@mysten-incubation/devstack 0.1.1 → 0.2.0

package/dist/plugins/seal/config-render.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config-render.mjs","names":[],"sources":["../../../src/plugins/seal/config-render.ts"],"sourcesContent":["// Seal plugin — key-server-config.yaml renderer.\n//\n// Distilled-doc invariant #19: the `network: !Devnet` discriminator\n// is LOAD-BEARING. Env-only mode silently routes at the public\n// testnet fullnode regardless of `NODE_URL`; going through the\n// config file with the `!Devnet` discriminator binds the daemon to\n// the in-stack sui RPC.\n//\n// Distilled-doc invariant #20: the rendered file MUST land under\n// `runtime/seal/`, NOT a scoped temp dir. The substrate's\n// service-path resolver (`servicePath('seal')`) produces the host\n// path; we land both the yaml and the master-key env-file there.\n//\n// This file declares the renderer + the staging procedure. The\n// renderer is a pure string builder; the staging procedure uses the\n// substrate's atomic-write primitive (FileSystem-backed).\n\nimport { Effect, FileSystem } from 'effect';\n\nimport { atomicWriteFile } from '../../substrate/runtime/atomic-write.ts';\nimport { sealConfigError, sealError, type SealError } from './errors.ts';\nimport { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from './keygen.ts';\nimport { SealSpans } from './spans.ts';\n\n// ---------------------------------------------------------------------------\n// Render inputs\n// ---------------------------------------------------------------------------\n\n/** Inputs the renderer consumes. The substrate provides the\n *  sui node URL (in-container DNS form, e.g. `http://sui-localnet:9000`)\n *  + the seal package id + the on-chain key-server object id. */\nexport interface SealKeyServerConfigInputs {\n\t/** Seal Move package id (from publish). */\n\treadonly sealPackageId: string;\n\t/** Sui RPC node URL as seen from inside the container's network. */\n\treadonly nodeUrl: string;\n\t/** On-chain `KeyServer` object id (from register). */\n\treadonly keyServerObjectId: string;\n\t/** Optional ts-sdk version requirement override. Default is the\n\t *  pin distilled from v3 (`'>=0.4.5'`); v2 plans expose this so\n\t *  consumers running older `@mysten/seal` aren't silently\n\t *  rejected. Distilled-doc opportunity #8. */\n\treadonly tsSdkVersionRequirement?: string;\n}\n\nexport interface ParsedSealKeyServerConfig {\n\treadonly sealPackageId: string;\n\treadonly nodeUrl: string;\n\treadonly keyServerObjectId: string;\n}\n\nconst DEFAULT_TS_SDK_REQUIREMENT = '>=0.4.5';\n\n// ---------------------------------------------------------------------------\n// Render — pure string builder\n// ---------------------------------------------------------------------------\n\n/** Allowed character set for raw interpolation into a YAML double-quoted\n *  string. A `\"` would close the quote and let downstream characters\n *  inject YAML syntax; a backslash would start an escape sequence the\n *  parser then chokes on. Sui/Seal object ids + node URLs only need\n *  alphanumerics, `:/_.-`, and `0x` — so the conservative whitelist is\n *  safe. The `ts_sdk_version_requirement` allows the SemVer comparator\n *  characters as well. */\nconst YAML_INTERP_FIELD_RE = /^[0-9a-zA-Z:/_.\\-]+$/;\nconst YAML_INTERP_SEMVER_RE = /^[0-9a-zA-Z:/_.\\-<>=^~* |!]+$/;\n\nconst assertYamlSafe = (field: string, value: string, pattern: RegExp): string => {\n\tif (pattern.test(value)) return value;\n\tthrow sealConfigError({\n\t\tfield,\n\t\tmessage: `seal.config-render: ${field} contains characters that would break YAML quoting`,\n\t\thint: `allowed characters: ${pattern.source}`,\n\t});\n};\n\n/** Render the key-server config yaml.\n *\n *  Distilled-doc invariant #19: `network: !Devnet` is hardcoded.\n *  This is the \"custom chain via node_url\" discriminator the\n *  upstream binary expects when devstack supplies its own RPC.\n *\n *  Each interpolated value is whitelist-asserted BEFORE rendering — a\n *  `\"` in any field would close the YAML quoted string and let\n *  downstream characters inject syntax. The assertion raises a\n *  `SealConfigError({phase: 'config-render'})` naming the offending\n *  field so callers see a typed refusal, not silently-broken YAML. */\nexport const renderSealKeyServerConfig = (inputs: SealKeyServerConfigInputs): string => {\n\tconst sealPackageId = assertYamlSafe('sealPackageId', inputs.sealPackageId, YAML_INTERP_FIELD_RE);\n\tconst nodeUrl = assertYamlSafe('nodeUrl', inputs.nodeUrl, YAML_INTERP_FIELD_RE);\n\tconst keyServerObjectId = assertYamlSafe(\n\t\t'keyServerObjectId',\n\t\tinputs.keyServerObjectId,\n\t\tYAML_INTERP_FIELD_RE,\n\t);\n\tconst tsReq = assertYamlSafe(\n\t\t'tsSdkVersionRequirement',\n\t\tinputs.tsSdkVersionRequirement ?? DEFAULT_TS_SDK_REQUIREMENT,\n\t\tYAML_INTERP_SEMVER_RE,\n\t);\n\treturn [\n\t\t'network: !Devnet',\n\t\t`  seal_package: \"${sealPackageId}\"`,\n\t\t`node_url: \"${nodeUrl}\"`,\n\t\t'server_mode: !Open',\n\t\t`  key_server_object_id: \"${keyServerObjectId}\"`,\n\t\t`ts_sdk_version_requirement: \"${tsReq}\"`,\n\t\t'',\n\t].join('\\n');\n};\n\n// ---------------------------------------------------------------------------\n// Master-key env-file body\n// ---------------------------------------------------------------------------\n\n/** Render the docker `--env-file` body. Single `KEY=value` line.\n *  Distilled-doc invariant #3 — this is the ONLY path the master key\n *  reaches the container; inline `-e MASTER_KEY=…` would surface\n *  the secret in `docker inspect` and host process env. */\nexport const renderMasterKeyEnvFile = (masterKeyHex: string): string =>\n\t`MASTER_KEY=${masterKeyHex}\\n`;\n\nconst readQuotedYamlField = (body: string, field: string): string | null => {\n\tconst escaped = field.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\t// Anchor to start-of-line: `(?:^|\\n)` plus a whitespace-only run\n\t// (`[ \\t]*` — explicitly excludes `#`) so a commented field\n\t// (`# node_url: \"fake\"`) can never accidentally match. The renderer\n\t// does not emit comments today, but the parser is also used on\n\t// snapshot-restore bodies that may grow comments in future. The\n\t// previous `\\s*` admitted no `#`, but `\\s` includes `\\n` which let\n\t// the regex engine skip past the start-of-line anchor; restricting\n\t// to inline-whitespace makes the line-anchoring strict.\n\tconst match = new RegExp(`(?:^|\\\\n)[ \\\\t]*${escaped}:[ \\\\t]*\"([^\"]+)\"[ \\\\t]*(?:\\\\n|$)`).exec(\n\t\tbody,\n\t);\n\treturn match?.[1] ?? null;\n};\n\nexport const parseSealKeyServerConfig = (body: string): ParsedSealKeyServerConfig | null => {\n\tconst sealPackageId = readQuotedYamlField(body, 'seal_package');\n\tconst nodeUrl = readQuotedYamlField(body, 'node_url');\n\tconst keyServerObjectId = readQuotedYamlField(body, 'key_server_object_id');\n\tif (sealPackageId === null || nodeUrl === null || keyServerObjectId === null) {\n\t\treturn null;\n\t}\n\treturn { sealPackageId, nodeUrl, keyServerObjectId };\n};\n\nexport const parseMasterKeyEnvFile = (body: string): string | null => {\n\tconst match = /^MASTER_KEY=(0x)?([0-9a-fA-F]+)\\s*$/m.exec(body);\n\treturn match?.[2] ?? null;\n};\n\n// ---------------------------------------------------------------------------\n// Staging procedure — write yaml + env-file with proper mode bits\n// ---------------------------------------------------------------------------\n\n/** Compose the two writes the local-keygen mode needs.\n *\n *  Writes:\n *\n *    - `${servicePath}/key-server-config.yaml` (mode 0o644 — public)\n *    - `${servicePath}/master-key.env`          (mode 0o600 — secret)\n *\n *  Parent dir is created with 0o700 (distilled-doc invariant #2).\n *  Both writes flow through the substrate's `atomicWriteFile`\n *  (tempfile + fsync + rename, never partial-write visible).\n *\n *  Distilled-doc invariant #4: `master-key.env` MUST NOT be unlinked\n *  on scope close (snapshot → restore round-trip retains the key).\n *  We do NOT register a finalizer here.\n *\n *  Error surface: `SealError({phase: 'config-render'})` wraps any\n *  underlying `AtomicWriteFailed`. The substrate's atomic write owns\n *  fsync + rename + cleanup semantics. */\nexport const stageSealConfig = (\n\tyamlBody: string,\n\tmasterKeyHex: string,\n\tservicePath: string,\n\tname: string,\n): Effect.Effect<\n\t{\n\t\treadonly configPath: string;\n\t\treadonly masterKeyEnvFile: string;\n\t},\n\tSealError,\n\tFileSystem.FileSystem\n> =>\n\tEffect.gen(function* () {\n\t\tconst configPath = `${servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;\n\t\tconst masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\t\tconst yamlBytes = new TextEncoder().encode(yamlBody);\n\t\tconst envBytes = new TextEncoder().encode(renderMasterKeyEnvFile(masterKeyHex));\n\n\t\t// World-readable yaml (no secrets) inside 0o700 parent — the\n\t\t// daemon process inside the container reads via the bind-mount\n\t\t// so host-side mode bits don't fully matter, but 0o644 is the\n\t\t// least-surprising default for a non-secret config.\n\t\tyield* atomicWriteFile(configPath, yamlBytes, {\n\t\t\tmode: 0o644,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${KEY_SERVER_CONFIG_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\t// SECRET — 0o600 inside the same 0o700 parent. Distilled-doc\n\t\t// §Hard requirements #2.\n\t\tyield* atomicWriteFile(masterKeyEnvFile, envBytes, {\n\t\t\tmode: 0o600,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${MASTER_KEY_ENVFILE_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\treturn { configPath, masterKeyEnvFile };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.config-render.stage', {\n\t\t\tattributes: { [SealSpans.name]: name, [SealSpans.servicePath]: servicePath },\n\t\t}),\n\t);\n"],"mappings":";;;;;;AAmDA,MAAM,6BAA6B;;;;;;;;AAanC,MAAM,uBAAuB;AAC7B,MAAM,wBAAwB;AAE9B,MAAM,kBAAkB,OAAe,OAAe,YAA4B;AACjF,KAAI,QAAQ,KAAK,MAAM,CAAE,QAAO;AAChC,OAAM,gBAAgB;EACrB;EACA,SAAS,uBAAuB,MAAM;EACtC,MAAM,uBAAuB,QAAQ;EACrC,CAAC;;;;;;;;;;;;;AAcH,MAAa,6BAA6B,WAA8C;CACvF,MAAM,gBAAgB,eAAe,iBAAiB,OAAO,eAAe,qBAAqB;CACjG,MAAM,UAAU,eAAe,WAAW,OAAO,SAAS,qBAAqB;CAC/E,MAAM,oBAAoB,eACzB,qBACA,OAAO,mBACP,qBACA;CACD,MAAM,QAAQ,eACb,2BACA,OAAO,2BAA2B,4BAClC,sBACA;AACD,QAAO;EACN;EACA,oBAAoB,cAAc;EAClC,cAAc,QAAQ;EACtB;EACA,4BAA4B,kBAAkB;EAC9C,gCAAgC,MAAM;EACtC;EACA,CAAC,KAAK,KAAK;;;;;;AAWb,MAAa,0BAA0B,iBACtC,cAAc,aAAa;AA4B5B,MAAa,yBAAyB,SAAgC;AAErE,QADc,uCAAuC,KAAK,KAC9C,GAAG,MAAM;;;;;;;;;;;;;;;;;;;;AAyBtB,MAAa,mBACZ,UACA,cACA,aACA,SASA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,GAAG,YAAY,GAAG;CACrC,MAAM,mBAAmB,GAAG,YAAY,GAAG;CAC3C,MAAM,YAAY,IAAI,aAAa,CAAC,OAAO,SAAS;CACpD,MAAM,WAAW,IAAI,aAAa,CAAC,OAAO,uBAAuB,aAAa,CAAC;AAM/E,QAAO,gBAAgB,YAAY,WAAW;EAC7C,MAAM;EACN,YAAY;EACZ,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,2BAA2B,IAAI,MAAM,MAAM;EAC3F;EACA,CAAC,CACF,CACD,CACD;AAID,QAAO,gBAAgB,kBAAkB,UAAU;EAClD,MAAM;EACN,YAAY;EACZ,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,4BAA4B,IAAI,MAAM,MAAM;EAC5F;EACA,CAAC,CACF,CACD,CACD;AAED,QAAO;EAAE;EAAY;EAAkB;EACtC,CAAC,KACF,OAAO,SAAS,4CAA4C,EAC3D,YAAY;EAAG,UAAU,OAAO;EAAO,UAAU,cAAc;CAAa,EAC5E,CAAC,CACF"}
