `http://<bindAddress>:<port>`\n\treadonly close: () => Effect.Effect<void>;\n}\n\n/** Body cap — 64 KiB. Above the largest reasonable sign-tx payload,\n *  well below any OOM threshold. */\nexport const MAX_BODY_BYTES = 64 * 1024;\n\n// ----------------------------------------------------------------------\n// Top-level boot\n// ----------------------------------------------------------------------\n\n/** Per-request socket-level timeout, milliseconds. Caps the time a\n *  malicious / hung peer can hold an idle connection. */\nconst REQUEST_SOCKET_TIMEOUT_MS = 30_000;\n\n/**\n * Boot the wallet HTTP server.\n *\n * Wires `node:http.createServer` against the dispatcher. Listens on\n * `bindAddress:port` (the substrate's port broker chose `port` upstream\n * of this call). The scope finalizer awaits graceful close on teardown\n * — `closeAllConnections()` followed by `close()` with await.\n *\n *  Request flow (per connection):\n *\n *    1. `request` listener fires with `IncomingMessage`+`ServerResponse`.\n *    2. We buffer the request body up to `MAX_BODY_BYTES`. If the\n *       inbound payload exceeds the cap, the socket is destroyed and\n *       a 413 returned without ever invoking the dispatcher (closes the\n *       supervisor-OOM path).\n *    3. Construct a `WalletRequest` from the buffered body + headers.\n *    4. `Effect.runForkWith(supervisorContext)(dispatch(config, req))`\n *       — captured at acquire time so handler logs/spans flow to the\n *       TUI logger sink.\n *    5. On fiber completion, write status + headers + body to `res`.\n *    6. On uncaught exception in the listener path: 500 with an opaque\n *       message (no token leak, no internal-state leak).\n *\n *  Scope finalizer:\n *\n *    Calls `server.closeAllConnections()` (kills idle keepalive\n *    sockets) then awaits `server.close()` (drains in-flight). The\n *    finalizer is uninterruptible so a Ctrl-C double-tap doesn't\n *    leave the socket dangling.\n */\nexport const startHttpServer = (\n\tconfig: WalletServerConfig,\n): Effect.Effect<WalletServerHandle, WalletBootError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// Capture the supervisor context so handler fibers run with the\n\t\t// same Logger / span sinks as the rest of the stack. The\n\t\t// dispatcher's R-channel is `never`, but capturing the context\n\t\t// keeps fiber-refs (logger, spans) flowing.\n\t\tconst supervisorContext = yield* Effect.context<never>();\n\t\tconst runDispatch = Effect.runForkWith(supervisorContext as Context.Context<never>);\n\n\t\tconst handle = yield* listenScopedHttpServer({\n\t\t\tbindAddress: config.bindAddress,\n\t\t\tport: config.port,\n\t\t\tlistener: makeRequestListener(config, runDispatch),\n\t\t\tonListenError: (cause): WalletBootError =>\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'listen',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`wallet HTTP server listen failed on ${config.bindAddress}:${config.port} — ` +\n\t\t\t\t\t\t(formatUnknownError(cause)),\n\t\t\t\t\thint:\n\t\t\t\t\t\t'check that the port broker did not hand out a busy port; ' +\n\t\t\t\t\t\t'a sibling devstack on the same address would also explain this.',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\n\t\tyield* Effect.logInfo('wallet HTTP server listening').pipe(\n\t\t\tEffect.annotateLogs({\n\t\t\t\t[SpanAttr.host]: config.bindAddress,\n\t\t\t\t[SpanAttr.port]: config.port,\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\turl: handle.url,\n\t\t\tclose: handle.close,\n\t\t} satisfies WalletServerHandle;\n\t});\n\n// ----------------------------------------------------------------------\n// Node request listener — bridges `node:http` → dispatcher Effect\n// ----------------------------------------------------------------------\n\n/**\n * Build the `(req, res)` listener Node hands to `http.createServer`.\n *\n * The listener:\n *\n *   - Buffers the request body up to `MAX_BODY_BYTES`. Over-cap →\n *     413 + socket destroyed (the dispatcher's body-cap check is the\n *     second line of defense; this one is the first).\n *   - Drops invalid socket-level errors silently (defensive: the\n *     wallet is loopback-only, but a malformed HTTP/1.1 line shouldn't\n *     crash the supervisor).\n *   - Forks the dispatcher Effect via the captured supervisor runtime.\n *   - Writes the resolved `WalletResponse` back to `res`.\n *\n * Returns void (Node listener signature) — all error reporting flows\n * through the dispatcher (request errors) or `Effect.logError` (boot/\n * listener path errors).\n */\nconst makeRequestListener =\n\t(\n\t\tconfig: WalletServerConfig,\n\t\trunDispatch: <A, E>(effect: Effect.Effect<A, E, never>) => unknown,\n\t): ((req: IncomingMessage, res: ServerResponse) => void) =>\n\t(req, res) => {\n\t\t// Socket-level timeout — protects against hung peers parking\n\t\t// requests on the supervisor's loopback.\n\t\treq.socket.setTimeout(REQUEST_SOCKET_TIMEOUT_MS);\n\n\t\tconst chunks: Buffer[] = [];\n\t\tlet totalBytes = 0;\n\t\tlet overflowed = false;\n\n\t\treq.on('data', (chunk: Buffer) => {\n\t\t\tif (overflowed) return;\n\t\t\ttotalBytes += chunk.length;\n\t\t\tif (totalBytes > MAX_BODY_BYTES) {\n\t\t\t\toverflowed = true;\n\t\t\t\twriteOverflow(res);\n\t\t\t\ttry {\n\t\t\t\t\treq.destroy();\n\t\t\t\t} catch {\n\t\t\t\t\t/* defensive */\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tchunks.push(chunk);\n\t\t});\n\n\t\treq.on('error', () => {\n\t\t\t// Socket-level error — drop. Per-request errors are handled\n\t\t\t// inside the dispatcher.\n\t\t});\n\n\t\treq.on('end', () => {\n\t\t\tif (overflowed) return;\n\t\t\tconst body = Buffer.concat(chunks).toString('utf8');\n\t\t\tconst walletReq: WalletRequest = {\n\t\t\t\tmethod: req.method ?? 'GET',\n\t\t\t\turl: req.url ?? '/',\n\t\t\t\theaders: normalizeHeaders(req.headers),\n\t\t\t\tbody,\n\t\t\t};\n\t\t\tconst program = dispatch(config, walletReq).pipe(\n\t\t\t\t// `dispatch` is typed `Effect<WalletResponse>` (no failure\n\t\t\t\t// channel) — its handlers map every expected failure into a\n\t\t\t\t// WalletResponse with the right HTTP status. Anything that\n\t\t\t\t// lands here is therefore a *defect* (thrown sync exception,\n\t\t\t\t// runtime invariant violation). We project the full Cause via\n\t\t\t\t// `matchCauseEffect` so we have something to log; `matchEffect`\n\t\t\t\t// would type the failure as `never` and the defect would\n\t\t\t\t// bypass it.\n\t\t\t\tEffect.matchCauseEffect({\n\t\t\t\t\tonFailure: (cause) =>\n\t\t\t\t\t\tEffect.logError('wallet dispatcher defect').pipe(\n\t\t\t\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t\t\t\t[WalletSpans.requestMethod]: walletReq.method,\n\t\t\t\t\t\t\t\t[WalletSpans.requestUrl]: walletReq.url,\n\t\t\t\t\t\t\t\tcause: Cause.pretty(cause),\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\tEffect.flatMap(() =>\n\t\t\t\t\t\t\t\tEffect.sync(() => {\n\t\t\t\t\t\t\t\t\twriteServerError(res);\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\tonSuccess: (resp) => Effect.sync(() => writeResponse(res, resp)),\n\t\t\t\t}),\n\t\t\t);\n\t\t\trunDispatch(program);\n\t\t});\n\t};\n\nconst writeResponse = (res: ServerResponse, resp: WalletResponse): void => {\n\tif (res.writableEnded) return;\n\tres.statusCode = resp.status;\n\tfor (const [k, v] of Object.entries(resp.headers)) {\n\t\tres.setHeader(k, v);\n\t}\n\tres.end(resp.body);\n};\n\nconst writeOverflow = (res: ServerResponse): void => {\n\tif (res.writableEnded) return;\n\tres.statusCode = 413;\n\tres.setHeader('content-type', 'text/plain; charset=utf-8');\n\tres.end('payload too large');\n};\n\n/** Write an opaque 500 — no token, no internal state leak. The\n *  caller is responsible for logging the underlying cause (see the\n *  `Effect.logError('wallet dispatcher defect')` in `dispatch`'s\n *  `matchCauseEffect` onFailure branch). */\nconst writeServerError = (res: ServerResponse): void => {\n\tif (res.writableEnded) return;\n\tres.statusCode = 500;\n\tres.setHeader('content-type', 'application/json; charset=utf-8');\n\tres.end(\n\t\tJSON.stringify({\n\t\t\terror: 'internal error',\n\t\t\tcode: 'internal-error',\n\t\t}),\n\t);\n};\n\n/** Normalize Node's `IncomingHttpHeaders` (string | string[] | undefined)\n *  to the `WalletRequest.headers` shape (string | undefined). Picks the\n *  first value for repeated headers — matches browser send semantics\n *  for the headers we care about (Origin, Authorization, Content-Type). */\nconst normalizeHeaders = (\n\theaders: IncomingMessage['headers'],\n): Readonly<Record<string, string | undefined>> => {\n\tconst out: Record<string, string | undefined> = {};\n\tfor (const [k, v] of Object.entries(headers)) {\n\t\tif (v === undefined) {\n\t\t\tout[k] = undefined;\n\t\t} else if (Array.isArray(v)) {\n\t\t\tout[k] = v[0];\n\t\t} else {\n\t\t\tout[k] = v;\n\t\t}\n\t}\n\treturn out;\n};\n\n// ----------------------------------------------------------------------\n// Dispatcher — pure(ish) function from request → effect\n// ----------------------------------------------------------------------\n\n/** Inbound request shape — substrate-runtime-agnostic. The substrate's\n *  http-server primitive converts a `node:http` IncomingMessage into\n *  this; tests can construct it directly. */\nexport interface WalletRequest {\n\treadonly method: string;\n\treadonly url: string; // path + query, no host\n\treadonly headers: Readonly<Record<string, string | undefined>>;\n\treadonly body: string; // already-buffered (capped at MAX_BODY_BYTES)\n}\n\n/** Outbound response. */\nexport interface WalletResponse {\n\treadonly status: number;\n\treadonly headers: Readonly<Record<string, string>>;\n\treadonly body: string;\n}\n\nconst json = (\n\tstatus: number,\n\tbody: unknown,\n\textraHeaders: Readonly<Record<string, string>> = {},\n): WalletResponse => ({\n\tstatus,\n\theaders: { 'content-type': 'application/json; charset=utf-8', ...extraHeaders },\n\tbody: JSON.stringify(body),\n});\n\nconst text = (\n\tstatus: number,\n\tbody: string,\n\textraHeaders: Readonly<Record<string, string>> = {},\n): WalletResponse => ({\n\tstatus,\n\theaders: { 'content-type': 'text/plain; charset=utf-8', ...extraHeaders },\n\tbody,\n});\n\n/**\n * Dispatch a single request to its handler. Returns an Effect that\n * always succeeds (the response is built); request-level failures\n * are projected to JSON envelopes via `errorEnvelope` below.\n *\n * The dispatch order matters:\n *   1. Path-prefix gate — anything not under `/api/v1/devstack/` is\n *      a flat 404 (text/plain). PROTECTS the auth gate (and the CORS\n *      preflight) from being visible on arbitrary URLs.\n *   2. OPTIONS preflight (returns 204 + CORS) — no auth required, but\n *      scoped to the protocol prefix by step 1 so an allowed origin\n *      cannot extract CORS headers for unrelated paths.\n *   3. Origin check (must be in policy.allowed; missing → 403).\n *   4. Bearer check (must constant-time-equal `config.token`).\n *   5. Method+path route to handler.\n */\nexport const dispatch = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n): Effect.Effect<WalletResponse> =>\n\tEffect.gen(function* () {\n\t\tconst requestId = randomUUID();\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t[WalletSpans.requestId]: requestId,\n\t\t\t[WalletSpans.requestMethod]: req.method,\n\t\t\t[WalletSpans.requestUrl]: req.url,\n\t\t});\n\n\t\t// 1. Path-prefix gate. Runs BEFORE the OPTIONS preflight so an\n\t\t//    allowed origin cannot pull a `204 + CORS` response for an\n\t\t//    arbitrary path — preflight success is scoped to the protocol\n\t\t//    prefix, not the whole host.\n\t\tconst path = req.url.split('?')[0] ?? '';\n\t\tif (!path.startsWith(WALLET_PROTOCOL_PREFIX)) {\n\t\t\treturn text(404, 'not found');\n\t\t}\n\n\t\t// 2. OPTIONS preflight — no auth check, but the origin still has\n\t\t//    to be in the allowlist so we don't leak CORS headers to\n\t\t//    arbitrary callers.\n\t\tif (req.method === 'OPTIONS') {\n\t\t\tconst origin = req.headers['origin'];\n\t\t\tif (origin !== undefined && config.policy.allowed.has(origin)) {\n\t\t\t\treturn { status: 204, headers: corsHeadersFor(origin), body: '' };\n\t\t\t}\n\t\t\treturn text(403, 'forbidden origin');\n\t\t}\n\n\t\t// 3. Origin check.\n\t\tconst originResult = checkOrigin(config.policy, req.headers['origin']);\n\t\tif (originResult === 'missing') {\n\t\t\t// Log the BEARER-VALIDITY only, never the token itself.\n\t\t\tyield* Effect.logWarning('wallet origin missing').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[SpanAttr.requestId]: requestId,\n\t\t\t\t\t[SpanAttr.httpMethod]: req.method,\n\t\t\t\t\t[SpanAttr.httpPath]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn text(403, 'Origin header required');\n\t\t}\n\t\tif (originResult === 'forbidden') {\n\t\t\tyield* Effect.logWarning('wallet origin forbidden').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[SpanAttr.requestId]: requestId,\n\t\t\t\t\t[WalletSpans.origin]: req.headers.origin ?? '(missing)',\n\t\t\t\t\t[SpanAttr.httpMethod]: req.method,\n\t\t\t\t\t[SpanAttr.httpPath]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn text(403, 'forbidden origin');\n\t\t}\n\t\tconst origin = req.headers['origin']!;\n\n\t\t// 4. Bearer check. Token never appears in log lines — only the\n\t\t//    boolean validity.\n\t\tconst bearer = parseBearerHeader(req.headers[WALLET_AUTH_HEADER]);\n\t\tconst bearerValid = bearer !== null && safeBearerEquals(bearer, config.token);\n\t\tyield* Effect.annotateCurrentSpan({ [WalletSpans.bearerValid]: bearerValid });\n\t\tif (!bearerValid) {\n\t\t\tyield* Effect.logWarning('wallet bearer check failed').