@mysten-incubation/devstack 0.3.0 → 0.4.0

package/dist/orchestrators/codegen/service.mjs

@@ -6,37 +6,38 @@ import { emitOne } from "./emit.mjs";
 import { dirModeFor, modeFor } from "./permissions.mjs";
 import { MoveCodegenService, MoveSummaryRunnerService, emitBindings, isPackageBindings } from "./bindings.mjs";
 import { CodegenPathsService } from "./paths.mjs";
-import { isRawExpr } from "../../contracts/codegenable.mjs";
+import { ForNetworkBucket, isForNetworkBucket, isRawExpr, rawExpr } from "../../contracts/codegenable.mjs";
 import { CONFIG_RUNTIME_OUTPUT_PATH, CONFIG_RUNTIME_SOURCE } from "./config-runtime.mjs";
+import { DEPLOYMENT_STRICT_OUTPUT_PATH, renderDeploymentStrict } from "./deployment-strict.mjs";
+import { LOCAL_NETWORK_NAME } from "../../api/inference-network.mjs";
 import { renderFile } from "./format.mjs";
 import { writeGitignore } from "./gitignore.mjs";
-import { UNRESOLVED_ID } from "./id-config.mjs";
+import { UNRESOLVED_ID } from "./deployment.mjs";
 import { Context, Effect, Layer, Order, Ref } from "effect";
-import { dirname } from "node:path";
+import { existsSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
 //#region src/orchestrators/codegen/service.ts
-/** Resolve a decl/aggregate's absolute output path against the tree
-*  selected by its `outputLocation`. `'generated-extras'` routes
-*  through `paths.resolveExtras` (the gitignored dev tree); everything
-*  else through `paths.resolve` (the staging-and-swapped runtime tree). */
-const resolveAt = (paths, location, outputPath) => location === "generated-extras" ? paths.resolveExtras(outputPath) : paths.resolve(outputPath);
-const declLocation = (decl) => decl.outputLocation ?? "generated";
-/** A decl belongs to the `emitExtras` flush IFF it writes ONLY into the
-*  dev-only `generated-extras` tree. INVARIANT: `emitExtras` must NEVER
-*  touch the committed `src/generated` tree (it runs without stage-and-swap),
-*  so a decl that would emit any file into `generated` is excluded.
-*
-*  - `aggregateOnly` decls write only their aggregate file: include iff the
-*    aggregate's location is `generated-extras` (e.g. each account folding
-*    into the gitignored `accounts.ts`).
-*  - standalone decls write a per-decl file (and possibly an aggregate):
-*    include iff that standalone file lands in `generated-extras` (e.g. the
-*    wallet's `dev-wallet.ts`). A standalone-in-`generated` decl is excluded
-*    even if its aggregate targets `generated-extras`. */
-const isExtrasDecl = (decl) => decl.aggregateOnly === true ? (decl.aggregate?.outputLocation ?? "generated") === "generated-extras" : declLocation(decl) === "generated-extras";
+/** Discover the app's LIVE network names by globbing `<projectRoot>/deployments/*.ts`
+*  (D7 — the network set is the `deployments/` directory, by FILENAME; the
+*  file CONTENTS are never read — ids load at app build via Vite). The
+*  project root is the grandparent of the canonical (non-staging) codegen
+*  `outputDir` (`<projectRoot>/src/generated`). Returns the filenames sans
+*  `.ts`, sorted; empty when there is no `deployments/` dir (a clean clone /
+*  template — `ProvidedNetwork = never`, `NETWORK_NAMES = [<local>]`). Never
+*  throws — a read failure degrades to empty (no live networks). */
+const discoverProvidedNetworks = (canonicalOutputDir) => {
+	try {
+		const deploymentsDir = join(dirname(dirname(canonicalOutputDir)), "deployments");
+		if (!existsSync(deploymentsDir)) return [];
+		return readdirSync(deploymentsDir).filter((f) => f.endsWith(".ts") && !f.endsWith(".d.ts")).map((f) => f.slice(0, -3)).filter((n) => n.length > 0).filter((n) => n !== LOCAL_NETWORK_NAME).sort();
+	} catch {
+		return [];
+	}
+};
 const buildParentModeResolver = (paths, entries) => Effect.gen(function* () {
 	const byParent = /* @__PURE__ */ new Map();
 	for (const entry of entries) {
-		const parent = dirname(yield* resolveAt(paths, entry.location, entry.outputPath));
+		const parent = dirname(yield* paths.resolve(entry.outputPath));
 		const current = byParent.get(parent);
 		if (current === void 0) byParent.set(parent, [{ sensitive: entry.sensitive }]);
 		else current.push({ sensitive: entry.sensitive });
@@ -66,6 +67,11 @@ const runEmitCycleLocked = (input) => Effect.gen(function* () {
 	const paths = yield* CodegenPathsService;
 	const moveRunner = yield* MoveSummaryRunnerService;