+{"version":3,"file":"config-render.mjs","names":[],"sources":["../../../src/plugins/seal/config-render.ts"],"sourcesContent":["// Seal plugin — key-server-config.yaml renderer.\n//\n// Distilled-doc invariant #19: the `network: !Devnet` discriminator\n// is LOAD-BEARING. Env-only mode silently routes at the public\n// testnet fullnode regardless of `NODE_URL`; going through the\n// config file with the `!Devnet` discriminator binds the daemon to\n// the in-stack sui RPC.\n//\n// Distilled-doc invariant #20: the rendered file MUST land under\n// `runtime/seal/`, NOT a scoped temp dir. The substrate's\n// service-path resolver (`servicePath('seal')`) produces the host\n// path; we land both the yaml and the master-key env-file there.\n//\n// This file declares the renderer + the staging procedure. The\n// renderer is a pure string builder; the staging procedure uses the\n// substrate's atomic-write primitive (FileSystem-backed).\n\nimport { Effect, FileSystem } from 'effect';\n\nimport { atomicWriteFile } from '../../substrate/runtime/atomic-write.ts';\nimport { sealConfigError, sealError, type SealError } from './errors.ts';\nimport { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from './keygen.ts';\n\n// ---------------------------------------------------------------------------\n// Render inputs\n// ---------------------------------------------------------------------------\n\n/** Inputs the renderer consumes. The substrate provides the\n *  sui node URL (in-container DNS form, e.g. `http://sui-localnet:9000`)\n *  + the seal package id + the on-chain key-server object id. */\nexport interface SealKeyServerConfigInputs {\n\t/** Seal Move package id (from publish). */\n\treadonly sealPackageId: string;\n\t/** Sui RPC node URL as seen from inside the container's network. */\n\treadonly nodeUrl: string;\n\t/** On-chain `KeyServer` object id (from register). */\n\treadonly keyServerObjectId: string;\n\t/** Optional ts-sdk version requirement override. Default pin is\n\t *  `'>=0.4.5'`; exposing this lets consumers running older\n\t *  `@mysten/seal` avoid being silently rejected. */\n\treadonly tsSdkVersionRequirement?: string;\n}\n\nexport interface ParsedSealKeyServerConfig {\n\treadonly sealPackageId: string;\n\treadonly nodeUrl: string;\n\treadonly keyServerObjectId: string;\n}\n\nconst DEFAULT_TS_SDK_REQUIREMENT = '>=0.4.5';\n\n// ---------------------------------------------------------------------------\n// Render — pure string builder\n// ---------------------------------------------------------------------------\n\n/** Allowed character set for raw interpolation into a YAML double-quoted\n *  string. A `\"` would close the quote and let downstream characters\n *  inject YAML syntax; a backslash would start an escape sequence the\n *  parser then chokes on. Sui/Seal object ids + node URLs only need\n *  alphanumerics, `:/_.-`, and `0x` — so the conservative whitelist is\n *  safe. The `ts_sdk_version_requirement` allows the SemVer comparator\n *  characters as well. */\nconst YAML_INTERP_FIELD_RE = /^[0-9a-zA-Z:/_.-]+$/;\nconst YAML_INTERP_SEMVER_RE = /^[0-9a-zA-Z:/_.\\-<>=^~* |!]+$/;\n\nconst assertYamlSafe = (field: string, value: string, pattern: RegExp): string => {\n\tif (pattern.test(value)) return value;\n\tthrow sealConfigError({\n\t\tfield,\n\t\tmessage: `seal.config-render: ${field} contains characters that would break YAML quoting`,\n\t\thint: `allowed characters: ${pattern.source}`,\n\t});\n};\n\n/** Render the key-server config yaml.\n *\n *  Distilled-doc invariant #19: `network: !Devnet` is hardcoded.\n *  This is the \"custom chain via node_url\" discriminator the\n *  upstream binary expects when devstack supplies its own RPC.\n *\n *  Each interpolated value is whitelist-asserted BEFORE rendering — a\n *  `\"` in any field would close the YAML quoted string and let\n *  downstream characters inject syntax. The assertion raises a\n *  `SealConfigError({phase: 'config-render'})` naming the offending\n *  field so callers see a typed refusal, not silently-broken YAML. */\nexport const renderSealKeyServerConfig = (inputs: SealKeyServerConfigInputs): string => {\n\tconst sealPackageId = assertYamlSafe('sealPackageId', inputs.sealPackageId, YAML_INTERP_FIELD_RE);\n\tconst nodeUrl = assertYamlSafe('nodeUrl', inputs.nodeUrl, YAML_INTERP_FIELD_RE);\n\tconst keyServerObjectId = assertYamlSafe(\n\t\t'keyServerObjectId',\n\t\tinputs.keyServerObjectId,\n\t\tYAML_INTERP_FIELD_RE,\n\t);\n\tconst tsReq = assertYamlSafe(\n\t\t'tsSdkVersionRequirement',\n\t\tinputs.tsSdkVersionRequirement ?? DEFAULT_TS_SDK_REQUIREMENT,\n\t\tYAML_INTERP_SEMVER_RE,\n\t);\n\treturn [\n\t\t'network: !Devnet',\n\t\t`  seal_package: \"${sealPackageId}\"`,\n\t\t`node_url: \"${nodeUrl}\"`,\n\t\t'server_mode: !Open',\n\t\t`  key_server_object_id: \"${keyServerObjectId}\"`,\n\t\t`ts_sdk_version_requirement: \"${tsReq}\"`,\n\t\t'',\n\t].join('\\n');\n};\n\n// ---------------------------------------------------------------------------\n// Master-key env-file body\n// ---------------------------------------------------------------------------\n\n/** Render the docker `--env-file` body. Single `KEY=value` line.\n *  Distilled-doc invariant #3 — this is the ONLY path the master key\n *  reaches the container; inline `-e MASTER_KEY=…` would surface\n *  the secret in `docker inspect` and host process env. */\nexport const renderMasterKeyEnvFile = (masterKeyHex: string): string =>\n\t`MASTER_KEY=${masterKeyHex}\\n`;\n\nconst readQuotedYamlField = (body: string, field: string): string | null => {\n\tconst escaped = field.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\t// Anchor to start-of-line: `(?:^|\\n)` plus a whitespace-only run\n\t// (`[ \\t]*` — explicitly excludes `#`) so a commented field\n\t// (`# node_url: \"fake\"`) can never accidentally match. The renderer\n\t// does not emit comments today, but the parser is also used on\n\t// snapshot-restore bodies that may grow comments in future. The\n\t// previous `\\s*` admitted no `#`, but `\\s` includes `\\n` which let\n\t// the regex engine skip past the start-of-line anchor; restricting\n\t// to inline-whitespace makes the line-anchoring strict.\n\tconst match = new RegExp(`(?:^|\\\\n)[ \\\\t]*${escaped}:[ \\\\t]*\"([^\"]+)\"[ \\\\t]*(?:\\\\n|$)`).exec(\n\t\tbody,\n\t);\n\treturn match?.[1] ?? null;\n};\n\nexport const parseSealKeyServerConfig = (body: string): ParsedSealKeyServerConfig | null => {\n\tconst sealPackageId = readQuotedYamlField(body, 'seal_package');\n\tconst nodeUrl = readQuotedYamlField(body, 'node_url');\n\tconst keyServerObjectId = readQuotedYamlField(body, 'key_server_object_id');\n\tif (sealPackageId === null || nodeUrl === null || keyServerObjectId === null) {\n\t\treturn null;\n\t}\n\treturn { sealPackageId, nodeUrl, keyServerObjectId };\n};\n\nexport const parseMasterKeyEnvFile = (body: string): string | null => {\n\tconst match = /^MASTER_KEY=(0x)?([0-9a-fA-F]+)\\s*$/m.exec(body);\n\treturn match?.[2] ?? null;\n};\n\n// ---------------------------------------------------------------------------\n// Staging procedure — write yaml + env-file with proper mode bits\n// ---------------------------------------------------------------------------\n\n/** Compose the two writes the local-keygen mode needs.\n *\n *  Writes:\n *\n *    - `${servicePath}/key-server-config.yaml` (mode 0o644 — public)\n *    - `${servicePath}/master-key.env`          (mode 0o600 — secret)\n *\n *  Parent dir is created with 0o700 (distilled-doc invariant #2).\n *  Both writes flow through the substrate's `atomicWriteFile`\n *  (tempfile + fsync + rename, never partial-write visible).\n *\n *  Distilled-doc invariant #4: `master-key.env` MUST NOT be unlinked\n *  on scope close (snapshot → restore round-trip retains the key).\n *  We do NOT register a finalizer here.\n *\n *  Error surface: `SealError({phase: 'config-render'})` wraps any\n *  underlying `AtomicWriteFailed`. The substrate's atomic write owns\n *  fsync + rename + cleanup semantics. */\nexport const stageSealConfig = (\n\tyamlBody: string,\n\tmasterKeyHex: string,\n\tservicePath: string,\n\tname: string,\n): Effect.Effect<\n\t{\n\t\treadonly configPath: string;\n\t\treadonly masterKeyEnvFile: string;\n\t},\n\tSealError,\n\tFileSystem.FileSystem\n> =>\n\tEffect.gen(function* () {\n\t\tconst configPath = `${servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;\n\t\tconst masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\t\tconst yamlBytes = new TextEncoder().encode(yamlBody);\n\t\tconst envBytes = new TextEncoder().encode(renderMasterKeyEnvFile(masterKeyHex));\n\n\t\t// World-readable yaml (no secrets) inside 0o700 parent — the\n\t\t// daemon process inside the container reads via the bind-mount\n\t\t// so host-side mode bits don't fully matter, but 0o644 is the\n\t\t// least-surprising default for a non-secret config.\n\t\tyield* atomicWriteFile(configPath, yamlBytes, {\n\t\t\tmode: 0o644,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${KEY_SERVER_CONFIG_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\t// SECRET — 0o600 inside the same 0o700 parent. Distilled-doc\n\t\t// §Hard requirements #2.\n\t\tyield* atomicWriteFile(masterKeyEnvFile, envBytes, {\n\t\t\tmode: 0o600,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${MASTER_KEY_ENVFILE_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\treturn { configPath, masterKeyEnvFile };\n\t});\n"],"mappings":";;;;;AAiDA,MAAM,6BAA6B;;;;;;;;AAanC,MAAM,uBAAuB;AAC7B,MAAM,wBAAwB;AAE9B,MAAM,kBAAkB,OAAe,OAAe,YAA4B;CACjF,IAAI,QAAQ,KAAK,KAAK,GAAG,OAAO;CAChC,MAAM,gBAAgB;EACrB;EACA,SAAS,uBAAuB,MAAM;EACtC,MAAM,uBAAuB,QAAQ;CACtC,CAAC;AACF;;;;;;;;;;;;AAaA,MAAa,6BAA6B,WAA8C;CACvF,MAAM,gBAAgB,eAAe,iBAAiB,OAAO,eAAe,oBAAoB;CAChG,MAAM,UAAU,eAAe,WAAW,OAAO,SAAS,oBAAoB;CAC9E,MAAM,oBAAoB,eACzB,qBACA,OAAO,mBACP,oBACD;CACA,MAAM,QAAQ,eACb,2BACA,OAAO,2BAA2B,4BAClC,qBACD;CACA,OAAO;EACN;EACA,oBAAoB,cAAc;EAClC,cAAc,QAAQ;EACtB;EACA,4BAA4B,kBAAkB;EAC9C,gCAAgC,MAAM;EACtC;CACD,CAAC,CAAC,KAAK,IAAI;AACZ;;;;;AAUA,MAAa,0BAA0B,iBACtC,cAAc,aAAa;AA4B5B,MAAa,yBAAyB,SAAgC;CAErE,OADc,uCAAuC,KAAK,IAC/C,CAAC,GAAG,MAAM;AACtB;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,mBACZ,UACA,cACA,aACA,SASA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,GAAG,YAAY,GAAG;CACrC,MAAM,mBAAmB,GAAG,YAAY,GAAG;CAC3C,MAAM,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ;CACnD,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,uBAAuB,YAAY,CAAC;CAM9E,OAAO,gBAAgB,YAAY,WAAW;EAC7C,MAAM;EACN,YAAY;CACb,CAAC,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,2BAA2B,IAAI,MAAM,MAAM;EAC3F;CACD,CAAC,CACF,CACD,CACD;CAIA,OAAO,gBAAgB,kBAAkB,UAAU;EAClD,MAAM;EACN,YAAY;CACb,CAAC,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,4BAA4B,IAAI,MAAM,MAAM;EAC5F;CACD,CAAC,CACF,CACD,CACD;CAEA,OAAO;EAAE;EAAY;CAAiB;AACvC,CAAC"}