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[SpanAttr.requestId]: requestId,\n\t\t\t\t\t[WalletSpans.bearerValid]: bearerValid,\n\t\t\t\t\t[SpanAttr.httpMethod]: req.method,\n\t\t\t\t\t[SpanAttr.httpPath]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn errorEnvelope(\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'unauthorized',\n\t\t\t\t\thttpStatus: 401,\n\t\t\t\t\tmessage: 'unauthorized',\n\t\t\t\t}),\n\t\t\t\tcorsHeadersFor(origin),\n\t\t\t);\n\t\t}\n\n\t\t// 5. Route.\n\t\tconst corsHdr = corsHeadersFor(origin);\n\t\treturn yield* routeRequest(config, req, path, corsHdr).pipe(\n\t\t\tEffect.catchTag('WalletRequestError', (err) => Effect.succeed(errorEnvelope(err, corsHdr))),\n\t\t);\n\t});\n\n// ----------------------------------------------------------------------\n// Routing\n// ----------------------------------------------------------------------\n\nconst routeRequest = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n\tpath: string,\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> => {\n\tif (req.method === 'GET' && path === WalletHttpPath.HEALTH) {\n\t\treturn Effect.succeed(\n\t\t\tjson(200, { ok: true } satisfies Schema.Schema.Type<typeof HealthResponseSchema>, corsHdr),\n\t\t);\n\t}\n\tif (req.method === 'GET' && path === WalletHttpPath.ACCOUNTS) {\n\t\treturn handleAccounts(config, corsHdr);\n\t}\n\tif (req.method === 'POST' && path === WalletHttpPath.SIGN_TRANSACTION) {\n\t\treturn handleSign(config, req, 'transaction', corsHdr);\n\t}\n\tif (req.method === 'POST' && path === WalletHttpPath.SIGN_PERSONAL_MESSAGE) {\n\t\treturn handleSign(config, req, 'personal-message', corsHdr);\n\t}\n\treturn Effect.fail(\n\t\twalletRequestError({\n\t\t\tphase: 'route-not-found',\n\t\t\thttpStatus: 404,\n\t\t\tmessage: `no route for ${req.method} ${path}`,\n\t\t}),\n\t);\n};\n\n// ----------------------------------------------------------------------\n// Handlers\n// ----------------------------------------------------------------------\n\nconst handleAccounts = (\n\tconfig: WalletServerConfig,\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> =>\n\tEffect.sync(() => {\n\t\tconst accounts: ReadonlyArray<AccountSummary> = Array.from(\n\t\t\tconfig.accountsByAddress.values(),\n\t\t).map((acct) => ({\n\t\t\tname: acct.name,\n\t\t\taddress: acct.address,\n\t\t\tscheme: acct.scheme,\n\t\t\tpublicKey: Buffer.from(acct.publicKey).toString('base64'),\n\t\t\tsource: acct.source,\n\t\t}));\n\t\t// Schema-validate the response so a drift between AccountValue\n\t\t// and the wire envelope blows up at the boundary rather than at\n\t\t// the browser-side decode.\n\t\tconst validated: Schema.Schema.Type<typeof AccountsResponseSchema> = { accounts };\n\t\treturn json(200, validated, corsHdr);\n\t});\n\nconst decodeJsonBody = <A>(\n\tschema: Schema.Schema<A>,\n\tbody: string,\n): Effect.Effect<A, WalletRequestError> =>\n\tEffect.gen(function* () {\n\t\t// Body-byte cap is enforced solely at the request listener (line\n\t\t// ~200): we accumulate `chunk.length` byte counts and write a 413\n\t\t// + destroy the socket the moment we cross `MAX_BODY_BYTES`. A\n\t\t// secondary in-dispatcher check on `body.length` would be wrong\n\t\t// anyway — `String.length` counts UTF-16 code units, not bytes,\n\t\t// so a 64 KiB body of multi-byte runes could slip past it. The\n\t\t// listener already gated correctly, so there's no second check\n\t\t// here.\n\t\t// Sanctioned cast: `decodeJsonText`'s `S extends Schema.Decoder<unknown>`\n\t\t// constraint is wider than `Schema.Schema<A>` (DecodingServices /\n\t\t// RequiresServices variance — Effect v4's `Decoder<unknown>` pins\n\t\t// these to `unknown` while `Schema.Schema<A>` pins them to `never`).\n\t\t// The runtime helper happily consumes either; only the TS variance\n\t\t// disagrees. Phase 19A attempted to widen the constraint to\n\t\t// `Schema.Top` but `decodeUnknownSync` requires `Decoder<unknown,\n\t\t// never>`, which a `Top` constraint can't satisfy without a\n\t\t// downstream cast that ends up uglier than this one.\n\t\treturn (yield* decodeJsonText(schema as Schema.Decoder<unknown>, body, {\n\t\t\tsource: 'wallet request body',\n\t\t\tmkError: (issue) =>\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'body-invalid',\n\t\t\t\t\thttpStatus: 400,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\tissue.message === 'failed to parse JSON'\n\t\t\t\t\t\t\t? 'invalid JSON body'\n\t\t\t\t\t\t\t: 'request body did not match schema',\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t})) as A;\n\t});\n\nconst handleSign = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n\tkind: 'transaction' | 'personal-message',\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> =>\n\tEffect.gen(function* () {\n\t\tconst body = yield* decodeJsonBody(SignRequestSchema, req.body);\n\t\tconst account = config.accountsByAddress.get(body.address);\n\t\tif (account === undefined) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'address-not-found',\n\t\t\t\t\thttpStatus: 404,\n\t\t\t\t\tmessage: `no account for address '${body.address}'`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst bytes = Buffer.from(body.bytes, 'base64');\n\t\tconst signed = yield* (\n\t\t\tkind === 'transaction' ? account.signTransaction(bytes) : account.signPersonalMessage(bytes)\n\t\t).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'sign-route-failed',\n\t\t\t\t\thttpStatus: 500,\n\t\t\t\t\tmessage: `${kind === 'transaction' ? 'signTransaction' : 'signPersonalMessage'} failed`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tconst resp: Schema.Schema.Type<typeof SignResponseSchema> = signed;\n\t\treturn json(200, resp, corsHdr);\n\t});\n\n// ----------------------------------------------------------------------\n// Error envelope\n// ----------------------------------------------------------------------\n\nconst errorEnvelope = (\n\terr: WalletRequestError,\n\tcorsHdr: Readonly<Record<string, string>>,\n): WalletResponse => json(err.httpStatus, { error: err.message, code: err.phase }, corsHdr);\n"],"mappings":";;;;;;;;;;;;;;;AAiFA,MAAa,iBAAiB,KAAK;;;AAQnC,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgClC,MAAa,mBACZ,WAEA,OAAO,IAAI,aAAa;CAKvB,MAAM,oBAAoB,OAAO,OAAO,SAAgB;CACxD,MAAM,cAAc,OAAO,YAAY,kBAA4C;CAEnF,MAAM,SAAS,OAAO,uBAAuB;EAC5C,aAAa,OAAO;EACpB,MAAM,OAAO;EACb,UAAU,oBAAoB,QAAQ,YAAY;EAClD,gBAAgB,UACf,gBAAgB;GACf,OAAO;GACP,SACC,uCAAuC,OAAO,YAAY,GAAG,OAAO,KAAK,OACxE,mBAAmB,MAAM;GAC3B,MACC;GAED;GACA,CAAC;EACH,CAAC;AAEF,QAAO,OAAO,QAAQ,+BAA+B,CAAC,KACrD,OAAO,aAAa;GAClB,SAAS,OAAO,OAAO;GACvB,SAAS,OAAO,OAAO;EACxB,CAAC,CACF;AAED,QAAO;EACN,KAAK,OAAO;EACZ,OAAO,OAAO;EACd;EACA;;;;;;;;;;;;;;;;;;;AAwBH,MAAM,uBAEJ,QACA,iBAEA,KAAK,QAAQ;AAGb,KAAI,OAAO,WAAW,0BAA0B;CAEhD,MAAM,SAAmB,EAAE;CAC3B,IAAI,aAAa;CACjB,IAAI,aAAa;AAEjB,KAAI,GAAG,SAAS,UAAkB;AACjC,MAAI,WAAY;AAChB,gBAAc,MAAM;AACpB,MAAI,aAAA,OAA6B;AAChC,gBAAa;AACb,iBAAc,IAAI;AAClB,OAAI;AACH,QAAI,SAAS;WACN;AAGR;;AAED,SAAO,KAAK,MAAM;GACjB;AAEF,KAAI,GAAG,eAAe,GAGpB;AAEF,KAAI,GAAG,aAAa;AACnB,MAAI,WAAY;EAChB,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC,SAAS,OAAO;EACnD,MAAM,YAA2B;GAChC,QAAQ,IAAI,UAAU;GACtB,KAAK,IAAI,OAAO;GAChB,SAAS,iBAAiB,IAAI,QAAQ;GACtC;GACA;AA2BD,cA1BgB,SAAS,QAAQ,UAAU,CAAC,KAS3C,OAAO,iBAAiB;GACvB,YAAY,UACX,OAAO,SAAS,2BAA2B,CAAC,KAC3C,OAAO,aAAa;KAClB,YAAY,gBAAgB,UAAU;KACtC,YAAY,aAAa,UAAU;IACpC,OAAO,MAAM,OAAO,MAAM;IAC1B,CAAC,EACF,OAAO,cACN,OAAO,WAAW;AACjB,qBAAiB,IAAI;KACpB,CACF,CACD;GACF,YAAY,SAAS,OAAO,WAAW,cAAc,KAAK,KAAK,CAAC;GAChE,CAAC,CAEgB,CAAC;GACnB;;AAGJ,MAAM,iBAAiB,KAAqB,SAA+B;AAC1E,KAAI,IAAI,cAAe;AACvB,KAAI,aAAa,KAAK;AACtB,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,QAAQ,CAChD,KAAI,UAAU,GAAG,EAAE;AAEpB,KAAI,IAAI,KAAK,KAAK;;AAGnB,MAAM,iBAAiB,QAA8B;AACpD,KAAI,IAAI,cAAe;AACvB,KAAI,aAAa;AACjB,KAAI,UAAU,gBAAgB,4BAA4B;AAC1D,KAAI,IAAI,oBAAoB;;;;;;AAO7B,MAAM,oBAAoB,QAA8B;AACvD,KAAI,IAAI,cAAe;AACvB,KAAI,aAAa;AACjB,KAAI,UAAU,gBAAgB,kCAAkC;AAChE,KAAI,IACH,KAAK,UAAU;EACd,OAAO;EACP,MAAM;EACN,CAAC,CACF;;;;;;AAOF,MAAM,oBACL,YACkD;CAClD,MAAM,MAA0C,EAAE;AAClD,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,CAC3C,KAAI,MAAM,KAAA,EACT,KAAI,KAAK,KAAA;UACC,MAAM,QAAQ,EAAE,CAC1B,KAAI,KAAK,EAAE;KAEX,KAAI,KAAK;AAGX,QAAO;;AAwBR,MAAM,QACL,QACA,MACA,eAAiD,EAAE,MAC9B;CACrB;CACA,SAAS;EAAE,gBAAgB;EAAmC,GAAG;EAAc;CAC/E,MAAM,KAAK,UAAU,KAAK;CAC1B;AAED,MAAM,QACL,QACA,MACA,eAAiD,EAAE,MAC9B;CACrB;CACA,SAAS;EAAE,gBAAgB;EAA6B,GAAG;EAAc;CACzE;CACA;;;;;;;;;;;;;;;;;AAkBD,MAAa,YACZ,QACA,QAEA,OAAO,IAAI,aAAa;CACvB,MAAM,YAAY,YAAY;AAC9B,QAAO,OAAO,oBAAoB;GAChC,YAAY,YAAY;GACxB,YAAY,gBAAgB,IAAI;GAChC,YAAY,aAAa,IAAI;EAC9B,CAAC;CAMF,MAAM,OAAO,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM;AACtC,KAAI,CAAC,KAAK,WAAA,oBAAkC,CAC3C,QAAO,KAAK,KAAK,YAAY;AAM9B,KAAI,IAAI,WAAW,WAAW;EAC7B,MAAM,SAAS,IAAI,QAAQ;AAC3B,MAAI,WAAW,KAAA,KAAa,OAAO,OAAO,QAAQ,IAAI,OAAO,CAC5D,QAAO;GAAE,QAAQ;GAAK,SAAS,eAAe,OAAO;GAAE,MAAM;GAAI;AAElE,SAAO,KAAK,KAAK,mBAAmB;;CAIrC,MAAM,eAAe,YAAY,OAAO,QAAQ,IAAI,QAAQ,UAAU;AACtE,KAAI,iBAAiB,WAAW;AAE/B,SAAO,OAAO,WAAW,wBAAwB,CAAC,KACjD,OAAO,aAAa;IAClB,SAAS,YAAY;IACrB,SAAS,aAAa,IAAI;IAC1B,SAAS,WAAW;GACrB,CAAC,CACF;AACD,SAAO,KAAK,KAAK,yBAAyB;;AAE3C,KAAI,iBAAiB,aAAa;AACjC,SAAO,OAAO,WAAW,0BAA0B,CAAC,KACnD,OAAO,aAAa;IAClB,SAAS,YAAY;IACrB,YAAY,SAAS,IAAI,QAAQ,UAAU;IAC3C,SAAS,aAAa,IAAI;IAC1B,SAAS,WAAW;GACrB,CAAC,CACF;AACD,SAAO,KAAK,KAAK,mBAAmB;;CAErC,MAAM,SAAS,IAAI,QAAQ;CAI3B,MAAM,SAAS,kBAAkB,IAAI,QAAQ,oBAAoB;CACjE,MAAM,cAAc,WAAW,QAAQ,iBAAiB,QAAQ,OAAO,MAAM;AAC7E,QAAO,OAAO,oBAAoB,GAAG,YAAY,cAAc,aAAa,CAAC;AAC7E,KAAI,CAAC,aAAa;AACjB,SAAO,OAAO,WAAW,6BAA6B,CAAC,KACtD,OAAO,aAAa;IAClB,SAAS,YAAY;IACrB,YAAY,cAAc;IAC1B,SAAS,aAAa,IAAI;IAC1B,SAAS,WAAW;GACrB,CAAC,CACF;AACD,SAAO,cACN,mBAAmB;GAClB,OAAO;GACP,YAAY;GACZ,SAAS;GACT,CAAC,EACF,eAAe,OAAO,CACtB;;CAIF,MAAM,UAAU,eAAe,OAAO;AACtC,QAAO,OAAO,aAAa,QAAQ,KAAK,MAAM,QAAQ,CAAC,KACtD,OAAO,SAAS,uBAAuB,QAAQ,OAAO,QAAQ,cAAc,KAAK,QAAQ,CAAC,CAAC,CAC3F;EACA;AAMH,MAAM,gBACL,QACA,KACA,MACA,YACuD;AACvD,KAAI,IAAI,WAAW,SAAS,SAAS,eAAe,OACnD,QAAO,OAAO,QACb,KAAK,KAAK,EAAE,IAAI,MAAM,EAA4D,QAAQ,CAC1F;AAEF,KAAI,IAAI,WAAW,SAAS,SAAS,eAAe,SACnD,QAAO,eAAe,QAAQ,QAAQ;AAEvC,KAAI,IAAI,WAAW,UAAU,SAAS,eAAe,iBACpD,QAAO,WAAW,QAAQ,KAAK,eAAe,QAAQ;AAEvD,KAAI,IAAI,WAAW,UAAU,SAAS,eAAe,sBACpD,QAAO,WAAW,QAAQ,KAAK,oBAAoB,QAAQ;AAE5D,QAAO,OAAO,KACb,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,gBAAgB,IAAI,OAAO,GAAG;EACvC,CAAC,CACF;;AAOF,MAAM,kBACL,QACA,YAEA,OAAO,WAAW;AAcjB,QAAO,KAAK,KAAK,EADsD,UAZvB,MAAM,KACrD,OAAO,kBAAkB,QAAQ,CACjC,CAAC,KAAK,UAAU;EAChB,MAAM,KAAK;EACX,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,WAAW,OAAO,KAAK,KAAK,UAAU,CAAC,SAAS,SAAS;EACzD,QAAQ,KAAK;EACb,EAI8E,EACrD,EAAE,QAAQ;EACnC;AAEH,MAAM,kBACL,QACA,SAEA,OAAO,IAAI,aAAa;AAkBvB,QAAQ,OAAO,eAAe,QAAmC,MAAM;EACtE,QAAQ;EACR,UAAU,UACT,mBAAmB;GAClB,OAAO;GACP,YAAY;GACZ,SACC,MAAM,YAAY,yBACf,sBACA;GACJ,OAAO,MAAM;GACb,CAAC;EACH,CAAC;EACD;AAEH,MAAM,cACL,QACA,KACA,MACA,YAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO,eAAe,mBAAmB,IAAI,KAAK;CAC/D,MAAM,UAAU,OAAO,kBAAkB,IAAI,KAAK,QAAQ;AAC1D,KAAI,YAAY,KAAA,EACf,QAAO,OAAO,OAAO,KACpB,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,2BAA2B,KAAK,QAAQ;EACjD,CAAC,CACF;CAEF,MAAM,QAAQ,OAAO,KAAK,KAAK,OAAO,SAAS;AAc/C,QAAO,KAAK,KAAK,QAZhB,SAAS,gBAAgB,QAAQ,gBAAgB,MAAM,GAAG,QAAQ,oBAAoB,MAAM,EAC3F,KACD,OAAO,UAAU,UAChB,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,GAAG,SAAS,gBAAgB,oBAAoB,sBAAsB;EAC/E;EACA,CAAC,CACF,CACD,EAEsB,QAAQ;EAC9B;AAMH,MAAM,iBACL,KACA,YACoB,KAAK,IAAI,YAAY;CAAE,OAAO,IAAI;CAAS,MAAM,IAAI;CAAO,EAAE,QAAQ"}
+{"version":3,"file":"server.mjs","names":[],"sources":["../../../src/plugins/wallet/server.ts"],"sourcesContent":["// Wallet plugin — in-process HTTP server.\n//\n// Responsibilities:\n//\n//   1. Bind a `node:http` server on a substrate-allocated port (the\n//      port broker hands the port in; we don't pick it here).\n//   2. Dispatch by `(METHOD, path)` to the four handlers below\n//      (health, accounts, sign-transaction, sign-personal-message).\n//   3. Enforce the auth gate: mandatory Origin in policy.allowed +\n//      constant-time bearer compare.\n//   4. Body-cap enforcement: 64 KiB before buffering — protects the\n//      supervisor from OOM via streaming payloads.\n//   5. Per-request span + log annotation under the captured\n//      supervisor context — so handler errors hit the TUI logger\n//      sink instead of bare stderr.\n//   6. Scope-finalizer teardown: `closeAllConnections()` →\n//      `close()` awaited → port release (the substrate's scope\n//      finalizer chain handles release; we just close).\n//\n// Wiring status (15-wallet.md alignment): both the per-route handler\n// bodies (auth + decode + dispatch to `AccountValue` sign closures)\n// AND the in-process `node:http.Server` listen loop are real. The\n// listener buffers each request body up to `MAX_BODY_BYTES`, forks the\n// dispatcher Effect under the captured supervisor context (so handler\n// logs flow to the TUI logger sink), while the substrate scoped HTTP\n// listener owns bind/close lifecycle.