 	const moveCodegen = yield* MoveCodegenService;
+	const providedNetworks = input.providedNetworks ?? discoverProvidedNetworks(paths.outputDir);
+	const innerInput = {
+		...input,
+		providedNetworks
+	};
 	yield* validateUniqueness(input.contributions);
 	yield* validateAggregatePathAvailability(input.contributions);
 	const cycleId = mintRandomSuffix(16);
@@ -75,7 +81,7 @@ const runEmitCycleLocked = (input) => Effect.gen(function* () {
 		idSuffix: cycleId,
 		preserveOnPreseed: true,
 		build: Effect.gen(function* () {
-			return rewriteResultPaths(yield* runEmitCycleInner(input, stagingPaths).pipe(Effect.provideService(MoveSummaryRunnerService, moveRunner), Effect.provideService(MoveCodegenService, moveCodegen)), stagingPaths.outputDir, paths.outputDir);
+			return rewriteResultPaths(yield* runEmitCycleInner(innerInput, stagingPaths).pipe(Effect.provideService(MoveSummaryRunnerService, moveRunner), Effect.provideService(MoveCodegenService, moveCodegen)), stagingPaths.outputDir, paths.outputDir);
 		})
 	}).pipe(Effect.mapError((e) => {
 		if (e instanceof StageAndSwapError) return new CodegenWriteFailed({
@@ -124,7 +130,6 @@ const runEmitCycleInner = (input, paths) => Effect.gen(function* () {
 	const sortedDecls = [...fileEmitters].sort(Order.mapInput(Order.String, (d) => d.outputPath));
 	const parentModeFor = yield* buildParentModeResolver(paths, fileEmitters.filter((d) => d.aggregateOnly !== true).map((d) => ({
 		outputPath: d.outputPath,
-		location: declLocation(d),
 		sensitive: d.sensitive === true
 	})));
 	for (const decl of sortedDecls) {
@@ -136,30 +141,19 @@ const runEmitCycleInner = (input, paths) => Effect.gen(function* () {
 				const bucket = aggregates.get(decl.aggregate.bucket) ?? {};
 				deepMerge(bucket, projected);
 				aggregates.set(decl.aggregate.bucket, bucket);
-				const declLoc = decl.aggregate.outputLocation ?? "generated";
 				const declSensitive = decl.aggregate.sensitive === true;
 				const established = aggregateMeta.get(decl.aggregate.bucket);
 				if (established === void 0) aggregateMeta.set(decl.aggregate.bucket, {
-					location: declLoc,
 					sensitive: declSensitive,
 					establishedBy: decl.emitterName
 				});
-				else {
-					if (established.location !== declLoc) return yield* Effect.fail(new CodegenAggregateConflict({
-						bucket: decl.aggregate.bucket,
-						field: "outputLocation",
-						established: established.location,
-						conflicting: declLoc,
-						emitters: [established.establishedBy, decl.emitterName]
-					}));
-					if (established.sensitive !== declSensitive) return yield* Effect.fail(new CodegenAggregateConflict({
-						bucket: decl.aggregate.bucket,
-						field: "sensitive",
-						established: String(established.sensitive),
-						conflicting: String(declSensitive),
-						emitters: [established.establishedBy, decl.emitterName]
-					}));
-				}
+				else if (established.sensitive !== declSensitive) return yield* Effect.fail(new CodegenAggregateConflict({
+					bucket: decl.aggregate.bucket,
+					field: "sensitive",
+					established: String(established.sensitive),
+					conflicting: String(declSensitive),
+					emitters: [established.establishedBy, decl.emitterName]
+				}));
 			}
 		}
 		for (const value of Object.values(exported)) if (isPackageBindings(value)) packageContribs.push(value);
@@ -172,7 +166,7 @@ const runEmitCycleInner = (input, paths) => Effect.gen(function* () {
 			imports: emission.imports
 		});
 		if (!rendered.ok) return yield* Effect.fail(rendered.error);
-		const abs = yield* resolveAt(paths, declLocation(decl), decl.outputPath);
+		const abs = yield* paths.resolve(decl.outputPath);
 		switch ((yield* emitOne({
 			path: abs,
 			content: rendered.text,
@@ -190,20 +184,27 @@ const runEmitCycleInner = (input, paths) => Effect.gen(function* () {
 				break;
 		}
 	}
-	const aggregateFiles = buildAggregateFiles(aggregates, aggregateMeta);
+	const aggregateFiles = buildAggregateFiles(aggregates, aggregateMeta).map(withConfigEnvelopeAccessors).map(withForNetworkAccessor);
 	let needsConfigRuntime = false;
 	for (const aggregate of aggregateFiles) {
-		const resolvers = resolversUsedBy(aggregate.exports);
-		if (resolvers.length > 0) needsConfigRuntime = true;
+		const usage = deploymentUsageOf(aggregate.exports);
+		if (!deploymentUsageEmpty(usage)) needsConfigRuntime = true;
+		const imports = deploymentImportsFor(usage);
