@mysten-incubation/devstack 0.1.1 → 0.2.0

package/dist/plugins/wallet/codegen.mjs

@@ -1,7 +1,4 @@
 import { defineSimpleConstExport } from "../internal/codegen-helpers.mjs";
-import { WalletSpans } from "./spans.mjs";
-import { redactToken } from "./pairing.mjs";
-import { Effect } from "effect";
 //#region src/plugins/wallet/codegen.ts
 /**
 * Construct the Codegenable contribution.
@@ -18,14 +15,11 @@ import { Effect } from "effect";
 */
 const makeWalletCodegen = (resolved) => defineSimpleConstExport({
 	emitterName: "dapp-kit-config",
-	outputPath: "dapp-kit/config.ts",
-	exportName: "dappKitConfig",
+	outputPath: "dev-wallet.ts",
+	exportName: "devWallet",
 	value: resolved,
-	sensitive: true,
-	preEmit: Effect.annotateCurrentSpan({
-		[WalletSpans.codegenPairUrl]: redactToken(resolved.pairUrl),
-		[WalletSpans.codegenWalletUrl]: resolved.walletUrl
-	})
+	outputLocation: "generated-extras",
+	sensitive: true
 });
 //#endregion
 export { makeWalletCodegen };

package/dist/plugins/wallet/codegen.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/wallet/codegen.ts"],"sourcesContent":["// Wallet plugin — Codegenable contribution.\n//\n// Architecture (15-wallet.md §\"Capabilities PRODUCED\" + §\"Codegen\n// emits a `dapp-kit-config.ts`\"):\n//\n//   - The browser-side dev-wallet adapter is the cross-boundary\n//     consumer. It reads a typed `dapp-kit-config` value at startup,\n//     constructs a `DevstackSignerAdapter`, and registers it with\n//     `@mysten/dapp-kit`'s wallet-standard surface (in user-app\n//     bundle code — devstack itself NEVER imports dapp-kit).\n//\n//   - The emitted file lives at `dapp-kit/config.ts` under the staging\n//     dir. The generated module owns the exported config value's type.\n//\n// SENSITIVE FLAG (task requirement #5 — manifest-vs-token threat\n// surface):\n//\n//   - The emitted file carries the unredacted pair URL (incl. the\n//     `#token=<32-hex>` fragment) so the dev-wallet adapter can wire\n//     itself up without a side-channel read.\n//   - Therefore `sensitive: true`. The codegen orchestrator tightens\n//     the file mode to `0o600` on emit AND injects the file path into\n//     `.gitignore`.\n//\n// Distilled-doc tension absorbed (15-wallet.md \"Manifest carries\n// unredacted pair URL while token file is 0o600 — pick one\"):\n//\n//   We pick \"tighten the emit perms\". The token still lives in a\n//   `0o600` side-channel file (see `pairing.ts:tokenPath`), AND the\n//   codegen emit is also `0o600` via the sensitive flag. The legacy\n//   `.devstack/manifest.json` write that left the pair URL world-\n//   readable is GONE — the rewrite no longer emits an unredacted pair\n//   URL into the manifest. Only the codegen file carries it, and that\n//   file is tightened.\n//\n//   See the report's §\"Architecture-doc revisions\" for the\n//   architecture-doc note that needs to land alongside this.\n\nimport { Effect } from 'effect';\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\n\nimport { defineSimpleConstExport } from '../internal/codegen-helpers.ts';\n\nimport { redactToken } from './pairing.ts';\nimport { WalletSpans } from './spans.ts';\n\n// ----------------------------------------------------------------------\n// Emitted shape\n// ----------------------------------------------------------------------\n\n/** The typed shape `dapp-kit/config.ts` exports. Downstream consumers\n *  (the user-app's dapp-kit boot code) import and consume this.\n *\n *  Field shape mirrors what `DevstackSignerAdapter` needs:\n *\n *    - `walletUrl`     : the wallet HTTP server's URL (router-fronted\n *                        host form when available, direct-loopback\n *                        fallback otherwise).\n *    - `pairUrl`       : `walletUrl` + `/#token=<32-hex>` (single\n *                        source of truth for the token).\n *    - `protocolPaths` : path constants the adapter reads. Mirrored\n *                        here so the adapter doesn't depend on a\n *                        separate import.\n *    - `chain`         : Sui chain id the wallet's accounts are\n *                        scoped to. Surfaced so dapp-kit can pin its\n *                        active chain.\n */\nexport interface DappKitConfigBindings {\n\treadonly walletUrl: string;\n\treadonly pairUrl: string;\n\treadonly chain: string;\n\treadonly protocolPaths: {\n\t\treadonly health: string;\n\t\treadonly accounts: string;\n\t\treadonly signTransaction: string;\n\t\treadonly signPersonalMessage: string;\n\t};\n}\n\n// ----------------------------------------------------------------------\n// Decl construction\n// ----------------------------------------------------------------------\n\n/**\n * Construct the Codegenable contribution.\n *\n *  Emits `dapp-kit/config.ts` with `sensitive: true` → the orchestrator\n *  writes the file with `0o600` and gitignores it. The emitted shape\n *  carries the unredacted pair URL; the side-channel token file is\n *  also `0o600`.\n *\n *  The `resolved` arg is supplied AFTER acquire (the substrate's\n *  \"resolve-once\" memo). At factory time the barrel passes a\n *  placeholder so the type plumbing works; at codegen time the\n *  substrate re-evaluates with the resolved values.\n */\nexport const makeWalletCodegen = (\n\tresolved: DappKitConfigBindings,\n): CodegenableDecl<'dapp-kit-config'> =>\n\tdefineSimpleConstExport({\n\t\temitterName: 'dapp-kit-config',\n\t\toutputPath: 'dapp-kit/config.ts',\n\t\texportName: 'dappKitConfig',\n\t\tvalue: resolved,\n\t\t// SENSITIVE: drives 0o600 + .gitignore. The architecture has\n\t\t// this hook (`SnapshotableDecl` mirrors it for the snapshot\n\t\t// subtree).\n\t\tsensitive: true,\n\t\t// Span annotation logs ONLY the redacted form — defense-in-\n\t\t// depth so any debug-mode span dump doesn't leak the token.\n\t\tpreEmit: Effect.annotateCurrentSpan({\n\t\t\t[WalletSpans.codegenPairUrl]: redactToken(resolved.pairUrl),\n\t\t\t[WalletSpans.codegenWalletUrl]: resolved.walletUrl,\n\t\t}),\n\t});\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiGA,MAAa,qBACZ,aAEA,wBAAwB;CACvB,aAAa;CACb,YAAY;CACZ,YAAY;CACZ,OAAO;CAIP,WAAW;CAGX,SAAS,OAAO,oBAAoB;GAClC,YAAY,iBAAiB,YAAY,SAAS,QAAQ;GAC1D,YAAY,mBAAmB,SAAS;EACzC,CAAC;CACF,CAAC"}
+{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/wallet/codegen.ts"],"sourcesContent":["// Wallet plugin — Codegenable contribution.\n//\n// Architecture (15-wallet.md §\"Capabilities PRODUCED\" + §\"Codegen\n// emits a `dapp-kit-config.ts`\"):\n//\n//   - The browser-side dev-wallet adapter is the cross-boundary\n//     consumer. It reads a typed `dapp-kit-config` value at startup,\n//     constructs a `DevstackSignerAdapter`, and registers it with\n//     `@mysten/dapp-kit`'s wallet-standard surface (in user-app\n//     bundle code — devstack itself NEVER imports dapp-kit).\n//\n//   - The emitted file lives at `dapp-kit/config.ts` under the staging\n//     dir. The generated module owns the exported config value's type.\n//\n// SENSITIVE FLAG (manifest-vs-token threat surface):\n//\n//   - The emitted file carries the unredacted pair URL (incl. the\n//     `#token=<32-hex>` fragment) so the dev-wallet adapter can wire\n//     itself up without a side-channel read.\n//   - Therefore `sensitive: true`. The codegen orchestrator tightens\n//     the file mode to `0o600` on emit AND injects the file path into\n//     `.gitignore`.\n//   - The token lives in a `0o600` side-channel file (see\n//     `pairing.ts:tokenPath`) AND the codegen emit is `0o600` via the\n//     sensitive flag. The unredacted pair URL is never written to a\n//     world-readable manifest — only the tightened codegen file carries\n//     it.\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\n\nimport { defineSimpleConstExport } from '../internal/codegen-helpers.ts';\n\n// ----------------------------------------------------------------------\n// Emitted shape\n// ----------------------------------------------------------------------\n\n/** The typed shape `dapp-kit/config.ts` exports. Downstream consumers\n *  (the user-app's dapp-kit boot code) import and consume this.\n *\n *  Field shape mirrors what `DevstackSignerAdapter` needs:\n *\n *    - `walletUrl`     : the wallet HTTP server's URL (router-fronted\n *                        host form when available, direct-loopback\n *                        fallback otherwise).\n *    - `pairUrl`       : `walletUrl` + `/#token=<32-hex>` (single\n *                        source of truth for the token).\n *    - `protocolPaths` : path constants the adapter reads. Mirrored\n *                        here so the adapter doesn't depend on a\n *                        separate import.\n *    - `network`       : the network name the wallet's accounts are\n *                        scoped to (e.g. `localnet`). The dev wallet\n *                        derives the wallet-standard chain (`sui:<network>`)\n *                        from it at the wallet-standard boundary; devstack\n *                        itself never carries the `sui:`-prefixed form.\n */\nexport interface DevWalletConfig {\n\treadonly walletUrl: string;\n\treadonly pairUrl: string;\n\treadonly network: string;\n\treadonly protocolPaths: {\n\t\treadonly health: string;\n\t\treadonly accounts: string;\n\t\treadonly signTransaction: string;\n\t\treadonly signPersonalMessage: string;\n\t};\n}\n\n// ----------------------------------------------------------------------\n// Decl construction\n// ----------------------------------------------------------------------\n\n/**\n * Construct the Codegenable contribution.\n *\n *  Emits `dapp-kit/config.ts` with `sensitive: true` → the orchestrator\n *  writes the file with `0o600` and gitignores it. The emitted shape\n *  carries the unredacted pair URL; the side-channel token file is\n *  also `0o600`.\n *\n *  The `resolved` arg is supplied AFTER acquire (the substrate's\n *  \"resolve-once\" memo). At factory time the barrel passes a\n *  placeholder so the type plumbing works; at codegen time the\n *  substrate re-evaluates with the resolved values.\n */\nexport const makeWalletCodegen = (resolved: DevWalletConfig): CodegenableDecl<'dapp-kit-config'> =>\n\tdefineSimpleConstExport({\n\t\temitterName: 'dapp-kit-config',\n\t\toutputPath: 'dev-wallet.ts',\n\t\texportName: 'devWallet',\n\t\tvalue: resolved,\n\t\t// Dev-only + secret-bearing: lands in the gitignored\n\t\t// `generated-extras` tree (reached via `@devstack-dev`). The\n\t\t// token never enters the runtime `src/generated/` tree.\n\t\toutputLocation: 'generated-extras',\n\t\t// SENSITIVE: drives 0o600. The architecture has this hook\n\t\t// (`SnapshotableDecl` mirrors it for the snapshot subtree).\n\t\t// `generated-extras` is already gitignored at the `.devstack`\n\t\t// level, so the codegen `.gitignore` does not list it.\n\t\tsensitive: true,\n\t});\n"],"mappings":";;;;;;;;;;;;;;;AAoFA,MAAa,qBAAqB,aACjC,wBAAwB;CACvB,aAAa;CACb,YAAY;CACZ,YAAY;CACZ,OAAO;CAIP,gBAAgB;CAKhB,WAAW;AACZ,CAAC"}

package/dist/plugins/wallet/errors.mjs

@@ -7,10 +7,7 @@ const walletRequestError = (parts) => ({
 	_tag: "WalletRequestError",
 	...parts
 });
-/** Error tags this plugin contributes — surfaced to the cause walker
-*  via `PluginErrorContribution`. */
-const WALLET_ERROR_TAGS = ["WalletBootError", "WalletRequestError"];
 //#endregion
-export { WALLET_ERROR_TAGS, walletBootError, walletRequestError };
+export { walletBootError, walletRequestError };
 
 //# sourceMappingURL=errors.mjs.map

package/dist/plugins/wallet/errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/wallet/errors.ts"],"sourcesContent":["// Wallet plugin — typed errors.\n//\n// Distilled-doc finding (15-wallet.md \"Failure modes\"): the wallet's\n// failure surface separates BOOT-time errors from REQUEST-time errors.\n// Boot errors surface as `WalletBootError` (port allocation, listen\n// failure, token-file write); request errors surface as\n// `WalletRequestError` (auth, origin, route, body parse, sign-route\n// failure). The two channels never mix — request errors flow back to\n// the HTTP client as JSON envelopes, boot errors flow up the supervisor\n// scope.\n//\n// Effect v4: plain interface + `_tag` literal discriminator (no\n// subclassing). Per-plugin tagged-error convention — the cause walker\n// dispatches on `_tag`.\n\n/**\n * Phases for `WalletBootError`. Closed sum — adding a phase means\n * editing this list AND any cause-walker display tables.\n *\n *  - `listen`            : `http.Server.listen` rejected (typically\n *                          EADDRINUSE after port-broker forward-scan, or\n *                          EACCES on a privileged port).\n *  - `allocate-port`     : the supervisor's port broker could not yield\n *                          a free port near the preferred one.\n *  - `read-token`        : the on-disk pairing-token file existed but\n *                          could not be read (EACCES, EIO).\n *  - `write-token`       : the freshly-minted token file could not be\n *                          persisted (ENOSPC, EROFS).\n *  - `bind-account`      : a consumed account tag failed to resolve at\n *                          acquire time (re-thrown with a wallet phase).\n *  - `route-url`         : failed to construct the router-fronted URL\n *                          for the generated dapp-kit config.\n *  - `no-accounts`       : account inference resolved to an empty set.\n */\nexport type WalletBootPhase =\n\t| 'listen'\n\t| 'allocate-port'\n\t| 'read-token'\n\t| 'write-token'\n\t| 'bind-account'\n\t| 'route-url'\n\t| 'no-accounts';\n\n/** Boot-time wallet error — raised by the plugin's acquire body. */\nexport interface WalletBootError {\n\treadonly _tag: 'WalletBootError';\n\treadonly phase: WalletBootPhase;\n\treadonly message: string;\n\treadonly hint?: string;\n\treadonly cause?: unknown;\n}\n\nexport const walletBootError = (parts: Omit<WalletBootError, '_tag'>): WalletBootError => ({\n\t_tag: 'WalletBootError',\n\t...parts,\n});\n\n/**\n * Phases for `WalletRequestError`. Each maps to an HTTP status the\n * server emits (status code carried explicitly so renderers can keep\n * the mapping in one place rather than re-deriving it).\n *\n *  - `origin-missing`        : 403 — no Origin header on a protected\n *                              route (closes the curl/non-browser\n *                              bypass; mandatory by C12).\n *  - `origin-forbidden`      : 403 — Origin not in the stack-scoped\n *                              allowlist.\n *  - `unauthorized`          : 401 — bearer absent or did not survive\n *                              constant-time compare.\n *  - `route-not-found`       : 404 — `/api/v1/devstack/*` path with no\n *                              handler wired.\n *  - `address-not-found`     : 404 — sign request named an address the\n *                              wallet did not bind.\n *  - `body-invalid`          : 400 — JSON parse, missing required\n *                              field, non-base64 bytes, body >64 KiB.\n *  - `sign-route-failed`     : 500 — the routed `AccountValue` sign\n *                              closure raised an `AccountSignError`.\n */\nexport type WalletRequestPhase =\n\t| 'origin-missing'\n\t| 'origin-forbidden'\n\t| 'unauthorized'\n\t| 'route-not-found'\n\t| 'address-not-found'\n\t| 'body-invalid'\n\t| 'sign-route-failed';\n\n/** Request-time wallet error — raised by the in-process HTTP handlers.\n *  Carries the HTTP status the server will write and an optional inner\n *  cause (e.g. an `AccountSignError` for `sign-route-failed`). */\nexport interface WalletRequestError {\n\treadonly _tag: 'WalletRequestError';\n\treadonly phase: WalletRequestPhase;\n\treadonly httpStatus: number;\n\treadonly message: string;\n\treadonly cause?: unknown;\n}\n\nexport const walletRequestError = (\n\tparts: Omit<WalletRequestError, '_tag'>,\n): WalletRequestError => ({ _tag: 'WalletRequestError', ...parts });\n\n/** Union of every error a wallet caller may encounter. */\nexport type WalletError = WalletBootError | WalletRequestError;\n\n/** Error tags this plugin contributes — surfaced to the cause walker\n *  via `PluginErrorContribution`. */\nexport const WALLET_ERROR_TAGS: ReadonlyArray<WalletError['_tag']> = [\n\t'WalletBootError',\n\t'WalletRequestError',\n] as const;\n"],"mappings":";AAoDA,MAAa,mBAAmB,WAA2D;CAC1F,MAAM;CACN,GAAG;CACH;AA2CD,MAAa,sBACZ,WACyB;CAAE,MAAM;CAAsB,GAAG;CAAO;;;AAOlE,MAAa,oBAAwD,CACpE,mBACA,qBACA"}
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/plugins/wallet/errors.ts"],"sourcesContent":["// Wallet plugin — typed errors.\n//\n// Distilled-doc finding (15-wallet.md \"Failure modes\"): the wallet's\n// failure surface separates BOOT-time errors from REQUEST-time errors.\n// Boot errors surface as `WalletBootError` (port allocation, listen\n// failure, token-file write); request errors surface as\n// `WalletRequestError` (auth, origin, route, body parse, sign-route\n// failure). The two channels never mix — request errors flow back to\n// the HTTP client as JSON envelopes, boot errors flow up the supervisor\n// scope.\n//\n// Effect v4: plain interface + `_tag` literal discriminator (no\n// subclassing). Per-plugin tagged-error convention — the cause walker\n// dispatches on `_tag`.\n\n/**\n * Phases for `WalletBootError`. Closed sum — adding a phase means\n * editing this list AND any cause-walker display tables.\n *\n *  - `listen`            : `http.Server.listen` rejected (typically\n *                          EADDRINUSE after port-broker forward-scan, or\n *                          EACCES on a privileged port).\n *  - `allocate-port`     : the supervisor's port broker could not yield\n *                          a free port near the preferred one.\n *  - `read-token`        : the on-disk pairing-token file existed but\n *                          could not be read (EACCES, EIO).\n *  - `write-token`       : the freshly-minted token file could not be\n *                          persisted (ENOSPC, EROFS).\n *  - `bind-account`      : a consumed account tag failed to resolve at\n *                          acquire time (re-thrown with a wallet phase).\n *  - `route-url`         : failed to construct the router-fronted URL\n *                          for the generated dapp-kit config.\n *  - `no-accounts`       : account inference resolved to an empty set.\n */\nexport type WalletBootPhase =\n\t| 'listen'\n\t| 'allocate-port'\n\t| 'read-token'\n\t| 'write-token'\n\t| 'bind-account'\n\t| 'route-url'\n\t| 'no-accounts';\n\n/** Boot-time wallet error — raised by the plugin's acquire body. */\nexport interface WalletBootError {\n\treadonly _tag: 'WalletBootError';\n\treadonly phase: WalletBootPhase;\n\treadonly message: string;\n\treadonly hint?: string;\n\treadonly cause?: unknown;\n}\n\nexport const walletBootError = (parts: Omit<WalletBootError, '_tag'>): WalletBootError => ({\n\t_tag: 'WalletBootError',\n\t...parts,\n});\n\n/**\n * Phases for `WalletRequestError`. Each maps to an HTTP status the\n * server emits (status code carried explicitly so renderers can keep\n * the mapping in one place rather than re-deriving it).\n *\n *  - `origin-missing`        : 403 — no Origin header on a protected\n *                              route (closes the curl/non-browser\n *                              bypass; mandatory by C12).\n *  - `origin-forbidden`      : 403 — Origin not in the stack-scoped\n *                              allowlist.\n *  - `unauthorized`          : 401 — bearer absent or did not survive\n *                              constant-time compare.\n *  - `route-not-found`       : 404 — `/api/v1/devstack/*` path with no\n *                              handler wired.\n *  - `address-not-found`     : 404 — sign request named an address the\n *                              wallet did not bind.\n *  - `body-invalid`          : 400 — JSON parse, missing required\n *                              field, non-base64 bytes, body >64 KiB.\n *  - `sign-route-failed`     : 500 — the routed `AccountValue` sign\n *                              closure raised an `AccountSignError`.\n */\nexport type WalletRequestPhase =\n\t| 'origin-missing'\n\t| 'origin-forbidden'\n\t| 'unauthorized'\n\t| 'route-not-found'\n\t| 'address-not-found'\n\t| 'body-invalid'\n\t| 'sign-route-failed';\n\n/** Request-time wallet error — raised by the in-process HTTP handlers.\n *  Carries the HTTP status the server will write and an optional inner\n *  cause (e.g. an `AccountSignError` for `sign-route-failed`). */\nexport interface WalletRequestError {\n\treadonly _tag: 'WalletRequestError';\n\treadonly phase: WalletRequestPhase;\n\treadonly httpStatus: number;\n\treadonly message: string;\n\treadonly cause?: unknown;\n}\n\nexport const walletRequestError = (\n\tparts: Omit<WalletRequestError, '_tag'>,\n): WalletRequestError => ({ _tag: 'WalletRequestError', ...parts });\n\n/** Union of every error a wallet caller may encounter. */\nexport type WalletError = WalletBootError | WalletRequestError;\n\n/** The catchable error tags this plugin exposes. Pinned against the\n *  user-facing error catalog by the error-catalog-parity test. */\nexport const WALLET_ERROR_TAGS: ReadonlyArray<WalletError['_tag']> = [\n\t'WalletBootError',\n\t'WalletRequestError',\n] as const;\n"],"mappings":";AAoDA,MAAa,mBAAmB,WAA2D;CAC1F,MAAM;CACN,GAAG;AACJ;AA2CA,MAAa,sBACZ,WACyB;CAAE,MAAM;CAAsB,GAAG;AAAM"}