package/dist/plugins/seal/deploy.mjs

@@ -1,9 +1,9 @@
 import { contentHash } from "../../substrate/brand.mjs";
-import { hashMoveSources, runMoveBuild, scrubLocksHost } from "../../substrate/runtime/sui-move-build/index.mjs";
-import { executeSuiTx, formatExecutedFailure } from "../../substrate/runtime/sui-execute/index.mjs";
+import { hashMoveSources, runMoveBuild, scrubLocksHost, withMoveBuildLock } from "../sui/move/index.mjs";
+import { executeSuiTx, formatExecutedFailure } from "../sui/exec/index.mjs";
+import "../sui/index.mjs";
 import { artifactPublishError } from "../../primitives/artifact-publisher.mjs";
 import { sealError } from "./errors.mjs";
-import { SealSpans } from "./spans.mjs";
 import { Effect, Schema } from "effect";
 import { createHash } from "node:crypto";
 import { fromHex } from "@mysten/sui/utils";
@@ -57,14 +57,15 @@ const projectSealPublishReceipt = (name, receipt) => {
 	});
 };
 const runSealPublishTransaction = (inputs) => Effect.gen(function* () {
-	yield* scrubLocksHost(inputs.movePackagePath, "~/.move").pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));
-	const buildOutput = yield* runMoveBuild({
-		sourcePath: inputs.movePackagePath,
-		packageName: inputs.name,
-		chainId: inputs.chain,
-		runtime: inputs.runtime,
-		...inputs.buildImage !== void 0 ? { buildImage: inputs.buildImage } : {}
-	}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));
+	const buildOutput = yield* withMoveBuildLock(Effect.gen(function* () {
+		yield* scrubLocksHost(inputs.movePackagePath, "~/.move").pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));
+		return yield* runMoveBuild({
+			sourcePath: inputs.movePackagePath,
+			packageName: inputs.name,
+			runtime: inputs.runtime,
+			...inputs.buildImage !== void 0 ? { buildImage: inputs.buildImage } : {}
+		}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));
+	}));
 	const result = yield* executeSuiTx({
 		client: inputs.sdk.client,
 		signer: inputs.signer,
@@ -83,24 +84,18 @@ const runSealPublishTransaction = (inputs) => Effect.gen(function* () {
 		message: `seal publish tx executed but on-chain execution failed for signer '${inputs.signer.name}' (address=${inputs.signer.address}) ` + formatExecutedFailure(result.FailedTransaction)
 	}));
 	return yield* projectSealPublishReceipt(inputs.name, result.Transaction);
-}).pipe(Effect.withSpan("devstack.plugin.seal.publish.suiTx", { attributes: {
-	[SealSpans.name]: inputs.name,
-	[SealSpans.signer]: inputs.signer.address
-} }));
+});
 const publishSealPackage = (publisher, inputs) => Effect.gen(function* () {
 	const inputsHash = sealPackageInputsHash(yield* hashMoveSources(inputs.movePackagePath).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err))), inputs.signer.address);
 	return { packageId: (yield* publisher.publish({
 		namespace: SEAL_PACKAGE_NAMESPACE,
-		chain: inputs.chain,
+		chain: inputs.chainId,
 		contentHash: inputsHash,
 		verify: (cached) => verifyObjectLenient(inputs.chainProbe, cached.packageId, SealPackageVerifyShape),
 		produce: runSealPublishTransaction(inputs).pipe(Effect.mapError((err) => sealProduceFailed("publish", err))),
 		register: () => Effect.void
 	})).packageId };
-}).pipe(Effect.withSpan("devstack.plugin.seal.publish", { attributes: {
-	[SealSpans.name]: inputs.name,
-	[SealSpans.chain]: inputs.chain
-} }));
+});
 const SEAL_KEY_SERVER_NAMESPACE = "seal/key-server-id";
 const SealKeyServerVerifyShape = Schema.Struct({
 	objectId: Schema.String,
@@ -166,24 +161,18 @@ const runRegisterKeyServerTransaction = (sdk, signer, inputs) => Effect.gen(func
 		message: `seal register tx executed but on-chain execution failed for signer '${signer.name}' (address=${signer.address}) ` + formatExecutedFailure(result.FailedTransaction)
 	}));
 	return yield* projectRegisterKeyServerReceipt(inputs.name, result.Transaction);
-}).pipe(Effect.withSpan("devstack.plugin.seal.register.suiTx", { attributes: {
-	[SealSpans.name]: inputs.name,
-	[SealSpans.url]: inputs.keyServerUrl
-} }));
+});
 const registerKeyServer = (publisher, inputs) => Effect.gen(function* () {
 	const inputsHash = sealRegisterInputsHash(inputs, inputs.signer.address);
 	return { objectId: (yield* publisher.publish({
 		namespace: SEAL_KEY_SERVER_NAMESPACE,
-		chain: inputs.chain,
+		chain: inputs.chainId,
 		contentHash: inputsHash,
 		verify: (cached) => verifyObjectLenient(inputs.chainProbe, cached.objectId, SealKeyServerVerifyShape),
 		produce: runRegisterKeyServerTransaction(inputs.sdk, inputs.signer, inputs).pipe(Effect.mapError((err) => sealProduceFailed("register", err))),
 		register: () => Effect.void
 	})).objectId };
-}).pipe(Effect.withSpan("devstack.plugin.seal.register", { attributes: {
-	[SealSpans.name]: inputs.name,
-	[SealSpans.url]: inputs.keyServerUrl
-} }));
+});
 //#endregion
 export { publishSealPackage, registerKeyServer };
 