+		const preamble = isServiceBucket(aggregate.outputPath) ? [] : deploymentPreambleFor(usage);
+		const usesNetworkNames = referencesNetworkNames(aggregate.exports);
+		const importLines = [];
+		if (imports.length > 0) importLines.push(`import { ${imports.join(", ")} } from './config-runtime.js';`);
+		if (usesNetworkNames) importLines.push(`import { NETWORK_NAMES } from './deployment.js';`);
 		const rendered = renderFile({
 			emitterName: aggregate.emitterName,
 			outputPath: aggregate.outputPath,
 			sensitive: aggregate.sensitive,
 			exports: aggregate.exports,
-			...resolvers.length > 0 ? { imports: [`import { ${resolvers.join(", ")} } from './config-runtime.js';`] } : {}
+			...importLines.length > 0 ? { imports: importLines } : {},
+			...preamble.length > 0 ? { preamble } : {}
 		});
 		if (!rendered.ok) return yield* Effect.fail(rendered.error);
-		const abs = yield* resolveAt(paths, aggregate.location, aggregate.outputPath);
+		const abs = yield* paths.resolve(aggregate.outputPath);
 		switch ((yield* emitOne({
 			path: abs,
 			content: rendered.text,
@@ -239,6 +240,32 @@ const runEmitCycleInner = (input, paths) => Effect.gen(function* () {
 				filesChmod.push(abs);
 				break;
 		}
+		const strictInput = strictTypeInputFrom(aggregateFiles);
+		const deploymentStrict = renderDeploymentStrict({
+			localNetworkName: LOCAL_NETWORK_NAME,
+			packageNames: strictInput.packageNames,
+			mvrPlaceholders: strictInput.mvrPlaceholders,
+			mvrTypeTags: strictInput.mvrTypeTags,
+			providedNetworks: input.providedNetworks ?? [],
+			serviceValues: serviceValuesFrom(input.contributions)
+		});
+		const strictAbs = yield* paths.resolve(DEPLOYMENT_STRICT_OUTPUT_PATH);
+		switch ((yield* emitOne({
+			path: strictAbs,
+			content: deploymentStrict,
+			mode: 420,
+			parentMode: parentModeFor(strictAbs)
+		})).outcome) {
+			case "wrote":
+				filesWritten.push(strictAbs);
+				break;
+			case "unchanged":
+				filesUnchanged.push(strictAbs);
+				break;
+			case "chmod-only":
+				filesChmod.push(strictAbs);
+				break;
+		}
 	}
 	let bindings = null;
 	if (packageContribs.length > 0) bindings = yield* emitBindings({
@@ -247,8 +274,8 @@ const runEmitCycleInner = (input, paths) => Effect.gen(function* () {
 		importExtension: input.bindingsImportExtension
 	});
 	else yield* Effect.logInfo("codegen: no package contributions; skipping Move-to-TS bindings step.");
-	if (fileEmitters.some((d) => d.aggregateOnly !== true && declLocation(d) === "generated") || aggregateFiles.some((a) => a.location === "generated")) {
-		const sensitivePaths = [...fileEmitters.filter((d) => d.sensitive === true && d.aggregateOnly !== true && declLocation(d) === "generated").map((d) => d.outputPath), ...aggregateFiles.filter((a) => a.sensitive && a.location === "generated").map((a) => a.outputPath)];
+	if (fileEmitters.some((d) => d.aggregateOnly !== true) || aggregateFiles.length > 0) {
+		const sensitivePaths = [...fileEmitters.filter((d) => d.sensitive === true && d.aggregateOnly !== true).map((d) => d.outputPath), ...aggregateFiles.filter((a) => a.sensitive).map((a) => a.outputPath)];
 		yield* writeGitignore({
 			path: paths.gitignoreFile,
 			sensitivePaths,
@@ -299,19 +326,18 @@ const validateUniqueness = (decls) => Effect.gen(function* () {
 	const byName = /* @__PURE__ */ new Map();
 	for (const d of decls) {
 		if (d.aggregateOnly !== true) {
-			const pathKey = `${declLocation(d)} ${d.outputPath}`;
-			const ps = byPath.get(pathKey) ?? [];
+			const ps = byPath.get(d.outputPath) ?? [];
 			ps.push(d.emitterName);
-			byPath.set(pathKey, ps);
+			byPath.set(d.outputPath, ps);
 		}
 		if (d.allowEmitterNameRepetition === true) continue;
 		const ns = byName.get(d.emitterName) ?? [];
 		ns.push(d.outputPath);
 		byName.set(d.emitterName, ns);
 	}
-	for (const [pathKey, emitters] of byPath) if (emitters.length > 1) return yield* Effect.fail(new CodegenPathConflict({
+	for (const [outputPath, emitters] of byPath) if (emitters.length > 1) return yield* Effect.fail(new CodegenPathConflict({
 		kind: "duplicate",
-		outputPath: pathKey.slice(pathKey.indexOf(" ") + 1),
+		outputPath,
 		emitters
 	}));
 	for (const [name, outputPaths] of byName) if (outputPaths.length > 1) return yield* Effect.fail(new CodegenEmitterCollision({
@@ -326,14 +352,10 @@ const validateUniqueness = (decls) => Effect.gen(function* () {
 * it does not enumerate or recognize plugin identities here.