package/dist/plugins/wallet/index.d.mts

@@ -1,11 +1,8 @@
 import { WALLET_AUTH_HEADER, WALLET_BEARER_PREFIX, WALLET_ENDPOINT_KEY, WALLET_ENDPOINT_NAME, WALLET_PROTOCOL_PREFIX, WALLET_TOKEN_FRAGMENT_KEY, WALLET_TOKEN_HEX_LENGTH, WalletHttpPath, WalletHttpPathValue } from "../../contracts/wallet-protocol.mjs";
-import { CodegenableDecl } from "../../contracts/codegenable.mjs";
-import { RoutableDecl } from "../../contracts/routable.mjs";
-import { SnapshotableDecl } from "../../contracts/snapshotable.mjs";
 import { Plugin, ResourceRef } from "../../substrate/plugin.mjs";
-import { SuiClient } from "../sui/mode/shared.mjs";
 import { SuiOptions } from "../sui/mode/spec.mjs";
-import { DappKitConfigBindings } from "./codegen.mjs";
+import { SuiClient } from "../sui/mode/shared.mjs";
+import { DevWalletConfig } from "./codegen.mjs";
 import { WalletBootError, WalletBootPhase, WalletError, WalletRequestError, WalletRequestPhase } from "./errors.mjs";
 import { PairingToken } from "./pairing.mjs";
 import { WalletServerHandle } from "./server.mjs";
@@ -55,7 +52,7 @@ declare function wallet(opts: Omit<WalletOptions, 'accounts'> & {
 declare function wallet(): ReturnType<typeof makeWalletMember<readonly []>>;
 declare function makeWalletMember<Accounts extends ReadonlyArray<WalletAccountMember>>(opts: WalletOptions, accounts: Accounts): Plugin<"wallet", WalletValue, readonly [ResourceRef<"sui", SuiClient & {
   readonly mode: SuiOptions["mode"];
-}>, ...Accounts], readonly [SnapshotableDecl, CodegenableDecl<"dapp-kit-config">, RoutableDecl]>;
+}>, ...Accounts]>;
 //#endregion
 export { wallet };
 //# sourceMappingURL=index.d.mts.map

package/dist/plugins/wallet/index.mjs

@@ -2,22 +2,21 @@ import { definePlugin, resource } from "../../substrate/plugin.mjs";
 import { attachPluginExpander } from "../../contracts/plugin-expander.mjs";
 import "../../api/define-plugin.mjs";
 import { IdentityContext, StackPathsService } from "../../substrate/runtime/paths.mjs";
+import { PluginContext } from "../../substrate/plugin-ctx.mjs";
 import { DEFAULT_PORT_WINDOW, PortBrokerService } from "../../substrate/runtime/port-broker/service.mjs";
 import "../../substrate/runtime/port-broker/index.mjs";
 import { renderUrl, routedHostname } from "../../substrate/runtime/routed-url.mjs";
 import { HOST_SERVICE_DEFAULT_ENTRYPOINT_PORT } from "../host-service/routable.mjs";
 import "../../contracts/wallet-protocol.mjs";
 import { WALLET_ENTRYPOINT_PORT, makeWalletRoutable } from "./routable.mjs";
-import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
 import { suiResource } from "../sui/index.mjs";
 import "../host-service/index.mjs";
-import { WALLET_ERROR_TAGS, walletBootError } from "./errors.mjs";
-import "./spans.mjs";
-import "./protocol.mjs";
-import "./pairing.mjs";
 import { makeWalletCodegen } from "./codegen.mjs";
+import { walletBootError } from "./errors.mjs";
 import { makeWalletSnapshotable } from "./snapshot.mjs";
 import "./origin-policy.mjs";
+import "./protocol.mjs";
+import "./pairing.mjs";
 import "./server.mjs";
 import { acquireWallet } from "./service.mjs";
 import { Effect } from "effect";
@@ -45,7 +44,6 @@ const isAccountResourceMember = (member) => member.id.startsWith(ACCOUNT_RESOURC
 /** The wallet plugin's resource identity. ONE per stack (15-wallet.md
 *  "singleton per stack"). The id is `'wallet'` (singular). */
 const walletResource = resource("wallet");
-const walletErrorContributions = pluginErrorContributions(WALLET_ERROR_TAGS);
 function wallet(opts) {
 	const resolvedOpts = opts ?? { accounts: "all" };
 	if (resolvedOpts.accounts === "all") {
@@ -74,6 +72,7 @@ function makeWalletMember(opts, accounts) {
 		role: "service",
 		section: "service",
 		start: (deps) => Effect.gen(function* () {
+			const ctx = yield* PluginContext;
 			const identity = yield* IdentityContext;
 			const paths = yield* StackPathsService;
 			const portBroker = yield* PortBrokerService;
@@ -96,10 +95,10 @@ function makeWalletMember(opts, accounts) {
 				message: `wallet app-origin URL construction failed: ${err.detail}`,
 				cause: err
 			})));
-			return yield* acquireWallet(resolvedOpts, {
+			const resolved = yield* acquireWallet(resolvedOpts, {
 				app: identity.app,
 				stack: identity.stack,
-				chain: identity.chain,
+				network: identity.network,
 				stateRoot: paths.stackRoot,
 				allocatePort: (preferred, probeHost) => portBroker.allocate({
 					owner: "wallet",
@@ -116,19 +115,15 @@ function makeWalletMember(opts, accounts) {
 				routerFrontedUrl,
 				routedAppOrigin
 			});
-		}),
-		errorContributions: walletErrorContributions,
-		capabilities: ({ value: resolved, runtime: acquireCtx }) => {
-			return [
-				makeWalletSnapshotable(),
-				makeWalletCodegen(resolved.bindings),
-				makeWalletRoutable({
-					app: acquireCtx.identity.app,
-					stack: acquireCtx.identity.stack,
-					port: resolved.localPort
-				})
-			];
-		}
+			ctx.snapshotExtra(makeWalletSnapshotable());
+			ctx.codegen(makeWalletCodegen(resolved.bindings));
+			ctx.endpoint(makeWalletRoutable({
+				app: identity.app,
+				stack: identity.stack,
+				port: resolved.localPort
+			}));
+			return resolved;
+		})
 	});
 }
 //#endregion