package/dist/plugins/seal/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../../src/plugins/seal/deploy.ts"],"sourcesContent":["// Seal plugin — SDK-backed Move publish + on-chain KeyServer register.\n\nimport { createHash } from 'node:crypto';\n\nimport { Effect, Schema, type Scope } from 'effect';\n\nimport {\n\tTransaction,\n\ttype TransactionArgument,\n\ttype TransactionObjectArgument,\n} from '@mysten/sui/transactions';\n\nimport type { ChainProbe, ChainProbeSchema } from '../../contracts/chain-probe.ts';\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\tartifactPublishError,\n\ttype ArtifactPublishError,\n\ttype ArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport { contentHash, type ChainId, type ContentHash } from '../../substrate/brand.ts';\nimport {\n\texecuteSuiTx,\n\tformatExecutedFailure,\n\ttype ExecutedReceipt,\n} from '../../substrate/runtime/sui-execute/index.ts';\nimport {\n\thashMoveSources,\n\trunMoveBuild,\n\tscrubLocksHost,\n\ttype BuildOutput,\n\ttype MoveBuildError,\n} from '../../substrate/runtime/sui-move-build/index.ts';\nimport { fromHex } from '@mysten/sui/utils';\n\nimport type { AccountValue } from '../account/index.ts';\nimport type { ClientWithCoreApi } from '../sui/index.ts';\nimport { sealError, type SealError } from './errors.ts';\nimport { SealSpans } from './spans.ts';\n\nconst KEY_TYPE_BONEH_FRANKLIN_BLS12381 = 0;\n\nexport type SealObjectProbeKey = { readonly kind: 'object'; readonly objectId: string };\n\nexport interface SealSuiSdk {\n\treadonly client: ClientWithCoreApi;\n}\n\nconst sealProduceFailed = (op: 'publish' | 'register', err: SealError): ArtifactPublishError =>\n\tartifactPublishError('produce-failed', `seal.${op} ${err.phase}: ${err.message}`);\n\nconst moveBuildToSealError = (name: string, err: MoveBuildError): SealError =>\n\tsealError('publish', {\n\t\tname,\n\t\tmessage: `seal publish ${err.phase} failed for source '${err.sourcePath}': ${err.message}`,\n\t\tcause: err,\n\t});\n\nconst verifyObjectLenient = <Verified>(\n\tprobe: ChainProbe<SealObjectProbeKey>,\n\tobjectId: string,\n\tschema: ChainProbeSchema<Verified>,\n): Effect.Effect<Verified | null, never> =>\n\tprobe\n\t\t.get({ kind: 'object', objectId }, schema, 'lenient')\n\t\t.pipe(Effect.catch(() => Effect.succeed(null as Verified | null)));\n\n// ---------------------------------------------------------------------------\n// Move publish — `sealPackage` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_PACKAGE_NAMESPACE = 'seal/package' as const;\n\nexport interface SealPackageCached {\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n}\n\nexport const SealPackageVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealPackageVerified = Schema.Schema.Type<typeof SealPackageVerifyShape>;\n\nexport interface SealPublishInputs {\n\treadonly name: string;\n\treadonly chain: ChainId;\n\treadonly movePackagePath: string;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly runtime: ContainerRuntime;\n\treadonly buildImage?: ImageRef;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealPackageInputsHash = (\n\tsourceHash: ContentHash,\n\tsignerAddress: string,\n): ContentHash => contentHash(`seal-package|source=${sourceHash}|signer=${signerAddress}`);\n\nexport interface SealPublishTransactionBuilder<TUpgradeCap = unknown> {\n\treadonly setSender: (address: string) => void;\n\treadonly publish: (input: {\n\t\treadonly modules: ReadonlyArray<ReadonlyArray<number>>;\n\t\treadonly dependencies: ReadonlyArray<string>;\n\t}) => TUpgradeCap;\n\treadonly transferObjects: (objects: ReadonlyArray<TUpgradeCap>, recipient: string) => void;\n}\n\nconst publishTransactionBuilder = (\n\ttx: Transaction,\n): SealPublishTransactionBuilder<TransactionObjectArgument> => ({\n\tsetSender: (address) => tx.setSender(address),\n\tpublish: (input) =>\n\t\ttx.publish({\n\t\t\tmodules: input.modules.map((m) => [...m]),\n\t\t\tdependencies: [...input.dependencies],\n\t\t}),\n\ttransferObjects: (objects, recipient) => tx.transferObjects([...objects], recipient),\n});\n\nexport const buildSealPublishTransaction = <TUpgradeCap>(\n\ttx: SealPublishTransactionBuilder<TUpgradeCap>,\n\tbuildOutput: BuildOutput,\n\tsignerAddress: string,\n): void => {\n\ttx.setSender(signerAddress);\n\tconst upgradeCap = tx.publish({\n\t\tmodules: buildOutput.modules.map((m) => Array.from(m)),\n\t\tdependencies: [...buildOutput.dependencies],\n\t});\n\ttx.transferObjects([upgradeCap], signerAddress);\n};\n\nexport const pickPackageWriteObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find((change) => change.outputState === 'PackageWrite')?.objectId ?? null;\n\nexport const pickUpgradeCapObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::package::UpgradeCap') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectSealPublishReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealPackageCached, SealError> => {\n\tconst packageId = pickPackageWriteObjectId(receipt);\n\tif (packageId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('publish', {\n\t\t\t\tname,\n\t\t\t\tmessage: `seal publish tx wrote no PackageWrite object ` + `(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\tconst upgradeCapId = pickUpgradeCapObjectId(receipt);\n\treturn Effect.succeed({\n\t\tpackageId,\n\t\t...(upgradeCapId !== null ? { upgradeCapId } : {}),\n\t});\n};\n\nexport const runSealPublishTransaction = (\n\tinputs: SealPublishInputs,\n): Effect.Effect<SealPackageCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// Scrub the shared Move git cache so a stale pin can't leak into the\n\t\t// build. The package's own Move.lock is scrubbed inside the container\n\t\t// on a disposable copy, so the developer's checked-in source is left\n\t\t// untouched host-side.\n\t\tyield* scrubLocksHost(inputs.movePackagePath, '~/.move').pipe(\n\t\t\tEffect.mapError((err) => moveBuildToSealError(inputs.name, err)),\n\t\t);\n\n\t\tconst buildOutput = yield* runMoveBuild({\n\t\t\tsourcePath: inputs.movePackagePath,\n\t\t\tpackageName: inputs.name,\n\t\t\tchainId: inputs.chain,\n\t\t\truntime: inputs.runtime,\n\t\t\t...(inputs.buildImage !== undefined ? { buildImage: inputs.buildImage } : {}),\n\t\t}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));\n\n\t\tconst result = yield* executeSuiTx({\n\t\t\tclient: inputs.sdk.client,\n\t\t\tsigner: inputs.signer,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildSealPublishTransaction(\n\t\t\t\t\tpublishTransactionBuilder(tx),\n\t\t\t\t\tbuildOutput,\n\t\t\t\t\tinputs.signer.address,\n\t\t\t\t);\n\t\t\t\treturn tx.build({ client: inputs.sdk.client });\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal publish tx failed for signer '${inputs.signer.name}' ` +\n\t\t\t\t\t\t`(address=${inputs.signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tif (result.$kind === 'FailedTransaction') {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal publish tx executed but on-chain execution failed for signer ` +\n\t\t\t\t\t\t`'${inputs.signer.name}' (address=${inputs.signer.address}) ` +\n\t\t\t\t\t\tformatExecutedFailure(result.FailedTransaction),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn yield* projectSealPublishReceipt(inputs.name, result.Transaction);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.publish.suiTx', {\n\t\t\tattributes: {\n\t\t\t\t[SealSpans.name]: inputs.name,\n\t\t\t\t[SealSpans.signer]: inputs.signer.address,\n\t\t\t},\n\t\t}),\n\t);\n\nexport const publishSealPackage = (\n\tpublisher: ArtifactPublisher,\n\tinputs: SealPublishInputs,\n): Effect.Effect<{ readonly packageId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst sourceHash = yield* hashMoveSources(inputs.movePackagePath).pipe(\n\t\t\tEffect.mapError((err) => moveBuildToSealError(inputs.name, err)),\n\t\t);\n\t\tconst inputsHash = sealPackageInputsHash(sourceHash, inputs.signer.address);\n\n\t\tconst cached: SealPackageCached = yield* publisher.publish<\n\t\t\tSealPackageCached,\n\t\t\tSealPackageVerified\n\t\t>({\n\t\t\tnamespace: SEAL_PACKAGE_NAMESPACE,\n\t\t\tchain: inputs.chain,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.packageId, SealPackageVerifyShape),\n\t\t\tproduce: runSealPublishTransaction(inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('publish', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\treturn { packageId: cached.packageId };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.publish', {\n\t\t\tattributes: { [SealSpans.name]: inputs.name, [SealSpans.chain]: inputs.chain },\n\t\t}),\n\t);\n\n// ---------------------------------------------------------------------------\n// KeyServer register — `keyServer` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_KEY_SERVER_NAMESPACE = 'seal/key-server-id' as const;\n\nexport interface SealKeyServerCached {\n\treadonly objectId: string;\n}\n\nexport const SealKeyServerVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealKeyServerVerified = Schema.Schema.Type<typeof SealKeyServerVerifyShape>;\n\nexport interface RegisterKeyServerTransactionInputs {\n\treadonly keyServerUrl: string;\n\treadonly sealPackageId: string;\n\treadonly publicKeyHex: string;\n\treadonly keyServerName: string;\n}\n\nexport interface RegisterKeyServerInputs extends RegisterKeyServerTransactionInputs {\n\treadonly name: string;\n\treadonly chain: ChainId;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealRegisterInputsHash = (\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): ContentHash =>\n\t// Keep the cache key path-safe and bounded. The raw material includes\n\t// a routed URL plus a long BLS public key; using it directly made the\n\t// best-effort cache write miss on normal restarts.\n\tcontentHash(\n\t\t`seal-register-v2|${createHash('sha256')\n\t\t\t.update(\n\t\t\t\tJSON.stringify({\n\t\t\t\t\tpackageId: inputs.sealPackageId,\n\t\t\t\t\tkeyServerUrl: inputs.keyServerUrl,\n\t\t\t\t\tkeyServerName: inputs.keyServerName,\n\t\t\t\t\tpublicKeyHex: inputs.publicKeyHex,\n\t\t\t\t\tsignerAddress,\n\t\t\t\t}),\n\t\t\t)\n\t\t\t.digest('hex')}`,\n\t);\n\nexport interface SealRegisterTransactionBuilder<TArgument = unknown> {\n\treadonly pure: {\n\t\treadonly string: (value: string) => TArgument;\n\t\treadonly u8: (value: number) => TArgument;\n\t\treadonly vector: (type: 'u8', value: ReadonlyArray<number>) => TArgument;\n\t};\n\treadonly setSender: (address: string) => void;\n\treadonly moveCall: (input: {\n\t\treadonly target: string;\n\t\treadonly arguments: ReadonlyArray<TArgument>;\n\t}) => unknown;\n}\n\nexport type SealRegisterSdk = SealSuiSdk;\n\nconst registerTransactionBuilder = (\n\ttx: Transaction,\n): SealRegisterTransactionBuilder<TransactionArgument> => ({\n\tpure: {\n\t\tstring: (value) => tx.pure.string(value),\n\t\tu8: (value) => tx.pure.u8(value),\n\t\tvector: (type, value) => tx.pure.vector(type, [...value]),\n\t},\n\tsetSender: (address) => tx.setSender(address),\n\tmoveCall: (input) =>\n\t\ttx.moveCall({\n\t\t\ttarget: input.target,\n\t\t\targuments: [...input.arguments],\n\t\t}),\n});\n\nexport const buildRegisterKeyServerMoveCall = <TArgument>(\n\ttx: SealRegisterTransactionBuilder<TArgument>,\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): void => {\n\tconst pkBytes = fromHex(inputs.publicKeyHex);\n\ttx.setSender(signerAddress);\n\ttx.moveCall({\n\t\ttarget: `${inputs.sealPackageId}::key_server::create_and_transfer_v2_independent_server`,\n\t\targuments: [\n\t\t\ttx.pure.string(inputs.keyServerName),\n\t\t\ttx.pure.string(inputs.keyServerUrl),\n\t\t\ttx.pure.u8(KEY_TYPE_BONEH_FRANKLIN_BLS12381),\n\t\t\ttx.pure.vector('u8', Array.from(pkBytes)),\n\t\t],\n\t});\n};\n\nexport const pickCreatedKeyServerObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::key_server::KeyServer') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectRegisterKeyServerReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealKeyServerCached, SealError> => {\n\tconst objectId = pickCreatedKeyServerObjectId(receipt);\n\tif (objectId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('register', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t`seal register tx created no ::key_server::KeyServer object ` +\n\t\t\t\t\t`(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed({ objectId });\n};\n\nexport const runRegisterKeyServerTransaction = (\n\tsdk: SealRegisterSdk,\n\tsigner: AccountValue,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<SealKeyServerCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst result = yield* executeSuiTx({\n\t\t\tclient: sdk.client,\n\t\t\tsigner,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildRegisterKeyServerMoveCall(registerTransactionBuilder(tx), inputs, signer.address);\n\t\t\t\treturn tx.build({ client: sdk.client });\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal register tx failed for signer '${signer.name}' ` +\n\t\t\t\t\t\t`(address=${signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tif (result.