\n\nimport { Cause, Context, Effect, Schema } from 'effect';\nimport type { Scope } from 'effect';\nimport { randomUUID } from 'node:crypto';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\n\nimport { listenScopedHttpServer } from '../../substrate/runtime/scoped-http-server.ts';\nimport { LogAttr } from '../../substrate/runtime/observability/log-attrs.ts';\nimport { decodeJsonText } from '../../substrate/runtime/runtime-decode.ts';\nimport { formatUnknownError } from '../../substrate/runtime/format-unknown-error.ts';\nimport type { AccountValue } from '../account/index.ts';\nimport {\n\twalletBootError,\n\twalletRequestError,\n\ttype WalletBootError,\n\ttype WalletRequestError,\n} from './errors.ts';\nimport { checkOrigin, corsHeadersFor, type OriginPolicy } from './origin-policy.ts';\nimport { parseBearerHeader, safeBearerEquals, type PairingToken } from './pairing.ts';\nimport {\n\tAccountsResponseSchema,\n\tHealthResponseSchema,\n\tSignRequestSchema,\n\tSignResponseSchema,\n\tWALLET_AUTH_HEADER,\n\tWALLET_PROTOCOL_PREFIX,\n\tWalletHttpPath,\n\ttype AccountSummary,\n} from './protocol.ts';\n\n// ----------------------------------------------------------------------\n// Server config + handle\n// ----------------------------------------------------------------------\n\n/** Inputs the substrate hands to `startHttpServer`. The plugin's\n *  acquire body builds this from its resolved inputs (port broker,\n *  origin policy, accounts map, token). */\nexport interface WalletServerConfig {\n\treadonly bindAddress: string;\n\treadonly port: number;\n\treadonly token: PairingToken;\n\treadonly policy: OriginPolicy;\n\treadonly accountsByAddress: ReadonlyMap<string, AccountValue>;\n}\n\n/** Opaque server handle. The substrate's scope finalizer chain\n *  invokes `.close()`; callers don't dispatch into it directly. */\nexport interface WalletServerHandle {\n\treadonly url: string; // direct loopback URL — `http://<bindAddress>:<port>`\n\treadonly close: () => Effect.Effect<void>;\n}\n\n/** Body cap — 64 KiB. Above the largest reasonable sign-tx payload,\n *  well below any OOM threshold. */\nexport const MAX_BODY_BYTES = 64 * 1024;\n\n// ----------------------------------------------------------------------\n// Top-level boot\n// ----------------------------------------------------------------------\n\n/** Per-request socket-level timeout, milliseconds. Caps the time a\n *  malicious / hung peer can hold an idle connection. */\nconst REQUEST_SOCKET_TIMEOUT_MS = 30_000;\n\n/**\n * Boot the wallet HTTP server.\n *\n * Wires `node:http.createServer` against the dispatcher. Listens on\n * `bindAddress:port` (the substrate's port broker chose `port` upstream\n * of this call). The scope finalizer awaits graceful close on teardown\n * — `closeAllConnections()` followed by `close()` with await.\n *\n *  Request flow (per connection):\n *\n *    1. `request` listener fires with `IncomingMessage`+`ServerResponse`.\n *    2. We buffer the request body up to `MAX_BODY_BYTES`. If the\n *       inbound payload exceeds the cap, the socket is destroyed and\n *       a 413 returned without ever invoking the dispatcher (closes the\n *       supervisor-OOM path).\n *    3. Construct a `WalletRequest` from the buffered body + headers.\n *    4. `Effect.runForkWith(supervisorContext)(dispatch(config, req))`\n *       — captured at acquire time so handler logs/spans flow to the\n *       TUI logger sink.\n *    5. On fiber completion, write status + headers + body to `res`.\n *    6. On uncaught exception in the listener path: 500 with an opaque\n *       message (no token leak, no internal-state leak).\n *\n *  Scope finalizer:\n *\n *    Calls `server.closeAllConnections()` (kills idle keepalive\n *    sockets) then awaits `server.close()` (drains in-flight). The\n *    finalizer is uninterruptible so a Ctrl-C double-tap doesn't\n *    leave the socket dangling.\n */\nexport const startHttpServer = (\n\tconfig: WalletServerConfig,\n): Effect.Effect<WalletServerHandle, WalletBootError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// Capture the supervisor context so handler fibers run with the\n\t\t// same Logger / span sinks as the rest of the stack. The\n\t\t// dispatcher's R-channel is `never`, but capturing the context\n\t\t// keeps fiber-refs (logger, spans) flowing.\n\t\tconst supervisorContext = yield* Effect.context<never>();\n\t\tconst runDispatch = Effect.runForkWith(supervisorContext as Context.Context<never>);\n\n\t\tconst handle = yield* listenScopedHttpServer({\n\t\t\tbindAddress: config.bindAddress,\n\t\t\tport: config.port,\n\t\t\tlistener: makeRequestListener(config, runDispatch),\n\t\t\tonListenError: (cause): WalletBootError =>\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'listen',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`wallet HTTP server listen failed on ${config.bindAddress}:${config.port} — ` +\n\t\t\t\t\t\tformatUnknownError(cause),\n\t\t\t\t\thint:\n\t\t\t\t\t\t'check that the port broker did not hand out a busy port; ' +\n\t\t\t\t\t\t'a sibling devstack on the same address would also explain this.',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\n\t\tyield* Effect.logInfo('wallet HTTP server listening').pipe(\n\t\t\tEffect.annotateLogs({\n\t\t\t\t[LogAttr.host]: config.bindAddress,\n\t\t\t\t[LogAttr.port]: config.port,\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\turl: handle.url,\n\t\t\tclose: handle.close,\n\t\t} satisfies WalletServerHandle;\n\t});\n\n// ----------------------------------------------------------------------\n// Node request listener — bridges `node:http` → dispatcher Effect\n// ----------------------------------------------------------------------\n\n/**\n * Build the `(req, res)` listener Node hands to `http.createServer`.\n *\n * The listener:\n *\n *   - Buffers the request body up to `MAX_BODY_BYTES`. Over-cap →\n *     413 + socket destroyed (the dispatcher's body-cap check is the\n *     second line of defense; this one is the first).\n *   - Drops invalid socket-level errors silently (defensive: the\n *     wallet is loopback-only, but a malformed HTTP/1.1 line shouldn't\n *     crash the supervisor).\n *   - Forks the dispatcher Effect via the captured supervisor runtime.\n *   - Writes the resolved `WalletResponse` back to `res`.\n *\n * Returns void (Node listener signature) — all error reporting flows\n * through the dispatcher (request errors) or `Effect.logError` (boot/\n * listener path errors).\n */\nconst makeRequestListener =\n\t(\n\t\tconfig: WalletServerConfig,\n\t\trunDispatch: <A, E>(effect: Effect.Effect<A, E, never>) => unknown,\n\t): ((req: IncomingMessage, res: ServerResponse) => void) =>\n\t(req, res) => {\n\t\t// Socket-level timeout — protects against hung peers parking\n\t\t// requests on the supervisor's loopback.\n\t\treq.socket.setTimeout(REQUEST_SOCKET_TIMEOUT_MS);\n\n\t\tconst chunks: Buffer[] = [];\n\t\tlet totalBytes = 0;\n\t\tlet overflowed = false;\n\n\t\treq.on('data', (chunk: Buffer) => {\n\t\t\tif (overflowed) return;\n\t\t\ttotalBytes += chunk.length;\n\t\t\tif (totalBytes > MAX_BODY_BYTES) {\n\t\t\t\toverflowed = true;\n\t\t\t\twriteOverflow(res);\n\t\t\t\ttry {\n\t\t\t\t\treq.destroy();\n\t\t\t\t} catch {\n\t\t\t\t\t/* defensive */\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tchunks.push(chunk);\n\t\t});\n\n\t\treq.on('error', () => {\n\t\t\t// Socket-level error — drop. Per-request errors are handled\n\t\t\t// inside the dispatcher.\n\t\t});\n\n\t\treq.on('end', () => {\n\t\t\tif (overflowed) return;\n\t\t\tconst body = Buffer.concat(chunks).toString('utf8');\n\t\t\tconst walletReq: WalletRequest = {\n\t\t\t\tmethod: req.method ?? 'GET',\n\t\t\t\turl: req.url ?? '/',\n\t\t\t\theaders: normalizeHeaders(req.headers),\n\t\t\t\tbody,\n\t\t\t};\n\t\t\tconst program = dispatch(config, walletReq).pipe(\n\t\t\t\t// `dispatch` is typed `Effect<WalletResponse>` (no failure\n\t\t\t\t// channel) — its handlers map every expected failure into a\n\t\t\t\t// WalletResponse with the right HTTP status. Anything that\n\t\t\t\t// lands here is therefore a *defect* (thrown sync exception,\n\t\t\t\t// runtime invariant violation). We project the full Cause via\n\t\t\t\t// `matchCauseEffect` so we have something to log; `matchEffect`\n\t\t\t\t// would type the failure as `never` and the defect would\n\t\t\t\t// bypass it.\n\t\t\t\tEffect.matchCauseEffect({\n\t\t\t\t\tonFailure: (cause) =>\n\t\t\t\t\t\tEffect.logError('wallet dispatcher defect').pipe(\n\t\t\t\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t\t\t\t'wallet.request.method': walletReq.method,\n\t\t\t\t\t\t\t\t'wallet.request.url': walletReq.url,\n\t\t\t\t\t\t\t\tcause: Cause.pretty(cause),\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\tEffect.flatMap(() =>\n\t\t\t\t\t\t\t\tEffect.sync(() => {\n\t\t\t\t\t\t\t\t\twriteServerError(res);\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\tonSuccess: (resp) => Effect.sync(() => writeResponse(res, resp)),\n\t\t\t\t}),\n\t\t\t);\n\t\t\trunDispatch(program);\n\t\t});\n\t};\n\nconst writeResponse = (res: ServerResponse, resp: WalletResponse): void => {\n\tif (res.writableEnded) return;\n\tres.statusCode = resp.status;\n\tfor (const [k, v] of Object.entries(resp.headers)) {\n\t\tres.setHeader(k, v);\n\t}\n\tres.end(resp.body);\n};\n\nconst writeOverflow = (res: ServerResponse): void => {\n\tif (res.writableEnded) return;\n\tres.statusCode = 413;\n\tres.setHeader('content-type', 'text/plain; charset=utf-8');\n\tres.end('payload too large');\n};\n\n/** Write an opaque 500 — no token, no internal state leak. The\n *  caller is responsible for logging the underlying cause (see the\n *  `Effect.logError('wallet dispatcher defect')` in `dispatch`'s\n *  `matchCauseEffect` onFailure branch). */\nconst writeServerError = (res: ServerResponse): void => {\n\tif (res.writableEnded) return;\n\tres.statusCode = 500;\n\tres.setHeader('content-type', 'application/json; charset=utf-8');\n\tres.end(\n\t\tJSON.stringify({\n\t\t\terror: 'internal error',\n\t\t\tcode: 'internal-error',\n\t\t}),\n\t);\n};\n\n/** Normalize Node's `IncomingHttpHeaders` (string | string[] | undefined)\n *  to the `WalletRequest.headers` shape (string | undefined). Picks the\n *  first value for repeated headers — matches browser send semantics\n *  for the headers we care about (Origin, Authorization, Content-Type). */\nconst normalizeHeaders = (\n\theaders: IncomingMessage['headers'],\n): Readonly<Record<string, string | undefined>> => {\n\tconst out: Record<string, string | undefined> = {};\n\tfor (const [k, v] of Object.entries(headers)) {\n\t\tif (v === undefined) {\n\t\t\tout[k] = undefined;\n\t\t} else if (Array.isArray(v)) {\n\t\t\tout[k] = v[0];\n\t\t} else {\n\t\t\tout[k] = v;\n\t\t}\n\t}\n\treturn out;\n};\n\n// ----------------------------------------------------------------------\n// Dispatcher — pure(ish) function from request → effect\n// ----------------------------------------------------------------------\n\n/** Inbound request shape — substrate-runtime-agnostic. The substrate's\n *  http-server primitive converts a `node:http` IncomingMessage into\n *  this; tests can construct it directly. */\nexport interface WalletRequest {\n\treadonly method: string;\n\treadonly url: string; // path + query, no host\n\treadonly headers: Readonly<Record<string, string | undefined>>;\n\treadonly body: string; // already-buffered (capped at MAX_BODY_BYTES)\n}\n\n/** Outbound response. */\nexport interface WalletResponse {\n\treadonly status: number;\n\treadonly headers: Readonly<Record<string, string>>;\n\treadonly body: string;\n}\n\nconst json = (\n\tstatus: number,\n\tbody: unknown,\n\textraHeaders: Readonly<Record<string, string>> = {},\n): WalletResponse => ({\n\tstatus,\n\theaders: { 'content-type': 'application/json; charset=utf-8', ...extraHeaders },\n\tbody: JSON.stringify(body),\n});\n\nconst text = (\n\tstatus: number,\n\tbody: string,\n\textraHeaders: Readonly<Record<string, string>> = {},\n): WalletResponse => ({\n\tstatus,\n\theaders: { 'content-type': 'text/plain; charset=utf-8', ...extraHeaders },\n\tbody,\n});\n\n/**\n * Dispatch a single request to its handler. Returns an Effect that\n * always succeeds (the response is built); request-level failures\n * are projected to JSON envelopes via `errorEnvelope` below.\n *\n * The dispatch order matters:\n *   1. Path-prefix gate — anything not under `/api/v1/devstack/` is\n *      a flat 404 (text/plain). PROTECTS the auth gate (and the CORS\n *      preflight) from being visible on arbitrary URLs.\n *   2. OPTIONS preflight (returns 204 + CORS) — no auth required, but\n *      scoped to the protocol prefix by step 1 so an allowed origin\n *      cannot extract CORS headers for unrelated paths.\n *   3. Origin check (must be in policy.allowed; missing → 403).\n *   4. Bearer check (must constant-time-equal `config.token`).\n *   5. Method+path route to handler.\n */\nexport const dispatch = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n): Effect.Effect<WalletResponse> =>\n\tEffect.gen(function* () {\n\t\tconst requestId = randomUUID();\n\t\t// 1. Path-prefix gate. Runs BEFORE the OPTIONS preflight so an\n\t\t//    allowed origin cannot pull a `204 + CORS` response for an\n\t\t//    arbitrary path — preflight success is scoped to the protocol\n\t\t//    prefix, not the whole host.\n\t\tconst path = req.url.split('?')[0] ?? '';\n\t\tif (!path.startsWith(WALLET_PROTOCOL_PREFIX)) {\n\t\t\treturn text(404, 'not found');\n\t\t}\n\n\t\t// 2. OPTIONS preflight — no auth check, but the origin still has\n\t\t//    to be in the allowlist so we don't leak CORS headers to\n\t\t//    arbitrary callers.\n\t\tif (req.method === 'OPTIONS') {\n\t\t\tconst origin = req.headers['origin'];\n\t\t\tif (origin !== undefined && config.policy.allowed.has(origin)) {\n\t\t\t\treturn { status: 204, headers: corsHeadersFor(origin), body: '' };\n\t\t\t}\n\t\t\treturn text(403, 'forbidden origin');\n\t\t}\n\n\t\t// 3. Origin check.\n\t\tconst originResult = checkOrigin(config.policy, req.headers['origin']);\n\t\tif (originResult === 'missing') {\n\t\t\t// Log the BEARER-VALIDITY only, never the token itself.\n\t\t\tyield* Effect.logWarning('wallet origin missing').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[LogAttr.requestId]: requestId,\n\t\t\t\t\t[LogAttr.httpMethod]: req.method,\n\t\t\t\t\t[LogAttr.httpPath]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn text(403, 'Origin header required');\n\t\t}\n\t\tif (originResult === 'forbidden') {\n\t\t\tyield* Effect.logWarning('wallet origin forbidden').