package/dist/plugins/wallet/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/wallet/index.ts"],"sourcesContent":["// Wallet plugin — barrel + `wallet(opts?)` factory.\n//\n// Architecture (15-wallet.md):\n//\n//   The wallet bridges devstack (the supervisor host) and the\n//   browser-side dev-wallet adapter (in the separate `dev-wallet`\n//   package). Two parts:\n//\n//     1. The IN-PROCESS HTTP server. Owned here. Boot at acquire,\n//        serve `/api/v1/devstack/*` routes (health, accounts,\n//        sign-transaction, sign-personal-message).\n//\n//     2. The BROWSER-SIDE ADAPTER. Owned by `dev-wallet`. Reads the\n//        codegen-emitted `dapp-kit/config.ts`, constructs a\n//        `DevstackSignerAdapter`, registers it with `@mysten/dapp-\n//        kit`'s wallet-standard surface.\n//\n//   The HTTP protocol is the ONE cross-boundary contract. THIS PACKAGE\n//   NEVER IMPORTS `@mysten/dapp-kit*` OR `@mysten/wallet-standard`.\n//\n// Capabilities emitted:\n//\n//   1. Snapshotable — pairing token under `wallet/token`.\n//   2. Codegenable — `dapp-kit-config` bindings (the dev-wallet\n//      adapter consumes this). Sensitive flag set — 0o600 + gitignore.\n//   3. Routable — wallet UI URL on the stack-scoped router.\n\nimport { Effect } from 'effect';\n\nimport { definePlugin, resource } from '../../api/define-plugin.ts';\nimport { pluginErrorContributions } from '../../api/plugin-errors.ts';\nimport { attachPluginExpander } from '../../contracts/plugin-expander.ts';\nimport { IdentityContext, StackPathsService } from '../../substrate/runtime/paths.ts';\nimport {\n\tDEFAULT_PORT_WINDOW,\n\tPortBrokerService,\n} from '../../substrate/runtime/port-broker/index.ts';\nimport { renderUrl, routedHostname } from '../../substrate/runtime/routed-url.ts';\nimport { suiResource } from '../sui/index.ts';\nimport type { AccountResourceId } from '../account/index.ts';\nimport {\n\tHOST_SERVICE_DEFAULT_ENDPOINT_NAME,\n\tHOST_SERVICE_DEFAULT_ENTRYPOINT_PORT,\n} from '../host-service/index.ts';\n\nimport { makeWalletCodegen } from './codegen.ts';\nimport { WALLET_ERROR_TAGS, walletBootError } from './errors.ts';\nimport { makeWalletRoutable, WALLET_ENTRYPOINT_PORT, WALLET_ROUTE_ROLE } from './routable.ts';\nimport { makeWalletSnapshotable } from './snapshot.ts';\nimport {\n\tacquireWallet,\n\tWALLET_ACCOUNTS_ALL,\n\ttype WalletAcquireContext,\n\ttype WalletAccountMember,\n\ttype WalletOptions,\n\ttype WalletValue,\n} from './service.ts';\nimport type { AnyPlugin } from '../../substrate/plugin.ts';\n\n/** Wallet's expander contributes through the substrate-owned\n *  `PluginExpander` contract (`contracts/plugin-expander.ts`). The\n *  composer dispatches every member's expander uniformly — wallet has\n *  no special-case wiring in `api/define-devstack.ts`.\n *\n *  Compose-time symmetry: any plugin needing the \"rewrite this\n *  placeholder once the full member tuple is known\" rewrite uses the\n *  same `attachPluginExpander(...)` seam wallet uses below. */\n\nconst ACCOUNT_RESOURCE_ID_PREFIX = 'account/' as const;\n\n/** Type-narrowing predicate on a plugin's resource id. The account\n *  plugin's `AccountResourceId<Name>` template-literal type IS the\n *  substrate-owned discriminator (12-account.md \"resource id flows into\n *  the on-disk path, the manifest key, container labels, and generated\n *  TypeScript exports\") — every account member's `id` reduces to\n *  `account/${Name}`. Probing through this typed predicate (vs. a bare\n *  `startsWith` whose narrowing returns `string`) prevents misclassifying\n *  a future plugin whose id happens to start with `account/` but is NOT\n *  the account-plugin shape, AND surfaces a compile error if the\n *  account-id prefix convention ever changes. */\nconst isAccountResourceMember = (\n\tmember: AnyPlugin,\n): member is AnyPlugin & { readonly id: AccountResourceId<string> } =>\n\tmember.id.startsWith(ACCOUNT_RESOURCE_ID_PREFIX);\n\n// ----------------------------------------------------------------------\n// Resource identity\n// ----------------------------------------------------------------------\n\n/** The wallet plugin's resource identity. ONE per stack (15-wallet.md\n *  \"singleton per stack\"). The id is `'wallet'` (singular). */\nconst walletResource = resource<'wallet', WalletValue>('wallet');\nconst walletErrorContributions = pluginErrorContributions(WALLET_ERROR_TAGS);\n\n// ----------------------------------------------------------------------\n// User-facing factory\n// ----------------------------------------------------------------------\n\n/**\n * Construct the wallet plugin.\n *\n * Two parts of the wallet:\n *\n *   - HERE: HTTP server + token + pairing protocol + codegen.\n *   - DEV-WALLET PACKAGE: `@mysten/dapp-kit`-shaped adapter the\n *     user-app's frontend bundle imports.\n *\n *  Distilled-doc invariant (15-wallet.md \"Always explicit\"): the\n *  composer NEVER auto-mounts the wallet. The user calls `wallet()`,\n *  `wallet({ accounts: 'all' })`, or `wallet({ accounts: [alice, bob] })`\n *  and passes the result to `defineDevstack(...)`.\n *\n *  ### Security defaults\n *\n *   - `bindAddress: '0.0.0.0'`. The router runs in Docker, so on\n *     native Linux it reaches this host process through the Docker\n *     host-gateway address instead of host loopback. The published\n *     wallet URL remains stack-scoped through the router.\n *\n *   - Origin allowlist is the router-fronted dev-server origin for\n *     this stack plus any explicit `allowedOrigins`. The wallet does\n *     not auto-allowlist a bare `http://localhost:<vite-port>` form —\n *     `localhost` is not stack-scoped, so a sibling stack on the same\n *     port could pair with this wallet. See `origin-policy.ts`.\n *\n *   - Pairing token in URL fragment only (`#token=<32-hex>`). Never\n *     in query params (would land in access logs / referrers).\n *\n *   - Constant-time bearer compare on every request.\n *\n *   - Token file `0o600`. Codegen output (`dapp-kit/config.ts`)\n *     `0o600` + gitignored via `sensitive: true`.\n */\nexport function wallet<const Accounts extends ReadonlyArray<WalletAccountMember>>(\n\topts: Omit<WalletOptions, 'accounts'> & { readonly accounts: Accounts },\n): ReturnType<typeof makeWalletMember<Accounts>>;\nexport function wallet(\n\topts: Omit<WalletOptions, 'accounts'> & { readonly accounts: typeof WALLET_ACCOUNTS_ALL },\n): ReturnType<typeof makeWalletMember<readonly []>>;\nexport function wallet(): ReturnType<typeof makeWalletMember<readonly []>>;\nexport function wallet(opts?: WalletOptions): AnyPlugin {\n\tconst resolvedOpts: WalletOptions =\n\t\topts ?? ({ accounts: WALLET_ACCOUNTS_ALL } satisfies WalletOptions);\n\tif (resolvedOpts.accounts === WALLET_ACCOUNTS_ALL) {\n\t\t// Deferred placeholder. `dependsOn` carries only `[suiResource]` —\n\t\t// the composer rewrites the member once it knows which account\n\t\t// members are in the stack (api-surface-design §4 D6). Without\n\t\t// composer expansion, the wallet would race account funding;\n\t\t// WITH composer expansion, every per-account dependency edge is\n\t\t// in place by the time the dep-graph builds.\n\t\t//\n\t\t// Type-level: the placeholder's `dependsOn` is `[suiResource]`. A\n\t\t// wider `ReadonlyArray<account/${string}>` would widen the\n\t\t// stack-level `MissingProviders` check to the template literal\n\t\t// (which never reduces to any concrete `account/<name>`), so\n\t\t// the placeholder MUST stay narrow.\n\t\t//\n\t\t// Runtime: the symbol-keyed expander is attached as a value-\n\t\t// only property; the factory's declared return type\n\t\t// intentionally does NOT surface it (a `unique symbol`-keyed\n\t\t// member field would leak into the user's inferred Stack type\n\t\t// and trigger TS2742 \"type cannot be named without a reference\n\t\t// to ./node_modules/.../plugins/wallet\" at every example's\n\t\t// default export).\n\t\tconst placeholder = makeWalletMember(resolvedOpts, [] as const);\n\t\tattachPluginExpander(placeholder, (members) => {\n\t\t\t// Filter the full composed member tuple to the per-account\n\t\t\t// resource members the wallet would otherwise have to receive\n\t\t\t// at factory call. `isAccountResourceMember` narrows on the\n\t\t\t// `AccountResourceId<Name>` template-literal type — the typed\n\t\t\t// discriminator the account plugin's barrel exposes via\n\t\t\t// `AccountResourceId<Name>` — so a future plugin whose id\n\t\t\t// accidentally starts with `account/` cannot masquerade.\n\t\t\tconst accountMembers: Array<WalletAccountMember> = [];\n\t\t\tfor (const m of members) {\n\t\t\t\tif (isAccountResourceMember(m)) {\n\t\t\t\t\taccountMembers.push(m as unknown as WalletAccountMember);\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn makeWalletMember({ ...resolvedOpts, accounts: accountMembers }, accountMembers);\n\t\t});\n\t\treturn placeholder;\n\t}\n\treturn makeWalletMember(resolvedOpts, resolvedOpts.accounts);\n}\n\nfunction makeWalletMember<Accounts extends ReadonlyArray<WalletAccountMember>>(\n\topts: WalletOptions,\n\taccounts: Accounts,\n) {\n\t// Dependencies MUST include every account ref (15-wallet.md\n\t// \"upstreamKeys MUST include suiResource.id + every account id\" — same\n\t// load-bearing invariant). The substrate's topological scheduler\n\t// uses `dependsOn` to drive build order; without including the\n\t// account refs here, the wallet would race account funding and the\n\t// first `signTransaction` would fail with `address-not-found`.\n\t//\n\tconst dependencies = [suiResource, ...accounts] as const;\n\n\t// The resolved-opts shape acquireWallet sees has accounts pinned to\n\t// the resolved tuple — `'all'` is purely a user-surface convenience\n\t// the composer never propagates to the supervisor.\n\tconst resolvedOpts: WalletOptions<Accounts> = { ...opts, accounts };\n\n\treturn definePlugin({\n\t\tid: walletResource.id,\n\t\tdependsOn: dependencies,\n\t\t// The HTTP server is a long-lived host process; per-request\n\t\t// handlers fork off the supervisor-context fiber but the server\n\t\t// itself lives for the stack's lifetime.\n\t\trole: 'service',\n\t\tsection: 'service',\n\t\tstart: (deps) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\t// Pull identity, the stack-paths bundle, and the port-\n\t\t\t\t// broker from the supervisor-provided substrate context.\n\t\t\t\t// `StackPathsService.stackRoot` is the on-disk root for\n\t\t\t\t// per-stack runtime artifacts (incl. `wallet/token`); the\n\t\t\t\t// port broker is per-stack (Layer-driven, one instance per\n\t\t\t\t// stack scope); the wallet's scope hangs off the\n\t\t\t\t// supervisor's `acquireScope`, so any release finalizer\n\t\t\t\t// installed by these primitives unwinds with the rest of\n\t\t\t\t// the plugin's resources on cycle / teardown.\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\tconst paths = yield* StackPathsService;\n\t\t\t\tconst portBroker = yield* PortBrokerService;\n\n\t\t\t\t// The first dependency is the hard Sui ordering edge; the\n\t\t\t\t// remaining values mirror the explicit account tuple.\n\t\t\t\tconst [, ...resolvedAccounts] = deps;\n\t\t\t\tconst routerFrontedUrl = yield* routedHostname(identity, WALLET_ROUTE_ROLE).pipe(\n\t\t\t\t\tEffect.map((hostname) =>\n\t\t\t\t\t\trenderUrl({\n\t\t\t\t\t\t\tprotocol: 'http',\n\t\t\t\t\t\t\thostname,\n\t\t\t\t\t\t\tport: WALLET_ENTRYPOINT_PORT,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\tphase: 'route-url',\n\t\t\t\t\t\t\tmessage: `wallet router URL construction failed: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tconst routedAppOrigin = yield* routedHostname(\n\t\t\t\t\tidentity,\n\t\t\t\t\tHOST_SERVICE_DEFAULT_ENDPOINT_NAME,\n\t\t\t\t).pipe(\n\t\t\t\t\tEffect.map((hostname) =>\n\t\t\t\t\t\trenderUrl({\n\t\t\t\t\t\t\tprotocol: 'http',\n\t\t\t\t\t\t\thostname,\n\t\t\t\t\t\t\tport: HOST_SERVICE_DEFAULT_ENTRYPOINT_PORT,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\tphase: 'route-url',\n\t\t\t\t\t\t\tmessage: `wallet app-origin URL construction failed: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tconst acquireCtx: WalletAcquireContext = {\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tchain: identity.chain,\n\t\t\t\t\tstateRoot: paths.stackRoot,\n\t\t\t\t\tallocatePort: (preferred, probeHost) =>\n\t\t\t\t\t\tportBroker\n\t\t\t\t\t\t\t.allocate({\n\t\t\t\t\t\t\t\towner: 'wallet',\n\t\t\t\t\t\t\t\t// Pin the wallet's UX-meaningful range so the dev wallet\n\t\t\t\t\t\t\t\t// adapter's auto-connect-port heuristic keeps working even\n\t\t\t\t\t\t\t\t// after a fallback scan. The broker scan window is half-open\n\t\t\t\t\t\t\t\t// `[start, start + size)`, so `DEFAULT_PORT_WINDOW`\n\t\t\t\t\t\t\t\t// (start 39200, size 1000) covers 39200..40199 inclusive.\n\t\t\t\t\t\t\t\t// Reuse the broker's exported default rather than a local\n\t\t\t\t\t\t\t\t// literal so the two cannot silently drift (pinned by\n\t\t\t\t\t\t\t\t// `test/plugins/wallet/port-window-pin.test.ts`).\n\t\t\t\t\t\t\t\twindowHint: DEFAULT_PORT_WINDOW,\n\t\t\t\t\t\t\t\tpreferredPort: preferred,\n\t\t\t\t\t\t\t\t...(probeHost === undefined ? {} : { probeHost }),\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\t\tEffect.map((alloc) => alloc.port),\n\t\t\t\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\t\t\t\tphase: 'allocate-port',\n\t\t\t\t\t\t\t\t\t\tmessage: `port-broker allocate failed: ${err.detail}`,\n\t\t\t\t\t\t\t\t\t\thint:\n\t\t\t\t\t\t\t\t\t\t\terr.reason === 'preferred-busy'\n\t\t\t\t\t\t\t\t\t\t\t\t? 'another plugin in this stack is using your preferred port; omit `port` to let the broker pick.'\n\t\t\t\t\t\t\t\t\t\t\t\t: err.reason === 'no-free-port'\n\t\t\t\t\t\t\t\t\t\t\t\t\t? 'the wallet port window is exhausted; check for stray devstack supervisors holding ports.'\n\t\t\t\t\t\t\t\t\t\t\t\t\t: 'bind-probe failed — likely a privileged port or jail restriction.',\n\t\t\t\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t),\n\t\t\t\t\tresolveAccounts: () => Effect.succeed(resolvedAccounts),\n\t\t\t\t\trouterFrontedUrl,\n\t\t\t\t\troutedAppOrigin,\n\t\t\t\t};\n\n\t\t\t\treturn yield* acquireWallet(resolvedOpts, acquireCtx);\n\t\t\t}),\n\t\terrorContributions: walletErrorContributions,\n\t\t// Dynamic capability factory — receives the resolved\n\t\t// `WalletValue` + acquire context. Stamps the real dapp-kit\n\t\t// bindings (walletUrl, pairUrl, chain id, paths) into the\n\t\t// codegen decl, and the real identity app/stack into the\n\t\t// routable decl.\n\t\tcapabilities: ({ value: resolved, runtime: acquireCtx }) => {\n\t\t\tconst snapshot = makeWalletSnapshotable();\n\t\t\tconst codegen = makeWalletCodegen(resolved.bindings);\n\t\t\tconst routable = makeWalletRoutable({\n\t\t\t\tapp: acquireCtx.identity.app,\n\t\t\t\tstack: acquireCtx.identity.stack,\n\t\t\t\tport: resolved.localPort,\n\t\t\t});\n\t\t\treturn [snapshot, codegen, routable] as const;\n\t\t},\n\t});\n}\n\n// ----------------------------------------------------------------------\n// Re-exports\n// ----------------------------------------------------------------------\n\nexport type {\n\tWalletOptions,\n\tWalletValue,\n\tWalletAccountMember,\n\tWalletAccountsAll,\n} from './service.ts';\nexport { WALLET_ACCOUNTS_ALL } from './service.ts';\nexport type { DappKitConfigBindings } from './codegen.ts';\nexport {\n\tWalletHttpPath,\n\tWALLET_PROTOCOL_PREFIX,\n\tWALLET_AUTH_HEADER,\n\tWALLET_BEARER_PREFIX,\n\tWALLET_TOKEN_FRAGMENT_KEY,\n\tWALLET_TOKEN_HEX_LENGTH,\n\tSignRequestSchema,\n\tSignResponseSchema,\n\tHealthResponseSchema,\n\tAccountsResponseSchema,\n\tAccountSummarySchema,\n\tErrorResponseSchema,\n\tSuiAddressSchema,\n\tBase64Schema,\n\tSignatureSchemeSchema,\n\tAccountSourceSchema,\n\ttype WalletHttpPathValue,\n\ttype SignRequest,\n\ttype SignResponse,\n\ttype HealthResponse,\n\ttype AccountsResponse,\n\ttype AccountSummary,\n\ttype ErrorResponse,\n} from './protocol.ts';\nexport type {\n\tWalletError,\n\tWalletBootError,\n\tWalletBootPhase,\n\tWalletRequestError,\n\tWalletRequestPhase,\n} from './errors.ts';\nexport { WALLET_ERROR_TAGS } from './errors.ts';\nexport type { OriginPolicy, OriginPolicyInputs, OriginCheckResult } from './origin-policy.ts';\nexport { resolveOriginPolicy, checkOrigin, corsHeadersFor } from './origin-policy.ts';\nexport type { PairingToken } from './pairing.ts';\nexport {\n\tmintToken,\n\tacquirePairingToken,\n\ttokenPath,\n\tcomposePairUrl,\n\tparsePairUrl,\n\tparseBearerHeader,\n\tsafeBearerEquals,\n\tredactToken,\n} from './pairing.ts';\nexport { WALLET_ENDPOINT_NAME, WALLET_ENDPOINT_KEY, makeWalletRoutable } from './routable.ts';\nexport { WalletSpans } from './spans.ts';\nexport {\n\tdispatch,\n\tstartHttpServer,\n\tMAX_BODY_BYTES,\n\ttype WalletRequest,\n\ttype WalletResponse,\n\ttype WalletServerConfig,\n\ttype WalletServerHandle,\n} from './server.ts';\nexport { makeWalletCodegen } from './codegen.ts';\nexport { makeWalletSnapshotable } from './snapshot.ts';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoEA,MAAM,6BAA6B;;;;;;;;;;;AAYnC,MAAM,2BACL,WAEA,OAAO,GAAG,WAAW,2BAA2B;;;AAQjD,MAAM,iBAAiB,SAAgC,SAAS;AAChE,MAAM,2BAA2B,yBAAyB,kBAAkB;AAgD5E,SAAgB,OAAO,MAAiC;CACvD,MAAM,eACL,QAAS,EAAE,UAAA,OAA+B;AAC3C,KAAI,aAAa,aAAA,OAAkC;EAqBlD,MAAM,cAAc,iBAAiB,cAAc,EAAE,CAAU;AAC/D,uBAAqB,cAAc,YAAY;GAQ9C,MAAM,iBAA6C,EAAE;AACrD,QAAK,MAAM,KAAK,QACf,KAAI,wBAAwB,EAAE,CAC7B,gBAAe,KAAK,EAAoC;AAG1D,UAAO,iBAAiB;IAAE,GAAG;IAAc,UAAU;IAAgB,EAAE,eAAe;IACrF;AACF,SAAO;;AAER,QAAO,iBAAiB,cAAc,aAAa,SAAS;;AAG7D,SAAS,iBACR,MACA,UACC;CAQD,MAAM,eAAe,CAAC,aAAa,GAAG,SAAS;CAK/C,MAAM,eAAwC;EAAE,GAAG;EAAM;EAAU;AAEnE,QAAO,aAAa;EACnB,IAAI,eAAe;EACnB,WAAW;EAIX,MAAM;EACN,SAAS;EACT,QAAQ,SACP,OAAO,IAAI,aAAa;GAUvB,MAAM,WAAW,OAAO;GACxB,MAAM,QAAQ,OAAO;GACrB,MAAM,aAAa,OAAO;GAI1B,MAAM,GAAG,GAAG,oBAAoB;GAChC,MAAM,mBAAmB,OAAO,eAAe,UAAA,MAA4B,CAAC,KAC3E,OAAO,KAAK,aACX,UAAU;IACT,UAAU;IACV;IACA,MAAM;IACN,CAAC,CACF,EACD,OAAO,UAAU,QAChB,gBAAgB;IACf,OAAO;IACP,SAAS,0CAA0C,IAAI;IACvD,OAAO;IACP,CAAC,CACF,CACD;GACD,MAAM,kBAAkB,OAAO,eAC9B,UAAA,MAEA,CAAC,KACD,OAAO,KAAK,aACX,UAAU;IACT,UAAU;IACV;IACA,MAAM;IACN,CAAC,CACF,EACD,OAAO,UAAU,QAChB,gBAAgB;IACf,OAAO;IACP,SAAS,8CAA8C,IAAI;IAC3D,OAAO;IACP,CAAC,CACF,CACD;AA4CD,UAAO,OAAO,cAAc,cAAc;IAzCzC,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,OAAO,SAAS;IAChB,WAAW,MAAM;IACjB,eAAe,WAAW,cACzB,WACE,SAAS;KACT,OAAO;KASP,YAAY;KACZ,eAAe;KACf,GAAI,cAAc,KAAA,IAAY,EAAE,GAAG,EAAE,WAAW;KAChD,CAAC,CACD,KACA,OAAO,KAAK,UAAU,MAAM,KAAK,EACjC,OAAO,UAAU,QAChB,gBAAgB;KACf,OAAO;KACP,SAAS,gCAAgC,IAAI;KAC7C,MACC,IAAI,WAAW,mBACZ,mGACA,IAAI,WAAW,iBACd,6FACA;KACL,OAAO;KACP,CAAC,CACF,CACD;IACH,uBAAuB,OAAO,QAAQ,iBAAiB;IACvD;IACA;IAGmD,CAAC;IACpD;EACH,oBAAoB;EAMpB,eAAe,EAAE,OAAO,UAAU,SAAS,iBAAiB;AAQ3D,UAAO;IAPU,wBAOD;IANA,kBAAkB,SAAS,SAMlB;IALR,mBAAmB;KACnC,KAAK,WAAW,SAAS;KACzB,OAAO,WAAW,SAAS;KAC3B,MAAM,SAAS;KACf,CACkC;IAAC;;EAErC,CAAC"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/wallet/index.ts"],"sourcesContent":["// Wallet plugin — barrel + `wallet(opts?)` factory.