$kind === 'FailedTransaction') {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal register tx executed but on-chain execution failed for signer ` +\n\t\t\t\t\t\t`'${signer.name}' (address=${signer.address}) ` +\n\t\t\t\t\t\tformatExecutedFailure(result.FailedTransaction),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn yield* projectRegisterKeyServerReceipt(inputs.name, result.Transaction);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.register.suiTx', {\n\t\t\tattributes: { [SealSpans.name]: inputs.name, [SealSpans.url]: inputs.keyServerUrl },\n\t\t}),\n\t);\n\nexport const registerKeyServer = (\n\tpublisher: ArtifactPublisher,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<{ readonly objectId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst inputsHash = sealRegisterInputsHash(inputs, inputs.signer.address);\n\t\tconst cached: SealKeyServerCached = yield* publisher.publish<\n\t\t\tSealKeyServerCached,\n\t\t\tSealKeyServerVerified\n\t\t>({\n\t\t\tnamespace: SEAL_KEY_SERVER_NAMESPACE,\n\t\t\tchain: inputs.chain,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.objectId, SealKeyServerVerifyShape),\n\t\t\tproduce: runRegisterKeyServerTransaction(inputs.sdk, inputs.signer, inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('register', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\treturn { objectId: cached.objectId };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.register', {\n\t\t\tattributes: { [SealSpans.name]: inputs.name, [SealSpans.url]: inputs.keyServerUrl },\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;AAuCA,MAAM,mCAAmC;AAQzC,MAAM,qBAAqB,IAA4B,QACtD,qBAAqB,kBAAkB,QAAQ,GAAG,GAAG,IAAI,MAAM,IAAI,IAAI,UAAU;AAElF,MAAM,wBAAwB,MAAc,QAC3C,UAAU,WAAW;CACpB;CACA,SAAS,gBAAgB,IAAI,MAAM,sBAAsB,IAAI,WAAW,KAAK,IAAI;CACjF,OAAO;CACP,CAAC;AAEH,MAAM,uBACL,OACA,UACA,WAEA,MACE,IAAI;CAAE,MAAM;CAAU;CAAU,EAAE,QAAQ,UAAU,CACpD,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAwB,CAAC,CAAC;AAMpE,MAAa,yBAAyB;AAOtC,MAAa,yBAAyB,OAAO,OAAO;CACnD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,QAAQ;CACrC,CAAC;AAcF,MAAa,yBACZ,YACA,kBACiB,YAAY,uBAAuB,WAAW,UAAU,gBAAgB;AAW1F,MAAM,6BACL,QAC+D;CAC/D,YAAY,YAAY,GAAG,UAAU,QAAQ;CAC7C,UAAU,UACT,GAAG,QAAQ;EACV,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;EACzC,cAAc,CAAC,GAAG,MAAM,aAAa;EACrC,CAAC;CACH,kBAAkB,SAAS,cAAc,GAAG,gBAAgB,CAAC,GAAG,QAAQ,EAAE,UAAU;CACpF;AAED,MAAa,+BACZ,IACA,aACA,kBACU;AACV,IAAG,UAAU,cAAc;CAC3B,MAAM,aAAa,GAAG,QAAQ;EAC7B,SAAS,YAAY,QAAQ,KAAK,MAAM,MAAM,KAAK,EAAE,CAAC;EACtD,cAAc,CAAC,GAAG,YAAY,aAAa;EAC3C,CAAC;AACF,IAAG,gBAAgB,CAAC,WAAW,EAAE,cAAc;;AAGhD,MAAa,4BAA4B,YACxC,QAAQ,cAAc,MAAM,WAAW,OAAO,gBAAgB,eAAe,EAAE,YAAY;AAE5F,MAAa,0BAA0B,YACtC,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,wBAAwB,IAAI,OAC1D,EAAE,YAAY;AAEhB,MAAa,6BACZ,MACA,YACiD;CACjD,MAAM,YAAY,yBAAyB,QAAQ;AACnD,KAAI,cAAc,KACjB,QAAO,OAAO,KACb,UAAU,WAAW;EACpB;EACA,SAAS,wDAA6D,QAAQ,OAAO;EACrF,CAAC,CACF;CAEF,MAAM,eAAe,uBAAuB,QAAQ;AACpD,QAAO,OAAO,QAAQ;EACrB;EACA,GAAI,iBAAiB,OAAO,EAAE,cAAc,GAAG,EAAE;EACjD,CAAC;;AAGH,MAAa,6BACZ,WAEA,OAAO,IAAI,aAAa;AAKvB,QAAO,eAAe,OAAO,iBAAiB,UAAU,CAAC,KACxD,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAChE;CAED,MAAM,cAAc,OAAO,aAAa;EACvC,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,OAAO;EAChB,SAAS,OAAO;EAChB,GAAI,OAAO,eAAe,KAAA,IAAY,EAAE,YAAY,OAAO,YAAY,GAAG,EAAE;EAC5E,CAAC,CAAC,KAAK,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAAC;CAEzE,MAAM,SAAS,OAAO,aAAa;EAClC,QAAQ,OAAO,IAAI;EACnB,QAAQ,OAAO;EACf,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,+BACC,0BAA0B,GAAG,EAC7B,aACA,OAAO,OAAO,QACd;AACD,UAAO,GAAG,MAAM,EAAE,QAAQ,OAAO,IAAI,QAAQ,CAAC;;EAE/C,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SACC,sCAAsC,OAAO,OAAO,KAAK,aAC7C,OAAO,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EACpE;EACA,CAAC,CACF,CACD;AACD,KAAI,OAAO,UAAU,oBACpB,QAAO,OAAO,OAAO,KACpB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SACC,sEACI,OAAO,OAAO,KAAK,aAAa,OAAO,OAAO,QAAQ,MAC1D,sBAAsB,OAAO,kBAAkB;EAChD,CAAC,CACF;AAGF,QAAO,OAAO,0BAA0B,OAAO,MAAM,OAAO,YAAY;EACvE,CAAC,KACF,OAAO,SAAS,sCAAsC,EACrD,YAAY;EACV,UAAU,OAAO,OAAO;EACxB,UAAU,SAAS,OAAO,OAAO;CAClC,EACD,CAAC,CACF;AAEF,MAAa,sBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CAIvB,MAAM,aAAa,sBAAsB,OAHf,gBAAgB,OAAO,gBAAgB,CAAC,KACjE,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,IAAI,CAAC,CAChE,EACoD,OAAO,OAAO,QAAQ;AAiB3E,QAAO,EAAE,YAAW,OAfqB,UAAU,QAGjD;EACD,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,WAAW,uBAAuB;EACjF,SAAS,0BAA0B,OAAO,CAAC,KAC1C,OAAO,UAAU,QAAQ,kBAAkB,WAAW,IAAI,CAAC,CAC3D;EACD,gBAAgB,OAAO;EACvB,CAAC,EAEyB,WAAW;EACrC,CAAC,KACF,OAAO,SAAS,gCAAgC,EAC/C,YAAY;EAAG,UAAU,OAAO,OAAO;EAAO,UAAU,QAAQ,OAAO;CAAO,EAC9E,CAAC,CACF;AAMF,MAAa,4BAA4B;AAMzC,MAAa,2BAA2B,OAAO,OAAO;CACrD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,QAAQ;CACrC,CAAC;AAkBF,MAAa,0BACZ,QACA,kBAKA,YACC,oBAAoB,WAAW,SAAS,CACtC,OACA,KAAK,UAAU;CACd,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,eAAe,OAAO;CACtB,cAAc,OAAO;CACrB;CACA,CAAC,CACF,CACA,OAAO,MAAM,GACf;AAiBF,MAAM,8BACL,QAC0D;CAC1D,MAAM;EACL,SAAS,UAAU,GAAG,KAAK,OAAO,MAAM;EACxC,KAAK,UAAU,GAAG,KAAK,GAAG,MAAM;EAChC,SAAS,MAAM,UAAU,GAAG,KAAK,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC;EACzD;CACD,YAAY,YAAY,GAAG,UAAU,QAAQ;CAC7C,WAAW,UACV,GAAG,SAAS;EACX,QAAQ,MAAM;EACd,WAAW,CAAC,GAAG,MAAM,UAAU;EAC/B,CAAC;CACH;AAED,MAAa,kCACZ,IACA,QACA,kBACU;CACV,MAAM,UAAU,QAAQ,OAAO,aAAa;AAC5C,IAAG,UAAU,cAAc;AAC3B,IAAG,SAAS;EACX,QAAQ,GAAG,OAAO,cAAc;EAChC,WAAW;GACV,GAAG,KAAK,OAAO,OAAO,cAAc;GACpC,GAAG,KAAK,OAAO,OAAO,aAAa;GACnC,GAAG,KAAK,GAAG,iCAAiC;GAC5C,GAAG,KAAK,OAAO,MAAM,MAAM,KAAK,QAAQ,CAAC;GACzC;EACD,CAAC;;AAGH,MAAa,gCAAgC,YAC5C,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,0BAA0B,IAAI,OAC5D,EAAE,YAAY;AAEhB,MAAa,mCACZ,MACA,YACmD;CACnD,MAAM,WAAW,6BAA6B,QAAQ;AACtD,KAAI,aAAa,KAChB,QAAO,OAAO,KACb,UAAU,YAAY;EACrB;EACA,SACC,sEACW,QAAQ,OAAO;EAC3B,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ,EAAE,UAAU,CAAC;;AAGpC,MAAa,mCACZ,KACA,QACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,aAAa;EAClC,QAAQ,IAAI;EACZ;EACA,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,kCAA+B,2BAA2B,GAAG,EAAE,QAAQ,OAAO,QAAQ;AACtF,UAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,QAAQ,CAAC;;EAExC,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SACC,uCAAuC,OAAO,KAAK,aACvC,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EAC7D;EACA,CAAC,CACF,CACD;AACD,KAAI,OAAO,UAAU,oBACpB,QAAO,OAAO,OAAO,KACpB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SACC,uEACI,OAAO,KAAK,aAAa,OAAO,QAAQ,MAC5C,sBAAsB,OAAO,kBAAkB;EAChD,CAAC,CACF;AAGF,QAAO,OAAO,gCAAgC,OAAO,MAAM,OAAO,YAAY;EAC7E,CAAC,KACF,OAAO,SAAS,uCAAuC,EACtD,YAAY;EAAG,UAAU,OAAO,OAAO;EAAO,UAAU,MAAM,OAAO;CAAc,EACnF,CAAC,CACF;AAEF,MAAa,qBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,uBAAuB,QAAQ,OAAO,OAAO,QAAQ;AAgBxE,QAAO,EAAE,WAAU,OAfwB,UAAU,QAGnD;EACD,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,UAAU,yBAAyB;EAClF,SAAS,gCAAgC,OAAO,KAAK,OAAO,QAAQ,OAAO,CAAC,KAC3E,OAAO,UAAU,QAAQ,kBAAkB,YAAY,IAAI,CAAC,CAC5D;EACD,gBAAgB,OAAO;EACvB,CAAC,EAEwB,UAAU;EACnC,CAAC,KACF,OAAO,SAAS,iCAAiC,EAChD,YAAY;EAAG,UAAU,OAAO,OAAO;EAAO,UAAU,MAAM,OAAO;CAAc,EACnF,CAAC,CACF"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../../src/plugins/seal/deploy.ts"],"sourcesContent":["// Seal plugin — SDK-backed Move publish + on-chain KeyServer register.\n\nimport { createHash } from 'node:crypto';\n\nimport { Effect, Schema, type Scope } from 'effect';\n\nimport {\n\tTransaction,\n\ttype TransactionArgument,\n\ttype TransactionObjectArgument,\n} from '@mysten/sui/transactions';\n\nimport type { ChainProbe, ChainProbeSchema } from '../../contracts/chain-probe.ts';\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\tartifactPublishError,\n\ttype ArtifactPublishError,\n\ttype ArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport { contentHash, type ContentHash } from '../../substrate/brand.ts';\nimport {\n\texecuteSuiTx,\n\tformatExecutedFailure,\n\thashMoveSources,\n\trunMoveBuild,\n\tscrubLocksHost,\n\twithMoveBuildLock,\n\ttype BuildOutput,\n\ttype ExecutedReceipt,\n\ttype MoveBuildError,\n\ttype ClientWithCoreApi,\n} from '../sui/index.ts';\nimport { fromHex } from '@mysten/sui/utils';\n\nimport type { AccountValue } from '../account/index.ts';\nimport { sealError, type SealError } from './errors.ts';\n\nconst KEY_TYPE_BONEH_FRANKLIN_BLS12381 = 0;\n\nexport type SealObjectProbeKey = { readonly kind: 'object'; readonly objectId: string };\n\nexport interface SealSuiSdk {\n\treadonly client: ClientWithCoreApi;\n}\n\nconst sealProduceFailed = (op: 'publish' | 'register', err: SealError): ArtifactPublishError =>\n\tartifactPublishError('produce-failed', `seal.${op} ${err.phase}: ${err.message}`);\n\nconst moveBuildToSealError = (name: string, err: MoveBuildError): SealError =>\n\tsealError('publish', {\n\t\tname,\n\t\tmessage: `seal publish ${err.phase} failed for source '${err.sourcePath}': ${err.message}`,\n\t\tcause: err,\n\t});\n\nconst verifyObjectLenient = <Verified>(\n\tprobe: ChainProbe<SealObjectProbeKey>,\n\tobjectId: string,\n\tschema: ChainProbeSchema<Verified>,\n): Effect.Effect<Verified | null, never> =>\n\tprobe\n\t\t.get({ kind: 'object', objectId }, schema, 'lenient')\n\t\t.pipe(Effect.catch(() => Effect.succeed(null as Verified | null)));\n\n// ---------------------------------------------------------------------------\n// Move publish — `sealPackage` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_PACKAGE_NAMESPACE = 'seal/package' as const;\n\nexport interface SealPackageCached {\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n}\n\nexport const SealPackageVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealPackageVerified = Schema.Schema.Type<typeof SealPackageVerifyShape>;\n\nexport interface SealPublishInputs {\n\treadonly name: string;\n\treadonly chainId: string;\n\treadonly movePackagePath: string;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly runtime: ContainerRuntime;\n\treadonly buildImage?: ImageRef;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealPackageInputsHash = (\n\tsourceHash: ContentHash,\n\tsignerAddress: string,\n): ContentHash => contentHash(`seal-package|source=${sourceHash}|signer=${signerAddress}`);\n\nexport interface SealPublishTransactionBuilder<TUpgradeCap = unknown> {\n\treadonly setSender: (address: string) => void;\n\treadonly publish: (input: {\n\t\treadonly modules: ReadonlyArray<ReadonlyArray<number>>;\n\t\treadonly dependencies: ReadonlyArray<string>;\n\t}) => TUpgradeCap;\n\treadonly transferObjects: (objects: ReadonlyArray<TUpgradeCap>, recipient: string) => void;\n}\n\nconst publishTransactionBuilder = (\n\ttx: Transaction,\n): SealPublishTransactionBuilder<TransactionObjectArgument> => ({\n\tsetSender: (address) => tx.setSender(address),\n\tpublish: (input) =>\n\t\ttx.publish({\n\t\t\tmodules: input.modules.map((m) => [...m]),\n\t\t\tdependencies: [...input.dependencies],\n\t\t}),\n\ttransferObjects: (objects, recipient) => tx.transferObjects([...objects], recipient),\n});\n\nexport const buildSealPublishTransaction = <TUpgradeCap>(\n\ttx: SealPublishTransactionBuilder<TUpgradeCap>,\n\tbuildOutput: BuildOutput,\n\tsignerAddress: string,\n): void => {\n\ttx.setSender(signerAddress);\n\tconst upgradeCap = tx.publish({\n\t\tmodules: buildOutput.modules.map((m) => Array.from(m)),\n\t\tdependencies: [...buildOutput.dependencies],\n\t});\n\ttx.transferObjects([upgradeCap], signerAddress);\n};\n\nexport const pickPackageWriteObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find((change) => change.outputState === 'PackageWrite')?.objectId ?? null;\n\nexport const pickUpgradeCapObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::package::UpgradeCap') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectSealPublishReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealPackageCached, SealError> => {\n\tconst packageId = pickPackageWriteObjectId(receipt);\n\tif (packageId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('publish', {\n\t\t\t\tname,\n\t\t\t\tmessage: `seal publish tx wrote no PackageWrite object ` + `(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\tconst upgradeCapId = pickUpgradeCapObjectId(receipt);\n\treturn Effect.succeed({\n\t\tpackageId,\n\t\t...(upgradeCapId !== null ? { upgradeCapId } : {}),\n\t});\n};\n\nexport const runSealPublishTransaction = (\n\tinputs: SealPublishInputs,\n): Effect.Effect<SealPackageCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\t// Scrub the shared Move git cache, then build — both under the\n\t\t// process-wide Move-build permit (`withMoveBuildLock`) so this build\n\t\t// can't race a concurrent package build's host scrub against a sibling\n\t\t// container's `git clone` into the same `~/.move/git` cache. The host\n\t\t// scrub strips stale pins so they can't leak into the build; the\n\t\t// package's own Move.lock is scrubbed inside the container on a\n\t\t// disposable copy, leaving the developer's checked-in source untouched.\n\t\tconst buildOutput = yield* withMoveBuildLock(\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* scrubLocksHost(inputs.movePackagePath, '~/.move').pipe(\n\t\t\t\t\tEffect.mapError((err) => moveBuildToSealError(inputs.name, err)),\n\t\t\t\t);\n\n\t\t\t\treturn yield* runMoveBuild({\n\t\t\t\t\tsourcePath: inputs.movePackagePath,\n\t\t\t\t\tpackageName: inputs.name,\n\t\t\t\t\truntime: inputs.runtime,\n\t\t\t\t\t...(inputs.buildImage !