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[LogAttr.requestId]: requestId,\n\t\t\t\t\t'wallet.origin': req.headers.origin ?? '(missing)',\n\t\t\t\t\t[LogAttr.httpMethod]: req.method,\n\t\t\t\t\t[LogAttr.httpPath]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn text(403, 'forbidden origin');\n\t\t}\n\t\tconst origin = req.headers['origin']!;\n\n\t\t// 4. Bearer check. Token never appears in log lines — only the\n\t\t//    boolean validity.\n\t\tconst bearer = parseBearerHeader(req.headers[WALLET_AUTH_HEADER]);\n\t\tconst bearerValid = bearer !== null && safeBearerEquals(bearer, config.token);\n\t\tif (!bearerValid) {\n\t\t\tyield* Effect.logWarning('wallet bearer check failed').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[LogAttr.requestId]: requestId,\n\t\t\t\t\t'wallet.auth.bearerValid': bearerValid,\n\t\t\t\t\t[LogAttr.httpMethod]: req.method,\n\t\t\t\t\t[LogAttr.httpPath]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn errorEnvelope(\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'unauthorized',\n\t\t\t\t\thttpStatus: 401,\n\t\t\t\t\tmessage: 'unauthorized',\n\t\t\t\t}),\n\t\t\t\tcorsHeadersFor(origin),\n\t\t\t);\n\t\t}\n\n\t\t// 5. Route.\n\t\tconst corsHdr = corsHeadersFor(origin);\n\t\treturn yield* routeRequest(config, req, path, corsHdr).pipe(\n\t\t\tEffect.catchTag('WalletRequestError', (err) => Effect.succeed(errorEnvelope(err, corsHdr))),\n\t\t);\n\t});\n\n// ----------------------------------------------------------------------\n// Routing\n// ----------------------------------------------------------------------\n\nconst routeRequest = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n\tpath: string,\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> => {\n\tif (req.method === 'GET' && path === WalletHttpPath.HEALTH) {\n\t\treturn Effect.succeed(\n\t\t\tjson(200, { ok: true } satisfies Schema.Schema.Type<typeof HealthResponseSchema>, corsHdr),\n\t\t);\n\t}\n\tif (req.method === 'GET' && path === WalletHttpPath.ACCOUNTS) {\n\t\treturn handleAccounts(config, corsHdr);\n\t}\n\tif (req.method === 'POST' && path === WalletHttpPath.SIGN_TRANSACTION) {\n\t\treturn handleSign(config, req, 'transaction', corsHdr);\n\t}\n\tif (req.method === 'POST' && path === WalletHttpPath.SIGN_PERSONAL_MESSAGE) {\n\t\treturn handleSign(config, req, 'personal-message', corsHdr);\n\t}\n\treturn Effect.fail(\n\t\twalletRequestError({\n\t\t\tphase: 'route-not-found',\n\t\t\thttpStatus: 404,\n\t\t\tmessage: `no route for ${req.method} ${path}`,\n\t\t}),\n\t);\n};\n\n// ----------------------------------------------------------------------\n// Handlers\n// ----------------------------------------------------------------------\n\nconst handleAccounts = (\n\tconfig: WalletServerConfig,\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> =>\n\tEffect.sync(() => {\n\t\tconst accounts: ReadonlyArray<AccountSummary> = Array.from(\n\t\t\tconfig.accountsByAddress.values(),\n\t\t).map((acct) => ({\n\t\t\tname: acct.name,\n\t\t\taddress: acct.address,\n\t\t\tscheme: acct.scheme,\n\t\t\tpublicKey: Buffer.from(acct.publicKey).toString('base64'),\n\t\t\tsource: acct.source,\n\t\t}));\n\t\t// Schema-validate the response so a drift between AccountValue\n\t\t// and the wire envelope blows up at the boundary rather than at\n\t\t// the browser-side decode.\n\t\tconst validated: Schema.Schema.Type<typeof AccountsResponseSchema> = { accounts };\n\t\treturn json(200, validated, corsHdr);\n\t});\n\nconst decodeJsonBody = <A>(\n\tschema: Schema.Schema<A>,\n\tbody: string,\n): Effect.Effect<A, WalletRequestError> =>\n\tEffect.gen(function* () {\n\t\t// Body-byte cap is enforced solely at the request listener (line\n\t\t// ~200): we accumulate `chunk.length` byte counts and write a 413\n\t\t// + destroy the socket the moment we cross `MAX_BODY_BYTES`. A\n\t\t// secondary in-dispatcher check on `body.length` would be wrong\n\t\t// anyway — `String.length` counts UTF-16 code units, not bytes,\n\t\t// so a 64 KiB body of multi-byte runes could slip past it. The\n\t\t// listener already gated correctly, so there's no second check\n\t\t// here.\n\t\t// Sanctioned cast: `decodeJsonText`'s `S extends Schema.Decoder<unknown>`\n\t\t// constraint is wider than `Schema.Schema<A>` (DecodingServices /\n\t\t// RequiresServices variance — Effect v4's `Decoder<unknown>` pins\n\t\t// these to `unknown` while `Schema.Schema<A>` pins them to `never`).\n\t\t// The runtime helper happily consumes either; only the TS variance\n\t\t// disagrees. Phase 19A attempted to widen the constraint to\n\t\t// `Schema.Top` but `decodeUnknownSync` requires `Decoder<unknown,\n\t\t// never>`, which a `Top` constraint can't satisfy without a\n\t\t// downstream cast that ends up uglier than this one.\n\t\treturn (yield* decodeJsonText(schema as Schema.Decoder<unknown>, body, {\n\t\t\tsource: 'wallet request body',\n\t\t\tmkError: (issue) =>\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'body-invalid',\n\t\t\t\t\thttpStatus: 400,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\tissue.message === 'failed to parse JSON'\n\t\t\t\t\t\t\t? 'invalid JSON body'\n\t\t\t\t\t\t\t: 'request body did not match schema',\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t})) as A;\n\t});\n\nconst handleSign = (\n\tconfig: WalletServerConfig,\n\treq: WalletRequest,\n\tkind: 'transaction' | 'personal-message',\n\tcorsHdr: Readonly<Record<string, string>>,\n): Effect.Effect<WalletResponse, WalletRequestError> =>\n\tEffect.gen(function* () {\n\t\tconst body = yield* decodeJsonBody(SignRequestSchema, req.body);\n\t\tconst account = config.accountsByAddress.get(body.address);\n\t\tif (account === undefined) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'address-not-found',\n\t\t\t\t\thttpStatus: 404,\n\t\t\t\t\tmessage: `no account for address '${body.address}'`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst bytes = Buffer.from(body.bytes, 'base64');\n\t\tconst signed = yield* (\n\t\t\tkind === 'transaction' ? account.signTransaction(bytes) : account.signPersonalMessage(bytes)\n\t\t).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\twalletRequestError({\n\t\t\t\t\tphase: 'sign-route-failed',\n\t\t\t\t\thttpStatus: 500,\n\t\t\t\t\tmessage: `${kind === 'transaction' ? 'signTransaction' : 'signPersonalMessage'} failed`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tconst resp: Schema.Schema.Type<typeof SignResponseSchema> = signed;\n\t\treturn json(200, resp, corsHdr);\n\t});\n\n// ----------------------------------------------------------------------\n// Error envelope\n// ----------------------------------------------------------------------\n\nconst errorEnvelope = (\n\terr: WalletRequestError,\n\tcorsHdr: Readonly<Record<string, string>>,\n): WalletResponse => json(err.httpStatus, { error: err.message, code: err.phase }, corsHdr);\n"],"mappings":";;;;;;;;;;;;;;AAgFA,MAAa,iBAAiB,KAAK;;;AAQnC,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgClC,MAAa,mBACZ,WAEA,OAAO,IAAI,aAAa;CAKvB,MAAM,oBAAoB,OAAO,OAAO,QAAe;CACvD,MAAM,cAAc,OAAO,YAAY,iBAA2C;CAElF,MAAM,SAAS,OAAO,uBAAuB;EAC5C,aAAa,OAAO;EACpB,MAAM,OAAO;EACb,UAAU,oBAAoB,QAAQ,WAAW;EACjD,gBAAgB,UACf,gBAAgB;GACf,OAAO;GACP,SACC,uCAAuC,OAAO,YAAY,GAAG,OAAO,KAAK,OACzE,mBAAmB,KAAK;GACzB,MACC;GAED;EACD,CAAC;CACH,CAAC;CAED,OAAO,OAAO,QAAQ,8BAA8B,CAAC,CAAC,KACrD,OAAO,aAAa;GAClB,QAAQ,OAAO,OAAO;GACtB,QAAQ,OAAO,OAAO;CACxB,CAAC,CACF;CAEA,OAAO;EACN,KAAK,OAAO;EACZ,OAAO,OAAO;CACf;AACD,CAAC;;;;;;;;;;;;;;;;;;;AAwBF,MAAM,uBAEJ,QACA,iBAEA,KAAK,QAAQ;CAGb,IAAI,OAAO,WAAW,yBAAyB;CAE/C,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,IAAI,aAAa;CAEjB,IAAI,GAAG,SAAS,UAAkB;EACjC,IAAI,YAAY;EAChB,cAAc,MAAM;EACpB,IAAI,aAAA,OAA6B;GAChC,aAAa;GACb,cAAc,GAAG;GACjB,IAAI;IACH,IAAI,QAAQ;GACb,QAAQ,CAER;GACA;EACD;EACA,OAAO,KAAK,KAAK;CAClB,CAAC;CAED,IAAI,GAAG,eAAe,CAGtB,CAAC;CAED,IAAI,GAAG,aAAa;EACnB,IAAI,YAAY;EAChB,MAAM,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM;EAClD,MAAM,YAA2B;GAChC,QAAQ,IAAI,UAAU;GACtB,KAAK,IAAI,OAAO;GAChB,SAAS,iBAAiB,IAAI,OAAO;GACrC;EACD;EA2BA,YA1BgB,SAAS,QAAQ,SAAS,CAAC,CAAC,KAS3C,OAAO,iBAAiB;GACvB,YAAY,UACX,OAAO,SAAS,0BAA0B,CAAC,CAAC,KAC3C,OAAO,aAAa;IACnB,yBAAyB,UAAU;IACnC,sBAAsB,UAAU;IAChC,OAAO,MAAM,OAAO,KAAK;GAC1B,CAAC,GACD,OAAO,cACN,OAAO,WAAW;IACjB,iBAAiB,GAAG;GACrB,CAAC,CACF,CACD;GACD,YAAY,SAAS,OAAO,WAAW,cAAc,KAAK,IAAI,CAAC;EAChE,CAAC,CAEgB,CAAC;CACpB,CAAC;AACF;AAED,MAAM,iBAAiB,KAAqB,SAA+B;CAC1E,IAAI,IAAI,eAAe;CACvB,IAAI,aAAa,KAAK;CACtB,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,OAAO,GAC/C,IAAI,UAAU,GAAG,CAAC;CAEnB,IAAI,IAAI,KAAK,IAAI;AAClB;AAEA,MAAM,iBAAiB,QAA8B;CACpD,IAAI,IAAI,eAAe;CACvB,IAAI,aAAa;CACjB,IAAI,UAAU,gBAAgB,2BAA2B;CACzD,IAAI,IAAI,mBAAmB;AAC5B;;;;;AAMA,MAAM,oBAAoB,QAA8B;CACvD,IAAI,IAAI,eAAe;CACvB,IAAI,aAAa;CACjB,IAAI,UAAU,gBAAgB,iCAAiC;CAC/D,IAAI,IACH,KAAK,UAAU;EACd,OAAO;EACP,MAAM;CACP,CAAC,CACF;AACD;;;;;AAMA,MAAM,oBACL,YACkD;CAClD,MAAM,MAA0C,CAAC;CACjD,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAC1C,IAAI,MAAM,KAAA,GACT,IAAI,KAAK,KAAA;MACH,IAAI,MAAM,QAAQ,CAAC,GACzB,IAAI,KAAK,EAAE;MAEX,IAAI,KAAK;CAGX,OAAO;AACR;AAuBA,MAAM,QACL,QACA,MACA,eAAiD,CAAC,OAC7B;CACrB;CACA,SAAS;EAAE,gBAAgB;EAAmC,GAAG;CAAa;CAC9E,MAAM,KAAK,UAAU,IAAI;AAC1B;AAEA,MAAM,QACL,QACA,MACA,eAAiD,CAAC,OAC7B;CACrB;CACA,SAAS;EAAE,gBAAgB;EAA6B,GAAG;CAAa;CACxE;AACD;;;;;;;;;;;;;;;;;AAkBA,MAAa,YACZ,QACA,QAEA,OAAO,IAAI,aAAa;CACvB,MAAM,YAAY,WAAW;CAK7B,MAAM,OAAO,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM;CACtC,IAAI,CAAC,KAAK,WAAA,mBAAiC,GAC1C,OAAO,KAAK,KAAK,WAAW;CAM7B,IAAI,IAAI,WAAW,WAAW;EAC7B,MAAM,SAAS,IAAI,QAAQ;EAC3B,IAAI,WAAW,KAAA,KAAa,OAAO,OAAO,QAAQ,IAAI,MAAM,GAC3D,OAAO;GAAE,QAAQ;GAAK,SAAS,eAAe,MAAM;GAAG,MAAM;EAAG;EAEjE,OAAO,KAAK,KAAK,kBAAkB;CACpC;CAGA,MAAM,eAAe,YAAY,OAAO,QAAQ,IAAI,QAAQ,SAAS;CACrE,IAAI,iBAAiB,WAAW;EAE/B,OAAO,OAAO,WAAW,uBAAuB,CAAC,CAAC,KACjD,OAAO,aAAa;IAClB,QAAQ,YAAY;IACpB,QAAQ,aAAa,IAAI;IACzB,QAAQ,WAAW;EACrB,CAAC,CACF;EACA,OAAO,KAAK,KAAK,wBAAwB;CAC1C;CACA,IAAI,iBAAiB,aAAa;EACjC,OAAO,OAAO,WAAW,yBAAyB,CAAC,CAAC,KACnD,OAAO,aAAa;IAClB,QAAQ,YAAY;GACrB,iBAAiB,IAAI,QAAQ,UAAU;IACtC,QAAQ,aAAa,IAAI;IACzB,QAAQ,WAAW;EACrB,CAAC,CACF;EACA,OAAO,KAAK,KAAK,kBAAkB;CACpC;CACA,MAAM,SAAS,IAAI,QAAQ;CAI3B,MAAM,SAAS,kBAAkB,IAAI,QAAQ,mBAAmB;CAChE,MAAM,cAAc,WAAW,QAAQ,iBAAiB,QAAQ,OAAO,KAAK;CAC5E,IAAI,CAAC,aAAa;EACjB,OAAO,OAAO,WAAW,4BAA4B,CAAC,CAAC,KACtD,OAAO,aAAa;IAClB,QAAQ,YAAY;GACrB,2BAA2B;IAC1B,QAAQ,aAAa,IAAI;IACzB,QAAQ,WAAW;EACrB,CAAC,CACF;EACA,OAAO,cACN,mBAAmB;GAClB,OAAO;GACP,YAAY;GACZ,SAAS;EACV,CAAC,GACD,eAAe,MAAM,CACtB;CACD;CAGA,MAAM,UAAU,eAAe,MAAM;CACrC,OAAO,OAAO,aAAa,QAAQ,KAAK,MAAM,OAAO,CAAC,CAAC,KACtD,OAAO,SAAS,uBAAuB,QAAQ,OAAO,QAAQ,cAAc,KAAK,OAAO,CAAC,CAAC,CAC3F;AACD,CAAC;AAMF,MAAM,gBACL,QACA,KACA,MACA,YACuD;CACvD,IAAI,IAAI,WAAW,SAAS,SAAS,eAAe,QACnD,OAAO,OAAO,QACb,KAAK,KAAK,EAAE,IAAI,KAAK,GAA6D,OAAO,CAC1F;CAED,IAAI,IAAI,WAAW,SAAS,SAAS,eAAe,UACnD,OAAO,eAAe,QAAQ,OAAO;CAEtC,IAAI,IAAI,WAAW,UAAU,SAAS,eAAe,kBACpD,OAAO,WAAW,QAAQ,KAAK,eAAe,OAAO;CAEtD,IAAI,IAAI,WAAW,UAAU,SAAS,eAAe,uBACpD,OAAO,WAAW,QAAQ,KAAK,oBAAoB,OAAO;CAE3D,OAAO,OAAO,KACb,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,gBAAgB,IAAI,OAAO,GAAG;CACxC,CAAC,CACF;AACD;AAMA,MAAM,kBACL,QACA,YAEA,OAAO,WAAW;CAcjB,OAAO,KAAK,KAAK,EADsD,UAZvB,MAAM,KACrD,OAAO,kBAAkB,OAAO,CACjC,CAAC,CAAC,KAAK,UAAU;EAChB,MAAM,KAAK;EACX,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,WAAW,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,SAAS,QAAQ;EACxD,QAAQ,KAAK;CACd,EAI8E,EACrD,GAAG,OAAO;AACpC,CAAC;AAEF,MAAM,kBACL,QACA,SAEA,OAAO,IAAI,aAAa;CAkBvB,OAAQ,OAAO,eAAe,QAAmC,MAAM;EACtE,QAAQ;EACR,UAAU,UACT,mBAAmB;GAClB,OAAO;GACP,YAAY;GACZ,SACC,MAAM,YAAY,yBACf,sBACA;GACJ,OAAO,MAAM;EACd,CAAC;CACH,CAAC;AACF,CAAC;AAEF,MAAM,cACL,QACA,KACA,MACA,YAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO,eAAe,mBAAmB,IAAI,IAAI;CAC9D,MAAM,UAAU,OAAO,kBAAkB,IAAI,KAAK,OAAO;CACzD,IAAI,YAAY,KAAA,GACf,OAAO,OAAO,OAAO,KACpB,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,2BAA2B,KAAK,QAAQ;CAClD,CAAC,CACF;CAED,MAAM,QAAQ,OAAO,KAAK,KAAK,OAAO,QAAQ;CAc9C,OAAO,KAAK,KAAK,QAZhB,SAAS,gBAAgB,QAAQ,gBAAgB,KAAK,IAAI,QAAQ,oBAAoB,KAAK,EAAA,CAC1F,KACD,OAAO,UAAU,UAChB,mBAAmB;EAClB,OAAO;EACP,YAAY;EACZ,SAAS,GAAG,SAAS,gBAAgB,oBAAoB,sBAAsB;EAC/E;CACD,CAAC,CACF,CACD,GAEuB,OAAO;AAC/B,CAAC;AAMF,MAAM,iBACL,KACA,YACoB,KAAK,IAAI,YAAY;CAAE,OAAO,IAAI;CAAS,MAAM,IAAI;AAAM,GAAG,OAAO"}

package/dist/plugins/wallet/service.d.mts

@@ -1,7 +1,7 @@
 import { ResourceRef } from "../../substrate/plugin.mjs";
 import { AccountValue } from "../account/service.mjs";
 import { AccountResourceId } from "../account/index.mjs";
-import { DappKitConfigBindings } from "./codegen.mjs";
+import { DevWalletConfig } from "./codegen.mjs";
 import { PairingToken } from "./pairing.mjs";
 import { WalletServerHandle } from "./server.mjs";
 import { Effect, FileSystem, Scope } from "effect";
@@ -51,7 +51,7 @@ interface WalletOptions<Accounts extends ReadonlyArray<WalletAccountMember> = Re
 interface WalletValue {
   readonly url: string;
   readonly pairUrl: string;
-  readonly bindings: DappKitConfigBindings;
+  readonly bindings: DevWalletConfig;
   readonly localPort: number;
   readonly token: PairingToken;
   /** Server handle — substrate's scope finalizer chain invokes

package/dist/plugins/wallet/service.mjs

@@ -1,9 +1,8 @@
 import { WalletHttpPath } from "../../contracts/wallet-protocol.mjs";
 import { walletBootError } from "./errors.mjs";
-import { WalletSpans } from "./spans.mjs";
+import { resolveOriginPolicy } from "./origin-policy.mjs";
 import "./protocol.mjs";
 import { acquirePairingToken, composePairUrl, tokenPath } from "./pairing.mjs";
-import { resolveOriginPolicy } from "./origin-policy.mjs";
 import { startHttpServer } from "./server.mjs";
 import { Effect } from "effect";
 //#region src/plugins/wallet/service.ts
@@ -29,13 +28,7 @@ const directUrlHostForBindAddress = (bindAddress) => bindAddress === WALLET_DEFA
 *     `origin-policy.ts:resolveOriginPolicy`.