\n//\n// Architecture (15-wallet.md):\n//\n//   The wallet bridges devstack (the supervisor host) and the\n//   browser-side dev-wallet adapter (in the separate `dev-wallet`\n//   package). Two parts:\n//\n//     1. The IN-PROCESS HTTP server. Owned here. Boot at acquire,\n//        serve `/api/v1/devstack/*` routes (health, accounts,\n//        sign-transaction, sign-personal-message).\n//\n//     2. The BROWSER-SIDE ADAPTER. Owned by `dev-wallet`. Reads the\n//        codegen-emitted `dapp-kit/config.ts`, constructs a\n//        `DevstackSignerAdapter`, registers it with `@mysten/dapp-\n//        kit`'s wallet-standard surface.\n//\n//   The HTTP protocol is the ONE cross-boundary contract. THIS PACKAGE\n//   NEVER IMPORTS `@mysten/dapp-kit*` OR `@mysten/wallet-standard`.\n//\n// During `start`, the plugin emits (via the typed `ctx.*` verbs):\n//\n//   1. `ctx.snapshotExtra` — pairing token under `wallet/token`.\n//   2. `ctx.codegen` — `dapp-kit-config` bindings (the dev-wallet\n//      adapter consumes this). Sensitive flag set — 0o600 + gitignore.\n//   3. `ctx.endpoint` — wallet UI URL on the stack-scoped router.\n\nimport { Effect } from 'effect';\n\nimport { definePlugin, resource } from '../../api/define-plugin.ts';\nimport { attachPluginExpander } from '../../contracts/plugin-expander.ts';\nimport { IdentityContext, StackPathsService } from '../../substrate/runtime/paths.ts';\nimport {\n\tDEFAULT_PORT_WINDOW,\n\tPortBrokerService,\n} from '../../substrate/runtime/port-broker/index.ts';\nimport { renderUrl, routedHostname } from '../../substrate/runtime/routed-url.ts';\nimport { suiResource } from '../sui/index.ts';\nimport type { AccountResourceId } from '../account/index.ts';\nimport {\n\tHOST_SERVICE_DEFAULT_ENDPOINT_NAME,\n\tHOST_SERVICE_DEFAULT_ENTRYPOINT_PORT,\n} from '../host-service/index.ts';\n\nimport { makeWalletCodegen } from './codegen.ts';\nimport { walletBootError } from './errors.ts';\nimport { makeWalletRoutable, WALLET_ENTRYPOINT_PORT, WALLET_ROUTE_ROLE } from './routable.ts';\nimport { makeWalletSnapshotable } from './snapshot.ts';\nimport {\n\tacquireWallet,\n\tWALLET_ACCOUNTS_ALL,\n\ttype WalletAcquireContext,\n\ttype WalletAccountMember,\n\ttype WalletOptions,\n\ttype WalletValue,\n} from './service.ts';\nimport type { AnyPlugin } from '../../substrate/plugin.ts';\nimport { PluginContext } from '../../substrate/plugin-ctx.ts';\n\n/** Wallet's expander contributes through the substrate-owned\n *  `PluginExpander` contract (`contracts/plugin-expander.ts`). The\n *  composer dispatches every member's expander uniformly — wallet has\n *  no special-case wiring in `api/define-devstack.ts`.\n *\n *  Compose-time symmetry: any plugin needing the \"rewrite this\n *  placeholder once the full member tuple is known\" rewrite uses the\n *  same `attachPluginExpander(...)` seam wallet uses below. */\n\nconst ACCOUNT_RESOURCE_ID_PREFIX = 'account/' as const;\n\n/** Type-narrowing predicate on a plugin's resource id. The account\n *  plugin's `AccountResourceId<Name>` template-literal type IS the\n *  substrate-owned discriminator (12-account.md \"resource id flows into\n *  the on-disk path, the manifest key, container labels, and generated\n *  TypeScript exports\") — every account member's `id` reduces to\n *  `account/${Name}`. Probing through this typed predicate (vs. a bare\n *  `startsWith` whose narrowing returns `string`) prevents misclassifying\n *  a future plugin whose id happens to start with `account/` but is NOT\n *  the account-plugin shape, AND surfaces a compile error if the\n *  account-id prefix convention ever changes. */\nconst isAccountResourceMember = (\n\tmember: AnyPlugin,\n): member is AnyPlugin & { readonly id: AccountResourceId<string> } =>\n\tmember.id.startsWith(ACCOUNT_RESOURCE_ID_PREFIX);\n\n// ----------------------------------------------------------------------\n// Resource identity\n// ----------------------------------------------------------------------\n\n/** The wallet plugin's resource identity. ONE per stack (15-wallet.md\n *  \"singleton per stack\"). The id is `'wallet'` (singular). */\nconst walletResource = resource<'wallet', WalletValue>('wallet');\n\n// ----------------------------------------------------------------------\n// User-facing factory\n// ----------------------------------------------------------------------\n\n/**\n * Construct the wallet plugin.\n *\n * Two parts of the wallet:\n *\n *   - HERE: HTTP server + token + pairing protocol + codegen.\n *   - DEV-WALLET PACKAGE: `@mysten/dapp-kit`-shaped adapter the\n *     user-app's frontend bundle imports.\n *\n *  Distilled-doc invariant (15-wallet.md \"Always explicit\"): the\n *  composer NEVER auto-mounts the wallet. The user calls `wallet()`,\n *  `wallet({ accounts: 'all' })`, or `wallet({ accounts: [alice, bob] })`\n *  and passes the result to `defineDevstack(...)`.\n *\n *  ### Security defaults\n *\n *   - `bindAddress: '0.0.0.0'`. The router runs in Docker, so on\n *     native Linux it reaches this host process through the Docker\n *     host-gateway address instead of host loopback. The published\n *     wallet URL remains stack-scoped through the router.\n *\n *   - Origin allowlist is the router-fronted dev-server origin for\n *     this stack plus any explicit `allowedOrigins`. The wallet does\n *     not auto-allowlist a bare `http://localhost:<vite-port>` form —\n *     `localhost` is not stack-scoped, so a sibling stack on the same\n *     port could pair with this wallet. See `origin-policy.ts`.\n *\n *   - Pairing token in URL fragment only (`#token=<32-hex>`). Never\n *     in query params (would land in access logs / referrers).\n *\n *   - Constant-time bearer compare on every request.\n *\n *   - Token file `0o600`. Codegen output (`dapp-kit/config.ts`)\n *     `0o600` + gitignored via `sensitive: true`.\n */\nexport function wallet<const Accounts extends ReadonlyArray<WalletAccountMember>>(\n\topts: Omit<WalletOptions, 'accounts'> & { readonly accounts: Accounts },\n): ReturnType<typeof makeWalletMember<Accounts>>;\nexport function wallet(\n\topts: Omit<WalletOptions, 'accounts'> & { readonly accounts: typeof WALLET_ACCOUNTS_ALL },\n): ReturnType<typeof makeWalletMember<readonly []>>;\nexport function wallet(): ReturnType<typeof makeWalletMember<readonly []>>;\nexport function wallet(opts?: WalletOptions): AnyPlugin {\n\tconst resolvedOpts: WalletOptions =\n\t\topts ?? ({ accounts: WALLET_ACCOUNTS_ALL } satisfies WalletOptions);\n\tif (resolvedOpts.accounts === WALLET_ACCOUNTS_ALL) {\n\t\t// Deferred placeholder. `dependsOn` carries only `[suiResource]` —\n\t\t// the composer rewrites the member once it knows which account\n\t\t// members are in the stack (api-surface-design §4 D6). Without\n\t\t// composer expansion, the wallet would race account funding;\n\t\t// WITH composer expansion, every per-account dependency edge is\n\t\t// in place by the time the dep-graph builds.\n\t\t//\n\t\t// Type-level: the placeholder's `dependsOn` is `[suiResource]`. A\n\t\t// wider `ReadonlyArray<account/${string}>` would widen the\n\t\t// stack-level `MissingProviders` check to the template literal\n\t\t// (which never reduces to any concrete `account/<name>`), so\n\t\t// the placeholder MUST stay narrow.\n\t\t//\n\t\t// Runtime: the symbol-keyed expander is attached as a value-\n\t\t// only property; the factory's declared return type\n\t\t// intentionally does NOT surface it (a `unique symbol`-keyed\n\t\t// member field would leak into the user's inferred Stack type\n\t\t// and trigger TS2742 \"type cannot be named without a reference\n\t\t// to ./node_modules/.../plugins/wallet\" at every example's\n\t\t// default export).\n\t\tconst placeholder = makeWalletMember(resolvedOpts, [] as const);\n\t\tattachPluginExpander(placeholder, (members) => {\n\t\t\t// Filter the full composed member tuple to the per-account\n\t\t\t// resource members the wallet would otherwise have to receive\n\t\t\t// at factory call. `isAccountResourceMember` narrows on the\n\t\t\t// `AccountResourceId<Name>` template-literal type — the typed\n\t\t\t// discriminator the account plugin's barrel exposes via\n\t\t\t// `AccountResourceId<Name>` — so a future plugin whose id\n\t\t\t// accidentally starts with `account/` cannot masquerade.\n\t\t\tconst accountMembers: Array<WalletAccountMember> = [];\n\t\t\tfor (const m of members) {\n\t\t\t\tif (isAccountResourceMember(m)) {\n\t\t\t\t\taccountMembers.push(m as unknown as WalletAccountMember);\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn makeWalletMember({ ...resolvedOpts, accounts: accountMembers }, accountMembers);\n\t\t});\n\t\treturn placeholder;\n\t}\n\treturn makeWalletMember(resolvedOpts, resolvedOpts.accounts);\n}\n\nfunction makeWalletMember<Accounts extends ReadonlyArray<WalletAccountMember>>(\n\topts: WalletOptions,\n\taccounts: Accounts,\n) {\n\t// Dependencies MUST include every account ref (15-wallet.md\n\t// \"upstreamKeys MUST include suiResource.id + every account id\" — same\n\t// load-bearing invariant). The substrate's topological scheduler\n\t// uses `dependsOn` to drive build order; without including the\n\t// account refs here, the wallet would race account funding and the\n\t// first `signTransaction` would fail with `address-not-found`.\n\t//\n\tconst dependencies = [suiResource, ...accounts] as const;\n\n\t// The resolved-opts shape acquireWallet sees has accounts pinned to\n\t// the resolved tuple — `'all'` is purely a user-surface convenience\n\t// the composer never propagates to the supervisor.\n\tconst resolvedOpts: WalletOptions<Accounts> = { ...opts, accounts };\n\n\treturn definePlugin({\n\t\tid: walletResource.id,\n\t\tdependsOn: dependencies,\n\t\t// The HTTP server is a long-lived host process; per-request\n\t\t// handlers fork off the supervisor-context fiber but the server\n\t\t// itself lives for the stack's lifetime.\n\t\trole: 'service',\n\t\tsection: 'service',\n\t\t// `deps` auto-infers from the resolved `dependsOn`: the hard Sui\n\t\t// ordering edge (discarded) followed by the resolved account\n\t\t// values. `ctx` arrives via the `PluginContext` service.\n\t\tstart: (deps) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst ctx = yield* PluginContext;\n\t\t\t\t// Pull identity, the stack-paths bundle, and the port-\n\t\t\t\t// broker from the supervisor-provided substrate context.\n\t\t\t\t// `StackPathsService.stackRoot` is the on-disk root for\n\t\t\t\t// per-stack runtime artifacts (incl. `wallet/token`); the\n\t\t\t\t// port broker is per-stack (Layer-driven, one instance per\n\t\t\t\t// stack scope); the wallet's scope hangs off the\n\t\t\t\t// supervisor's `acquireScope`, so any release finalizer\n\t\t\t\t// installed by these primitives unwinds with the rest of\n\t\t\t\t// the plugin's resources on cycle / teardown.\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\tconst paths = yield* StackPathsService;\n\t\t\t\tconst portBroker = yield* PortBrokerService;\n\n\t\t\t\t// The first dependency is the hard Sui ordering edge; the\n\t\t\t\t// remaining values mirror the explicit account tuple.\n\t\t\t\tconst [, ...resolvedAccounts] = deps;\n\t\t\t\tconst routerFrontedUrl = yield* routedHostname(identity, WALLET_ROUTE_ROLE).pipe(\n\t\t\t\t\tEffect.map((hostname) =>\n\t\t\t\t\t\trenderUrl({\n\t\t\t\t\t\t\tprotocol: 'http',\n\t\t\t\t\t\t\thostname,\n\t\t\t\t\t\t\tport: WALLET_ENTRYPOINT_PORT,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\tphase: 'route-url',\n\t\t\t\t\t\t\tmessage: `wallet router URL construction failed: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tconst routedAppOrigin = yield* routedHostname(\n\t\t\t\t\tidentity,\n\t\t\t\t\tHOST_SERVICE_DEFAULT_ENDPOINT_NAME,\n\t\t\t\t).pipe(\n\t\t\t\t\tEffect.map((hostname) =>\n\t\t\t\t\t\trenderUrl({\n\t\t\t\t\t\t\tprotocol: 'http',\n\t\t\t\t\t\t\thostname,\n\t\t\t\t\t\t\tport: HOST_SERVICE_DEFAULT_ENTRYPOINT_PORT,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\tphase: 'route-url',\n\t\t\t\t\t\t\tmessage: `wallet app-origin URL construction failed: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tconst acquireCtx: WalletAcquireContext = {\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tnetwork: identity.network,\n\t\t\t\t\tstateRoot: paths.stackRoot,\n\t\t\t\t\tallocatePort: (preferred, probeHost) =>\n\t\t\t\t\t\tportBroker\n\t\t\t\t\t\t\t.allocate({\n\t\t\t\t\t\t\t\towner: 'wallet',\n\t\t\t\t\t\t\t\t// Pin the wallet's UX-meaningful range so the dev wallet\n\t\t\t\t\t\t\t\t// adapter's auto-connect-port heuristic keeps working even\n\t\t\t\t\t\t\t\t// after a fallback scan. The broker scan window is half-open\n\t\t\t\t\t\t\t\t// `[start, start + size)`, so `DEFAULT_PORT_WINDOW`\n\t\t\t\t\t\t\t\t// (start 39200, size 1000) covers 39200..40199 inclusive.\n\t\t\t\t\t\t\t\t// Reuse the broker's exported default rather than a local\n\t\t\t\t\t\t\t\t// literal so the two cannot silently drift (pinned by\n\t\t\t\t\t\t\t\t// `test/plugins/wallet/port-window-pin.test.ts`).\n\t\t\t\t\t\t\t\twindowHint: DEFAULT_PORT_WINDOW,\n\t\t\t\t\t\t\t\tpreferredPort: preferred,\n\t\t\t\t\t\t\t\t...(probeHost === undefined ? {} : { probeHost }),\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\t\tEffect.map((alloc) => alloc.port),\n\t\t\t\t\t\t\t\tEffect.mapError((err) =>\n\t\t\t\t\t\t\t\t\twalletBootError({\n\t\t\t\t\t\t\t\t\t\tphase: 'allocate-port',\n\t\t\t\t\t\t\t\t\t\tmessage: `port-broker allocate failed: ${err.detail}`,\n\t\t\t\t\t\t\t\t\t\thint:\n\t\t\t\t\t\t\t\t\t\t\terr.reason === 'preferred-busy'\n\t\t\t\t\t\t\t\t\t\t\t\t? 'another plugin in this stack is using your preferred port; omit `port` to let the broker pick.'\n\t\t\t\t\t\t\t\t\t\t\t\t: err.reason === 'no-free-port'\n\t\t\t\t\t\t\t\t\t\t\t\t\t? 'the wallet port window is exhausted; check for stray devstack supervisors holding ports.'\n\t\t\t\t\t\t\t\t\t\t\t\t\t: 'bind-probe failed — likely a privileged port or jail restriction.',\n\t\t\t\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t),\n\t\t\t\t\tresolveAccounts: () => Effect.succeed(resolvedAccounts),\n\t\t\t\t\trouterFrontedUrl,\n\t\t\t\t\troutedAppOrigin,\n\t\t\t\t};\n\n\t\t\t\tconst resolved = yield* acquireWallet(resolvedOpts, acquireCtx);\n\n\t\t\t\t// Emit the wallet's contributions inline. `resolved` is the\n\t\t\t\t// just-acquired `WalletValue`; `runtime.identity.{app,stack}`\n\t\t\t\t// map to the `identity` already held here\n\t\t\t\t// (`yield* IdentityContext`). Emit each decl via its matching\n\t\t\t\t// buffered verb IN ORDER (snapshotable → `ctx.snapshotExtra`,\n\t\t\t\t// codegenable → `ctx.codegen`, routable → `ctx.endpoint`); decl\n\t\t\t\t// shapes are load-bearing. The verbs are void and buffer for the\n\t\t\t\t// supervisor's post-start replay.\n\t\t\t\tctx.snapshotExtra(makeWalletSnapshotable());\n\t\t\t\tctx.codegen(makeWalletCodegen(resolved.bindings));\n\t\t\t\tctx.endpoint(\n\t\t\t\t\tmakeWalletRoutable({\n\t\t\t\t\t\tapp: identity.app,\n\t\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\t\tport: resolved.localPort,\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\t\t\treturn resolved;\n\t\t\t}),\n\t});\n}\n\n// ----------------------------------------------------------------------\n// Re-exports\n// ----------------------------------------------------------------------\n\nexport type {\n\tWalletOptions,\n\tWalletValue,\n\tWalletAccountMember,\n\tWalletAccountsAll,\n} from './service.ts';\nexport { WALLET_ACCOUNTS_ALL } from './service.ts';\nexport type { DevWalletConfig } from './codegen.ts';\nexport {\n\tWalletHttpPath,\n\tWALLET_PROTOCOL_PREFIX,\n\tWALLET_AUTH_HEADER,\n\tWALLET_BEARER_PREFIX,\n\tWALLET_TOKEN_FRAGMENT_KEY,\n\tWALLET_TOKEN_HEX_LENGTH,\n\tSignRequestSchema,\n\tSignResponseSchema,\n\tHealthResponseSchema,\n\tAccountsResponseSchema,\n\tAccountSummarySchema,\n\tErrorResponseSchema,\n\tSuiAddressSchema,\n\tBase64Schema,\n\tSignatureSchemeSchema,\n\tAccountSourceSchema,\n\ttype WalletHttpPathValue,\n\ttype SignRequest,\n\ttype SignResponse,\n\ttype HealthResponse,\n\ttype AccountsResponse,\n\ttype AccountSummary,\n\ttype ErrorResponse,\n} from './protocol.ts';\nexport type {\n\tWalletError,\n\tWalletBootError,\n\tWalletBootPhase,\n\tWalletRequestError,\n\tWalletRequestPhase,\n} from './errors.ts';\nexport type { OriginPolicy, OriginPolicyInputs, OriginCheckResult } from './origin-policy.ts';\nexport { resolveOriginPolicy, checkOrigin, corsHeadersFor } from './origin-policy.ts';\nexport type { PairingToken } from './pairing.ts';\nexport {\n\tmintToken,\n\tacquirePairingToken,\n\ttokenPath,\n\tcomposePairUrl,\n\tparsePairUrl,\n\tparseBearerHeader,\n\tsafeBearerEquals,\n\tredactToken,\n} from './pairing.ts';\nexport { WALLET_ENDPOINT_NAME, WALLET_ENDPOINT_KEY, makeWalletRoutable } from './routable.ts';\nexport {\n\tdispatch,\n\tstartHttpServer,\n\tMAX_BODY_BYTES,\n\ttype WalletRequest,\n\ttype WalletResponse,\n\ttype WalletServerConfig,\n\ttype WalletServerHandle,\n} from './server.ts';\nexport { makeWalletCodegen } from './codegen.ts';\nexport { makeWalletSnapshotable } from './snapshot.ts';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoEA,MAAM,6BAA6B;;;;;;;;;;;AAYnC,MAAM,2BACL,WAEA,OAAO,GAAG,WAAW,0BAA0B;;;AAQhD,MAAM,iBAAiB,SAAgC,QAAQ;AAgD/D,SAAgB,OAAO,MAAiC;CACvD,MAAM,eACL,QAAS,EAAE,UAAA,MAA8B;CAC1C,IAAI,aAAa,aAAA,OAAkC;EAqBlD,MAAM,cAAc,iBAAiB,cAAc,CAAC,CAAU;EAC9D,qBAAqB,cAAc,YAAY;GAQ9C,MAAM,iBAA6C,CAAC;GACpD,KAAK,MAAM,KAAK,SACf,IAAI,wBAAwB,CAAC,GAC5B,eAAe,KAAK,CAAmC;GAGzD,OAAO,iBAAiB;IAAE,GAAG;IAAc,UAAU;GAAe,GAAG,cAAc;EACtF,CAAC;EACD,OAAO;CACR;CACA,OAAO,iBAAiB,cAAc,aAAa,QAAQ;AAC5D;AAEA,SAAS,iBACR,MACA,UACC;CAQD,MAAM,eAAe,CAAC,aAAa,GAAG,QAAQ;CAK9C,MAAM,eAAwC;EAAE,GAAG;EAAM;CAAS;CAElE,OAAO,aAAa;EACnB,IAAI,eAAe;EACnB,WAAW;EAIX,MAAM;EACN,SAAS;EAIT,QAAQ,SACP,OAAO,IAAI,aAAa;GACvB,MAAM,MAAM,OAAO;GAUnB,MAAM,WAAW,OAAO;GACxB,MAAM,QAAQ,OAAO;GACrB,MAAM,aAAa,OAAO;GAI1B,MAAM,GAAG,GAAG,oBAAoB;GAChC,MAAM,mBAAmB,OAAO,eAAe,UAAA,KAA2B,CAAC,CAAC,KAC3E,OAAO,KAAK,aACX,UAAU;IACT,UAAU;IACV;IACA,MAAM;GACP,CAAC,CACF,GACA,OAAO,UAAU,QAChB,gBAAgB;IACf,OAAO;IACP,SAAS,0CAA0C,IAAI;IACvD,OAAO;GACR,CAAC,CACF,CACD;GACA,MAAM,kBAAkB,OAAO,eAC9B,UAAA,KAED,CAAC,CAAC,KACD,OAAO,KAAK,aACX,UAAU;IACT,UAAU;IACV;IACA,MAAM;GACP,CAAC,CACF,GACA,OAAO,UAAU,QAChB,gBAAgB;IACf,OAAO;IACP,SAAS,8CAA8C,IAAI;IAC3D,OAAO;GACR,CAAC,CACF,CACD;GA4CA,MAAM,WAAW,OAAO,cAAc,cAAc;IAzCnD,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,SAAS,SAAS;IAClB,WAAW,MAAM;IACjB,eAAe,WAAW,cACzB,WACE,SAAS;KACT,OAAO;KASP,YAAY;KACZ,eAAe;KACf,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;IAChD,CAAC,CAAC,CACD,KACA,OAAO,KAAK,UAAU,MAAM,IAAI,GAChC,OAAO,UAAU,QAChB,gBAAgB;KACf,OAAO;KACP,SAAS,gCAAgC,IAAI;KAC7C,MACC,IAAI,WAAW,mBACZ,mGACA,IAAI,WAAW,iBACd,6FACA;KACL,OAAO;IACR,CAAC,CACF,CACD;IACF,uBAAuB,OAAO,QAAQ,gBAAgB;IACtD;IACA;GAG4D,CAAC;GAU9D,IAAI,cAAc,uBAAuB,CAAC;GAC1C,IAAI,QAAQ,kBAAkB,SAAS,QAAQ,CAAC;GAChD,IAAI,SACH,mBAAmB;IAClB,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,MAAM,SAAS;GAChB,CAAC,CACF;GAEA,OAAO;EACR,CAAC;CACH,CAAC;AACF"}