 */
 const validateAggregatePathAvailability = (decls) => Effect.gen(function* () {
-	const aggregatePaths = /* @__PURE__ */ new Map();
-	for (const decl of decls) if (decl.aggregate !== void 0) {
-		const location = decl.aggregate.outputLocation ?? "generated";
-		aggregatePaths.set(`${location} ${decl.aggregate.bucket}`, decl.aggregate.bucket);
-	}
-	for (const [key, bucket] of aggregatePaths) {
-		const location = key.slice(0, key.indexOf(" "));
-		const colliding = decls.filter((decl) => decl.aggregateOnly !== true && declLocation(decl) === location && decl.outputPath === bucket);
+	const aggregateBuckets = /* @__PURE__ */ new Set();
+	for (const decl of decls) if (decl.aggregate !== void 0) aggregateBuckets.add(decl.aggregate.bucket);
+	for (const bucket of aggregateBuckets) {
+		const colliding = decls.filter((decl) => decl.aggregateOnly !== true && decl.outputPath === bucket);
 		if (colliding.length > 0) return yield* Effect.fail(new CodegenPathConflict({
 			kind: "duplicate",
 			outputPath: bucket,
@@ -369,8 +391,7 @@ const deepMerge = (target, source) => {
 * orchestrator picks the export key from the bucket filename; the
 * stem itself is not a plugin identifier — it is the filename
 * without the `.ts` extension, derived mechanically. The bucket's
-* `location`/`sensitive` (from the first contributing decl) drive
-* which tree the file lands in and its mode.
+* `sensitive` flag (from the first contributing decl) drives its mode.
 */
 const buildAggregateFiles = (buckets, meta) => {
 	const files = [];
@@ -379,7 +400,6 @@ const buildAggregateFiles = (buckets, meta) => {
 		if (Object.keys(contents).length === 0) continue;
 		const stem = bucketStem(bucket);
 		const bucketMeta = meta.get(bucket) ?? {
-			location: "generated",
 			sensitive: false,
 			establishedBy: `aggregate/${stem}`
 		};
@@ -387,62 +407,264 @@ const buildAggregateFiles = (buckets, meta) => {
 			emitterName: `aggregate/${stem}`,
 			outputPath: bucket,
 			exports: { [stem]: contents },
-			location: bucketMeta.location,
 			sensitive: bucketMeta.sensitive
 		});
 	}
 	return files;
 };
 const bucketStem = (bucket) => bucket.replace(/\.ts$/, "").replace(/^.*\//, "");
-/** The config-runtime resolver names a committed `config.ts` aggregate may
-*  reference as raw expressions. Each is imported from `./config-runtime.js`
-*  only when the aggregate actually calls it (oxlint flags unused imports). */
-const CONFIG_RUNTIME_RESOLVERS = [
-	"resolveId",
-	"resolveNetwork",
-	"resolveNetworks",
-	"resolveValue"
-];
-/** Recursively collect which `config-runtime.ts` resolvers an exports map
-*  references via raw expressions — i.e. the committed `config.ts` needs each
-*  imported + the fixed `config-runtime.ts` emitted alongside it. */
-const collectResolversInValue = (value, found) => {
+/** The committed `config.ts` bucket. The orchestrator already encodes
+*  `config.ts` semantics by name elsewhere (the live `assembleDeployment`
+*  slices it by this exact bucket); the static envelope-accessor injection
+*  below is the matching static-render-only branch. */
+const CONFIG_BUCKET = "config.ts";
+/** The network-agnostic `accounts.ts` bucket. Like `config.ts`, this is a
+*  bucket the orchestrator special-cases STRUCTURALLY (not by plugin identity):
+*  the live `assembleDeployment` folds it into the deployment envelope's
+*  network-AGNOSTIC `accounts` map (name → address) rather than any per-network
+*  unit, so it must NOT receive the per-network `forNetwork(network)` wrapper. */
+const ACCOUNTS_BUCKET = "accounts.ts";
+/** The buckets that are NOT per-network service buckets — the ones the
+*  orchestrator special-cases structurally:
+*   - `config.ts`: carries the TYPED deployment channel and its own
+*     per-network `forNetwork` field (injected by {@link withConfigEnvelopeAccessors});
+*     `assembleDeployment` slices it into `network`/`networks`/`packages`/`mvrOverrides`.
+*   - `accounts.ts`: network-agnostic (name → address), folded into the
+*     envelope's `accounts` map by `assembleDeployment`.