 */
 const acquireWallet = (opts, ctx) => Effect.gen(function* () {
-	yield* Effect.annotateCurrentSpan({
-		[WalletSpans.app]: ctx.app,
-		[WalletSpans.stack]: ctx.stack,
-		[WalletSpans.chain]: ctx.chain
-	});
 	const accounts = yield* ctx.resolveAccounts();
-	yield* Effect.annotateCurrentSpan({ [WalletSpans.accountCount]: accounts.length });
 	if (accounts.length === 0) return yield* Effect.fail(walletBootError({
 		phase: "no-accounts",
 		message: "wallet resolved zero accounts; add account('name') to the stack or pass accounts explicitly.",
@@ -70,7 +63,7 @@ const acquireWallet = (opts, ctx) => Effect.gen(function* () {
 	const bindings = {
 		walletUrl,
 		pairUrl,
-		chain: ctx.chain,
+		network: ctx.network,
 		protocolPaths: {
 			health: WalletHttpPath.HEALTH,
 			accounts: WalletHttpPath.ACCOUNTS,
@@ -78,13 +71,9 @@ const acquireWallet = (opts, ctx) => Effect.gen(function* () {
 			signPersonalMessage: WalletHttpPath.SIGN_PERSONAL_MESSAGE
 		}
 	};
-	yield* Effect.annotateCurrentSpan({
-		[WalletSpans.url]: walletUrl,
-		[WalletSpans.localPort]: port
-	});
 	yield* Effect.logInfo("wallet ready").pipe(Effect.annotateLogs({
-		[WalletSpans.url]: walletUrl,
-		[WalletSpans.token]: "redacted-fragment"
+		"wallet.url": walletUrl,
+		"wallet.token": "redacted-fragment"
 	}));
 	return {
 		url: walletUrl,

package/dist/plugins/wallet/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/wallet/service.ts"],"sourcesContent":["// Wallet plugin — main acquire Effect.\n//\n// What this file does (15-wallet.md §Lifecycle, Startup ordered):\n//\n//   1. Resolve each consumed account tag and key the AccountValues by\n//      address (load-bearing: sign endpoints look up by address).\n//   2. Allocate a port via the substrate's `PortBrokerService`.\n//   3. Mint or rehydrate the pairing token (read-existing-or-mint at\n//      `<stateRoot>/wallet/token`, mode 0o600) via the substrate's\n//      `atomicWriteFile`.\n//   4. Resolve the stack-scoped origin allowlist via\n//      `origin-policy.ts`.\n//   5. Start the in-process HTTP server.\n//   6. Compose the wallet URL + pair URL + return the resolved\n//      `WalletValue`.\n//\n// The substrate handles:\n//\n//   - Scope finalizers (port release, server close) — declared by the\n//     substrate primitives we call into.\n//   - Endpoint registry publication (we surface the URL/pairUrl via\n//     our resolved tag value; the substrate's endpoint-registry\n//     primitive consumes the `RoutableDecl` from `routable.ts`).\n//   - Manifest emit — the substrate projects from registry. We never\n//     write `.devstack/manifest.json` directly.\n\nimport { Effect } from 'effect';\nimport type { FileSystem, Scope } from 'effect';\n\nimport type { AccountResourceId, AccountValue } from '../account/index.ts';\nimport type { DappKitConfigBindings } from './codegen.ts';\nimport { walletBootError, type WalletBootError } from './errors.ts';\nimport { resolveOriginPolicy } from './origin-policy.ts';\nimport { acquirePairingToken, composePairUrl, tokenPath, type PairingToken } from './pairing.ts';\nimport { startHttpServer, type WalletServerConfig, type WalletServerHandle } from './server.ts';\nimport { WalletHttpPath } from './protocol.ts';\n\n// ----------------------------------------------------------------------\n// User-facing options\n// ----------------------------------------------------------------------\n\nimport type { ResourceRef } from '../../api/define-plugin.ts';\nimport { WalletSpans } from './spans.ts';\n\n/** Literal sentinel for `WalletOptions.accounts: 'all'` — every account\n *  member in the stack. Expanded by the composer at `defineDevstack`\n *  call time (api-surface-design §4 D6). Kept as an exported constant\n *  so the wallet factory + composer share one source of truth. */\nexport const WALLET_ACCOUNTS_ALL = 'all' as const;\nexport type WalletAccountsAll = typeof WALLET_ACCOUNTS_ALL;\n\n/** A user-supplied account ref. The user passes the result of\n *  `account('alice')` — NOT a bare string. Generic over the literal\n *  account name so the wallet's dependency tuple preserves each\n *  per-account resource id (`account/alice`, `account/bob`, ...). */\nexport type WalletAccountMember<Name extends string = string> = ResourceRef<\n\tAccountResourceId<Name>,\n\tAccountValue\n>;\n\nexport interface WalletOptions<\n\tAccounts extends ReadonlyArray<WalletAccountMember> = ReadonlyArray<WalletAccountMember>,\n> {\n\t/** Accounts the wallet binds. Each is yielded for ordering AND its\n\t *  resolved value is keyed by address into the sign-handler map.\n\t *\n\t *  Two shapes:\n\t *\n\t *   - Explicit tuple — each entry is the plugin/resource ref returned\n\t *     by `account('name')`. Pins the bound set at the wallet's call\n\t *     site; preserves each literal `account/${Name}` so stack\n\t *     composition can validate and recursively expand the refs.\n\t *\n\t *   - The literal `'all'` — shorthand for \"every account member in\n\t *     the stack\". The composer expands this against the final\n\t *     member tuple at `defineDevstack(...)` time (api-surface-design\n\t *     §4 D6). The wallet member returned by the factory carries an\n\t *     expander hook keyed off `WALLET_ACCOUNTS_ALL` that the\n\t *     composer invokes once the account-providing members are\n\t *     known. */\n\treadonly accounts: Accounts | typeof WALLET_ACCOUNTS_ALL;\n\t/** Extra origins merged on top of the router-fronted dev-server\n\t *  origin. Useful for headless test runners and custom dev hosts. */\n\treadonly allowedOrigins?: ReadonlyArray<string>;\n\t/** Preferred host port. Substrate's port broker forward-scans if\n\t *  this is taken. Default: substrate-picked (no preference). */\n\treadonly port?: number;\n\t/** NIC the HTTP server binds. Defaults to `'0.0.0.0'` because the\n\t *  router runs in Docker and must reach the host process through the\n\t *  host-gateway address on native Linux. The public wallet URL remains\n\t *  router-fronted and stack-scoped. */\n\treadonly bindAddress?: string;\n}\n\n// ----------------------------------------------------------------------\n// Resolved value (what the wallet plugin publishes)\n// ----------------------------------------------------------------------\n\nexport interface WalletValue {\n\treadonly url: string; // router-fronted URL when available, loopback otherwise\n\treadonly pairUrl: string;\n\treadonly bindings: DappKitConfigBindings;\n\treadonly localPort: number;\n\treadonly token: PairingToken;\n\t/** Server handle — substrate's scope finalizer chain invokes\n\t *  `.close()`; callers don't reach in. Exposed here so tests can\n\t *  drive teardown explicitly. */\n\treadonly server: WalletServerHandle;\n}\n\nconst WALLET_DEFAULT_BIND_ADDRESS = '0.0.0.0' as const;\nconst WALLET_DIRECT_URL_HOST = '127.0.0.1' as const;\ntype WalletPortProbeHost = '127.0.0.1' | '0.0.0.0';\n\nconst portProbeHostForBindAddress = (bindAddress: string): WalletPortProbeHost =>\n\tbindAddress === WALLET_DEFAULT_BIND_ADDRESS ? '0.0.0.0' : '127.0.0.1';\n\nconst directUrlHostForBindAddress = (bindAddress: string): string =>\n\tbindAddress === WALLET_DEFAULT_BIND_ADDRESS ? WALLET_DIRECT_URL_HOST : bindAddress;\n\n// ----------------------------------------------------------------------\n// Per-acquire context — supplied by the barrel\n// ----------------------------------------------------------------------\n\n/** Inputs from the substrate. The barrel fills these from the\n *  BuildContext; tests can construct directly. */\nexport interface WalletAcquireContext {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly chain: string;\n\t/** State root where `wallet/token` lives. Convention:\n\t *  `<appDir>/.devstack/stacks/<stack>/runtime`. */\n\treadonly stateRoot: string;\n\t/** Port broker seam — returns the allocated port + a scope-\n\t *  finalizer-installed release. The barrel adapts the substrate's\n\t *  `PortBrokerService.allocate` to this signature so tests can pin\n\t *  the port without yielding from a substrate Layer. */\n\treadonly allocatePort: (\n\t\tpreferred?: number,\n\t\tprobeHost?: WalletPortProbeHost,\n\t) => Effect.Effect<number, WalletBootError, Scope.Scope>;\n\t/** Account value resolver — the barrel hands this in keyed off the\n\t *  BuildContext so the service body stays substrate-agnostic. */\n\treadonly resolveAccounts: () => Effect.Effect<ReadonlyArray<AccountValue>, WalletBootError>;\n\t/** Stable router-fronted base URL for this wallet on the stack-scoped\n\t *  hostname (e.g. `http://wallet.<app>.localhost:<router-port>`). Null\n\t *  only in tests that bypass the router derivation. */\n\treadonly routerFrontedUrl: string | null;\n\t/** Stable router-fronted dev-server origin for this stack. Added to\n\t *  the wallet allowlist so app+wallet stacks work without repeating\n\t *  router origins in user configs. */\n\treadonly routedAppOrigin: string | null;\n}\n\n// ----------------------------------------------------------------------\n// Acquire\n// ----------------------------------------------------------------------\n\n/**\n * Acquire the wallet service.\n *\n * Distilled-doc invariants honored:\n *\n *   - C12 (mandatory Origin + bearer): both gates are wired in\n *     `server.ts:dispatch`.\n *   - Token comparison constant-time: `pairing.ts:safeBearerEquals`.\n *   - Token file 0o600: `pairing.ts:acquirePairingToken`.\n *   - Token in URL fragment only: `pairing.ts:composePairUrl`.\n *   - Token NEVER in log lines: handlers log only `bearerValid:\n *     boolean`.\n *   - Default bindAddress `'0.0.0.0'`: required for the Docker router to\n *     reach host-loopback services on native Linux.\n *   - Stack-scoped origin allowlist (no cross-stack pairing risk):\n *     `origin-policy.ts:resolveOriginPolicy`.\n */\nexport const acquireWallet = (\n\topts: WalletOptions,\n\tctx: WalletAcquireContext,\n): Effect.Effect<WalletValue, WalletBootError, Scope.Scope | FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t[WalletSpans.app]: ctx.app,\n\t\t\t[WalletSpans.stack]: ctx.stack,\n\t\t\t[WalletSpans.chain]: ctx.chain,\n\t\t});\n\n\t\t// 1. Resolve the dependency account values. The barrel sets up\n\t\t//    `resolveAccounts` to walk the BuildContext via resolved dependencies in\n\t\t//    `opts.accounts`; we just project to the address-keyed map.\n\t\t//    Count is annotated AFTER resolution — `opts.accounts` may\n\t\t//    be the `'all'` sentinel before composer expansion, so the\n\t\t//    resolved-array length is the load-bearing value.\n\t\tconst accounts = yield* ctx.resolveAccounts();\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t[WalletSpans.accountCount]: accounts.length,\n\t\t});\n\t\tif (accounts.length === 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'no-accounts',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"wallet resolved zero accounts; add account('name') to the stack or pass accounts explicitly.\",\n\t\t\t\t\thint: \"`wallet()` and `wallet({ accounts: 'all' })` require at least one account member in the final stack.\",\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst accountsByAddress = new Map<string, AccountValue>();\n\t\tfor (const acct of accounts) {\n\t\t\t// Two accounts resolving to the same address would silently\n\t\t\t// last-write-wins the sign-route map, so a sign request for\n\t\t\t// that address binds to a non-deterministic account. Fail at\n\t\t\t// boot with the colliding address named.\n\t\t\tif (accountsByAddress.has(acct.address)) {\n\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\twalletBootError({\n\t\t\t\t\t\tphase: 'bind-account',\n\t\t\t\t\t\tmessage: `wallet resolved two accounts at the same address ${acct.address}; each account must own a distinct address.`,\n\t\t\t\t\t\thint: 'Remove the duplicate account member, or give the colliding accounts distinct keypairs.',\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t}\n\t\t\taccountsByAddress.set(acct.address, acct);\n\t\t}\n\n\t\t// 2. Port allocation. Probe the same host family the real\n\t\t//    listener uses, otherwise a process bound on a non-loopback\n\t\t//    interface could race the wallet's all-interface listen.\n\t\tconst bindAddress = opts.bindAddress ?? WALLET_DEFAULT_BIND_ADDRESS;\n\t\tconst port = yield* ctx.allocatePort(opts.port, portProbeHostForBindAddress(bindAddress));\n\n\t\t// 3. Token mint or rehydrate. Lives at the stack-scoped state root\n\t\t//    so warm-start + snapshot-restore preserve the existing\n\t\t//    pairing.\n\t\tconst token = yield* acquirePairingToken(tokenPath(ctx.stateRoot));\n\n\t\t// 4. Origin policy. Allowlist is the router-fronted dev-server\n\t\t//    origin for this stack plus any explicit `allowedOrigins`.\n\t\tconst policy = yield* resolveOriginPolicy({\n\t\t\tapp: ctx.app,\n\t\t\tstack: ctx.stack,\n\t\t\troutedAppOrigin: ctx.routedAppOrigin,\n\t\t\textraOrigins: opts.allowedOrigins ?? [],\n\t\t});\n\n\t\t// 5. Start the HTTP server. The dispatcher in `server.ts` owns\n\t\t//    route matching + the constant-time bearer compare + the\n\t\t//    JSON envelope contract.