package/dist/plugins/wallet/origin-policy.mjs

@@ -1,4 +1,4 @@
-import { SpanAttr } from "../../substrate/runtime/observability/spans.mjs";
+import { LogAttr } from "../../substrate/runtime/observability/log-attrs.mjs";
 import { Effect } from "effect";
 //#region src/plugins/wallet/origin-policy.ts
 /**
@@ -23,8 +23,8 @@ const resolveOriginPolicy = (inputs) => Effect.gen(function* () {
 	if (inputs.routedAppOrigin !== null) allowed.add(inputs.routedAppOrigin);
 	for (const o of inputs.extraOrigins) allowed.add(o);
 	if (allowed.size === 0) yield* Effect.logWarning("wallet origin allowlist is empty").pipe(Effect.annotateLogs({
-		[SpanAttr.app]: inputs.app,
-		[SpanAttr.stack]: inputs.stack
+		[LogAttr.app]: inputs.app,
+		[LogAttr.stack]: inputs.stack
 	}));
 	return { allowed };
 });

package/dist/plugins/wallet/origin-policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"origin-policy.mjs","names":[],"sources":["../../../src/plugins/wallet/origin-policy.ts"],"sourcesContent":["// Wallet plugin — CORS / origin allowlist policy.\n//\n// The allowlist is built from two real, substrate-wired sources: the\n// router-fronted dev-server origin for this stack (`routedAppOrigin`)\n// and any caller-supplied `extraOrigins`. Both are stack-scoped or\n// explicit, so neither opens the cross-stack pairing risk described in\n// 15-wallet.md.\n//\n// History (removed): an earlier design auto-allowlisted a vite-port-\n// derived origin (`http://dev.<stack>.<app>.localhost:<vite-port>`,\n// plus an opt-in `http://localhost:<vite-port>`). That branch was dead\n// AT THE TIME: there was no vite plugin and the port broker only\n// allocated ports for in-stack plugins with no reader/lookup API, so\n// `vitePortForThisStack` was always `null` at the only production call\n// site and the branch never fired. Per STYLE_GUIDE §5 (\"code either\n// works or doesn't exist\") the whole vite-origin path — and the\n// `allowLocalhostVite` opt-in it gated — was removed rather than left as\n// an unreachable allowlist seam.\n//\n// Note (no longer dead, but deliberately NOT re-added here): with the\n// `hostService(...)` plugin devstack now DOES own the dev server's bind\n// port (the broker allocates it; Vite binds it via `--port {port}`). So\n// the raw-loopback origin (`http://127.0.0.1:<port>` /\n// `http://localhost:<port>`) the dev sees in Vite's own console banner is\n// a real, knowable origin. The canonical fix lives on the host-service\n// side instead: it now publishes the ROUTED origin as its\n// `HostServiceValue.url`, so `devstack up` output (and any consumer\n// holding the resolved host-service value) point devs at the URL whose\n// Origin THIS allowlist already accepts (the routed `routedAppOrigin`).\n// Re-adding a raw-loopback branch\n// here is intentionally deferred — it would have to thread the\n// host-service's dynamic bind port into the wallet, which runs in the\n// OPPOSITE direction of the current dependency edge (host-service\n// `dependsOn` wallet), so the wallet has no view of that port at its own\n// boot. Devs who must load the raw Vite URL can pass it via\n// `allowedOrigins` (→ `extraOrigins`) until that plumbing is justified.\n//\n// Why \"origin + bearer together\": bearer alone leaves a non-browser-\n// tooling bypass — curl / fetch from a service worker can forge\n// `Authorization` from a leaked token. Browsers always send `Origin`;\n// non-browsers omit it. Demanding BOTH closes the bypass.\n\nimport { Effect } from 'effect';\n\nimport { SpanAttr } from '../../substrate/runtime/observability/spans.ts';\n\n// ----------------------------------------------------------------------\n// Policy shape\n// ----------------------------------------------------------------------\n\n/** Result of resolving the origin allowlist at boot. Captured into\n *  the HTTP handler closure so per-request checks are pure-string\n *  comparison. */\nexport interface OriginPolicy {\n\treadonly allowed: ReadonlySet<string>;\n}\n\n/** Per-stack inputs the policy resolver needs. Supplied by the\n *  substrate at acquire time (identity + routed-url derivation); this\n *  module doesn't reach into the broker itself. */\nexport interface OriginPolicyInputs {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly routedAppOrigin: string | null;\n\treadonly extraOrigins: ReadonlyArray<string>;\n}\n\n// ----------------------------------------------------------------------\n// Resolution\n// ----------------------------------------------------------------------\n\n/**\n * Resolve the per-stack origin allowlist.\n *\n *  - Always allowlisted: the router-fronted dev-server origin for this\n *    stack (`routedAppOrigin`), when the router derivation produced one.\n *  - Always allowlisted: any explicit caller-supplied origins from\n *    `extraOrigins`.\n *\n * Empty-allowlist policy (no `routedAppOrigin` AND no `extraOrigins`):\n * allowed. The wallet boots normally; with an empty allowlist the\n * per-request gate refuses every request (every Origin lands in\n * `forbidden`). This is the correct behavior for a stack composed\n * without any client UI (e.g. node-only smoke / e2e configs) — the\n * wallet's keypair + token are still useful for the host process, but\n * the HTTP surface is effectively closed. A `Effect.logWarning`\n * surfaces the configuration for operator visibility.\n */\nexport const resolveOriginPolicy = (inputs: OriginPolicyInputs): Effect.Effect<OriginPolicy> =>\n\tEffect.gen(function* () {\n\t\tconst allowed = new Set<string>();\n\n\t\tif (inputs.routedAppOrigin !== null) {\n\t\t\tallowed.add(inputs.routedAppOrigin);\n\t\t}\n\n\t\tfor (const o of inputs.extraOrigins) {\n\t\t\tallowed.add(o);\n\t\t}\n\n\t\tif (allowed.size === 0) {\n\t\t\tyield* Effect.logWarning('wallet origin allowlist is empty').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[SpanAttr.app]: inputs.app,\n\t\t\t\t\t[SpanAttr.stack]: inputs.stack,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn { allowed } satisfies OriginPolicy;\n\t});\n\n// ----------------------------------------------------------------------\n// Per-request check\n// ----------------------------------------------------------------------\n\n/** Per-request origin gate. Returns `'missing'` for absent Origin,\n *  `'forbidden'` for Origin not in the allowlist, `'ok'` for accepted.\n *\n *  Distilled-doc invariant (C12): missing Origin is its OWN refusal\n *  shape (closes the curl / non-browser bypass — bearer alone is not\n *  enough). */\nexport type OriginCheckResult = 'missing' | 'forbidden' | 'ok';\n\nexport const checkOrigin = (\n\tpolicy: OriginPolicy,\n\theaderValue: string | undefined,\n): OriginCheckResult => {\n\tif (headerValue === undefined || headerValue.length === 0) return 'missing';\n\treturn policy.allowed.has(headerValue) ? 'ok' : 'forbidden';\n};\n\n/** Compose CORS headers for a successful request. Single-allowed-origin\n *  echo (browsers don't honor wildcard with credentials, and we want\n *  to keep `Access-Control-Allow-Credentials` open for fetch with\n *  `credentials: 'include'` if a future codegen seam needs it). */\nexport const corsHeadersFor = (origin: string): Readonly<Record<string, string>> => ({\n\t'access-control-allow-origin': origin,\n\t'access-control-allow-methods': 'GET, POST, OPTIONS',\n\t'access-control-allow-headers': 'authorization, content-type',\n\t'access-control-allow-credentials': 'true',\n\tvary: 'origin',\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwFA,MAAa,uBAAuB,WACnC,OAAO,IAAI,aAAa;CACvB,MAAM,0BAAU,IAAI,KAAa;AAEjC,KAAI,OAAO,oBAAoB,KAC9B,SAAQ,IAAI,OAAO,gBAAgB;AAGpC,MAAK,MAAM,KAAK,OAAO,aACtB,SAAQ,IAAI,EAAE;AAGf,KAAI,QAAQ,SAAS,EACpB,QAAO,OAAO,WAAW,mCAAmC,CAAC,KAC5D,OAAO,aAAa;GAClB,SAAS,MAAM,OAAO;GACtB,SAAS,QAAQ,OAAO;EACzB,CAAC,CACF;AAGF,QAAO,EAAE,SAAS;EACjB;AAcH,MAAa,eACZ,QACA,gBACuB;AACvB,KAAI,gBAAgB,KAAA,KAAa,YAAY,WAAW,EAAG,QAAO;AAClE,QAAO,OAAO,QAAQ,IAAI,YAAY,GAAG,OAAO;;;;;;AAOjD,MAAa,kBAAkB,YAAsD;CACpF,+BAA+B;CAC/B,gCAAgC;CAChC,gCAAgC;CAChC,oCAAoC;CACpC,MAAM;CACN"}
+{"version":3,"file":"origin-policy.mjs","names":[],"sources":["../../../src/plugins/wallet/origin-policy.ts"],"sourcesContent":["// Wallet plugin — CORS / origin allowlist policy.\n//\n// The allowlist is built from two real, substrate-wired sources: the\n// router-fronted dev-server origin for this stack (`routedAppOrigin`)\n// and any caller-supplied `extraOrigins`. Both are stack-scoped or\n// explicit, so neither opens the cross-stack pairing risk described in\n// 15-wallet.md.\n//\n// No raw-loopback origin: with the `hostService(...)` plugin devstack\n// owns the dev server's bind port (the broker allocates it; Vite binds\n// it via `--port {port}`), so the raw-loopback origin\n// (`http://127.0.0.1:<port>` / `http://localhost:<port>`) the dev sees\n// in Vite's own console banner is a real, knowable origin. The canonical\n// fix lives on the host-service side: it publishes the ROUTED origin as\n// its `HostServiceValue.url`, so `devstack up` output (and any consumer\n// holding the resolved host-service value) point devs at the URL whose\n// Origin THIS allowlist already accepts (the routed `routedAppOrigin`).\n// A raw-loopback allowlist branch would have to thread the host-service's\n// dynamic bind port into the wallet, which runs in the OPPOSITE direction\n// of the dependency edge (host-service `dependsOn` wallet), so the wallet\n// has no view of that port at its own boot. Devs who must load the raw\n// Vite URL pass it via `allowedOrigins` (→ `extraOrigins`).\n//\n// Why \"origin + bearer together\": bearer alone leaves a non-browser-\n// tooling bypass — curl / fetch from a service worker can forge\n// `Authorization` from a leaked token. Browsers always send `Origin`;\n// non-browsers omit it. Demanding BOTH closes the bypass.\n\nimport { Effect } from 'effect';\n\nimport { LogAttr } from '../../substrate/runtime/observability/log-attrs.ts';\n\n// ----------------------------------------------------------------------\n// Policy shape\n// ----------------------------------------------------------------------\n\n/** Result of resolving the origin allowlist at boot. Captured into\n *  the HTTP handler closure so per-request checks are pure-string\n *  comparison. */\nexport interface OriginPolicy {\n\treadonly allowed: ReadonlySet<string>;\n}\n\n/** Per-stack inputs the policy resolver needs. Supplied by the\n *  substrate at acquire time (identity + routed-url derivation); this\n *  module doesn't reach into the broker itself. */\nexport interface OriginPolicyInputs {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly routedAppOrigin: string | null;\n\treadonly extraOrigins: ReadonlyArray<string>;\n}\n\n// ----------------------------------------------------------------------\n// Resolution\n// ----------------------------------------------------------------------\n\n/**\n * Resolve the per-stack origin allowlist.\n *\n *  - Always allowlisted: the router-fronted dev-server origin for this\n *    stack (`routedAppOrigin`), when the router derivation produced one.\n *  - Always allowlisted: any explicit caller-supplied origins from\n *    `extraOrigins`.\n *\n * Empty-allowlist policy (no `routedAppOrigin` AND no `extraOrigins`):\n * allowed. The wallet boots normally; with an empty allowlist the\n * per-request gate refuses every request (every Origin lands in\n * `forbidden`). This is the correct behavior for a stack composed\n * without any client UI (e.g. node-only smoke / e2e configs) — the\n * wallet's keypair + token are still useful for the host process, but\n * the HTTP surface is effectively closed. A `Effect.logWarning`\n * surfaces the configuration for operator visibility.\n */\nexport const resolveOriginPolicy = (inputs: OriginPolicyInputs): Effect.Effect<OriginPolicy> =>\n\tEffect.gen(function* () {\n\t\tconst allowed = new Set<string>();\n\n\t\tif (inputs.routedAppOrigin !== null) {\n\t\t\tallowed.add(inputs.routedAppOrigin);\n\t\t}\n\n\t\tfor (const o of inputs.extraOrigins) {\n\t\t\tallowed.add(o);\n\t\t}\n\n\t\tif (allowed.size === 0) {\n\t\t\tyield* Effect.logWarning('wallet origin allowlist is empty').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[LogAttr.app]: inputs.app,\n\t\t\t\t\t[LogAttr.stack]: inputs.stack,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn { allowed } satisfies OriginPolicy;\n\t});\n\n// ----------------------------------------------------------------------\n// Per-request check\n// ----------------------------------------------------------------------\n\n/** Per-request origin gate. Returns `'missing'` for absent Origin,\n *  `'forbidden'` for Origin not in the allowlist, `'ok'` for accepted.\n *\n *  Distilled-doc invariant (C12): missing Origin is its OWN refusal\n *  shape (closes the curl / non-browser bypass — bearer alone is not\n *  enough). */\nexport type OriginCheckResult = 'missing' | 'forbidden' | 'ok';\n\nexport const checkOrigin = (\n\tpolicy: OriginPolicy,\n\theaderValue: string | undefined,\n): OriginCheckResult => {\n\tif (headerValue === undefined || headerValue.length === 0) return 'missing';\n\treturn policy.allowed.has(headerValue) ? 'ok' : 'forbidden';\n};\n\n/** Compose CORS headers for a successful request. Single-allowed-origin\n *  echo (browsers don't honor wildcard with credentials, and we want\n *  to keep `Access-Control-Allow-Credentials` open for fetch with\n *  `credentials: 'include'` if a future codegen seam needs it). */\nexport const corsHeadersFor = (origin: string): Readonly<Record<string, string>> => ({\n\t'access-control-allow-origin': origin,\n\t'access-control-allow-methods': 'GET, POST, OPTIONS',\n\t'access-control-allow-headers': 'authorization, content-type',\n\t'access-control-allow-credentials': 'true',\n\tvary: 'origin',\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA0EA,MAAa,uBAAuB,WACnC,OAAO,IAAI,aAAa;CACvB,MAAM,0BAAU,IAAI,IAAY;CAEhC,IAAI,OAAO,oBAAoB,MAC9B,QAAQ,IAAI,OAAO,eAAe;CAGnC,KAAK,MAAM,KAAK,OAAO,cACtB,QAAQ,IAAI,CAAC;CAGd,IAAI,QAAQ,SAAS,GACpB,OAAO,OAAO,WAAW,kCAAkC,CAAC,CAAC,KAC5D,OAAO,aAAa;GAClB,QAAQ,MAAM,OAAO;GACrB,QAAQ,QAAQ,OAAO;CACzB,CAAC,CACF;CAGD,OAAO,EAAE,QAAQ;AAClB,CAAC;AAcF,MAAa,eACZ,QACA,gBACuB;CACvB,IAAI,gBAAgB,KAAA,KAAa,YAAY,WAAW,GAAG,OAAO;CAClE,OAAO,OAAO,QAAQ,IAAI,WAAW,IAAI,OAAO;AACjD;;;;;AAMA,MAAa,kBAAkB,YAAsD;CACpF,+BAA+B;CAC/B,gCAAgC;CAChC,gCAAgC;CAChC,oCAAoC;CACpC,MAAM;AACP"}