+*   - `packages.ts`: network-agnostic MVR pointers (see {@link PACKAGES_BUCKET}).
+*  config/accounts mirror the two bucket arms `assembleDeployment` branches on;
+*  `packages.ts` is the additional structurally-network-agnostic aggregate whose
+*  per-network story is owned by `config.forNetwork`. Keeping this set to the
+*  genuinely network-agnostic buckets is what lets the STATIC `forNetwork` gate
+*  auto-wrap any NEW per-network service bucket by default. */
+const NON_SERVICE_BUCKETS = new Set([
+	CONFIG_BUCKET,
+	ACCOUNTS_BUCKET,
+	"packages.ts"
+]);
+/** True when a bucket is a per-network SERVICE bucket (coins / deepbook / seal /
+*  walrus today; a NEW plugin's `pyth.ts` automatically) — i.e. any aggregate
+*  bucket that is NOT one of the orchestrator's structurally-special buckets.
+*
+*  Derived from a DECLARED structural fact (the bucket is not config / not
+*  accounts) rather than a hard-coded service-name allowlist: a per-network
+*  service plugin emitting a new bucket is wrapped in its `forNetwork(network)`
+*  accessor by default, so its ids resolve for the dapp-kit-selected network
+*  instead of silently baking the DEFAULT network's ids at module load. */
+const isServiceBucket = (bucket) => !NON_SERVICE_BUCKETS.has(bucket);
+/**
+* Inject the DEPLOYMENT envelope-accessor fields into the committed
+* `config.ts` aggregate's `config` object literal as raw expressions:
+*   - `defaultNetwork: __deployment.defaultNetwork`
+*   - `networkNames:   __deployment.networkNames`
+*   - `forNetwork:     __deployment.forNetwork`
+*
+* There is deliberately NO `activeNetwork` field: the genuinely active network
+* is whatever dapp-kit currently has selected (it can `switchNetwork` at
+* runtime), so a statically-resolved "active" entry would lie the moment the
+* user switches. Apps resolve per-network data through
+* `config.forNetwork(<dapp-kit-selected network>)` — e.g.
+* `createClient(network) => config.forNetwork(network)` — so nothing drifts out
+* of sync with the selected network.
+*
+* STATIC-render-only: these are wired into the emitted committed tree so apps
+* can enumerate / look up networks off `config`, but they are NOT part of the
+* live deployment path (`assembleDeployment` / `deploymentFromBucket` slice the raw
+* `network`/`networks`/`packages`/`mvrOverrides` fields, never these). The
+* aggregate file's `exports` is `{ config: {...} }`; mutate the inner object.
+*/
+const withConfigEnvelopeAccessors = (file) => {
+	if (file.outputPath !== CONFIG_BUCKET) return file;
+	const stem = bucketStem(file.outputPath);
+	const inner = file.exports[stem];
+	if (!isPlainObject(inner)) return file;
+	const augmented = {
+		...inner,
+		defaultNetwork: rawExpr("__deployment.defaultNetwork as (typeof NETWORK_NAMES)[number]"),
+		networkNames: rawExpr("NETWORK_NAMES"),
+		forNetwork: rawExpr("__deployment.forNetwork")
+	};
+	return {
+		...file,
+		exports: {
+			...file.exports,
+			[stem]: augmented
+		}
+	};
+};
+/**
+* Wrap a SERVICE bucket's inner object in a `forNetwork(network)` accessor.
+*
+* A per-network service bucket (coin → `coins.ts`, deepbook → `deepbook.ts`,
+* seal → `seal.ts`, walrus → `walrus.ts`, and any NEW plugin's bucket) gets its
+* ids wrapped so they resolve for the dapp-kit-selected network rather than the
+* default network baked at module load. Which buckets qualify is derived from
+* {@link isServiceBucket} (every bucket that is not the structurally-special
+* `config.ts` / `accounts.ts`) — see its note for why a declared denylist beats
+* a hard-coded service-name allowlist.
+*
+* The aggregate file's `exports` is `{ <stem>: <merged bucket object> }`. We
+* replace the merged object with a {@link ForNetworkBucket} marker the renderer
+* emits as `{ forNetwork(network) { const dep = …; return <object> as const; } }`.
+* `needsDep` is true when the merged object actually references `dep` (a
+* pure-literal bucket — known/live seal, builtin-only coin — does not, so the
+* accessor omits the `const dep` line and ignores its `network` param).
+*
+* Non-service buckets pass through unchanged.