\n\t\tconst serverConfig: WalletServerConfig = {\n\t\t\tbindAddress,\n\t\t\tport,\n\t\t\ttoken,\n\t\t\tpolicy,\n\t\t\taccountsByAddress,\n\t\t};\n\t\tconst server = yield* startHttpServer(serverConfig);\n\n\t\t// 6. Compose URLs. Router-fronted form when available, loopback\n\t\t//    fallback otherwise. The token rides ONLY the fragment — never\n\t\t//    a query param — per C13.\n\t\tconst walletUrl =\n\t\t\tctx.routerFrontedUrl ?? `http://${directUrlHostForBindAddress(bindAddress)}:${port}`;\n\t\tconst pairUrl = composePairUrl(walletUrl, token);\n\n\t\tconst bindings: DappKitConfigBindings = {\n\t\t\twalletUrl,\n\t\t\tpairUrl,\n\t\t\tchain: ctx.chain,\n\t\t\tprotocolPaths: {\n\t\t\t\thealth: WalletHttpPath.HEALTH,\n\t\t\t\taccounts: WalletHttpPath.ACCOUNTS,\n\t\t\t\tsignTransaction: WalletHttpPath.SIGN_TRANSACTION,\n\t\t\t\tsignPersonalMessage: WalletHttpPath.SIGN_PERSONAL_MESSAGE,\n\t\t\t},\n\t\t};\n\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t[WalletSpans.url]: walletUrl,\n\t\t\t[WalletSpans.localPort]: port,\n\t\t});\n\n\t\t// Defensive: NEVER log `pairUrl` directly. It carries the token.\n\t\tyield* Effect.logInfo('wallet ready').pipe(\n\t\t\tEffect.annotateLogs({\n\t\t\t\t[WalletSpans.url]: walletUrl,\n\t\t\t\t[WalletSpans.token]: 'redacted-fragment',\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\turl: walletUrl,\n\t\t\tpairUrl,\n\t\t\tbindings,\n\t\t\tlocalPort: port,\n\t\t\ttoken,\n\t\t\tserver,\n\t\t} satisfies WalletValue;\n\t});\n"],"mappings":";;;;;;;;;AA8GA,MAAM,8BAA8B;AACpC,MAAM,yBAAyB;AAG/B,MAAM,+BAA+B,gBACpC,gBAAgB,8BAA8B,YAAY;AAE3D,MAAM,+BAA+B,gBACpC,gBAAgB,8BAA8B,yBAAyB;;;;;;;;;;;;;;;;;;AAyDxE,MAAa,iBACZ,MACA,QAEA,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,oBAAoB;GAChC,YAAY,MAAM,IAAI;GACtB,YAAY,QAAQ,IAAI;GACxB,YAAY,QAAQ,IAAI;EACzB,CAAC;CAQF,MAAM,WAAW,OAAO,IAAI,iBAAiB;AAC7C,QAAO,OAAO,oBAAoB,GAChC,YAAY,eAAe,SAAS,QACrC,CAAC;AACF,KAAI,SAAS,WAAW,EACvB,QAAO,OAAO,OAAO,KACpB,gBAAgB;EACf,OAAO;EACP,SACC;EACD,MAAM;EACN,CAAC,CACF;CAEF,MAAM,oCAAoB,IAAI,KAA2B;AACzD,MAAK,MAAM,QAAQ,UAAU;AAK5B,MAAI,kBAAkB,IAAI,KAAK,QAAQ,CACtC,QAAO,OAAO,OAAO,KACpB,gBAAgB;GACf,OAAO;GACP,SAAS,oDAAoD,KAAK,QAAQ;GAC1E,MAAM;GACN,CAAC,CACF;AAEF,oBAAkB,IAAI,KAAK,SAAS,KAAK;;CAM1C,MAAM,cAAc,KAAK,eAAe;CACxC,MAAM,OAAO,OAAO,IAAI,aAAa,KAAK,MAAM,4BAA4B,YAAY,CAAC;CAKzF,MAAM,QAAQ,OAAO,oBAAoB,UAAU,IAAI,UAAU,CAAC;CAqBlE,MAAM,SAAS,OAAO,gBAAgB;EANrC;EACA;EACA;EACA,QAAA,OAdqB,oBAAoB;GACzC,KAAK,IAAI;GACT,OAAO,IAAI;GACX,iBAAiB,IAAI;GACrB,cAAc,KAAK,kBAAkB,EAAE;GACvC,CAAC;EAUD;EAEiD,CAAC;CAKnD,MAAM,YACL,IAAI,oBAAoB,UAAU,4BAA4B,YAAY,CAAC,GAAG;CAC/E,MAAM,UAAU,eAAe,WAAW,MAAM;CAEhD,MAAM,WAAkC;EACvC;EACA;EACA,OAAO,IAAI;EACX,eAAe;GACd,QAAQ,eAAe;GACvB,UAAU,eAAe;GACzB,iBAAiB,eAAe;GAChC,qBAAqB,eAAe;GACpC;EACD;AAED,QAAO,OAAO,oBAAoB;GAChC,YAAY,MAAM;GAClB,YAAY,YAAY;EACzB,CAAC;AAGF,QAAO,OAAO,QAAQ,eAAe,CAAC,KACrC,OAAO,aAAa;GAClB,YAAY,MAAM;GAClB,YAAY,QAAQ;EACrB,CAAC,CACF;AAED,QAAO;EACN,KAAK;EACL;EACA;EACA,WAAW;EACX;EACA;EACA;EACA"}
+{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/wallet/service.ts"],"sourcesContent":["// Wallet plugin — main acquire Effect.\n//\n// What this file does (15-wallet.md §Lifecycle, Startup ordered):\n//\n//   1. Resolve each consumed account tag and key the AccountValues by\n//      address (load-bearing: sign endpoints look up by address).\n//   2. Allocate a port via the substrate's `PortBrokerService`.\n//   3. Mint or rehydrate the pairing token (read-existing-or-mint at\n//      `<stateRoot>/wallet/token`, mode 0o600) via the substrate's\n//      `atomicWriteFile`.\n//   4. Resolve the stack-scoped origin allowlist via\n//      `origin-policy.ts`.\n//   5. Start the in-process HTTP server.\n//   6. Compose the wallet URL + pair URL + return the resolved\n//      `WalletValue`.\n//\n// The substrate handles:\n//\n//   - Scope finalizers (port release, server close) — declared by the\n//     substrate primitives we call into.\n//   - Endpoint registry publication (we surface the URL/pairUrl via\n//     our resolved tag value; the substrate's endpoint-registry\n//     primitive consumes the `RoutableDecl` from `routable.ts`).\n//   - Manifest emit — the substrate projects from registry. We never\n//     write `.devstack/manifest.json` directly.\n\nimport { Effect } from 'effect';\nimport type { FileSystem, Scope } from 'effect';\n\nimport type { AccountResourceId, AccountValue } from '../account/index.ts';\nimport type { DevWalletConfig } from './codegen.ts';\nimport { walletBootError, type WalletBootError } from './errors.ts';\nimport { resolveOriginPolicy } from './origin-policy.ts';\nimport { acquirePairingToken, composePairUrl, tokenPath, type PairingToken } from './pairing.ts';\nimport { startHttpServer, type WalletServerConfig, type WalletServerHandle } from './server.ts';\nimport { WalletHttpPath } from './protocol.ts';\n\n// ----------------------------------------------------------------------\n// User-facing options\n// ----------------------------------------------------------------------\n\nimport type { ResourceRef } from '../../api/define-plugin.ts';\n\n/** Literal sentinel for `WalletOptions.accounts: 'all'` — every account\n *  member in the stack. Expanded by the composer at `defineDevstack`\n *  call time (api-surface-design §4 D6). Kept as an exported constant\n *  so the wallet factory + composer share one source of truth. */\nexport const WALLET_ACCOUNTS_ALL = 'all' as const;\nexport type WalletAccountsAll = typeof WALLET_ACCOUNTS_ALL;\n\n/** A user-supplied account ref. The user passes the result of\n *  `account('alice')` — NOT a bare string. Generic over the literal\n *  account name so the wallet's dependency tuple preserves each\n *  per-account resource id (`account/alice`, `account/bob`, ...). */\nexport type WalletAccountMember<Name extends string = string> = ResourceRef<\n\tAccountResourceId<Name>,\n\tAccountValue\n>;\n\nexport interface WalletOptions<\n\tAccounts extends ReadonlyArray<WalletAccountMember> = ReadonlyArray<WalletAccountMember>,\n> {\n\t/** Accounts the wallet binds. Each is yielded for ordering AND its\n\t *  resolved value is keyed by address into the sign-handler map.\n\t *\n\t *  Two shapes:\n\t *\n\t *   - Explicit tuple — each entry is the plugin/resource ref returned\n\t *     by `account('name')`. Pins the bound set at the wallet's call\n\t *     site; preserves each literal `account/${Name}` so stack\n\t *     composition can validate and recursively expand the refs.\n\t *\n\t *   - The literal `'all'` — shorthand for \"every account member in\n\t *     the stack\". The composer expands this against the final\n\t *     member tuple at `defineDevstack(...)` time (api-surface-design\n\t *     §4 D6). The wallet member returned by the factory carries an\n\t *     expander hook keyed off `WALLET_ACCOUNTS_ALL` that the\n\t *     composer invokes once the account-providing members are\n\t *     known. */\n\treadonly accounts: Accounts | typeof WALLET_ACCOUNTS_ALL;\n\t/** Extra origins merged on top of the router-fronted dev-server\n\t *  origin. Useful for headless test runners and custom dev hosts. */\n\treadonly allowedOrigins?: ReadonlyArray<string>;\n\t/** Preferred host port. Substrate's port broker forward-scans if\n\t *  this is taken. Default: substrate-picked (no preference). */\n\treadonly port?: number;\n\t/** NIC the HTTP server binds. Defaults to `'0.0.0.0'` because the\n\t *  router runs in Docker and must reach the host process through the\n\t *  host-gateway address on native Linux. The public wallet URL remains\n\t *  router-fronted and stack-scoped. */\n\treadonly bindAddress?: string;\n}\n\n// ----------------------------------------------------------------------\n// Resolved value (what the wallet plugin publishes)\n// ----------------------------------------------------------------------\n\nexport interface WalletValue {\n\treadonly url: string; // router-fronted URL when available, loopback otherwise\n\treadonly pairUrl: string;\n\treadonly bindings: DevWalletConfig;\n\treadonly localPort: number;\n\treadonly token: PairingToken;\n\t/** Server handle — substrate's scope finalizer chain invokes\n\t *  `.close()`; callers don't reach in. Exposed here so tests can\n\t *  drive teardown explicitly. */\n\treadonly server: WalletServerHandle;\n}\n\nconst WALLET_DEFAULT_BIND_ADDRESS = '0.0.0.0' as const;\nconst WALLET_DIRECT_URL_HOST = '127.0.0.1' as const;\ntype WalletPortProbeHost = '127.0.0.1' | '0.0.0.0';\n\nconst portProbeHostForBindAddress = (bindAddress: string): WalletPortProbeHost =>\n\tbindAddress === WALLET_DEFAULT_BIND_ADDRESS ? '0.0.0.0' : '127.0.0.1';\n\nconst directUrlHostForBindAddress = (bindAddress: string): string =>\n\tbindAddress === WALLET_DEFAULT_BIND_ADDRESS ? WALLET_DIRECT_URL_HOST : bindAddress;\n\n// ----------------------------------------------------------------------\n// Per-acquire context — supplied by the barrel\n// ----------------------------------------------------------------------\n\n/** Inputs from the substrate. The barrel fills these from the\n *  BuildContext; tests can construct directly. */\nexport interface WalletAcquireContext {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly network: string;\n\t/** State root where `wallet/token` lives. Convention:\n\t *  `<appDir>/.devstack/stacks/<stack>/runtime`. */\n\treadonly stateRoot: string;\n\t/** Port broker seam — returns the allocated port + a scope-\n\t *  finalizer-installed release. The barrel adapts the substrate's\n\t *  `PortBrokerService.allocate` to this signature so tests can pin\n\t *  the port without yielding from a substrate Layer. */\n\treadonly allocatePort: (\n\t\tpreferred?: number,\n\t\tprobeHost?: WalletPortProbeHost,\n\t) => Effect.Effect<number, WalletBootError, Scope.Scope>;\n\t/** Account value resolver — the barrel hands this in keyed off the\n\t *  BuildContext so the service body stays substrate-agnostic. */\n\treadonly resolveAccounts: () => Effect.Effect<ReadonlyArray<AccountValue>, WalletBootError>;\n\t/** Stable router-fronted base URL for this wallet on the stack-scoped\n\t *  hostname (e.g. `http://wallet.<app>.localhost:<router-port>`). Null\n\t *  only in tests that bypass the router derivation. */\n\treadonly routerFrontedUrl: string | null;\n\t/** Stable router-fronted dev-server origin for this stack. Added to\n\t *  the wallet allowlist so app+wallet stacks work without repeating\n\t *  router origins in user configs. */\n\treadonly routedAppOrigin: string | null;\n}\n\n// ----------------------------------------------------------------------\n// Acquire\n// ----------------------------------------------------------------------\n\n/**\n * Acquire the wallet service.\n *\n * Distilled-doc invariants honored:\n *\n *   - C12 (mandatory Origin + bearer): both gates are wired in\n *     `server.ts:dispatch`.\n *   - Token comparison constant-time: `pairing.ts:safeBearerEquals`.\n *   - Token file 0o600: `pairing.ts:acquirePairingToken`.\n *   - Token in URL fragment only: `pairing.ts:composePairUrl`.\n *   - Token NEVER in log lines: handlers log only `bearerValid:\n *     boolean`.\n *   - Default bindAddress `'0.0.0.0'`: required for the Docker router to\n *     reach host-loopback services on native Linux.\n *   - Stack-scoped origin allowlist (no cross-stack pairing risk):\n *     `origin-policy.ts:resolveOriginPolicy`.\n */\nexport const acquireWallet = (\n\topts: WalletOptions,\n\tctx: WalletAcquireContext,\n): Effect.Effect<WalletValue, WalletBootError, Scope.Scope | FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\t// 1. Resolve the dependency account values. The barrel sets up\n\t\t//    `resolveAccounts` to walk the BuildContext via resolved dependencies in\n\t\t//    `opts.accounts`; we just project to the address-keyed map.\n\t\tconst accounts = yield* ctx.resolveAccounts();\n\t\tif (accounts.length === 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'no-accounts',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"wallet resolved zero accounts; add account('name') to the stack or pass accounts explicitly.\",\n\t\t\t\t\thint: \"`wallet()` and `wallet({ accounts: 'all' })` require at least one account member in the final stack.\",\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst accountsByAddress = new Map<string, AccountValue>();\n\t\tfor (const acct of accounts) {\n\t\t\t// Two accounts resolving to the same address would silently\n\t\t\t// last-write-wins the sign-route map, so a sign request for\n\t\t\t// that address binds to a non-deterministic account. Fail at\n\t\t\t// boot with the colliding address named.\n\t\t\tif (accountsByAddress.has(acct.address)) {\n\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\twalletBootError({\n\t\t\t\t\t\tphase: 'bind-account',\n\t\t\t\t\t\tmessage: `wallet resolved two accounts at the same address ${acct.address}; each account must own a distinct address.`,\n\t\t\t\t\t\thint: 'Remove the duplicate account member, or give the colliding accounts distinct keypairs.',\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t}\n\t\t\taccountsByAddress.set(acct.address, acct);\n\t\t}\n\n\t\t// 2. Port allocation. Probe the same host family the real\n\t\t//    listener uses, otherwise a process bound on a non-loopback\n\t\t//    interface could race the wallet's all-interface listen.