package/dist/plugins/wallet/pairing.mjs

@@ -1,13 +1,11 @@
-import { redactText } from "../../substrate/runtime/observability/redaction.mjs";
 import { atomicWriteFile } from "../../substrate/runtime/atomic-write.mjs";
 import "../../substrate/runtime/observability/index.mjs";
 import { WALLET_BEARER_PREFIX, WALLET_TOKEN_FRAGMENT_KEY } from "../../contracts/wallet-protocol.mjs";
 import { walletBootError } from "./errors.mjs";
-import { WalletSpans } from "./spans.mjs";
 import "./protocol.mjs";
 import { Effect } from "effect";
-import { randomBytes, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import { readFile } from "node:fs/promises";
 //#region src/plugins/wallet/pairing.ts
 /** Token-charset regex: lowercase hex, exactly 32 chars. Reject any
@@ -17,8 +15,9 @@ const asToken = (s) => s;
 /** Mint a fresh token. 16 random bytes → 32 hex chars. */
 const mintToken = () => Effect.sync(() => asToken(randomBytes(16).toString("hex")));
 /** Resolve the on-disk token path under a state root. The state root
-*  is supplied by the substrate's identity / state-store config; this
-*  helper centralises the layout convention.
+*  is the substrate path resolver's per-stack `StackPathsService.stackRoot`
+*  (derived from the runtime root + identity); this helper centralises
+*  the layout convention.
 *
 *  Convention: `<stateRoot>/wallet/token` — one token per stack, lives
 *  alongside other per-stack runtime artifacts. */
@@ -51,7 +50,7 @@ const acquirePairingToken = (path) => Effect.gen(function* () {
 	if (existing !== null) {
 		const trimmed = existing.trim();
 		if (TOKEN_RE.test(trimmed)) return asToken(trimmed);
-		yield* Effect.logWarning("wallet token file is malformed; re-minting").pipe(Effect.annotateLogs({ [WalletSpans.tokenFile]: path }));
+		yield* Effect.logWarning("wallet token file is malformed; re-minting").pipe(Effect.annotateLogs({ "wallet.tokenFile": path }));
 	}
 	const token = yield* mintToken();
 	yield* atomicWriteFile(path, new TextEncoder().encode(token), { mode: 384 }).pipe(Effect.mapError((cause) => walletBootError({
@@ -104,24 +103,7 @@ const safeBearerEquals = (a, b) => {
 	if (ab.length !== bb.length) return false;
 	return timingSafeEqual(ab, bb);
 };
-const TOKEN_REDACTION_RULE = {
-	kind: "pattern",
-	pattern: /([#?&]token=)[A-Za-z0-9]+/g,
-	replacement: "$1<redacted>"
-};
-/**
-* Redact the token fragment from any URL-shaped string for logging /
-* TUI rendering. Defense-in-depth — the engine's log sink should never
-* see the unredacted pair URL anyway, but this exists for callers that
-* accidentally pass `pairUrl` straight into a log line.
-*
-* Distilled-doc opportunity (15-wallet.md): the legacy redactor only
-* covered `#token=`. This regex covers BOTH the fragment form and a
-* hypothetical query form so a future config change doesn't silently
-* leak.
-*/
-const redactToken = (s) => redactText(s, [TOKEN_REDACTION_RULE]);
 //#endregion
-export { acquirePairingToken, composePairUrl, mintToken, parseBearerHeader, redactToken, safeBearerEquals, tokenPath };
+export { acquirePairingToken, composePairUrl, mintToken, parseBearerHeader, safeBearerEquals, tokenPath };
 