+*/
+const withForNetworkAccessor = (file) => {
+	if (!isServiceBucket(file.outputPath)) return file;
+	const stem = bucketStem(file.outputPath);
+	const inner = file.exports[stem];
+	if (!isPlainObject(inner)) return file;
+	const usage = { ...EMPTY_DEPLOYMENT_USAGE };
+	scanDeploymentUsage(inner, usage);
+	const marker = new ForNetworkBucket(inner, usage.usesDep);
+	return {
+		...file,
+		exports: {
+			...file.exports,
+			[stem]: marker
+		}
+	};
+};
+/** Pull the app's declared package names + MVR placeholders out of the
+*  committed `config.ts` aggregate's inner `config` object — the SAME data
+*  the strict `deployment.ts` type narrows over. `config.packages.<name>`
+*  gives the package names; `config.mvrOverrides.<mvr>` gives the placeholder
+*  keys. Both come from the deep-merged bucket (no chain / no live data), so
+*  this stays a pure projection over already-collected exports. Returns empty
+*  arrays when there is no `config.ts` aggregate. */
+const strictTypeInputFrom = (aggregateFiles) => {
+	const empty = {
+		packageNames: [],
+		mvrPlaceholders: [],
+		mvrTypeTags: []
+	};
+	const configFile = aggregateFiles.find((f) => f.outputPath === CONFIG_BUCKET);
+	if (configFile === void 0) return empty;
+	const inner = configFile.exports[bucketStem(CONFIG_BUCKET)];
+	if (!isPlainObject(inner)) return empty;
+	const packagesNode = inner["packages"];
+	const mvrNode = isPlainObject(inner["mvrOverrides"]) ? inner["mvrOverrides"] : {};
+	const mvrPackagesNode = mvrNode["packages"];
+	const mvrTypesNode = mvrNode["types"];
+	return {
+		packageNames: isPlainObject(packagesNode) ? Object.keys(packagesNode).sort() : [],
+		mvrPlaceholders: isPlainObject(mvrPackagesNode) ? Object.keys(mvrPackagesNode).sort() : [],
+		mvrTypeTags: isPlainObject(mvrTypesNode) ? Object.keys(mvrTypesNode).sort() : []
+	};
+};
+/**
+* Derive the structured SERVICE-VALUE channel `values[namespace][key] = <tsType>`
+* for the strict `deployment.ts` — every generic (non-sugar) RESOLVED
+* config-binding the contributions declare. Computed from the SAME contribution
+* decls the cycle emits: a binding lands here exactly when it would land in the
+* live deployment's generic `values` channel (a `resolved` binding with NO
+* `sugar`), so the required `AppNetworkDeployment.values` shape matches what a
+* resolved deployment actually carries. The tsType is read off each contribution's
+* `aggregate.valueTypes` (added in config-bindings); a binding with no declared
+* tsType contributes `'unknown'`. Empty for a service-less app.
+*/
+const serviceValuesFrom = (contributions) => {
+	const out = {};
+	for (const decl of contributions) {
+		const valueTypes = decl.aggregate?.valueTypes;
+		if (valueTypes === void 0) continue;
+		for (const [ns, keys] of Object.entries(valueTypes)) {
+			const nsOut = out[ns] ??= {};
+			for (const [key, tsType] of Object.entries(keys)) nsOut[key] = tsType;
+		}
+	}
+	return out;
+};
+const EMPTY_DEPLOYMENT_USAGE = {
+	usesDep: false,
+	usesDeployment: false,
+	requireId: false,
+	requireValue: false,
+	optionalValue: false
+};
+const deploymentUsageEmpty = (u) => !u.usesDep && !u.usesDeployment && !u.requireId && !u.requireValue && !u.optionalValue;
+/** Recursively scan an exports value's raw expressions, OR-ing in the
+*  deployment symbols each references. */
+const scanDeploymentUsage = (value, acc) => {
 	if (isRawExpr(value)) {
-		for (const name of CONFIG_RUNTIME_RESOLVERS) if (value.expr.includes(`${name}(`)) found.add(name);
+		const e = value.expr;
+		if (/\bdep\b/.test(e)) acc.usesDep = true;
+		if (e.includes("__deployment")) acc.usesDeployment = true;
+		if (e.includes("requireId(")) acc.requireId = true;
+		if (e.includes("requireValue")) acc.requireValue = true;
+		if (e.includes("optionalValue(")) acc.optionalValue = true;
+		return;
+	}
+	if (isForNetworkBucket(value)) {
+		scanDeploymentUsage(value.inner, acc);
 		return;
 	}
 	if (Array.isArray(value)) {
-		for (const v of value) collectResolversInValue(v, found);
+		for (const v of value) scanDeploymentUsage(v, acc);
 		return;
 	}
-	if (isPlainObject(value)) for (const v of Object.values(value)) collectResolversInValue(v, found);
+	if (isPlainObject(value)) for (const v of Object.values(value)) scanDeploymentUsage(v, acc);
+};
+/** True when any raw expression in the exports references the `NETWORK_NAMES`
+*  identifier (the strict `deployment.ts` tuple `config.ts` types against).