== undefined ? { buildImage: inputs.buildImage } : {}),\n\t\t\t\t}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));\n\t\t\t}),\n\t\t);\n\n\t\tconst result = yield* executeSuiTx({\n\t\t\tclient: inputs.sdk.client,\n\t\t\tsigner: inputs.signer,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildSealPublishTransaction(\n\t\t\t\t\tpublishTransactionBuilder(tx),\n\t\t\t\t\tbuildOutput,\n\t\t\t\t\tinputs.signer.address,\n\t\t\t\t);\n\t\t\t\treturn tx.build({ client: inputs.sdk.client });\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal publish tx failed for signer '${inputs.signer.name}' ` +\n\t\t\t\t\t\t`(address=${inputs.signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tif (result.$kind === 'FailedTransaction') {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('publish', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal publish tx executed but on-chain execution failed for signer ` +\n\t\t\t\t\t\t`'${inputs.signer.name}' (address=${inputs.signer.address}) ` +\n\t\t\t\t\t\tformatExecutedFailure(result.FailedTransaction),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn yield* projectSealPublishReceipt(inputs.name, result.Transaction);\n\t});\n\nexport const publishSealPackage = (\n\tpublisher: ArtifactPublisher,\n\tinputs: SealPublishInputs,\n): Effect.Effect<{ readonly packageId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst sourceHash = yield* hashMoveSources(inputs.movePackagePath).pipe(\n\t\t\tEffect.mapError((err) => moveBuildToSealError(inputs.name, err)),\n\t\t);\n\t\tconst inputsHash = sealPackageInputsHash(sourceHash, inputs.signer.address);\n\n\t\tconst cached: SealPackageCached = yield* publisher.publish<\n\t\t\tSealPackageCached,\n\t\t\tSealPackageVerified\n\t\t>({\n\t\t\tnamespace: SEAL_PACKAGE_NAMESPACE,\n\t\t\tchain: inputs.chainId,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.packageId, SealPackageVerifyShape),\n\t\t\tproduce: runSealPublishTransaction(inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('publish', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\treturn { packageId: cached.packageId };\n\t});\n\n// ---------------------------------------------------------------------------\n// KeyServer register — `keyServer` artifact\n// ---------------------------------------------------------------------------\n\nexport const SEAL_KEY_SERVER_NAMESPACE = 'seal/key-server-id' as const;\n\nexport interface SealKeyServerCached {\n\treadonly objectId: string;\n}\n\nexport const SealKeyServerVerifyShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.optional(Schema.Unknown),\n});\nexport type SealKeyServerVerified = Schema.Schema.Type<typeof SealKeyServerVerifyShape>;\n\nexport interface RegisterKeyServerTransactionInputs {\n\treadonly keyServerUrl: string;\n\treadonly sealPackageId: string;\n\treadonly publicKeyHex: string;\n\treadonly keyServerName: string;\n}\n\nexport interface RegisterKeyServerInputs extends RegisterKeyServerTransactionInputs {\n\treadonly name: string;\n\treadonly chainId: string;\n\treadonly signer: AccountValue;\n\treadonly sdk: SealSuiSdk;\n\treadonly chainProbe: ChainProbe<SealObjectProbeKey>;\n}\n\nexport const sealRegisterInputsHash = (\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): ContentHash =>\n\t// Keep the cache key path-safe and bounded. The raw material includes\n\t// a routed URL plus a long BLS public key; using it directly made the\n\t// best-effort cache write miss on normal restarts.\n\tcontentHash(\n\t\t`seal-register-v2|${createHash('sha256')\n\t\t\t.update(\n\t\t\t\tJSON.stringify({\n\t\t\t\t\tpackageId: inputs.sealPackageId,\n\t\t\t\t\tkeyServerUrl: inputs.keyServerUrl,\n\t\t\t\t\tkeyServerName: inputs.keyServerName,\n\t\t\t\t\tpublicKeyHex: inputs.publicKeyHex,\n\t\t\t\t\tsignerAddress,\n\t\t\t\t}),\n\t\t\t)\n\t\t\t.digest('hex')}`,\n\t);\n\nexport interface SealRegisterTransactionBuilder<TArgument = unknown> {\n\treadonly pure: {\n\t\treadonly string: (value: string) => TArgument;\n\t\treadonly u8: (value: number) => TArgument;\n\t\treadonly vector: (type: 'u8', value: ReadonlyArray<number>) => TArgument;\n\t};\n\treadonly setSender: (address: string) => void;\n\treadonly moveCall: (input: {\n\t\treadonly target: string;\n\t\treadonly arguments: ReadonlyArray<TArgument>;\n\t}) => unknown;\n}\n\nexport type SealRegisterSdk = SealSuiSdk;\n\nconst registerTransactionBuilder = (\n\ttx: Transaction,\n): SealRegisterTransactionBuilder<TransactionArgument> => ({\n\tpure: {\n\t\tstring: (value) => tx.pure.string(value),\n\t\tu8: (value) => tx.pure.u8(value),\n\t\tvector: (type, value) => tx.pure.vector(type, [...value]),\n\t},\n\tsetSender: (address) => tx.setSender(address),\n\tmoveCall: (input) =>\n\t\ttx.moveCall({\n\t\t\ttarget: input.target,\n\t\t\targuments: [...input.arguments],\n\t\t}),\n});\n\nexport const buildRegisterKeyServerMoveCall = <TArgument>(\n\ttx: SealRegisterTransactionBuilder<TArgument>,\n\tinputs: RegisterKeyServerTransactionInputs,\n\tsignerAddress: string,\n): void => {\n\tconst pkBytes = fromHex(inputs.publicKeyHex);\n\ttx.setSender(signerAddress);\n\ttx.moveCall({\n\t\ttarget: `${inputs.sealPackageId}::key_server::create_and_transfer_v2_independent_server`,\n\t\targuments: [\n\t\t\ttx.pure.string(inputs.keyServerName),\n\t\t\ttx.pure.string(inputs.keyServerUrl),\n\t\t\ttx.pure.u8(KEY_TYPE_BONEH_FRANKLIN_BLS12381),\n\t\t\ttx.pure.vector('u8', Array.from(pkBytes)),\n\t\t],\n\t});\n};\n\nexport const pickCreatedKeyServerObjectId = (receipt: ExecutedReceipt): string | null =>\n\treceipt.objectChanges.find(\n\t\t(change) =>\n\t\t\tchange.idOperation === 'Created' &&\n\t\t\t(change.objectType?.endsWith('::key_server::KeyServer') ?? false),\n\t)?.objectId ?? null;\n\nexport const projectRegisterKeyServerReceipt = (\n\tname: string,\n\treceipt: ExecutedReceipt,\n): Effect.Effect<SealKeyServerCached, SealError> => {\n\tconst objectId = pickCreatedKeyServerObjectId(receipt);\n\tif (objectId === null) {\n\t\treturn Effect.fail(\n\t\t\tsealError('register', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t`seal register tx created no ::key_server::KeyServer object ` +\n\t\t\t\t\t`(digest=${receipt.digest})`,\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed({ objectId });\n};\n\nexport const runRegisterKeyServerTransaction = (\n\tsdk: SealRegisterSdk,\n\tsigner: AccountValue,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<SealKeyServerCached, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst result = yield* executeSuiTx({\n\t\t\tclient: sdk.client,\n\t\t\tsigner,\n\t\t\tbuild: async () => {\n\t\t\t\tconst tx = new Transaction();\n\t\t\t\tbuildRegisterKeyServerMoveCall(registerTransactionBuilder(tx), inputs, signer.address);\n\t\t\t\treturn tx.build({ client: sdk.client });\n\t\t\t},\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal register tx failed for signer '${signer.name}' ` +\n\t\t\t\t\t\t`(address=${signer.address}) during ${cause.phase}: ${cause.message}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tif (result.$kind === 'FailedTransaction') {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('register', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal register tx executed but on-chain execution failed for signer ` +\n\t\t\t\t\t\t`'${signer.name}' (address=${signer.address}) ` +\n\t\t\t\t\t\tformatExecutedFailure(result.FailedTransaction),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn yield* projectRegisterKeyServerReceipt(inputs.name, result.Transaction);\n\t});\n\nexport const registerKeyServer = (\n\tpublisher: ArtifactPublisher,\n\tinputs: RegisterKeyServerInputs,\n): Effect.Effect<{ readonly objectId: string }, ArtifactPublishError | SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst inputsHash = sealRegisterInputsHash(inputs, inputs.signer.address);\n\t\tconst cached: SealKeyServerCached = yield* publisher.publish<\n\t\t\tSealKeyServerCached,\n\t\t\tSealKeyServerVerified\n\t\t>({\n\t\t\tnamespace: SEAL_KEY_SERVER_NAMESPACE,\n\t\t\tchain: inputs.chainId,\n\t\t\tcontentHash: inputsHash,\n\t\t\tverify: (cached) =>\n\t\t\t\tverifyObjectLenient(inputs.chainProbe, cached.objectId, SealKeyServerVerifyShape),\n\t\t\tproduce: runRegisterKeyServerTransaction(inputs.sdk, inputs.signer, inputs).pipe(\n\t\t\t\tEffect.mapError((err) => sealProduceFailed('register', err)),\n\t\t\t),\n\t\t\tregister: () => Effect.void,\n\t\t});\n\n\t\treturn { objectId: cached.objectId };\n\t});\n"],"mappings":";;;;;;;;;;;AAqCA,MAAM,mCAAmC;AAQzC,MAAM,qBAAqB,IAA4B,QACtD,qBAAqB,kBAAkB,QAAQ,GAAG,GAAG,IAAI,MAAM,IAAI,IAAI,SAAS;AAEjF,MAAM,wBAAwB,MAAc,QAC3C,UAAU,WAAW;CACpB;CACA,SAAS,gBAAgB,IAAI,MAAM,sBAAsB,IAAI,WAAW,KAAK,IAAI;CACjF,OAAO;AACR,CAAC;AAEF,MAAM,uBACL,OACA,UACA,WAEA,MACE,IAAI;CAAE,MAAM;CAAU;AAAS,GAAG,QAAQ,SAAS,CAAC,CACpD,KAAK,OAAO,YAAY,OAAO,QAAQ,IAAuB,CAAC,CAAC;AAMnE,MAAa,yBAAyB;AAOtC,MAAa,yBAAyB,OAAO,OAAO;CACnD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,OAAO;AACrC,CAAC;AAcD,MAAa,yBACZ,YACA,kBACiB,YAAY,uBAAuB,WAAW,UAAU,eAAe;AAWzF,MAAM,6BACL,QAC+D;CAC/D,YAAY,YAAY,GAAG,UAAU,OAAO;CAC5C,UAAU,UACT,GAAG,QAAQ;EACV,SAAS,MAAM,QAAQ,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;EACxC,cAAc,CAAC,GAAG,MAAM,YAAY;CACrC,CAAC;CACF,kBAAkB,SAAS,cAAc,GAAG,gBAAgB,CAAC,GAAG,OAAO,GAAG,SAAS;AACpF;AAEA,MAAa,+BACZ,IACA,aACA,kBACU;CACV,GAAG,UAAU,aAAa;CAC1B,MAAM,aAAa,GAAG,QAAQ;EAC7B,SAAS,YAAY,QAAQ,KAAK,MAAM,MAAM,KAAK,CAAC,CAAC;EACrD,cAAc,CAAC,GAAG,YAAY,YAAY;CAC3C,CAAC;CACD,GAAG,gBAAgB,CAAC,UAAU,GAAG,aAAa;AAC/C;AAEA,MAAa,4BAA4B,YACxC,QAAQ,cAAc,MAAM,WAAW,OAAO,gBAAgB,cAAc,CAAC,EAAE,YAAY;AAE5F,MAAa,0BAA0B,YACtC,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,uBAAuB,KAAK,MAC3D,CAAC,EAAE,YAAY;AAEhB,MAAa,6BACZ,MACA,YACiD;CACjD,MAAM,YAAY,yBAAyB,OAAO;CAClD,IAAI,cAAc,MACjB,OAAO,OAAO,KACb,UAAU,WAAW;EACpB;EACA,SAAS,wDAA6D,QAAQ,OAAO;CACtF,CAAC,CACF;CAED,MAAM,eAAe,uBAAuB,OAAO;CACnD,OAAO,OAAO,QAAQ;EACrB;EACA,GAAI,iBAAiB,OAAO,EAAE,aAAa,IAAI,CAAC;CACjD,CAAC;AACF;AAEA,MAAa,6BACZ,WAEA,OAAO,IAAI,aAAa;CAQvB,MAAM,cAAc,OAAO,kBAC1B,OAAO,IAAI,aAAa;EACvB,OAAO,eAAe,OAAO,iBAAiB,SAAS,CAAC,CAAC,KACxD,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,GAAG,CAAC,CAChE;EAEA,OAAO,OAAO,aAAa;GAC1B,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,SAAS,OAAO;GAChB,GAAI,OAAO,eAAe,KAAA,IAAY,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;EAC5E,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,GAAG,CAAC,CAAC;CACzE,CAAC,CACF;CAEA,MAAM,SAAS,OAAO,aAAa;EAClC,QAAQ,OAAO,IAAI;EACnB,QAAQ,OAAO;EACf,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,YAAY;GAC3B,4BACC,0BAA0B,EAAE,GAC5B,aACA,OAAO,OAAO,OACf;GACA,OAAO,GAAG,MAAM,EAAE,QAAQ,OAAO,IAAI,OAAO,CAAC;EAC9C;CACD,CAAC,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SACC,sCAAsC,OAAO,OAAO,KAAK,aAC7C,OAAO,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EACpE;CACD,CAAC,CACF,CACD;CACA,IAAI,OAAO,UAAU,qBACpB,OAAO,OAAO,OAAO,KACpB,UAAU,WAAW;EACpB,MAAM,OAAO;EACb,SACC,sEACI,OAAO,OAAO,KAAK,aAAa,OAAO,OAAO,QAAQ,MAC1D,sBAAsB,OAAO,iBAAiB;CAChD,CAAC,CACF;CAGD,OAAO,OAAO,0BAA0B,OAAO,MAAM,OAAO,WAAW;AACxE,CAAC;AAEF,MAAa,sBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CAIvB,MAAM,aAAa,sBAAsB,OAHf,gBAAgB,OAAO,eAAe,CAAC,CAAC,KACjE,OAAO,UAAU,QAAQ,qBAAqB,OAAO,MAAM,GAAG,CAAC,CAChE,GACqD,OAAO,OAAO,OAAO;CAiB1E,OAAO,EAAE,YAAW,OAfqB,UAAU,QAGjD;EACD,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,WAAW,sBAAsB;EAChF,SAAS,0BAA0B,MAAM,CAAC,CAAC,KAC1C,OAAO,UAAU,QAAQ,kBAAkB,WAAW,GAAG,CAAC,CAC3D;EACA,gBAAgB,OAAO;CACxB,CAAC,EAAA,CAE0B,UAAU;AACtC,CAAC;AAMF,MAAa,4BAA4B;AAMzC,MAAa,2BAA2B,OAAO,OAAO;CACrD,UAAU,OAAO;CACjB,MAAM,OAAO,SAAS,OAAO,OAAO;AACrC,CAAC;AAkBD,MAAa,0BACZ,QACA,kBAKA,YACC,oBAAoB,WAAW,QAAQ,CAAC,CACtC,OACA,KAAK,UAAU;CACd,WAAW,OAAO;CAClB,cAAc,OAAO;CACrB,eAAe,OAAO;CACtB,cAAc,OAAO;CACrB;AACD,CAAC,CACF,CAAC,CACA,OAAO,KAAK,GACf;AAiBD,MAAM,8BACL,QAC0D;CAC1D,MAAM;EACL,SAAS,UAAU,GAAG,KAAK,OAAO,KAAK;EACvC,KAAK,UAAU,GAAG,KAAK,GAAG,KAAK;EAC/B,SAAS,MAAM,UAAU,GAAG,KAAK,OAAO,MAAM,CAAC,GAAG,KAAK,CAAC;CACzD;CACA,YAAY,YAAY,GAAG,UAAU,OAAO;CAC5C,WAAW,UACV,GAAG,SAAS;EACX,QAAQ,MAAM;EACd,WAAW,CAAC,GAAG,MAAM,SAAS;CAC/B,CAAC;AACH;AAEA,MAAa,kCACZ,IACA,QACA,kBACU;CACV,MAAM,UAAU,QAAQ,OAAO,YAAY;CAC3C,GAAG,UAAU,aAAa;CAC1B,GAAG,SAAS;EACX,QAAQ,GAAG,OAAO,cAAc;EAChC,WAAW;GACV,GAAG,KAAK,OAAO,OAAO,aAAa;GACnC,GAAG,KAAK,OAAO,OAAO,YAAY;GAClC,GAAG,KAAK,GAAG,gCAAgC;GAC3C,GAAG,KAAK,OAAO,MAAM,MAAM,KAAK,OAAO,CAAC;EACzC;CACD,CAAC;AACF;AAEA,MAAa,gCAAgC,YAC5C,QAAQ,cAAc,MACpB,WACA,OAAO,gBAAgB,cACtB,OAAO,YAAY,SAAS,yBAAyB,KAAK,MAC7D,CAAC,EAAE,YAAY;AAEhB,MAAa,mCACZ,MACA,YACmD;CACnD,MAAM,WAAW,6BAA6B,OAAO;CACrD,IAAI,aAAa,MAChB,OAAO,OAAO,KACb,UAAU,YAAY;EACrB;EACA,SACC,sEACW,QAAQ,OAAO;CAC5B,CAAC,CACF;CAED,OAAO,OAAO,QAAQ,EAAE,SAAS,CAAC;AACnC;AAEA,MAAa,mCACZ,KACA,QACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,aAAa;EAClC,QAAQ,IAAI;EACZ;EACA,OAAO,YAAY;GAClB,MAAM,KAAK,IAAI,YAAY;GAC3B,+BAA+B,2BAA2B,EAAE,GAAG,QAAQ,OAAO,OAAO;GACrF,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;EACvC;CACD,CAAC,CAAC,CAAC,KACF,OAAO,UAAU,UAChB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SACC,uCAAuC,OAAO,KAAK,aACvC,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,MAAM;EAC7D;CACD,CAAC,CACF,CACD;CACA,IAAI,OAAO,UAAU,qBACpB,OAAO,OAAO,OAAO,KACpB,UAAU,YAAY;EACrB,MAAM,OAAO;EACb,SACC,uEACI,OAAO,KAAK,aAAa,OAAO,QAAQ,MAC5C,sBAAsB,OAAO,iBAAiB;CAChD,CAAC,CACF;CAGD,OAAO,OAAO,gCAAgC,OAAO,MAAM,OAAO,WAAW;AAC9E,CAAC;AAEF,MAAa,qBACZ,WACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,uBAAuB,QAAQ,OAAO,OAAO,OAAO;CAgBvE,OAAO,EAAE,WAAU,OAfwB,UAAU,QAGnD;EACD,WAAW;EACX,OAAO,OAAO;EACd,aAAa;EACb,SAAS,WACR,oBAAoB,OAAO,YAAY,OAAO,UAAU,wBAAwB;EACjF,SAAS,gCAAgC,OAAO,KAAK,OAAO,QAAQ,MAAM,CAAC,CAAC,KAC3E,OAAO,UAAU,QAAQ,kBAAkB,YAAY,GAAG,CAAC,CAC5D;EACA,gBAAgB,OAAO;CACxB,CAAC,EAAA,CAEyB,SAAS;AACpC,CAAC"}