 //# sourceMappingURL=pairing.mjs.map

package/dist/plugins/wallet/pairing.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.mjs","names":["joinPath"],"sources":["../../../src/plugins/wallet/pairing.ts"],"sourcesContent":["// Wallet plugin — pairing-token discipline.\n//\n// What this module owns (15-wallet.md \"Token comparison MUST be\n// constant-time\", \"Token MUST live in URL fragment (not query)\",\n// \"Token MUST NOT appear in log lines\", \"Token file MUST be mode\n// 0o600\"):\n//\n//   1. Token generation: 16 random bytes → 32 hex chars.\n//   2. Token persistence: file at `<stateRoot>/wallet/token`, mode\n//      `0o600`, atomic write.\n//   3. Token rehydration: read-existing-or-mint so warm starts +\n//      snapshot restore preserve the dev-wallet pairing.\n//   4. URL-fragment ↔ Authorization-header bridge: helpers that\n//      compose the pair URL (token in fragment) and parse the\n//      bearer-prefixed header back to the raw token.\n//   5. Constant-time bearer compare: timing-safe equality so a\n//      remote attacker can't recover the token byte-by-byte via\n//      response-time measurement.\n//\n// What this module does NOT own:\n//\n//   - The HTTP server (see `server.ts`).\n//   - The CORS / Origin allowlist (see `origin-policy.ts`).\n//   - The codegen file (see `codegen.ts`).\n\nimport { Effect, FileSystem } from 'effect';\nimport { randomBytes, timingSafeEqual } from 'node:crypto';\nimport { readFile } from 'node:fs/promises';\nimport { join as joinPath } from 'node:path';\n\nimport { atomicWriteFile } from '../../substrate/runtime/atomic-write.ts';\nimport { redactText, type RedactionRule } from '../../substrate/runtime/observability/index.ts';\nimport { walletBootError, type WalletBootError } from './errors.ts';\nimport { WalletSpans } from './spans.ts';\nimport {\n\tWALLET_BEARER_PREFIX,\n\tWALLET_TOKEN_FRAGMENT_KEY,\n\tWALLET_TOKEN_HEX_LENGTH,\n} from './protocol.ts';\n\n// ----------------------------------------------------------------------\n// Token shape\n// ----------------------------------------------------------------------\n\n/** A pairing token. Branded so it can't be confused with arbitrary\n *  strings at the type level — only this module mints them. */\nexport type PairingToken = string & { readonly __pairingToken: unique symbol };\n\n/** Token-charset regex: lowercase hex, exactly 32 chars. Reject any\n *  on-disk value that doesn't match (re-mint). */\nconst TOKEN_RE = /^[0-9a-f]{32}$/;\n\nconst asToken = (s: string): PairingToken => s as PairingToken;\n\n// ----------------------------------------------------------------------\n// Generation\n// ----------------------------------------------------------------------\n\n/** Mint a fresh token. 16 random bytes → 32 hex chars. */\nexport const mintToken = (): Effect.Effect<PairingToken> =>\n\tEffect.sync(() => asToken(randomBytes(16).toString('hex')));\n\n// ----------------------------------------------------------------------\n// Persistence\n// ----------------------------------------------------------------------\n\n/** Resolve the on-disk token path under a state root. The state root\n *  is supplied by the substrate's identity / state-store config; this\n *  helper centralises the layout convention.\n *\n *  Convention: `<stateRoot>/wallet/token` — one token per stack, lives\n *  alongside other per-stack runtime artifacts. */\nexport const tokenPath = (stateRoot: string): string => joinPath(stateRoot, 'wallet', 'token');\n\n/**\n * Read the on-disk token if it exists and is well-formed; otherwise\n * mint + persist a fresh one via the substrate's atomic-write primitive\n * (mkdir-parent → O_EXCL temp → write → fsync → rename, mode 0o600).\n * Warm starts and snapshot restores both land in the \"read existing\"\n * branch so a previously-paired dev-wallet keeps working without a\n * re-pair UX.\n */\nexport const acquirePairingToken = (\n\tpath: string,\n): Effect.Effect<PairingToken, WalletBootError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\t// Try to read an existing token.\n\t\tconst existing = yield* Effect.tryPromise({\n\t\t\ttry: async () => {\n\t\t\t\ttry {\n\t\t\t\t\treturn await readFile(path, 'utf8');\n\t\t\t\t} catch (err) {\n\t\t\t\t\tif ((err as NodeJS.ErrnoException)?.code === 'ENOENT') return null;\n\t\t\t\t\tthrow err;\n\t\t\t\t}\n\t\t\t},\n\t\t\tcatch: (cause) =>\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'read-token',\n\t\t\t\t\tmessage: `read of wallet token file failed at ${path}`,\n\t\t\t\t\thint: 'check filesystem permissions / disk availability',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\n\t\tif (existing !== null) {\n\t\t\tconst trimmed = existing.trim();\n\t\t\tif (TOKEN_RE.test(trimmed)) {\n\t\t\t\treturn asToken(trimmed);\n\t\t\t}\n\t\t\t// Malformed — fall through to mint + overwrite.\n\t\t\tyield* Effect.logWarning('wallet token file is malformed; re-minting').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[WalletSpans.tokenFile]: path,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\t// Mint a new one + persist via substrate's atomic-write\n\t\t// (mode 0o600). The token survives partial-write failures: the\n\t\t// in-memory value is authoritative for the current cycle, and a\n\t\t// failed persist surfaces as `write-token` so callers can choose\n\t\t// to fail-fast or continue with a transient pairing.\n\t\tconst token = yield* mintToken();\n\t\tconst bytes = new TextEncoder().encode(token);\n\t\tyield* atomicWriteFile(path, bytes, { mode: 0o600 }).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'write-token',\n\t\t\t\t\tmessage: `failed to persist wallet token at ${path}`,\n\t\t\t\t\thint: 'ENOSPC / EROFS / EACCES — boot continues with in-memory token; new pairing required next cycle',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\n\t\treturn token;\n\t});\n\n// ----------------------------------------------------------------------\n// Pair-URL composition (fragment-only)\n// ----------------------------------------------------------------------\n\n/**\n * Compose the pair URL the dev-wallet adapter reads.\n *\n * The token rides the URL FRAGMENT (`#token=...`), never a query\n * parameter. Fragments are not sent to servers, so the token can't\n * land in access logs / referrer headers / Sentry breadcrumbs.\n */\nexport const composePairUrl = (walletUrl: string, token: PairingToken): string =>\n\t`${walletUrl}/#${WALLET_TOKEN_FRAGMENT_KEY}=${token}`;\n\n/**\n * Inverse — parse the token out of a pair URL fragment. Used by tests +\n * by the dev-wallet adapter (mirrored there because of the workspace-\n * cycle constraint).\n */\nexport const parsePairUrl = (pairUrl: string): PairingToken | null => {\n\tconst hashIdx = pairUrl.indexOf('#');\n\tif (hashIdx < 0) return null;\n\tconst fragment = pairUrl.slice(hashIdx + 1);\n\tconst prefix = `${WALLET_TOKEN_FRAGMENT_KEY}=`;\n\tif (!fragment.startsWith(prefix)) return null;\n\tconst raw = fragment.slice(prefix.length);\n\treturn TOKEN_RE.test(raw) ? asToken(raw) : null;\n};\n\n// ----------------------------------------------------------------------\n// Authorization-header bridge\n// ----------------------------------------------------------------------\n\n/**\n * Parse a raw `Authorization` header value into the bearer token. The\n * dev-wallet adapter copies the token from `url.hash` into the\n * `Authorization: Bearer <token>` header on every request — this\n * helper is the symmetric inverse.\n *\n * Returns `null` on missing / malformed header so the caller can map\n * to the structured `unauthorized` request error.\n */\nexport const parseBearerHeader = (header: string | undefined): string | null => {\n\tif (header === undefined) return null;\n\tif (!header.startsWith(WALLET_BEARER_PREFIX)) return null;\n\tconst raw = header.slice(WALLET_BEARER_PREFIX.length);\n\t// Don't TOKEN_RE-test here — the constant-time compare against the\n\t// expected token covers shape mismatch (length-difference shortcut\n\t// is acceptable since token length is public knowledge).\n\treturn raw.length === WALLET_TOKEN_HEX_LENGTH ? raw : null;\n};\n\n// ----------------------------------------------------------------------\n// Constant-time compare\n// ----------------------------------------------------------------------\n\n/**\n * Constant-time bearer-token compare. The length-mismatch shortcut is\n * intentional — token length is public knowledge (always 32 hex\n * chars), so leaking \"wrong length\" is not a credential leak. The\n * shortcut also prevents `timingSafeEqual` from throwing on mismatched\n * buffer sizes.\n *\n * Invariant (15-wallet.md \"Token comparison MUST be constant-time\"):\n * NEVER `===` two tokens. `===` on strings short-circuits at the first\n * mismatching byte, leaking the prefix byte-by-byte via response-time\n * measurement to a remote attacker.\n */\nexport const safeBearerEquals = (a: string, b: PairingToken | string): boolean => {\n\tif (a.length !== b.length) return false;\n\t// `a` is attacker-controlled — a multi-byte UTF-8 codepoint in `a`\n\t// would inflate `ab.length` past `bb.length` even though\n\t// `a.length === b.length` passed (string length counts UTF-16 code\n\t// units, byte length counts UTF-8 bytes). The second length guard\n\t// stops `timingSafeEqual` from throwing in that case (its contract\n\t// requires equal-length buffers) and keeps the function total. For\n\t// the canonical case (`b` is a 32-hex `PairingToken`) the guard is\n\t// redundant; for the defensive case it prevents a malformed-input\n\t// throw from leaking up the dispatcher path.\n\tconst ab = Buffer.from(a, 'utf8');\n\tconst bb = Buffer.from(b, 'utf8');\n\tif (ab.length !== bb.length) return false;\n\treturn timingSafeEqual(ab, bb);\n};\n\n// ----------------------------------------------------------------------\n// Logging hygiene\n// ----------------------------------------------------------------------\n\nconst TOKEN_REDACTION_RULE: RedactionRule = {\n\tkind: 'pattern',\n\tpattern: /([#?&]token=)[A-Za-z0-9]+/g,\n\treplacement: '$1<redacted>',\n};\n\n/**\n * Redact the token fragment from any URL-shaped string for logging /\n * TUI rendering. Defense-in-depth — the engine's log sink should never\n * see the unredacted pair URL anyway, but this exists for callers that\n * accidentally pass `pairUrl` straight into a log line.\n *\n * Distilled-doc opportunity (15-wallet.md): the legacy redactor only\n * covered `#token=`. This regex covers BOTH the fragment form and a\n * hypothetical query form so a future config change doesn't silently\n * leak.\n */\nexport const redactToken = (s: string): string => redactText(s, [TOKEN_REDACTION_RULE]);\n"],"mappings":";;;;;;;;;;;;;;AAkDA,MAAM,WAAW;AAEjB,MAAM,WAAW,MAA4B;;AAO7C,MAAa,kBACZ,OAAO,WAAW,QAAQ,YAAY,GAAG,CAAC,SAAS,MAAM,CAAC,CAAC;;;;;;;AAY5D,MAAa,aAAa,cAA8BA,KAAS,WAAW,UAAU,QAAQ;;;;;;;;;AAU9F,MAAa,uBACZ,SAEA,OAAO,IAAI,aAAa;CAEvB,MAAM,WAAW,OAAO,OAAO,WAAW;EACzC,KAAK,YAAY;AAChB,OAAI;AACH,WAAO,MAAM,SAAS,MAAM,OAAO;YAC3B,KAAK;AACb,QAAK,KAA+B,SAAS,SAAU,QAAO;AAC9D,UAAM;;;EAGR,QAAQ,UACP,gBAAgB;GACf,OAAO;GACP,SAAS,uCAAuC;GAChD,MAAM;GACN;GACA,CAAC;EACH,CAAC;AAEF,KAAI,aAAa,MAAM;EACtB,MAAM,UAAU,SAAS,MAAM;AAC/B,MAAI,SAAS,KAAK,QAAQ,CACzB,QAAO,QAAQ,QAAQ;AAGxB,SAAO,OAAO,WAAW,6CAA6C,CAAC,KACtE,OAAO,aAAa,GAClB,YAAY,YAAY,MACzB,CAAC,CACF;;CAQF,MAAM,QAAQ,OAAO,WAAW;AAEhC,QAAO,gBAAgB,MADT,IAAI,aAAa,CAAC,OAAO,MACL,EAAE,EAAE,MAAM,KAAO,CAAC,CAAC,KACpD,OAAO,UAAU,UAChB,gBAAgB;EACf,OAAO;EACP,SAAS,qCAAqC;EAC9C,MAAM;EACN;EACA,CAAC,CACF,CACD;AAED,QAAO;EACN;;;;;;;;AAaH,MAAa,kBAAkB,WAAmB,UACjD,GAAG,UAAU,IAAI,0BAA0B,GAAG;;;;;;;;;;AA8B/C,MAAa,qBAAqB,WAA8C;AAC/E,KAAI,WAAW,KAAA,EAAW,QAAO;AACjC,KAAI,CAAC,OAAO,WAAA,UAAgC,CAAE,QAAO;CACrD,MAAM,MAAM,OAAO,MAAM,qBAAqB,OAAO;AAIrD,QAAO,IAAI,WAAA,KAAqC,MAAM;;;;;;;;;;;;;;AAmBvD,MAAa,oBAAoB,GAAW,MAAsC;AACjF,KAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;CAUlC,MAAM,KAAK,OAAO,KAAK,GAAG,OAAO;CACjC,MAAM,KAAK,OAAO,KAAK,GAAG,OAAO;AACjC,KAAI,GAAG,WAAW,GAAG,OAAQ,QAAO;AACpC,QAAO,gBAAgB,IAAI,GAAG;;AAO/B,MAAM,uBAAsC;CAC3C,MAAM;CACN,SAAS;CACT,aAAa;CACb;;;;;;;;;;;;AAaD,MAAa,eAAe,MAAsB,WAAW,GAAG,CAAC,qBAAqB,CAAC"}
+{"version":3,"file":"pairing.mjs","names":["joinPath"],"sources":["../../../src/plugins/wallet/pairing.ts"],"sourcesContent":["// Wallet plugin — pairing-token discipline.\n//\n// What this module owns (15-wallet.md \"Token comparison MUST be\n// constant-time\", \"Token MUST live in URL fragment (not query)\",\n// \"Token MUST NOT appear in log lines\", \"Token file MUST be mode\n// 0o600\"):\n//\n//   1. Token generation: 16 random bytes → 32 hex chars.\n//   2. Token persistence: file at `<stateRoot>/wallet/token`, mode\n//      `0o600`, atomic write.\n//   3. Token rehydration: read-existing-or-mint so warm starts +\n//      snapshot restore preserve the dev-wallet pairing.\n//   4. URL-fragment ↔ Authorization-header bridge: helpers that\n//      compose the pair URL (token in fragment) and parse the\n//      bearer-prefixed header back to the raw token.\n//   5. Constant-time bearer compare: timing-safe equality so a\n//      remote attacker can't recover the token byte-by-byte via\n//      response-time measurement.\n//\n// What this module does NOT own:\n//\n//   - The HTTP server (see `server.ts`).\n//   - The CORS / Origin allowlist (see `origin-policy.ts`).\n//   - The codegen file (see `codegen.ts`).\n\nimport { Effect, FileSystem } from 'effect';\nimport { randomBytes, timingSafeEqual } from 'node:crypto';\nimport { readFile } from 'node:fs/promises';\nimport { join as joinPath } from 'node:path';\n\nimport { atomicWriteFile } from '../../substrate/runtime/atomic-write.ts';\nimport { redactText, type RedactionRule } from '../../substrate/runtime/observability/index.ts';\nimport { walletBootError, type WalletBootError } from './errors.ts';\nimport {\n\tWALLET_BEARER_PREFIX,\n\tWALLET_TOKEN_FRAGMENT_KEY,\n\tWALLET_TOKEN_HEX_LENGTH,\n} from './protocol.ts';\n\n// ----------------------------------------------------------------------\n// Token shape\n// ----------------------------------------------------------------------\n\n/** A pairing token. Branded so it can't be confused with arbitrary\n *  strings at the type level — only this module mints them. */\nexport type PairingToken = string & { readonly __pairingToken: unique symbol };\n\n/** Token-charset regex: lowercase hex, exactly 32 chars. Reject any\n *  on-disk value that doesn't match (re-mint). */\nconst TOKEN_RE = /^[0-9a-f]{32}$/;\n\nconst asToken = (s: string): PairingToken => s as PairingToken;\n\n// ----------------------------------------------------------------------\n// Generation\n// ----------------------------------------------------------------------\n\n/** Mint a fresh token. 16 random bytes → 32 hex chars. */\nexport const mintToken = (): Effect.Effect<PairingToken> =>\n\tEffect.sync(() => asToken(randomBytes(16).toString('hex')));\n\n// ----------------------------------------------------------------------\n// Persistence\n// ----------------------------------------------------------------------\n\n/** Resolve the on-disk token path under a state root. The state root\n *  is the substrate path resolver's per-stack `StackPathsService.stackRoot`\n *  (derived from the runtime root + identity); this helper centralises\n *  the layout convention.\n *\n *  Convention: `<stateRoot>/wallet/token` — one token per stack, lives\n *  alongside other per-stack runtime artifacts. */\nexport const tokenPath = (stateRoot: string): string => joinPath(stateRoot, 'wallet', 'token');\n\n/**\n * Read the on-disk token if it exists and is well-formed; otherwise\n * mint + persist a fresh one via the substrate's atomic-write primitive\n * (mkdir-parent → O_EXCL temp → write → fsync → rename, mode 0o600).\n * Warm starts and snapshot restores both land in the \"read existing\"\n * branch so a previously-paired dev-wallet keeps working without a\n * re-pair UX.\n */\nexport const acquirePairingToken = (\n\tpath: string,\n): Effect.Effect<PairingToken, WalletBootError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\t// Try to read an existing token.\n\t\tconst existing = yield* Effect.tryPromise({\n\t\t\ttry: async () => {\n\t\t\t\ttry {\n\t\t\t\t\treturn await readFile(path, 'utf8');\n\t\t\t\t} catch (err) {\n\t\t\t\t\tif ((err as NodeJS.ErrnoException)?.code === 'ENOENT') return null;\n\t\t\t\t\tthrow err;\n\t\t\t\t}\n\t\t\t},\n\t\t\tcatch: (cause) =>\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'read-token',\n\t\t\t\t\tmessage: `read of wallet token file failed at ${path}`,\n\t\t\t\t\thint: 'check filesystem permissions / disk availability',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\n\t\tif (existing !== null) {\n\t\t\tconst trimmed = existing.trim();\n\t\t\tif (TOKEN_RE.test(trimmed)) {\n\t\t\t\treturn asToken(trimmed);\n\t\t\t}\n\t\t\t// Malformed — fall through to mint + overwrite.\n\t\t\tyield* Effect.logWarning('wallet token file is malformed; re-minting').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t'wallet.tokenFile': path,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\t// Mint a new one + persist via substrate's atomic-write\n\t\t// (mode 0o600). The token survives partial-write failures: the\n\t\t// in-memory value is authoritative for the current cycle, and a\n\t\t// failed persist surfaces as `write-token` so callers can choose\n\t\t// to fail-fast or continue with a transient pairing.\n\t\tconst token = yield* mintToken();\n\t\tconst bytes = new TextEncoder().encode(token);\n\t\tyield* atomicWriteFile(path, bytes, { mode: 0o600 }).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\twalletBootError({\n\t\t\t\t\tphase: 'write-token',\n\t\t\t\t\tmessage: `failed to persist wallet token at ${path}`,\n\t\t\t\t\thint: 'ENOSPC / EROFS / EACCES — boot continues with in-memory token; new pairing required next cycle',\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\n\t\treturn token;\n\t});\n\n// ----------------------------------------------------------------------\n// Pair-URL composition (fragment-only)\n// ----------------------------------------------------------------------\n\n/**\n * Compose the pair URL the dev-wallet adapter reads.\n *\n * The token rides the URL FRAGMENT (`#token=...`), never a query\n * parameter. Fragments are not sent to servers, so the token can't\n * land in access logs / referrer headers / Sentry breadcrumbs.\n */\nexport const composePairUrl = (walletUrl: string, token: PairingToken): string =>\n\t`${walletUrl}/#${WALLET_TOKEN_FRAGMENT_KEY}=${token}`;\n\n/**\n * Inverse — parse the token out of a pair URL fragment. Used by tests +\n * by the dev-wallet adapter (mirrored there because of the workspace-\n * cycle constraint).\n */\nexport const parsePairUrl = (pairUrl: string): PairingToken | null => {\n\tconst hashIdx = pairUrl.indexOf('#');\n\tif (hashIdx < 0) return null;\n\tconst fragment = pairUrl.slice(hashIdx + 1);\n\tconst prefix = `${WALLET_TOKEN_FRAGMENT_KEY}=`;\n\tif (!fragment.startsWith(prefix)) return null;\n\tconst raw = fragment.slice(prefix.length);\n\treturn TOKEN_RE.test(raw) ? asToken(raw) : null;\n};\n\n// ----------------------------------------------------------------------\n// Authorization-header bridge\n// ----------------------------------------------------------------------\n\n/**\n * Parse a raw `Authorization` header value into the bearer token. The\n * dev-wallet adapter copies the token from `url.hash` into the\n * `Authorization: Bearer <token>` header on every request — this\n * helper is the symmetric inverse.\n *\n * Returns `null` on missing / malformed header so the caller can map\n * to the structured `unauthorized` request error.\n */\nexport const parseBearerHeader = (header: string | undefined): string | null => {\n\tif (header === undefined) return null;\n\tif (!header.startsWith(WALLET_BEARER_PREFIX)) return null;\n\tconst raw = header.slice(WALLET_BEARER_PREFIX.length);\n\t// Don't TOKEN_RE-test here — the constant-time compare against the\n\t// expected token covers shape mismatch (length-difference shortcut\n\t// is acceptable since token length is public knowledge).\n\treturn raw.length === WALLET_TOKEN_HEX_LENGTH ? raw : null;\n};\n\n// ----------------------------------------------------------------------\n// Constant-time compare\n// ----------------------------------------------------------------------\n\n/**\n * Constant-time bearer-token compare. The length-mismatch shortcut is\n * intentional — token length is public knowledge (always 32 hex\n * chars), so leaking \"wrong length\" is not a credential leak. The\n * shortcut also prevents `timingSafeEqual` from throwing on mismatched\n * buffer sizes.\n *\n * Invariant (15-wallet.md \"Token comparison MUST be constant-time\"):\n * NEVER `===` two tokens. `===` on strings short-circuits at the first\n * mismatching byte, leaking the prefix byte-by-byte via response-time\n * measurement to a remote attacker.\n */\nexport const safeBearerEquals = (a: string, b: PairingToken | string): boolean => {\n\tif (a.length !== b.length) return false;\n\t// `a` is attacker-controlled — a multi-byte UTF-8 codepoint in `a`\n\t// would inflate `ab.length` past `bb.length` even though\n\t// `a.length === b.length` passed (string length counts UTF-16 code\n\t// units, byte length counts UTF-8 bytes). The second length guard\n\t// stops `timingSafeEqual` from throwing in that case (its contract\n\t// requires equal-length buffers) and keeps the function total. For\n\t// the canonical case (`b` is a 32-hex `PairingToken`) the guard is\n\t// redundant; for the defensive case it prevents a malformed-input\n\t// throw from leaking up the dispatcher path.\n\tconst ab = Buffer.from(a, 'utf8');\n\tconst bb = Buffer.from(b, 'utf8');\n\tif (ab.length !== bb.length) return false;\n\treturn timingSafeEqual(ab, bb);\n};\n\n// ----------------------------------------------------------------------\n// Logging hygiene\n// ----------------------------------------------------------------------\n\nconst TOKEN_REDACTION_RULE: RedactionRule = {\n\tkind: 'pattern',\n\tpattern: /([#?&]token=)[A-Za-z0-9]+/g,\n\treplacement: '$1<redacted>',\n};\n\n/**\n * Redact the token fragment from any URL-shaped string for logging /\n * TUI rendering. Defense-in-depth — the engine's log sink should never\n * see the unredacted pair URL anyway, but this exists for callers that\n * accidentally pass `pairUrl` straight into a log line.\n *\n * This regex covers BOTH the fragment form (`#token=`) and a\n * hypothetical query form so a future config change doesn't silently\n * leak.\n */\nexport const redactToken = (s: string): string => redactText(s, [TOKEN_REDACTION_RULE]);\n"],"mappings":";;;;;;;;;;;;AAiDA,MAAM,WAAW;AAEjB,MAAM,WAAW,MAA4B;;AAO7C,MAAa,kBACZ,OAAO,WAAW,QAAQ,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC;;;;;;;;AAa3D,MAAa,aAAa,cAA8BA,KAAS,WAAW,UAAU,OAAO;;;;;;;;;AAU7F,MAAa,uBACZ,SAEA,OAAO,IAAI,aAAa;CAEvB,MAAM,WAAW,OAAO,OAAO,WAAW;EACzC,KAAK,YAAY;GAChB,IAAI;IACH,OAAO,MAAM,SAAS,MAAM,MAAM;GACnC,SAAS,KAAK;IACb,IAAK,KAA+B,SAAS,UAAU,OAAO;IAC9D,MAAM;GACP;EACD;EACA,QAAQ,UACP,gBAAgB;GACf,OAAO;GACP,SAAS,uCAAuC;GAChD,MAAM;GACN;EACD,CAAC;CACH,CAAC;CAED,IAAI,aAAa,MAAM;EACtB,MAAM,UAAU,SAAS,KAAK;EAC9B,IAAI,SAAS,KAAK,OAAO,GACxB,OAAO,QAAQ,OAAO;EAGvB,OAAO,OAAO,WAAW,4CAA4C,CAAC,CAAC,KACtE,OAAO,aAAa,EACnB,oBAAoB,KACrB,CAAC,CACF;CACD;CAOA,MAAM,QAAQ,OAAO,UAAU;CAE/B,OAAO,gBAAgB,MADT,IAAI,YAAY,CAAC,CAAC,OAAO,KACN,GAAG,EAAE,MAAM,IAAM,CAAC,CAAC,CAAC,KACpD,OAAO,UAAU,UAChB,gBAAgB;EACf,OAAO;EACP,SAAS,qCAAqC;EAC9C,MAAM;EACN;CACD,CAAC,CACF,CACD;CAEA,OAAO;AACR,CAAC;;;;;;;;AAaF,MAAa,kBAAkB,WAAmB,UACjD,GAAG,UAAU,IAAI,0BAA0B,GAAG;;;;;;;;;;AA8B/C,MAAa,qBAAqB,WAA8C;CAC/E,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,CAAC,OAAO,WAAA,SAA+B,GAAG,OAAO;CACrD,MAAM,MAAM,OAAO,MAAM,qBAAqB,MAAM;CAIpD,OAAO,IAAI,WAAA,KAAqC,MAAM;AACvD;;;;;;;;;;;;;AAkBA,MAAa,oBAAoB,GAAW,MAAsC;CACjF,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAUlC,MAAM,KAAK,OAAO,KAAK,GAAG,MAAM;CAChC,MAAM,KAAK,OAAO,KAAK,GAAG,MAAM;CAChC,IAAI,GAAG,WAAW,GAAG,QAAQ,OAAO;CACpC,OAAO,gBAAgB,IAAI,EAAE;AAC9B"}