+*  Drives the `./deployment.js` import injection. */
+const referencesNetworkNames = (value) => {
+	if (isRawExpr(value)) return /\bNETWORK_NAMES\b/.test(value.expr);
+	if (Array.isArray(value)) return value.some(referencesNetworkNames);
+	if (isPlainObject(value)) return Object.values(value).some(referencesNetworkNames);
+	return false;
+};
+/** The deployment symbols an aggregate's exports use (all-false when the
+*  aggregate carries no deployment expressions — pure literals). */
+const deploymentUsageOf = (exports) => {
+	const acc = { ...EMPTY_DEPLOYMENT_USAGE };
+	for (const v of Object.values(exports)) scanDeploymentUsage(v, acc);
+	return acc;
 };
-/** The ordered set of config-runtime resolvers an aggregate's exports use
-*  (empty when none — the aggregate needs no resolver import). */
-const resolversUsedBy = (exports) => {
-	const found = /* @__PURE__ */ new Set();
-	for (const v of Object.values(exports)) collectResolversInValue(v, found);
-	return CONFIG_RUNTIME_RESOLVERS.filter((name) => found.has(name));
+/** The `./config-runtime.js` named imports the usage requires, in a stable
+*  order. Only symbols actually used are imported (oxlint flags unused). */
+const deploymentImportsFor = (u) => {
+	const names = [];
+	if (u.usesDep || u.usesDeployment) names.push("loadDeployment");
+	if (u.requireId) names.push("requireId");
+	if (u.requireValue) names.push("requireValue");
+	if (u.optionalValue) names.push("optionalValue");
+	return names;
+};
+/** The module-level preamble lines the usage requires (`loadDeployment()`
+*  once, then the active-network `dep`). */
+const deploymentPreambleFor = (u) => {
+	const lines = [];
+	if (u.usesDep || u.usesDeployment) lines.push("const __deployment = loadDeployment();");
+	if (u.usesDep) lines.push("const dep = __deployment.forNetwork(__deployment.defaultNetwork);");
+	return lines;
 };
 var CodegenOrchestratorService = class extends Context.Service()("@devstack/orchestrators/Codegen") {};
 /**
-* Slice the deep-merged `config.ts` aggregate bucket into the loadable
-* `IdConfig` interchange shape. The bucket is the live codegen
-* accumulation (sui `networks`, per-package `packages`/`objects`/
-* `mvrOverrides`, account `accounts`); this picks the id-bearing fields
-* the Vite plugin injects. Reads are defensive — any missing slice
-* collapses to an empty record so a partial stack still writes a valid
-* (if sparse) id-config.
+* Slice the deep-merged `config.ts` aggregate bucket into a single
+* loadable `NetworkDeployment` (the LIVE LOCAL network unit). The bucket is
+* the live codegen accumulation (sui `networks`, per-package `packages`/
+* `objects`/`mvrOverrides`); this picks the id-bearing
+* fields the Vite plugin injects and FLATTENS the chosen network's
+* connection coordinates (rpc/chainId/faucet/graphql) inline. Reads are
+* defensive — any missing slice collapses to an empty record so a partial
+* stack still writes a valid (if sparse) network deployment. Single-network
+* only here: `assembleDeployment` keys the envelope under this unit's network.
+* Per-network package ids for live networks come from the committed
+* `deployments/<net>.ts` files merged into the envelope at app build/dev time.
 */
-const idConfigFromBucket = (bucket, network, values) => {
+const deploymentFromBucket = (bucket, network, values) => {
 	const asRecord = (v) => isPlainObject(v) ? v : {};
 	const asString = (v) => typeof v === "string" ? v : void 0;
-	const networks = {};
+	const conns = {};
 	for (const [name, raw] of Object.entries(asRecord(bucket["networks"]))) {
 		const entry = asRecord(raw);
 		const rpc = asString(entry["rpc"]);
 		if (rpc === void 0) continue;
-		networks[name] = {
+		conns[name] = {
 			rpc,
 			...asString(entry["chainId"]) !== void 0 ? { chainId: asString(entry["chainId"]) } : {},
 			...entry["faucet"] !== void 0 ? { faucet: asString(entry["faucet"]) ?? null } : {},
@@ -465,23 +687,28 @@ const idConfigFromBucket = (bucket, network, values) => {
 			...Object.keys(objects).length > 0 ? { objects } : {}
 		};
 	}
-	const accounts = {};
-	for (const [name, v] of Object.entries(asRecord(bucket["accounts"]))) {
-		const address = asString(v) ?? asString(asRecord(v)["address"]);
-		if (address !== void 0) accounts[name] = address;
-	}
-	const mvrOverrides = {};
-	for (const [mvr, v] of Object.entries(asRecord(bucket["mvrOverrides"]))) {
+	const mvrPackages = {};