package/dist/plugins/seal/errors.d.mts

@@ -2,8 +2,8 @@ import { ConfigIssue } from "../../substrate/runtime/config-validation.mjs";
 import { ForkIncompatibleError } from "../../substrate/runtime/mode-errors.mjs";
 
 //#region src/plugins/seal/errors.d.ts
-/** Phases for `SealError`. Closed sum — matches the v3 catalog
- *  (07-seal.md §"Adjacent Seal references" → `engine/phases.ts:79-91`).
+/** Phases for `SealError`. Closed sum (07-seal.md §"Adjacent Seal
+ *  references").
  *
  *  Phase semantics:
  *   - `port-alloc`     — router `seal` entrypoint not registered.
@@ -20,9 +20,8 @@ import { ForkIncompatibleError } from "../../substrate/runtime/mode-errors.mjs";
  *   - `ready`          — /health probe timed out.
  *   - `seal`           — generic catch-all for non-phaseable failures. */
 type SealPhase = 'port-alloc' | 'image' | 'keygen' | 'publish' | 'register' | 'config-render' | 'container' | 'ready' | 'seal';
-/** Generic Seal plugin error. The structured shape mirrors the v3
- *  `SealError` from `engine/errors.ts:325-341` minus the dead
- *  `keyServer` field (07-seal.md §Opportunities #6).
+/** Generic Seal plugin error. A structured tagged error
+ *  (07-seal.md §Opportunities #6).
  *
  *  Distilled-doc invariant #16: `stdout` / `stderr` MUST be redacted
  *  via `redactMasterKey` at every raise site that touches `seal-cli`

package/dist/plugins/seal/errors.mjs

@@ -12,14 +12,7 @@ const sealError = (phase, parts) => ({
 *  two-layer cause walk. */
 const isSealError = (value) => typeof value === "object" && value !== null && value._tag === "SealError";
 const sealConfigError = defineConfigError("SealConfigError");
-/** Error tags this plugin contributes — surfaced to the cause walker
-*  via `PluginErrorContribution`. */
-const SEAL_ERROR_TAGS = [
-	"SealError",
-	"ForkIncompatibleError",
-	"SealConfigError"
-];
 //#endregion
-export { SEAL_ERROR_TAGS, isSealError, sealConfigError, sealError };
+export { isSealError, sealConfigError, sealError };
 
 //# sourceMappingURL=errors.mjs.map

package/dist/plugins/seal/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/seal/errors.ts"],"sourcesContent":["// Seal plugin — typed errors.\n//\n// Every error surfacing site that may carry stdout/stderr from the\n// seal-cli MUST run the bytes through a master-key redactor. The\n// redactor lives in `keygen.ts` so the keygen pipeline is the single\n// owner of the redaction substrate; this file only declares the\n// closed phase set + the structured error shapes.\n//\n// Effect v4: errors are plain interfaces with a `_tag` discriminator\n// (per surrounding subsystem style). `Effect.catchTag` / `catchTags`\n// match on the literal `_tag`.\n//\n// `ForkIncompatibleError` is a cross-cutting mode-refusal shape\n// owned by `substrate/runtime/mode-errors.ts`; seal contributes\n// the `sealLocalKeygen` variant via the factory below. Substrate\n// owns the canonical re-export; this module does NOT re-export the\n// class — the cross-plugin re-export was the cause of a name\n// collision at the root barrel.\n\nimport { ForkIncompatibleError } from '../../substrate/runtime/mode-errors.ts';\nimport { defineConfigError, type ConfigIssue } from '../../substrate/runtime/config-validation.ts';\n\n// ---------------------------------------------------------------------------\n// SealError — the plugin's primary tagged error\n// ---------------------------------------------------------------------------\n\n/** Phases for `SealError`. Closed sum — matches the v3 catalog\n *  (07-seal.md §\"Adjacent Seal references\" → `engine/phases.ts:79-91`).\n *\n *  Phase semantics:\n *   - `port-alloc`     — router `seal` entrypoint not registered.\n *   - `image`          — image build / pull failed (bootstrap-asset\n *                        cargo step).\n *   - `keygen`         — `seal-cli genkey` container failed OR stdout\n *                        parse failed.\n *   - `publish`        — Move publish of the seal contracts failed.\n *   - `register`       — `KeyServer::create_and_transfer_v2_independent_server`\n *                        Move call failed OR object id parse failed.\n *   - `config-render`  — key-server-config.yaml / master-key.env write\n *                        failed (FS perms, disk full).\n *   - `container`      — long-running key-server container start failed.\n *   - `ready`          — /health probe timed out.\n *   - `seal`           — generic catch-all for non-phaseable failures. */\nexport type SealPhase =\n\t| 'port-alloc'\n\t| 'image'\n\t| 'keygen'\n\t| 'publish'\n\t| 'register'\n\t| 'config-render'\n\t| 'container'\n\t| 'ready'\n\t| 'seal';\n\n/** Generic Seal plugin error. The structured shape mirrors the v3\n *  `SealError` from `engine/errors.ts:325-341` minus the dead\n *  `keyServer` field (07-seal.md §Opportunities #6).\n *\n *  Distilled-doc invariant #16: `stdout` / `stderr` MUST be redacted\n *  via `redactMasterKey` at every raise site that touches `seal-cli`\n *  output. The raise sites in this plugin pipe their captures\n *  through the redactor before constructing the error. */\nexport interface SealError {\n\treadonly _tag: 'SealError';\n\treadonly phase: SealPhase;\n\t/** Seal instance name (default `'seal'`). Folds into TUI display\n\t *  + cause-walker context. */\n\treadonly name: string;\n\treadonly message: string;\n\treadonly stdout?: string;\n\treadonly stderr?: string;\n\treadonly exitCode?: number;\n\treadonly cause?: unknown;\n}\n\nexport const sealError = (\n\tphase: SealPhase,\n\tparts: Omit<SealError, '_tag' | 'phase'>,\n): SealError => ({ _tag: 'SealError', phase, ...parts });\n\n/** Structural predicate — true iff `value` has the `SealError` tag.\n *  Used at re-wrap sites (e.g. `key-server.ts` probe mapError) to\n *  unwrap a nested `SealError` rather than re-wrap and create a\n *  two-layer cause walk. */\nexport const isSealError = (value: unknown): value is SealError =>\n\ttypeof value === 'object' &&\n\tvalue !== null &&\n\t(value as { readonly _tag?: unknown })._tag === 'SealError';\n\n// ---------------------------------------------------------------------------\n// SealConfigError — synchronous factory-time configuration faults\n// ---------------------------------------------------------------------------\n\nexport interface SealConfigError extends ConfigIssue {\n\treadonly _tag: 'SealConfigError';\n}\n\nexport const sealConfigError = defineConfigError('SealConfigError');\n\n// ---------------------------------------------------------------------------\n// Error-tag inventory\n// ---------------------------------------------------------------------------\n\n/** Error tags this plugin contributes — surfaced to the cause walker\n *  via `PluginErrorContribution`. */\nexport const SEAL_ERROR_TAGS = ['SealError', 'ForkIncompatibleError', 'SealConfigError'] as const;\n\n/** Union of every error a Seal-plugin caller may encounter. */\nexport type SealAnyError = SealError | ForkIncompatibleError | SealConfigError;\n"],"mappings":";;;AA2EA,MAAa,aACZ,OACA,WACgB;CAAE,MAAM;CAAa;CAAO,GAAG;CAAO;;;;;AAMvD,MAAa,eAAe,UAC3B,OAAO,UAAU,YACjB,UAAU,QACT,MAAsC,SAAS;AAUjD,MAAa,kBAAkB,kBAAkB,kBAAkB;;;AAQnE,MAAa,kBAAkB;CAAC;CAAa;CAAyB;CAAkB"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/seal/errors.ts"],"sourcesContent":["// Seal plugin — typed errors.\n//\n// Every error surfacing site that may carry stdout/stderr from the\n// seal-cli MUST run the bytes through a master-key redactor. The\n// redactor lives in `keygen.ts` so the keygen pipeline is the single\n// owner of the redaction substrate; this file only declares the\n// closed phase set + the structured error shapes.\n//\n// Effect v4: errors are plain interfaces with a `_tag` discriminator\n// (per surrounding subsystem style). `Effect.catchTag` / `catchTags`\n// match on the literal `_tag`.\n//\n// `ForkIncompatibleError` is a cross-cutting mode-refusal shape\n// owned by `substrate/runtime/mode-errors.ts`; seal contributes\n// the `sealLocalKeygen` variant via the factory below. Substrate\n// owns the canonical re-export; this module does NOT re-export the\n// class — the cross-plugin re-export was the cause of a name\n// collision at the root barrel.\n\nimport { ForkIncompatibleError } from '../../substrate/runtime/mode-errors.ts';\nimport { defineConfigError, type ConfigIssue } from '../../substrate/runtime/config-validation.ts';\n\n// ---------------------------------------------------------------------------\n// SealError — the plugin's primary tagged error\n// ---------------------------------------------------------------------------\n\n/** Phases for `SealError`. Closed sum (07-seal.md §\"Adjacent Seal\n *  references\").\n *\n *  Phase semantics:\n *   - `port-alloc`     — router `seal` entrypoint not registered.\n *   - `image`          — image build / pull failed (bootstrap-asset\n *                        cargo step).\n *   - `keygen`         — `seal-cli genkey` container failed OR stdout\n *                        parse failed.\n *   - `publish`        — Move publish of the seal contracts failed.\n *   - `register`       — `KeyServer::create_and_transfer_v2_independent_server`\n *                        Move call failed OR object id parse failed.\n *   - `config-render`  — key-server-config.yaml / master-key.env write\n *                        failed (FS perms, disk full).\n *   - `container`      — long-running key-server container start failed.\n *   - `ready`          — /health probe timed out.\n *   - `seal`           — generic catch-all for non-phaseable failures. */\nexport type SealPhase =\n\t| 'port-alloc'\n\t| 'image'\n\t| 'keygen'\n\t| 'publish'\n\t| 'register'\n\t| 'config-render'\n\t| 'container'\n\t| 'ready'\n\t| 'seal';\n\n/** Generic Seal plugin error. A structured tagged error\n *  (07-seal.md §Opportunities #6).\n *\n *  Distilled-doc invariant #16: `stdout` / `stderr` MUST be redacted\n *  via `redactMasterKey` at every raise site that touches `seal-cli`\n *  output. The raise sites in this plugin pipe their captures\n *  through the redactor before constructing the error. */\nexport interface SealError {\n\treadonly _tag: 'SealError';\n\treadonly phase: SealPhase;\n\t/** Seal instance name (default `'seal'`). Folds into TUI display\n\t *  + cause-walker context. */\n\treadonly name: string;\n\treadonly message: string;\n\treadonly stdout?: string;\n\treadonly stderr?: string;\n\treadonly exitCode?: number;\n\treadonly cause?: unknown;\n}\n\nexport const sealError = (\n\tphase: SealPhase,\n\tparts: Omit<SealError, '_tag' | 'phase'>,\n): SealError => ({ _tag: 'SealError', phase, ...parts });\n\n/** Structural predicate — true iff `value` has the `SealError` tag.\n *  Used at re-wrap sites (e.g. `key-server.ts` probe mapError) to\n *  unwrap a nested `SealError` rather than re-wrap and create a\n *  two-layer cause walk. */\nexport const isSealError = (value: unknown): value is SealError =>\n\ttypeof value === 'object' &&\n\tvalue !== null &&\n\t(value as { readonly _tag?: unknown })._tag === 'SealError';\n\n// ---------------------------------------------------------------------------\n// SealConfigError — synchronous factory-time configuration faults\n// ---------------------------------------------------------------------------\n\nexport interface SealConfigError extends ConfigIssue {\n\treadonly _tag: 'SealConfigError';\n}\n\nexport const sealConfigError = defineConfigError('SealConfigError');\n\n// ---------------------------------------------------------------------------\n// Error-tag inventory\n// ---------------------------------------------------------------------------\n\n/** The catchable error tags this plugin exposes. Pinned against the\n *  user-facing error catalog by the error-catalog-parity test. */\nexport const SEAL_ERROR_TAGS = ['SealError', 'ForkIncompatibleError', 'SealConfigError'] as const;\n\n/** Union of every error a Seal-plugin caller may encounter. */\nexport type SealAnyError = SealError | ForkIncompatibleError | SealConfigError;\n"],"mappings":";;;AA0EA,MAAa,aACZ,OACA,WACgB;CAAE,MAAM;CAAa;CAAO,GAAG;AAAM;;;;;AAMtD,MAAa,eAAe,UAC3B,OAAO,UAAU,YACjB,UAAU,QACT,MAAsC,SAAS;AAUjD,MAAa,kBAAkB,kBAAkB,iBAAiB"}