\n\t\tconst bindAddress = opts.bindAddress ?? WALLET_DEFAULT_BIND_ADDRESS;\n\t\tconst port = yield* ctx.allocatePort(opts.port, portProbeHostForBindAddress(bindAddress));\n\n\t\t// 3. Token mint or rehydrate. Lives at the stack-scoped state root\n\t\t//    so warm-start + snapshot-restore preserve the existing\n\t\t//    pairing.\n\t\tconst token = yield* acquirePairingToken(tokenPath(ctx.stateRoot));\n\n\t\t// 4. Origin policy. Allowlist is the router-fronted dev-server\n\t\t//    origin for this stack plus any explicit `allowedOrigins`.\n\t\tconst policy = yield* resolveOriginPolicy({\n\t\t\tapp: ctx.app,\n\t\t\tstack: ctx.stack,\n\t\t\troutedAppOrigin: ctx.routedAppOrigin,\n\t\t\textraOrigins: opts.allowedOrigins ?? [],\n\t\t});\n\n\t\t// 5. Start the HTTP server. The dispatcher in `server.ts` owns\n\t\t//    route matching + the constant-time bearer compare + the\n\t\t//    JSON envelope contract.\n\t\tconst serverConfig: WalletServerConfig = {\n\t\t\tbindAddress,\n\t\t\tport,\n\t\t\ttoken,\n\t\t\tpolicy,\n\t\t\taccountsByAddress,\n\t\t};\n\t\tconst server = yield* startHttpServer(serverConfig);\n\n\t\t// 6. Compose URLs. Router-fronted form when available, loopback\n\t\t//    fallback otherwise. The token rides ONLY the fragment — never\n\t\t//    a query param — per C13.\n\t\tconst walletUrl =\n\t\t\tctx.routerFrontedUrl ?? `http://${directUrlHostForBindAddress(bindAddress)}:${port}`;\n\t\tconst pairUrl = composePairUrl(walletUrl, token);\n\n\t\tconst bindings: DevWalletConfig = {\n\t\t\twalletUrl,\n\t\t\tpairUrl,\n\t\t\tnetwork: ctx.network,\n\t\t\tprotocolPaths: {\n\t\t\t\thealth: WalletHttpPath.HEALTH,\n\t\t\t\taccounts: WalletHttpPath.ACCOUNTS,\n\t\t\t\tsignTransaction: WalletHttpPath.SIGN_TRANSACTION,\n\t\t\t\tsignPersonalMessage: WalletHttpPath.SIGN_PERSONAL_MESSAGE,\n\t\t\t},\n\t\t};\n\n\t\t// Defensive: NEVER log `pairUrl` directly. It carries the token.\n\t\tyield* Effect.logInfo('wallet ready').pipe(\n\t\t\tEffect.annotateLogs({\n\t\t\t\t'wallet.url': walletUrl,\n\t\t\t\t'wallet.token': 'redacted-fragment',\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\turl: walletUrl,\n\t\t\tpairUrl,\n\t\t\tbindings,\n\t\t\tlocalPort: port,\n\t\t\ttoken,\n\t\t\tserver,\n\t\t} satisfies WalletValue;\n\t});\n"],"mappings":";;;;;;;;AA6GA,MAAM,8BAA8B;AACpC,MAAM,yBAAyB;AAG/B,MAAM,+BAA+B,gBACpC,gBAAgB,8BAA8B,YAAY;AAE3D,MAAM,+BAA+B,gBACpC,gBAAgB,8BAA8B,yBAAyB;;;;;;;;;;;;;;;;;;AAyDxE,MAAa,iBACZ,MACA,QAEA,OAAO,IAAI,aAAa;CAIvB,MAAM,WAAW,OAAO,IAAI,gBAAgB;CAC5C,IAAI,SAAS,WAAW,GACvB,OAAO,OAAO,OAAO,KACpB,gBAAgB;EACf,OAAO;EACP,SACC;EACD,MAAM;CACP,CAAC,CACF;CAED,MAAM,oCAAoB,IAAI,IAA0B;CACxD,KAAK,MAAM,QAAQ,UAAU;EAK5B,IAAI,kBAAkB,IAAI,KAAK,OAAO,GACrC,OAAO,OAAO,OAAO,KACpB,gBAAgB;GACf,OAAO;GACP,SAAS,oDAAoD,KAAK,QAAQ;GAC1E,MAAM;EACP,CAAC,CACF;EAED,kBAAkB,IAAI,KAAK,SAAS,IAAI;CACzC;CAKA,MAAM,cAAc,KAAK,eAAe;CACxC,MAAM,OAAO,OAAO,IAAI,aAAa,KAAK,MAAM,4BAA4B,WAAW,CAAC;CAKxF,MAAM,QAAQ,OAAO,oBAAoB,UAAU,IAAI,SAAS,CAAC;CAqBjE,MAAM,SAAS,OAAO,gBAAgB;EANrC;EACA;EACA;EACA,QAAA,OAdqB,oBAAoB;GACzC,KAAK,IAAI;GACT,OAAO,IAAI;GACX,iBAAiB,IAAI;GACrB,cAAc,KAAK,kBAAkB,CAAC;EACvC,CAAC;EAUA;CAEgD,CAAC;CAKlD,MAAM,YACL,IAAI,oBAAoB,UAAU,4BAA4B,WAAW,EAAE,GAAG;CAC/E,MAAM,UAAU,eAAe,WAAW,KAAK;CAE/C,MAAM,WAA4B;EACjC;EACA;EACA,SAAS,IAAI;EACb,eAAe;GACd,QAAQ,eAAe;GACvB,UAAU,eAAe;GACzB,iBAAiB,eAAe;GAChC,qBAAqB,eAAe;EACrC;CACD;CAGA,OAAO,OAAO,QAAQ,cAAc,CAAC,CAAC,KACrC,OAAO,aAAa;EACnB,cAAc;EACd,gBAAgB;CACjB,CAAC,CACF;CAEA,OAAO;EACN,KAAK;EACL;EACA;EACA,WAAW;EACX;EACA;CACD;AACD,CAAC"}

package/dist/plugins/wallet/snapshot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/wallet/snapshot.ts"],"sourcesContent":["// Wallet plugin — Snapshotable contribution.\n//\n// The dev-wallet pairing token is plugin-owned state. Snapshot L3 must\n// not special-case its runtime path; the wallet declares the subtree\n// like any other stateful plugin.\n\nimport { Effect } from 'effect';\n\nimport type { SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\nexport const makeWalletSnapshotable = (): SnapshotableDecl => ({\n\tkind: 'snapshotable',\n\tsubtrees: ['wallet/token'],\n\tmissingTolerance: 'fatal',\n\tsecretMaterial: true,\n\tpreRestore: Effect.succeed({ kind: 'wallet-pairing-token' as const }),\n\tpostRestore: Effect.void,\n});\n"],"mappings":";;AAUA,MAAa,gCAAkD;CAC9D,MAAM;CACN,UAAU,CAAC,eAAe;CAC1B,kBAAkB;CAClB,gBAAgB;CAChB,YAAY,OAAO,QAAQ,EAAE,MAAM,wBAAiC,CAAC;CACrE,aAAa,OAAO;CACpB"}
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/wallet/snapshot.ts"],"sourcesContent":["// Wallet plugin — Snapshotable contribution.\n//\n// The dev-wallet pairing token is plugin-owned state. Snapshot L3 must\n// not special-case its runtime path; the wallet declares the subtree\n// like any other stateful plugin.\n\nimport { Effect } from 'effect';\n\nimport type { SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\nexport const makeWalletSnapshotable = (): SnapshotableDecl => ({\n\tkind: 'snapshotable',\n\tsubtrees: ['wallet/token'],\n\tmissingTolerance: 'fatal',\n\tsecretMaterial: true,\n\tpreRestore: Effect.succeed({ kind: 'wallet-pairing-token' as const }),\n\tpostRestore: Effect.void,\n});\n"],"mappings":";;AAUA,MAAa,gCAAkD;CAC9D,MAAM;CACN,UAAU,CAAC,cAAc;CACzB,kBAAkB;CAClB,gBAAgB;CAChB,YAAY,OAAO,QAAQ,EAAE,MAAM,uBAAgC,CAAC;CACpE,aAAa,OAAO;AACrB"}

package/dist/plugins/walrus/bootstrap-assets/cargo-image.mjs

@@ -1,5 +1,4 @@
 import { walrusPluginError } from "../errors.mjs";
-import { WalrusSpans } from "../spans.mjs";
 import { readEnv } from "../../../substrate/runtime/typed-env.mjs";
 import { Effect } from "effect";
 import { fileURLToPath } from "node:url";
@@ -57,10 +56,7 @@ const resolveCargoImage = (runtime, inputs, expectedTag) => Effect.gen(function*
 		digest: built.digest,
 		tag: built.tag ?? built.digest
 	};
-}).pipe(Effect.withSpan("devstack.plugin.walrus.cargoImage.resolve", { attributes: {
-	[WalrusSpans.ref]: inputs.walrusRef,
-	[WalrusSpans.suiVersion]: inputs.suiVersion
-} }));
+});
 //#endregion
 export { DEFAULT_SUI_VERSION, DEFAULT_WALRUS_REF, resolveCargoImage };
 

package/dist/plugins/walrus/bootstrap-assets/cargo-image.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cargo-image.mjs","names":[],"sources":["../../../../src/plugins/walrus/bootstrap-assets/cargo-image.ts"],"sourcesContent":["// Walrus vendored Dockerfile-built image.\n//\n// CONTRACT:\n//\n// The vendored Dockerfile packages the upstream Walrus release tarball\n// selected by Docker's TARGETARCH. It never builds Walrus from source:\n// upstream release binaries are the contract, and the Dockerfile verifies\n// the selected asset before the image is accepted.\n//\n// Two staged paths:\n//\n//   (a) `WALRUS_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked\n//        registry tag (or a locally `docker build`-tagged image). Skips\n//        the runtime build entirely and returns a bare `ImageRef`. The\n//        e2e stub test uses this path (`walrus-test-stub:latest`).\n//\n//   (b) Vendored Dockerfile build via `runtime.ensureImage()`. The\n//        substrate's content-addressed build cache short-circuits when\n//        the (context + dockerfile + buildArgs) hash matches a prior result;\n//        cold-cache wall-time is the upstream release download.\n//\n// Distilled-doc invariants honored:\n//   - 24: `DEFAULT_SUI_VERSION` (the wrapper-baked sui binary) MUST\n//        align with the localnet image's sui release.\n//   - 25: ubuntu:24.04 base — handled in the Dockerfile.\n\nimport { Effect, type Scope } from 'effect';\nimport { fileURLToPath } from 'node:url';\n\nimport type { ContainerRuntime } from '../../../contracts/container-runtime.ts';\nimport { readEnv } from '../../../substrate/runtime/typed-env.ts';\nimport { walrusPluginError, type WalrusPluginError } from '../errors.ts';\nimport { WalrusSpans } from '../spans.ts';\n\nconst WALRUS_CARGO_IMAGE_OVERRIDE_ENV = 'WALRUS_CARGO_IMAGE_OVERRIDE' as const;\n\n/** Pinned Walrus release whose native binaries are packaged into the\n *  local-cluster wrapper image. */\nexport const DEFAULT_WALRUS_REF = 'testnet-v1.49.1' as const;\n\n/** Distilled-doc invariant 24: the wrapper-baked sui binary must\n *  match the localnet image's sui release. Pinned here in lockstep\n *  with the walrus ref bump. */\nexport const DEFAULT_SUI_VERSION = 'devnet-v1.71.0' as const;\n\n/** Inputs to the walrus image resolver. */\nexport interface WalrusCargoImageInputs<Ref extends string = string, SuiV extends string = string> {\n\treadonly walrusRef: Ref;\n\treadonly suiVersion: SuiV;\n\t/** Owner identity stamped on the built image so label-driven prune\n\t *  finds it. */\n\treadonly owner: {\n\t\treadonly app: string;\n\t\treadonly stack: string;\n\t};\n}\n\n/** Resolved value — the content-addressed image ref. */\nexport interface WalrusCargoImageResolved {\n\treadonly digest: string;\n\treadonly tag: string;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Resolve to the on-disk path of the vendored Dockerfile context.\n *  `fileURLToPath` normalises the URL → host-path conversion across\n *  platforms (Windows `file:///C:/...` → `C:\\...`; POSIX strips the\n *  scheme and percent-decodes). Reading `.pathname` directly would\n *  leave the leading `/` on Windows. */\nconst vendoredDockerfileContext = (): string =>\n\tfileURLToPath(new URL('../../../../images/walrus/', import.meta.url));\n\n/** Resolve the walrus image. Path (a) trusts an env-override tag; path\n *  (b) builds the vendored Dockerfile via `runtime.ensureImage`.\n *\n *  `expectedTag`, when given, is the on-host tag the resolved image is\n *  published under (the build itself is content-cached, so multiple distinct\n *  tags of the SAME build are cheap re-tags). The storage-node committee uses\n *  this to give each node its OWN image tag — otherwise all N nodes share one\n *  tag and snapshot-restore's per-container image promote collapses N committed\n *  writable layers onto that single tag (last-write-wins), losing N-1 nodes'\n *  RocksDB. `ensureImage` reuses an existing tag without rebuilding, so a tag\n *  the restore already promoted to a committed layer is preserved on reboot. */\nexport const resolveCargoImage = (\n\truntime: ContainerRuntime,\n\tinputs: WalrusCargoImageInputs,\n\texpectedTag?: string,\n): Effect.Effect<WalrusCargoImageResolved, WalrusPluginError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst override = readEnv(WALRUS_CARGO_IMAGE_OVERRIDE_ENV);\n\t\tif (override && override.length > 0) {\n\t\t\t// Trust-the-tag path. The digest is opaque (substrate's\n\t\t\t// content-addressed cache will re-resolve via `docker inspect`\n\t\t\t// when it materializes the image). The per-node `expectedTag`\n\t\t\t// aliasing is build-path only (it relies on `ensureImage`'s\n\t\t\t// reuse-if-tag-exists to stay restore-safe across reboots);\n\t\t\t// override images keep the shared tag, so override + multi-node +\n\t\t\t// snapshot/restore is not committee-distinct (a documented niche —\n\t\t\t// the e2e matrix forces the build path).\n\t\t\treturn { digest: override, tag: override };\n\t\t}\n\n\t\t// Real build via the vendored Dockerfile.\n\t\tconst buildCtx = {\n\t\t\tcontextPath: vendoredDockerfileContext(),\n\t\t\tdockerfile: 'Dockerfile',\n\t\t\tbuildArgs: {\n\t\t\t\tWALRUS_VERSION: inputs.walrusRef,\n\t\t\t\tSUI_VERSION: inputs.suiVersion,\n\t\t\t},\n\t\t\towner: {\n\t\t\t\tapp: inputs.owner.app,\n\t\t\t\tstack: inputs.owner.stack,\n\t\t\t\tplugin: 'walrus',\n\t\t\t\trole: 'cluster',\n\t\t\t},\n\t\t};\n\n\t\t// `expected.tag`, when present, is the on-host tag ensureImage publishes\n\t\t// (and REUSES without rebuilding if it already exists — so a per-node tag\n\t\t// the restore promoted to a committed layer survives reboot). The build\n\t\t// itself is content-cached, so N per-node tags of one build are cheap.\n\t\tconst built = yield* runtime\n\t\t\t.ensureImage(\n\t\t\t\tbuildCtx,\n\t\t\t\texpectedTag !== undefined ? { digest: expectedTag, tag: expectedTag } : undefined,\n\t\t\t)\n\t\t\t.pipe(\n\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'image-build',\n\t\t\t\t\t\t`walrus image build failed (walrusRef=${inputs.walrusRef}, suiVersion=${inputs.suiVersion}): ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t{ cause },\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\treturn { digest: built.digest, tag: built.tag ?? built.digest };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.walrus.cargoImage.resolve', {\n\t\t\tattributes: {\n\t\t\t\t[WalrusSpans.ref]: inputs.walrusRef,\n\t\t\t\t[WalrusSpans.suiVersion]: inputs.suiVersion,\n\t\t\t},\n\t\t}),\n\t);\n"],"mappings":";;;;;;AAkCA,MAAM,kCAAkC;;;AAIxC,MAAa,qBAAqB;;;;AAKlC,MAAa,sBAAsB;;;;;;AA6BnC,MAAM,kCACL,cAAc,IAAI,IAAI,8BAA8B,OAAO,KAAK,IAAI,CAAC;;;;;;;;;;;;AAatE,MAAa,qBACZ,SACA,QACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,QAAQ,gCAAgC;AACzD,KAAI,YAAY,SAAS,SAAS,EASjC,QAAO;EAAE,QAAQ;EAAU,KAAK;EAAU;CAI3C,MAAM,WAAW;EAChB,aAAa,2BAA2B;EACxC,YAAY;EACZ,WAAW;GACV,gBAAgB,OAAO;GACvB,aAAa,OAAO;GACpB;EACD,OAAO;GACN,KAAK,OAAO,MAAM;GAClB,OAAO,OAAO,MAAM;GACpB,QAAQ;GACR,MAAM;GACN;EACD;CAMD,MAAM,QAAQ,OAAO,QACnB,YACA,UACA,gBAAgB,KAAA,IAAY;EAAE,QAAQ;EAAa,KAAK;EAAa,GAAG,KAAA,EACxE,CACA,KACA,OAAO,UAAU,UAChB,kBACC,eACA,wCAAwC,OAAO,UAAU,eAAe,OAAO,WAAW,KAAK,MAAM,OAAO,IAAI,MAAM,UACtH,EAAE,OAAO,CACT,CACD,CACD;AACF,QAAO;EAAE,QAAQ,MAAM;EAAQ,KAAK,MAAM,OAAO,MAAM;EAAQ;EAC9D,CAAC,KACF,OAAO,SAAS,6CAA6C,EAC5D,YAAY;EACV,YAAY,MAAM,OAAO;EACzB,YAAY,aAAa,OAAO;CACjC,EACD,CAAC,CACF"}