+	const mvrNode = asRecord(bucket["mvrOverrides"]);
+	for (const [mvr, v] of Object.entries(asRecord(mvrNode["packages"]))) {
 		const s = asString(v);
-		if (s !== void 0) mvrOverrides[mvr] = s;
+		if (s !== void 0) mvrPackages[mvr] = s;
 	}
-	const networkKeys = Object.keys(networks);
+	const mvrOverrides = {
+		packages: mvrPackages,
+		types: {}
+	};
+	const connKeys = Object.keys(conns);
 	const bucketNetwork = asString(bucket["network"]);
+	const activeNetwork = bucketNetwork !== void 0 && connKeys.includes(bucketNetwork) ? bucketNetwork : connKeys.length === 1 ? connKeys[0] : bucketNetwork ?? network;
+	const conn = conns[activeNetwork] ?? { rpc: "" };
 	return {
-		network: bucketNetwork !== void 0 && networkKeys.includes(bucketNetwork) ? bucketNetwork : networkKeys.includes(network) ? network : networkKeys.length === 1 ? networkKeys[0] : bucketNetwork ?? network,
-		networks,
+		network: activeNetwork,
+		rpc: conn.rpc,
+		...conn.chainId !== void 0 ? { chainId: conn.chainId } : {},
+		...conn.faucet !== void 0 ? { faucet: conn.faucet } : {},
+		...conn.graphql !== void 0 ? { graphql: conn.graphql } : {},
+		local: true,
 		packages,
-		accounts,
 		mvrOverrides,
 		...Object.keys(values).length > 0 ? { values } : {}
 	};
@@ -502,7 +729,7 @@ const layerCodegenOrchestrator = Layer.effect(CodegenOrchestratorService, Effect
 		yield* Ref.update(contributionsRef, (xs) => [...xs, entry]);
 		yield* Effect.addFinalizer(() => Ref.update(contributionsRef, (xs) => xs.filter((e) => e.seq !== seq)));
 	});
-	const assembleIdConfig = (network) => Effect.gen(function* () {
+	const assembleDeployment = (network) => Effect.gen(function* () {
 		const registered = (yield* Ref.get(contributionsRef)).map((e) => e.decl);
 		const bucket = {};
 		const accounts = {};
@@ -510,41 +737,28 @@ const layerCodegenOrchestrator = Layer.effect(CodegenOrchestratorService, Effect
 		for (const decl of registered) {
 			if (decl.aggregate === void 0) continue;
 			if (decl.aggregate.idConfigValues !== void 0) deepMerge(values, decl.aggregate.idConfigValues);
-			if (decl.aggregate.bucket === "config.ts") {
+			if (decl.aggregate.bucket === CONFIG_BUCKET) {
 				const emission = yield* runEmitter(decl);
 				const projected = decl.aggregate.project(emission.exports);
 				if (projected !== null) deepMerge(bucket, projected);
-			} else if (decl.aggregate.bucket === "accounts.ts") {
+			} else if (decl.aggregate.bucket === ACCOUNTS_BUCKET) {
 				const emission = yield* runEmitter(decl);
 				const projected = decl.aggregate.project(emission.exports);
 				if (projected !== null) deepMerge(accounts, projected);
 			}
 		}
-		bucket["accounts"] = accounts;
-		return idConfigFromBucket(bucket, network, values);
-	});
-	const emitExtras = () => Effect.gen(function* () {
-		const extras = (yield* Ref.get(contributionsRef)).map((e) => e.decl).filter(isExtrasDecl);
-		if (extras.length === 0) return {
-			filesWritten: [],
-			filesUnchanged: [],
-			filesChmod: [],
-			bindings: null
+		const envelopeAccounts = {};
+		for (const [name, v] of Object.entries(accounts)) {
+			const address = typeof v === "string" ? v : isPlainObject(v) && typeof v["address"] === "string" ? v["address"] : void 0;
+			if (address !== void 0) envelopeAccounts[name] = address;
+		}
+		const unit = deploymentFromBucket(bucket, network, values);
+		const unitNetwork = unit.network ?? network;
+		return {
+			defaultNetwork: unitNetwork,
+			networks: { [unitNetwork]: unit },
+			accounts: envelopeAccounts
 		};
-		yield* validateUniqueness(extras);
-		yield* validateAggregatePathAvailability(extras);
-		const paths = yield* CodegenPathsService;
-		return yield* Effect.scoped(Effect.gen(function* () {
-			yield* acquireStackLock(paths.codegenLockFile, CODEGEN_CYCLE_LOCK_TIMEOUT_MS).pipe(Effect.mapError((cause) => new CodegenWriteFailed({
-				outputPath: paths.codegenLockFile,
-				stage: "write",
-				cause
-			})));
-			return yield* runEmitCycleInner({
-				contributions: extras,
-				trackTree: false
-			}, paths);
-		}));
 	});
 	const emitBindings = (contributions) => Effect.gen(function* () {
 		if (contributions.length === 0) return {
@@ -560,8 +774,7 @@ const layerCodegenOrchestrator = Layer.effect(CodegenOrchestratorService, Effect
 	});
 	return CodegenOrchestratorService.of({
 		registerContribution,
-		assembleIdConfig,
-		emitExtras,
+		assembleDeployment,
 		emitBindings
 	});
 }));