package/dist/plugins/seal/index.d.mts

@@ -1,10 +1,7 @@
-import { CodegenableDecl } from "../../contracts/codegenable.mjs";
-import { RoutableDecl } from "../../contracts/routable.mjs";
-import { SnapshotableDecl } from "../../contracts/snapshotable.mjs";
 import { AnyResourceRef, Plugin, ResourceRef } from "../../substrate/plugin.mjs";
 import { ModeNamespace } from "../../api/mode-narrowed-factory.mjs";
-import { SuiClient } from "../sui/mode/shared.mjs";
 import { SuiOptions } from "../sui/mode/spec.mjs";
+import { SuiClient } from "../sui/mode/shared.mjs";
 import { AccountValue } from "../account/service.mjs";
 import { AccountResourceId } from "../account/index.mjs";
 import { SealKeyManager } from "./key-manager.mjs";
@@ -76,19 +73,7 @@ declare const seal: <const Signer extends SealSignerMember = SealSignerMember>(o
     readonly mode: SuiOptions["mode"];
   }>;
   readonly signer: Signer;
-} ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never, readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">, RoutableDecl]> | Plugin<`seal:${string}`, {
-  mode: "live";
-  manager: null;
-  serverConfigs: ReadonlyArray<SealKeyServerEntry>;
-  keyServerUrl: string;
-  objectId: string;
-}, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]> | Plugin<`seal:${string}`, {
-  mode: "fork-known";
-  manager: null;
-  serverConfigs: ReadonlyArray<SealKeyServerEntry>;
-  keyServerUrl: string;
-  objectId: string;
-}, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+} ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never> | Plugin<`seal:${string}`, SealResolved, readonly []>;
 /** Mode-narrowed factory namespace.
  *
  *  Usage:
@@ -116,7 +101,7 @@ declare const sealFor: ModeNamespace<{
         readonly mode: SuiOptions["mode"];
       }>;
       readonly signer: Signer;
-    } ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never, readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">, RoutableDecl]>;
+    } ? T extends Readonly<Record<string, AnyResourceRef>> ? readonly T[keyof T][] : readonly [] : never : never>;
   };
   live: {
     testnet: (opts?: Omit<SealLiveOptions, "network">) => Plugin<`seal:${string}`, {
@@ -125,30 +110,24 @@ declare const sealFor: ModeNamespace<{
       serverConfigs: ReadonlyArray<SealKeyServerEntry>;
       keyServerUrl: string;
       objectId: string;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+    }, readonly []>;
     mainnet: (opts?: Omit<SealLiveOptions, "network">) => Plugin<`seal:${string}`, {
       mode: "live";
       manager: null;
       serverConfigs: ReadonlyArray<SealKeyServerEntry>;
       keyServerUrl: string;
       objectId: string;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+    }, readonly []>;
     custom: (opts: Required<Pick<SealLiveOptions, "objectId" | "keyServerUrl">> & SealLiveOptions) => Plugin<`seal:${string}`, {
       mode: "live";
       manager: null;
       serverConfigs: ReadonlyArray<SealKeyServerEntry>;
       keyServerUrl: string;
       objectId: string;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+    }, readonly []>;
   };
   fork: {
-    forkKnown: (opts: SealForkKnownOptions) => Plugin<`seal:${string}`, {
-      mode: "fork-known";
-      manager: null;
-      serverConfigs: ReadonlyArray<SealKeyServerEntry>;
-      keyServerUrl: string;
-      objectId: string;
-    }, readonly [], readonly [SnapshotableDecl, CodegenableDecl<"seal-key-server">]>;
+    forkKnown: (opts: SealForkKnownOptions) => Plugin<`seal:${string}`, SealResolved, readonly []>;
   };
 }>;
 //#endregion

package/dist/plugins/seal/index.mjs

@@ -1,21 +1,21 @@
 import { definePlugin } from "../../substrate/plugin.mjs";
 import "../../api/define-plugin.mjs";
 import { IdentityContext, StackPathsService } from "../../substrate/runtime/paths.mjs";
+import { CacheService } from "../../substrate/runtime/cache/service.mjs";
+import "../../substrate/runtime/cache/index.mjs";
 import { ContainerRuntimeService } from "../../runtime/docker/service.mjs";
-import { ArtifactPublisherService } from "../../substrate/runtime/artifact-publisher/index.mjs";
+import { PluginContext } from "../../substrate/plugin-ctx.mjs";
 import { chainProbeFor } from "../../substrate/runtime/strategy-registry/chain-probe-for.mjs";
 import "../../substrate/runtime/strategy-registry/index.mjs";
 import { DEFAULT_KEY_SERVER_PORT, buildSealKeyServerPublicRoute, makeSealRoutable } from "./routable.mjs";
-import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
 import { defineModeNamespace } from "../../api/mode-narrowed-factory.mjs";
 import { suiResource } from "../sui/index.mjs";
 import { withSubnetAddressing } from "../../substrate/runtime/subnet-broker.mjs";
 import { sealPluginKey } from "./plugin-key.mjs";
-import { makeSealCodegenable } from "./codegen.mjs";
-import { SEAL_ERROR_TAGS, sealError } from "./errors.mjs";
+import { makeSealCodegenable, makeSealStaticCodegen } from "./codegen.mjs";
+import { sealError } from "./errors.mjs";
 import { validateLiveInputs } from "./mode/live.mjs";
 import { validateForkKnownInputs } from "./mode/fork-known.mjs";
-import "./spans.mjs";
 import { buildSealNetworkName, deriveSealSubnetPrefix } from "./key-server.mjs";
 import { DEFAULT_SEAL_VERSION } from "./bootstrap-assets/source-fetch.mjs";
 import { bootLocalKeygen, resolveLocalKeygenOptions } from "./mode/local-keygen.mjs";
@@ -24,7 +24,6 @@ import { makeKnownSnapshotable, makeLocalKeygenSnapshotable } from "./snapshot.m
 import { bootSealService } from "./service.mjs";
 import { Effect, FileSystem, Path } from "effect";
 //#region src/plugins/seal/index.ts
-const sealErrorContributions = pluginErrorContributions(SEAL_ERROR_TAGS);
 /** Constants + shared knobs for the buildXyz helpers below. */
 const DEFAULT_NAME = "seal";
 /** Build the local-keygen-mode plugin. The service contributes
@@ -44,15 +43,20 @@ const buildLocalKeygenPlugin = (opts) => {
 		role: "service",
 		section: "service",
 		pluginKey: sealPluginKey(resolved.name),
+		staticCodegen: () => [makeSealStaticCodegen({
+			name: resolved.name,
+			mode: "local-keygen"
+		})],
 		start: (deps) => Effect.gen(function* () {
+			const ctx = yield* PluginContext;
 			const { sui, signer: signerAccount } = deps;
 			const runtime = yield* ContainerRuntimeService;
 			const identity = yield* IdentityContext;
-			const publisher = yield* ArtifactPublisherService;
+			const publisher = yield* CacheService;
 			const stackPaths = yield* StackPathsService;
 			const fs = yield* FileSystem.FileSystem;
 			const path = yield* Path.Path;
-			const probe = yield* chainProbeFor(sui.chain);
+			const probe = yield* chainProbeFor(sui.chainId);
 			const servicePath = path.join(stackPaths.stackRoot, "seal", resolved.name);
 			yield* fs.makeDirectory(servicePath, { recursive: true }).pipe(Effect.catch((cause) => Effect.fail(sealError("config-render", {
 				name: resolved.name,
@@ -83,7 +87,7 @@ const buildLocalKeygenPlugin = (opts) => {
 				sdk: sui.sdk,
 				...sui.buildImage !== null ? { buildImage: sui.buildImage } : {},
 				chainProbe: probe,
-				chain: sui.chain,
+				chainId: sui.chainId,
 				servicePath,
 				containerName: `devstack-${identity.app}-${identity.stack}-seal-${resolved.name}-key-server`,
 				labels: {
@@ -97,34 +101,29 @@ const buildLocalKeygenPlugin = (opts) => {
 				routedHostname: routed.hostname,
 				routedUrl: routed.url
 			}, resolved);
-			return {
+			const resolvedValue = {
 				...boot.keyServer,
 				mode: "local-keygen",
 				manager: boot.keyManager
 			};
-		}),
-		capabilities: ({ value: resolvedKs, runtime: acquireCtx }) => {
-			const bindings = {
+			ctx.snapshotExtra(makeLocalKeygenSnapshotable({
+				name: resolved.name,
+				app: identity.app,
+				stack: identity.stack
+			}));
+			ctx.codegen(makeSealCodegenable({
 				name: resolved.name,
-				objectId: resolvedKs.objectId,
-				keyServerUrl: resolvedKs.keyServerUrl,
-				serverConfigs: resolvedKs.serverConfigs,
+				objectId: resolvedValue.objectId,
+				keyServerUrl: resolvedValue.keyServerUrl,
+				serverConfigs: resolvedValue.serverConfigs,
 				mode: "local-keygen"
-			};
-			return [
-				makeLocalKeygenSnapshotable({
-					name: resolved.name,
-					app: acquireCtx.identity.app,
-					stack: acquireCtx.identity.stack
-				}),
-				makeSealCodegenable(bindings),
-				makeSealRoutable({
-					name: resolved.name,
-					containerName: `devstack-${acquireCtx.identity.app}-${acquireCtx.identity.stack}-seal-${resolved.name}-key-server`
-				})
-			];
-		},
-		errorContributions: sealErrorContributions
+			}));
+			ctx.endpoint(makeSealRoutable({
+				name: resolved.name,
+				containerName: `devstack-${identity.app}-${identity.stack}-seal-${resolved.name}-key-server`
+			}));
+			return resolvedValue;
+		})
 	});
 };
 /** Build the live-mode plugin. No Routable (URL is remote). */
@@ -146,25 +145,35 @@ const buildLivePlugin = (opts) => {
 		mode: "live"
 	};
 	const snap = makeKnownSnapshotable({ name });
-	const codegen = makeSealCodegenable(bindings);
 	return definePlugin({
 		id: sealResource.id,
 		role: "task",
 		section: "service",
+		staticCodegen: () => [makeSealStaticCodegen({
+			name,
+			mode: "live",
+			known: {
+				objectId: bindings.objectId,
+				keyServerUrl: bindings.keyServerUrl,
+				serverConfigs: bindings.serverConfigs
+			}
+		})],
 		start: () => Effect.gen(function* () {
+			const ctx = yield* PluginContext;
 			const mode = {
 				mode: "live",
 				name,
 				resolved: validated
 			};
+			const resolved = yield* bootSealService(yield* CacheService, mode);
+			ctx.snapshotExtra(snap);
+			ctx.codegen(makeSealCodegenable(bindings));
 			return {
-				...(yield* bootSealService(yield* ArtifactPublisherService, mode)).keyServer,
+				...resolved.keyServer,
 				mode: "live",
 				manager: null
 			};
-		}),
-		capabilities: [snap, codegen],
-		errorContributions: sealErrorContributions
+		})
 	});
 };
 /** Build the fork-known-mode plugin. Structurally symmetric with
@@ -191,29 +200,42 @@ const buildForkKnownPlugin = (opts) => {
 		id: sealResource.id,
 		role: "task",
 		section: "service",
+		staticCodegen: () => [makeSealStaticCodegen({
+			name,
+			mode: "fork-known",
+			known: {
+				objectId: validated.objectId,
+				keyServerUrl: validated.keyServerUrl,
+				serverConfigs: [{
+					objectId: validated.objectId,
+					weight: 1
+				}]
+			}
+		})],
 		start: () => Effect.gen(function* () {
+			const ctx = yield* PluginContext;
 			const mode = {
 				mode: "fork-known",
 				name,
 				upstream: opts.upstream,
 				resolved: validated
 			};
-			return {
-				...(yield* bootSealService(yield* ArtifactPublisherService, mode)).keyServer,
+			const resolved = yield* bootSealService(yield* CacheService, mode);
+			const resolvedValue = {
+				...resolved.keyServer,
 				mode: "fork-known",
 				manager: null
 			};
-		}),
-		capabilities: ({ value: resolvedKs }) => {
-			return [snap, makeSealCodegenable({
+			ctx.snapshotExtra(snap);
+			ctx.codegen(makeSealCodegenable({
 				name,
-				objectId: resolvedKs.objectId,
-				keyServerUrl: resolvedKs.keyServerUrl,
-				serverConfigs: resolvedKs.serverConfigs,
+				objectId: resolved.keyServer.objectId,
+				keyServerUrl: resolved.keyServer.keyServerUrl,
+				serverConfigs: resolved.keyServer.serverConfigs,
 				mode: "fork-known"
-			})];
-		},
-		errorContributions: sealErrorContributions
+			}));
+			return resolvedValue;
+		})
 	});
 };
 /** Explicit Seal factory. `local-keygen` requires a signer; live and