package/dist/plugins/wallet/protocol.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/plugins/wallet/protocol.ts"],"sourcesContent":["// Wallet plugin — wire-level protocol.\n//\n// This file is the ONE cross-boundary contract between the devstack-\n// side HTTP server (this plugin) and the browser-side adapter (the\n// `dev-wallet` package). The browser-side adapter MUST be kept in\n// lock-step with these schemas; today that's enforced by a mirror in\n// `dev-wallet/src/adapters/devstack-paths.ts` + a byte-equality test.\n//\n// Distilled-doc opportunity (15-wallet.md \"Acyclic-edge duplication\"):\n// the duplication exists because devstack peer-deps on dev-wallet (for\n// codegen output) and a reverse edge would close a workspace cycle.\n// Per the task's architecture-revision flag: the long-term fix is to\n// hoist this file into a third tiny package (e.g.\n// `@mysten-incubation/devstack-wallet-protocol`) consumed by BOTH\n// sides. See `## Architecture-doc revisions` in the report.\n//\n// Canonical envelope choice (15-wallet.md \"Asymmetric sign-response\n// field names\" + \"Dual field-name acceptance\"):\n//\n//   - Sign endpoints accept `{ address, bytes }` (always `bytes`, never\n//     `txBytes` or `messageBytes`).\n//   - Sign endpoints respond `{ bytes, signature }` (always those two\n//     names; never `txBytes` / `suiSignature`).\n//\n// This mirrors `@mysten/sui`'s `Signer.signTransaction` /\n// `signPersonalMessage` return shape exactly, eliminating the asymmetry\n// the legacy server carried. Per the memory note \"no compat for\n// never-cases\" — devstack is unreleased, no migration burden.\n//\n// Effect v4 Schema is the validator. Each request/response is a\n// Schema.Struct; handlers `Schema.decodeUnknown(...)` the body and\n// `catchTag('ParseError', ...)` into a `body-invalid` request error.\n\nimport { Schema } from 'effect';\n\n// Pure wire constants live in the name-blind contract so L5 build\n// integrations can consume them without importing this L2 plugin\n// module; re-exported here so plugin-internal callers keep their\n// current import sites.\nexport {\n\tWalletHttpPath,\n\tWALLET_PROTOCOL_PREFIX,\n\tWALLET_AUTH_HEADER,\n\tWALLET_BEARER_PREFIX,\n\tWALLET_TOKEN_FRAGMENT_KEY,\n\tWALLET_TOKEN_HEX_LENGTH,\n\ttype WalletHttpPathValue,\n} from '../../contracts/wallet-protocol.ts';\n\n// ----------------------------------------------------------------------\n// Shared primitives\n// ----------------------------------------------------------------------\n\n/**\n * Sui address — `0x` + 64 hex chars. Schema-validated so a typo or\n * truncated address surfaces as a structured `body-invalid` request\n * error rather than a confusing `address-not-found` (no account bound\n * at the address would be the same shape if we didn't validate).\n */\nexport const SuiAddressSchema = Schema.String.check(Schema.isPattern(/^0x[0-9a-fA-F]{64}$/));\n\n/** Base64-encoded bytes — string-typed at the wire (we keep base64 over\n *  the cross-boundary; the server decodes with `Uint8Array.fromBase64`\n *  or equivalent before handing to the Account sign closures). */\nexport const Base64Schema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9+/]*={0,2}$/));\n\n/** Signature scheme discriminator surfaced on `/accounts`. Mirrors the\n *  `AccountValue.scheme` shape from the account plugin. */\nexport const SignatureSchemeSchema = Schema.Union([\n\tSchema.Literal('ed25519'),\n\tSchema.Literal('secp256k1'),\n\tSchema.Literal('secp256r1'),\n]);\n\n/** Account-source discriminator. `'impersonate'` accounts cannot\n *  satisfy `signTransaction` / `signPersonalMessage` — fork-admin\n *  surfaces (not part of this protocol today) are the only sensible\n *  consumers. */\nexport const AccountSourceSchema = Schema.Union([\n\tSchema.Literal('real'),\n\tSchema.Literal('impersonate'),\n]);\n\n// ----------------------------------------------------------------------\n// Response envelopes (200)\n// ----------------------------------------------------------------------\n\nexport const HealthResponseSchema = Schema.Struct({\n\tok: Schema.Literal(true),\n});\nexport type HealthResponse = Schema.Schema.Type<typeof HealthResponseSchema>;\n\nexport const AccountSummarySchema = Schema.Struct({\n\tname: Schema.String,\n\taddress: SuiAddressSchema,\n\tscheme: SignatureSchemeSchema,\n\t/** Base64-encoded `publicKey`. Impersonation accounts publish a\n\t *  zero-length string here — consumers branch on `source`, not on\n\t *  publicKey emptiness. */\n\tpublicKey: Base64Schema,\n\tsource: AccountSourceSchema,\n});\nexport type AccountSummary = Schema.Schema.Type<typeof AccountSummarySchema>;\n\nexport const AccountsResponseSchema = Schema.Struct({\n\taccounts: Schema.Array(AccountSummarySchema),\n});\nexport type AccountsResponse = Schema.Schema.Type<typeof AccountsResponseSchema>;\n\n// ----------------------------------------------------------------------\n// Sign endpoints — request + response\n// ----------------------------------------------------------------------\n\n/** Canonical sign request — same shape for transaction and personal-\n *  message routes. `bytes` is the only payload key (no `txBytes`,\n *  `message`, or `messageBytes` aliases). */\nexport const SignRequestSchema = Schema.Struct({\n\taddress: SuiAddressSchema,\n\tbytes: Base64Schema,\n});\nexport type SignRequest = Schema.Schema.Type<typeof SignRequestSchema>;\n\n/** Canonical sign response — same shape for transaction and personal-\n *  message routes. Matches `@mysten/sui`'s `Signer` return shape\n *  byte-for-byte. */\nexport const SignResponseSchema = Schema.Struct({\n\tbytes: Base64Schema,\n\tsignature: Schema.String,\n});\nexport type SignResponse = Schema.Schema.Type<typeof SignResponseSchema>;\n\n// ----------------------------------------------------------------------\n// Error envelope\n// ----------------------------------------------------------------------\n\n/** Error response body. The HTTP status carries the broad classification\n *  (400/401/403/404/500); `code` carries the narrow phase so callers\n *  can branch programmatically. */\nexport const ErrorResponseSchema = Schema.Struct({\n\terror: Schema.String,\n\tcode: Schema.String,\n});\nexport type ErrorResponse = Schema.Schema.Type<typeof ErrorResponseSchema>;\n\n// Header / token constants are re-exported above from\n// `../../contracts/wallet-protocol.ts`.\n"],"mappings":";;;;;;;;;AA2DA,MAAa,mBAAmB,OAAO,OAAO,MAAM,OAAO,UAAU,sBAAsB,CAAC;;;;AAK5F,MAAa,eAAe,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;;;AAI3F,MAAa,wBAAwB,OAAO,MAAM;CACjD,OAAO,QAAQ,UAAU;CACzB,OAAO,QAAQ,YAAY;CAC3B,OAAO,QAAQ,YAAY;CAC3B,CAAC;;;;;AAMF,MAAa,sBAAsB,OAAO,MAAM,CAC/C,OAAO,QAAQ,OAAO,EACtB,OAAO,QAAQ,cAAc,CAC7B,CAAC;AAMkC,OAAO,OAAO,EACjD,IAAI,OAAO,QAAQ,KAAK,EACxB,CAAC;AAGF,MAAa,uBAAuB,OAAO,OAAO;CACjD,MAAM,OAAO;CACb,SAAS;CACT,QAAQ;;;;CAIR,WAAW;CACX,QAAQ;CACR,CAAC;AAGoC,OAAO,OAAO,EACnD,UAAU,OAAO,MAAM,qBAAqB,EAC5C,CAAC;;;;AAUF,MAAa,oBAAoB,OAAO,OAAO;CAC9C,SAAS;CACT,OAAO;CACP,CAAC;AAMgC,OAAO,OAAO;CAC/C,OAAO;CACP,WAAW,OAAO;CAClB,CAAC;AAUiC,OAAO,OAAO;CAChD,OAAO,OAAO;CACd,MAAM,OAAO;CACb,CAAC"}
+{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/plugins/wallet/protocol.ts"],"sourcesContent":["// Wallet plugin — wire-level protocol.\n//\n// This file is the ONE cross-boundary contract between the devstack-\n// side HTTP server (this plugin) and the browser-side adapter (the\n// `dev-wallet` package). The browser-side adapter MUST be kept in\n// lock-step with these schemas; today that's enforced by a mirror in\n// `dev-wallet/src/adapters/devstack-paths.ts` + a byte-equality test.\n//\n// Distilled-doc opportunity (15-wallet.md \"Acyclic-edge duplication\"):\n// the duplication exists because devstack peer-deps on dev-wallet (for\n// codegen output) and a reverse edge would close a workspace cycle.\n// The long-term fix is to hoist this file into a third tiny package\n// (e.g. `@mysten-incubation/devstack-wallet-protocol`) consumed by BOTH\n// sides.\n//\n// Canonical envelope choice (15-wallet.md \"Asymmetric sign-response\n// field names\" + \"Dual field-name acceptance\"):\n//\n//   - Sign endpoints accept `{ address, bytes }` (always `bytes`, never\n//     `txBytes` or `messageBytes`).\n//   - Sign endpoints respond `{ bytes, signature }` (always those two\n//     names; never `txBytes` / `suiSignature`).\n//\n// This mirrors `@mysten/sui`'s `Signer.signTransaction` /\n// `signPersonalMessage` return shape exactly, so the request/response\n// field names stay symmetric.\n//\n// Effect v4 Schema is the validator. Each request/response is a\n// Schema.Struct; handlers `Schema.decodeUnknown(...)` the body and\n// `catchTag('ParseError', ...)` into a `body-invalid` request error.\n\nimport { Schema } from 'effect';\n\n// Pure wire constants live in the name-blind contract so L5 build\n// integrations can consume them without importing this L2 plugin\n// module; re-exported here so plugin-internal callers keep their\n// current import sites.\nexport {\n\tWalletHttpPath,\n\tWALLET_PROTOCOL_PREFIX,\n\tWALLET_AUTH_HEADER,\n\tWALLET_BEARER_PREFIX,\n\tWALLET_TOKEN_FRAGMENT_KEY,\n\tWALLET_TOKEN_HEX_LENGTH,\n\ttype WalletHttpPathValue,\n} from '../../contracts/wallet-protocol.ts';\n\n// ----------------------------------------------------------------------\n// Shared primitives\n// ----------------------------------------------------------------------\n\n/**\n * Sui address — `0x` + 64 hex chars. Schema-validated so a typo or\n * truncated address surfaces as a structured `body-invalid` request\n * error rather than a confusing `address-not-found` (no account bound\n * at the address would be the same shape if we didn't validate).\n */\nexport const SuiAddressSchema = Schema.String.check(Schema.isPattern(/^0x[0-9a-fA-F]{64}$/));\n\n/** Base64-encoded bytes — string-typed at the wire (we keep base64 over\n *  the cross-boundary; the server decodes with `Uint8Array.fromBase64`\n *  or equivalent before handing to the Account sign closures). */\nexport const Base64Schema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9+/]*={0,2}$/));\n\n/** Signature scheme discriminator surfaced on `/accounts`. Mirrors the\n *  `AccountValue.scheme` shape from the account plugin. */\nexport const SignatureSchemeSchema = Schema.Union([\n\tSchema.Literal('ed25519'),\n\tSchema.Literal('secp256k1'),\n\tSchema.Literal('secp256r1'),\n]);\n\n/** Account-source discriminator. `'impersonate'` accounts cannot\n *  satisfy `signTransaction` / `signPersonalMessage` — fork-admin\n *  surfaces (not part of this protocol today) are the only sensible\n *  consumers. */\nexport const AccountSourceSchema = Schema.Union([\n\tSchema.Literal('real'),\n\tSchema.Literal('impersonate'),\n]);\n\n// ----------------------------------------------------------------------\n// Response envelopes (200)\n// ----------------------------------------------------------------------\n\nexport const HealthResponseSchema = Schema.Struct({\n\tok: Schema.Literal(true),\n});\nexport type HealthResponse = Schema.Schema.Type<typeof HealthResponseSchema>;\n\nexport const AccountSummarySchema = Schema.Struct({\n\tname: Schema.String,\n\taddress: SuiAddressSchema,\n\tscheme: SignatureSchemeSchema,\n\t/** Base64-encoded `publicKey`. Impersonation accounts publish a\n\t *  zero-length string here — consumers branch on `source`, not on\n\t *  publicKey emptiness. */\n\tpublicKey: Base64Schema,\n\tsource: AccountSourceSchema,\n});\nexport type AccountSummary = Schema.Schema.Type<typeof AccountSummarySchema>;\n\nexport const AccountsResponseSchema = Schema.Struct({\n\taccounts: Schema.Array(AccountSummarySchema),\n});\nexport type AccountsResponse = Schema.Schema.Type<typeof AccountsResponseSchema>;\n\n// ----------------------------------------------------------------------\n// Sign endpoints — request + response\n// ----------------------------------------------------------------------\n\n/** Canonical sign request — same shape for transaction and personal-\n *  message routes. `bytes` is the only payload key (no `txBytes`,\n *  `message`, or `messageBytes` aliases). */\nexport const SignRequestSchema = Schema.Struct({\n\taddress: SuiAddressSchema,\n\tbytes: Base64Schema,\n});\nexport type SignRequest = Schema.Schema.Type<typeof SignRequestSchema>;\n\n/** Canonical sign response — same shape for transaction and personal-\n *  message routes. Matches `@mysten/sui`'s `Signer` return shape\n *  byte-for-byte. */\nexport const SignResponseSchema = Schema.Struct({\n\tbytes: Base64Schema,\n\tsignature: Schema.String,\n});\nexport type SignResponse = Schema.Schema.Type<typeof SignResponseSchema>;\n\n// ----------------------------------------------------------------------\n// Error envelope\n// ----------------------------------------------------------------------\n\n/** Error response body. The HTTP status carries the broad classification\n *  (400/401/403/404/500); `code` carries the narrow phase so callers\n *  can branch programmatically. */\nexport const ErrorResponseSchema = Schema.Struct({\n\terror: Schema.String,\n\tcode: Schema.String,\n});\nexport type ErrorResponse = Schema.Schema.Type<typeof ErrorResponseSchema>;\n\n// Header / token constants are re-exported above from\n// `../../contracts/wallet-protocol.ts`.\n"],"mappings":";;;;;;;;;AAyDA,MAAa,mBAAmB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;;;;AAK3F,MAAa,eAAe,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;;;AAI1F,MAAa,wBAAwB,OAAO,MAAM;CACjD,OAAO,QAAQ,SAAS;CACxB,OAAO,QAAQ,WAAW;CAC1B,OAAO,QAAQ,WAAW;AAC3B,CAAC;;;;;AAMD,MAAa,sBAAsB,OAAO,MAAM,CAC/C,OAAO,QAAQ,MAAM,GACrB,OAAO,QAAQ,aAAa,CAC7B,CAAC;AAMmC,OAAO,OAAO,EACjD,IAAI,OAAO,QAAQ,IAAI,EACxB,CAAC;AAGD,MAAa,uBAAuB,OAAO,OAAO;CACjD,MAAM,OAAO;CACb,SAAS;CACT,QAAQ;;;;CAIR,WAAW;CACX,QAAQ;AACT,CAAC;AAGqC,OAAO,OAAO,EACnD,UAAU,OAAO,MAAM,oBAAoB,EAC5C,CAAC;;;;AAUD,MAAa,oBAAoB,OAAO,OAAO;CAC9C,SAAS;CACT,OAAO;AACR,CAAC;AAMiC,OAAO,OAAO;CAC/C,OAAO;CACP,WAAW,OAAO;AACnB,CAAC;AAUkC,OAAO,OAAO;CAChD,OAAO,OAAO;CACd,MAAM,OAAO;AACd,CAAC"}

package/dist/plugins/wallet/routable.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/wallet/routable.ts"],"sourcesContent":["// Wallet plugin — Routable contribution.\n//\n// The wallet's HTTP server is a HOST PROCESS (not a docker container)\n// listening on a loopback port the substrate's port broker hands us.\n// The router (Traefik) fronts the loopback port under a stack-scoped\n// hostname like `wallet.<app>.localhost:<router-port>`.\n//\n// This contribution is what tells the router about the upstream. The\n// router orchestrator reads the decl, mints the stack-scoped hostname,\n// and writes the file-provider YAML without ever naming the wallet\n// plugin.\n//\n// The wallet always emits this decl. The router is the standard app\n// and wallet entrypoint, while the loopback URL remains an internal\n// fallback for tests and direct host tooling.\n\nimport type { EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\n// The routed-endpoint identity constants live in the name-blind\n// contract so L5 build integrations can consume them without importing\n// this L2 plugin module; re-exported here so plugin-internal callers\n// (and the conventional-routes alias table) keep one source of truth.\nexport {\n\tWALLET_ENDPOINT_NAME,\n\tWALLET_ENDPOINT_KEY,\n} from '../../contracts/wallet-protocol.ts';\n\nimport { WALLET_ENDPOINT_NAME } from '../../contracts/wallet-protocol.ts';\n\nexport const WALLET_ROUTE_ROLE = 'api' as const;\nexport const WALLET_ENTRYPOINT_PORT = 6173;\n\nexport const WALLET_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: WALLET_ENDPOINT_NAME, port: WALLET_ENTRYPOINT_PORT, protocol: 'http' },\n];\n\n// ----------------------------------------------------------------------\n// Decl\n// ----------------------------------------------------------------------\n\n/** Construct the Routable decl for the stack-scoped wallet endpoint. */\nexport const makeWalletRoutable = (parts: {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly port: number;\n}): RoutableDecl => ({\n\tkind: 'routable',\n\tendpointName: WALLET_ENDPOINT_NAME,\n\tdispatchId: {\n\t\t// Convention: `<plugin>.<app>.<stack>` keeps dispatch-file\n\t\t// listings readable; the router still hashes the full\n\t\t// `(app, stack, serviceKey, role)` tuple for uniqueness.\n\t\tserviceKey: `wallet.${parts.app}.${parts.stack}`,\n\t\trole: WALLET_ROUTE_ROLE,\n\t},\n\tupstream: { type: 'host-loopback', port: parts.port },\n\tcors: true,\n\twireProtocol: 'http',\n});\n"],"mappings":";AA8BA,MAAa,yBAAyB;AAEtC,MAAa,qBAAoD,CAChE;CAAE,MAAM;CAAsB,MAAM;CAAwB,UAAU;CAAQ,CAC9E;;AAOD,MAAa,sBAAsB,WAId;CACpB,MAAM;CACN,cAAc;CACd,YAAY;EAIX,YAAY,UAAU,MAAM,IAAI,GAAG,MAAM;EACzC,MAAA;EACA;CACD,UAAU;EAAE,MAAM;EAAiB,MAAM,MAAM;EAAM;CACrD,MAAM;CACN,cAAc;CACd"}
+{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/wallet/routable.ts"],"sourcesContent":["// Wallet plugin — Routable contribution.\n//\n// The wallet's HTTP server is a HOST PROCESS (not a docker container)\n// listening on a loopback port the substrate's port broker hands us.\n// The router (Traefik) fronts the loopback port under a stack-scoped\n// hostname like `wallet.<app>.localhost:<router-port>`.\n//\n// This contribution is what tells the router about the upstream. The\n// router orchestrator reads the decl, mints the stack-scoped hostname,\n// and writes the file-provider YAML without ever naming the wallet\n// plugin.\n//\n// The wallet always emits this decl. The router is the standard app\n// and wallet entrypoint, while the loopback URL remains an internal\n// fallback for tests and direct host tooling.\n\nimport type { EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\n// The routed-endpoint identity constants live in the name-blind\n// contract so L5 build integrations can consume them without importing\n// this L2 plugin module; re-exported here so plugin-internal callers\n// (and the conventional-routes alias table) keep one source of truth.\nexport { WALLET_ENDPOINT_NAME, WALLET_ENDPOINT_KEY } from '../../contracts/wallet-protocol.ts';\n\nimport { WALLET_ENDPOINT_NAME } from '../../contracts/wallet-protocol.ts';\n\nexport const WALLET_ROUTE_ROLE = 'api' as const;\nexport const WALLET_ENTRYPOINT_PORT = 6173;\n\nexport const WALLET_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: WALLET_ENDPOINT_NAME, port: WALLET_ENTRYPOINT_PORT, protocol: 'http' },\n];\n\n// ----------------------------------------------------------------------\n// Decl\n// ----------------------------------------------------------------------\n\n/** Construct the Routable decl for the stack-scoped wallet endpoint. */\nexport const makeWalletRoutable = (parts: {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly port: number;\n}): RoutableDecl => ({\n\tkind: 'routable',\n\tendpointName: WALLET_ENDPOINT_NAME,\n\tdispatchId: {\n\t\t// Convention: `<plugin>.<app>.<stack>` keeps dispatch-file\n\t\t// listings readable; the router still hashes the full\n\t\t// `(app, stack, serviceKey, role)` tuple for uniqueness.\n\t\tserviceKey: `wallet.${parts.app}.${parts.stack}`,\n\t\trole: WALLET_ROUTE_ROLE,\n\t},\n\tupstream: { type: 'host-loopback', port: parts.port },\n\tcors: true,\n\twireProtocol: 'http',\n});\n"],"mappings":";AA2BA,MAAa,yBAAyB;AAEtC,MAAa,qBAAoD,CAChE;CAAE,MAAM;CAAsB,MAAM;CAAwB,UAAU;AAAO,CAC9E;;AAOA,MAAa,sBAAsB,WAId;CACpB,MAAM;CACN,cAAc;CACd,YAAY;EAIX,YAAY,UAAU,MAAM,IAAI,GAAG,MAAM;EACzC,MAAA;CACD;CACA,UAAU;EAAE,MAAM;EAAiB,MAAM,MAAM;CAAK;CACpD,MAAM;CACN,cAAc;AACf"}