+{"version":3,"file":"cargo-image.mjs","names":[],"sources":["../../../../src/plugins/walrus/bootstrap-assets/cargo-image.ts"],"sourcesContent":["// Walrus vendored Dockerfile-built image.\n//\n// CONTRACT:\n//\n// The vendored Dockerfile packages the upstream Walrus release tarball\n// selected by Docker's TARGETARCH. It never builds Walrus from source:\n// upstream release binaries are the contract, and the Dockerfile verifies\n// the selected asset before the image is accepted.\n//\n// Two staged paths:\n//\n//   (a) `WALRUS_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked\n//        registry tag (or a locally `docker build`-tagged image). Skips\n//        the runtime build entirely and returns a bare `ImageRef`. The\n//        e2e stub test uses this path (`walrus-test-stub:latest`).\n//\n//   (b) Vendored Dockerfile build via `runtime.ensureImage()`. The\n//        substrate's content-addressed build cache short-circuits when\n//        the (context + dockerfile + buildArgs) hash matches a prior result;\n//        cold-cache wall-time is the upstream release download.\n//\n// Distilled-doc invariants honored:\n//   - 24: `DEFAULT_SUI_VERSION` (the wrapper-baked sui binary) MUST\n//        align with the localnet image's sui release.\n//   - 25: ubuntu:24.04 base — handled in the Dockerfile.\n\nimport { Effect, type Scope } from 'effect';\nimport { fileURLToPath } from 'node:url';\n\nimport type { ContainerRuntime } from '../../../contracts/container-runtime.ts';\nimport { readEnv } from '../../../substrate/runtime/typed-env.ts';\nimport { walrusPluginError, type WalrusPluginError } from '../errors.ts';\n\nconst WALRUS_CARGO_IMAGE_OVERRIDE_ENV = 'WALRUS_CARGO_IMAGE_OVERRIDE' as const;\n\n/** Pinned Walrus release whose native binaries are packaged into the\n *  local-cluster wrapper image. */\nexport const DEFAULT_WALRUS_REF = 'testnet-v1.49.1' as const;\n\n/** Distilled-doc invariant 24: the wrapper-baked sui binary must\n *  match the localnet image's sui release. Pinned here in lockstep\n *  with the walrus ref bump. */\nexport const DEFAULT_SUI_VERSION = 'devnet-v1.71.0' as const;\n\n/** Inputs to the walrus image resolver. */\nexport interface WalrusCargoImageInputs<Ref extends string = string, SuiV extends string = string> {\n\treadonly walrusRef: Ref;\n\treadonly suiVersion: SuiV;\n\t/** Owner identity stamped on the built image so label-driven prune\n\t *  finds it. */\n\treadonly owner: {\n\t\treadonly app: string;\n\t\treadonly stack: string;\n\t};\n}\n\n/** Resolved value — the content-addressed image ref. */\nexport interface WalrusCargoImageResolved {\n\treadonly digest: string;\n\treadonly tag: string;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Resolve to the on-disk path of the vendored Dockerfile context.\n *  `fileURLToPath` normalises the URL → host-path conversion across\n *  platforms (Windows `file:///C:/...` → `C:\\...`; POSIX strips the\n *  scheme and percent-decodes). Reading `.pathname` directly would\n *  leave the leading `/` on Windows. */\nconst vendoredDockerfileContext = (): string =>\n\tfileURLToPath(new URL('../../../../images/walrus/', import.meta.url));\n\n/** Resolve the walrus image. Path (a) trusts an env-override tag; path\n *  (b) builds the vendored Dockerfile via `runtime.ensureImage`.\n *\n *  `expectedTag`, when given, is the on-host tag the resolved image is\n *  published under (the build itself is content-cached, so multiple distinct\n *  tags of the SAME build are cheap re-tags). The storage-node committee uses\n *  this to give each node its OWN image tag — otherwise all N nodes share one\n *  tag and snapshot-restore's per-container image promote collapses N committed\n *  writable layers onto that single tag (last-write-wins), losing N-1 nodes'\n *  RocksDB. `ensureImage` reuses an existing tag without rebuilding, so a tag\n *  the restore already promoted to a committed layer is preserved on reboot. */\nexport const resolveCargoImage = (\n\truntime: ContainerRuntime,\n\tinputs: WalrusCargoImageInputs,\n\texpectedTag?: string,\n): Effect.Effect<WalrusCargoImageResolved, WalrusPluginError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst override = readEnv(WALRUS_CARGO_IMAGE_OVERRIDE_ENV);\n\t\tif (override && override.length > 0) {\n\t\t\t// Trust-the-tag path. The digest is opaque (substrate's\n\t\t\t// content-addressed cache will re-resolve via `docker inspect`\n\t\t\t// when it materializes the image). The per-node `expectedTag`\n\t\t\t// aliasing is build-path only (it relies on `ensureImage`'s\n\t\t\t// reuse-if-tag-exists to stay restore-safe across reboots);\n\t\t\t// override images keep the shared tag, so override + multi-node +\n\t\t\t// snapshot/restore is not committee-distinct (a documented niche —\n\t\t\t// the e2e matrix forces the build path).\n\t\t\treturn { digest: override, tag: override };\n\t\t}\n\n\t\t// Real build via the vendored Dockerfile.\n\t\tconst buildCtx = {\n\t\t\tcontextPath: vendoredDockerfileContext(),\n\t\t\tdockerfile: 'Dockerfile',\n\t\t\tbuildArgs: {\n\t\t\t\tWALRUS_VERSION: inputs.walrusRef,\n\t\t\t\tSUI_VERSION: inputs.suiVersion,\n\t\t\t},\n\t\t\towner: {\n\t\t\t\tapp: inputs.owner.app,\n\t\t\t\tstack: inputs.owner.stack,\n\t\t\t\tplugin: 'walrus',\n\t\t\t\trole: 'cluster',\n\t\t\t},\n\t\t};\n\n\t\t// `expected.tag`, when present, is the on-host tag ensureImage publishes\n\t\t// (and REUSES without rebuilding if it already exists — so a per-node tag\n\t\t// the restore promoted to a committed layer survives reboot). The build\n\t\t// itself is content-cached, so N per-node tags of one build are cheap.\n\t\tconst built = yield* runtime\n\t\t\t.ensureImage(\n\t\t\t\tbuildCtx,\n\t\t\t\texpectedTag !== undefined ? { digest: expectedTag, tag: expectedTag } : undefined,\n\t\t\t)\n\t\t\t.pipe(\n\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'image-build',\n\t\t\t\t\t\t`walrus image build failed (walrusRef=${inputs.walrusRef}, suiVersion=${inputs.suiVersion}): ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t{ cause },\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\treturn { digest: built.digest, tag: built.tag ?? built.digest };\n\t});\n"],"mappings":";;;;;AAiCA,MAAM,kCAAkC;;;AAIxC,MAAa,qBAAqB;;;;AAKlC,MAAa,sBAAsB;;;;;;AA6BnC,MAAM,kCACL,cAAc,IAAI,IAAI,8BAA8B,OAAO,KAAK,GAAG,CAAC;;;;;;;;;;;;AAarE,MAAa,qBACZ,SACA,QACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,QAAQ,+BAA+B;CACxD,IAAI,YAAY,SAAS,SAAS,GASjC,OAAO;EAAE,QAAQ;EAAU,KAAK;CAAS;CAI1C,MAAM,WAAW;EAChB,aAAa,0BAA0B;EACvC,YAAY;EACZ,WAAW;GACV,gBAAgB,OAAO;GACvB,aAAa,OAAO;EACrB;EACA,OAAO;GACN,KAAK,OAAO,MAAM;GAClB,OAAO,OAAO,MAAM;GACpB,QAAQ;GACR,MAAM;EACP;CACD;CAMA,MAAM,QAAQ,OAAO,QACnB,YACA,UACA,gBAAgB,KAAA,IAAY;EAAE,QAAQ;EAAa,KAAK;CAAY,IAAI,KAAA,CACzE,CAAC,CACA,KACA,OAAO,UAAU,UAChB,kBACC,eACA,wCAAwC,OAAO,UAAU,eAAe,OAAO,WAAW,KAAK,MAAM,OAAO,IAAI,MAAM,UACtH,EAAE,MAAM,CACT,CACD,CACD;CACD,OAAO;EAAE,QAAQ,MAAM;EAAQ,KAAK,MAAM,OAAO,MAAM;CAAO;AAC/D,CAAC"}

package/dist/plugins/walrus/codegen.d.mts

@@ -1,7 +1,5 @@
 //#region src/plugins/walrus/codegen.d.ts
-/** Per-node descriptor — matches the storage-nodes module's shape
- *  for the local-cluster path, and is empty (or whatever the user
- *  provides) for known. */
+/** Per-node descriptor. */
 interface WalrusNodeBinding {
   readonly nodeIndex: number;
   readonly publicHostname: string;
@@ -10,27 +8,18 @@ interface WalrusNodeBinding {
 /** The typed shape the emitted file exports. */
 interface WalrusBindings {
   readonly mode: 'local' | 'known';
-  readonly chain: string;
+  readonly network: string;
   readonly walrusPackageId: string | null;
   readonly walPackageId: string | null;
   readonly walCoinType: string | null;
-  /** SDK-ready `packageConfig` — structurally compatible with
-   *  `@mysten/walrus`'s `WalrusPackageConfig`. */
   readonly packageConfig: {
     readonly systemObjectId: string;
     readonly stakingPoolId: string;
     readonly exchangeIds?: ReadonlyArray<string>;
   };
-  /** HTTP URLs — each is `null` only when that specific URL is
-   *  unresolved (local resolves all three; known surfaces each
-   *  independently — distilled-doc invariant 15). */
   readonly proxyUrl: string | null;
   readonly aggregatorUrl: string | null;
   readonly publisherUrl: string | null;
-  /** Storage-node committee — local publishes N descriptors; known
-   *  publishes user-supplied nodes (testnet/mainnet's 100+ nodes
-   *  are fetched dynamically by the SDK, not pinned here —
-   *  distilled-doc invariant 16). */
   readonly nodes: ReadonlyArray<WalrusNodeBinding>;
 }
 //#endregion

package/dist/plugins/walrus/codegen.mjs

@@ -1,34 +1,99 @@
-import { Effect } from "effect";
+import { configCodegenable } from "../../contracts/config-bindings.mjs";
 //#region src/plugins/walrus/codegen.ts
-/** Construct the Codegenable contribution. Emit is byte-deterministic
-*  on unchanged input (architecture: no mtime churn on no-op
-*  cycles). */
-const makeCodegenable = (inputs) => ({
-	kind: "codegenable",
-	emitterName: "walrus-network",
-	outputPath: "walrus/network.ts",
-	emit: (ctx) => Effect.sync(() => {
-		const bindings = {
-			mode: inputs.mode,
-			chain: inputs.chain,
-			walrusPackageId: inputs.walrusPackageId,
-			walPackageId: inputs.walPackageId,
-			walCoinType: inputs.walCoinType,
-			packageConfig: {
-				systemObjectId: inputs.systemObjectId,
-				stakingPoolId: inputs.stakingPoolId,
-				exchangeIds: inputs.exchangeIds.length > 0 ? inputs.exchangeIds : void 0
+const NAMESPACE = "walrus";
+/** TS source-type strings for the resolved walrus fields — keeps the committed
+*  `walrus.ts` typed as `WalrusBindings` declares (the generic `resolveValue`
+*  channel would otherwise return `unknown`). Composite blobs inline their
+*  structural literal types so no emitted type-import is needed. */
+const PACKAGE_CONFIG_TS_TYPE = "{ readonly systemObjectId: string; readonly stakingPoolId: string; readonly exchangeIds?: ReadonlyArray<string> }";
+const NODES_TS_TYPE = "ReadonlyArray<{ readonly nodeIndex: number; readonly publicHostname: string; readonly rpcUrl: string }>";
+/** The walrus config bindings, declared ONCE. `mode` / `network` are
+*  structural literals; every id / coin type / URL / committee value is a
+*  RESOLVED binding on the generic `resolveValue('walrus', '<key>')` channel.
+*  Both the live boot decl and the static committed-tree decl derive from it. */
+const walrusConfigBindings = (structural) => {
+	const known = structural.known;
+	const field = (key, live) => known !== void 0 ? {
+		variant: "literal",
+		configPath: [key],
+		value: known[key]
+	} : {
+		variant: "resolved",
+		configPath: [key],
+		namespace: NAMESPACE,
+		key,
+		tsType: "string | null",
+		live
+	};
+	const packageConfigBinding = known !== void 0 ? {
+		variant: "literal",
+		configPath: ["packageConfig"],
+		value: known.packageConfig
+	} : {
+		variant: "resolved",
+		configPath: ["packageConfig"],
+		namespace: NAMESPACE,
+		key: "packageConfig",
+		tsType: PACKAGE_CONFIG_TS_TYPE,
+		live: (i) => ({
+			systemObjectId: i.systemObjectId,
+			stakingPoolId: i.stakingPoolId,
+			...i.exchangeIds.length > 0 ? { exchangeIds: [...i.exchangeIds] } : {}
+		})
+	};
+	const nodesBinding = known !== void 0 ? {
+		variant: "literal",
+		configPath: ["nodes"],
+		value: known.nodes
+	} : {
+		variant: "resolved",
+		configPath: ["nodes"],
+		namespace: NAMESPACE,
+		key: "nodes",
+		tsType: NODES_TS_TYPE,
+		live: (i) => i.nodes
+	};
+	return {
+		bucket: "walrus.ts",
+		kind: "walrus",
+		emitterName: "walrus-network",
+		bindings: [
+			{
+				variant: "literal",
+				configPath: ["mode"],
+				value: structural.mode
 			},
-			proxyUrl: inputs.proxyUrl,
-			aggregatorUrl: inputs.aggregatorUrl,
-			publisherUrl: inputs.publisherUrl,
-			nodes: inputs.nodes
-		};
-		ctx.exportConst("walrus", bindings);
-		return ctx.done();
-	})
+			{
+				variant: "literal",
+				configPath: ["network"],
+				value: structural.network
+			},
+			field("walrusPackageId", (i) => i.walrusPackageId),
+			field("walPackageId", (i) => i.walPackageId),
+			field("walCoinType", (i) => i.walCoinType),
+			packageConfigBinding,
+			field("proxyUrl", (i) => i.proxyUrl),
+			field("aggregatorUrl", (i) => i.aggregatorUrl),
+			field("publisherUrl", (i) => i.publisherUrl),
+			nodesBinding
+		]
+	};
+};
+/** Construct the LIVE Codegenable contribution. Bakes the resolved ids /
+*  URLs into the ephemeral tree + feeds the generic id-config `values`
+*  channel. */
+const makeCodegenable = (inputs) => configCodegenable(walrusConfigBindings({
+	mode: inputs.mode,
+	network: inputs.network
+}), {
+	mode: "live",
+	state: inputs
 });
+/** Construct the STATIC (stack-free) Codegenable contribution. Emits
+*  `resolveValue('walrus', '<key>')` for the runtime fields; the committed
+*  `walrus.ts` carries no baked object id / endpoint URL. */
+const makeWalrusStaticCodegen = (config) => configCodegenable(walrusConfigBindings(config), "static");
 //#endregion
-export { makeCodegenable };
+export { makeCodegenable, makeWalrusStaticCodegen };
 
 //# sourceMappingURL=codegen.mjs.map