@unconfirmed/sui-effect 0.1.0 → 0.1.2

package/dist/services/Tx.d.ts

@@ -1,8 +1,8 @@
 import { Transaction } from "@mysten/sui/transactions";
-import { Effect, Schema } from "effect";
+import { DateTime, Effect, type Option, Schema } from "effect";
 import { BuildError, ExecutionFailed, JournalError, NotApplied, PolicyDenied, SigningError, SimulationFailed, SubmissionUnknown, TransportError } from "../domain/errors.ts";
 import { Executed } from "../domain/executed.ts";
-import { Digest, SignedTransaction, SuiAddress } from "../domain/schemas.ts";
+import { Digest, type Signature, SignedTransaction, SuiAddress } from "../domain/schemas.ts";
 import type { Signer } from "./Signer.ts";
 import type { Recipe } from "./Sui.ts";
 import { Sui } from "./Sui.ts";
@@ -15,7 +15,9 @@ export declare const Signed: Schema.Struct<{
     readonly digest: Schema.brand<Schema.String, "Digest">;
     readonly bytes: Schema.Uint8ArrayFromBase64;
     readonly signatures: Schema.$Array<Schema.brand<Schema.String, "Signature">>;
-    readonly sender: Schema.brand<Schema.decodeTo<Schema.toType<Schema.String>, Schema.String, never, never>, "SuiAddress">;
+    readonly sender: Schema.brand<Schema.decodeTo<Schema.toType<Schema.String>, Schema.String, never, never>, "SuiAddress"> & {
+        normalize: (input: string) => string & import("effect/Brand").Brand<"SuiAddress">;
+    };
     readonly expiration: Schema.optional<Schema.toTaggedUnion<"$kind", readonly [Schema.Struct<{
         readonly $kind: Schema.Literal<"None">;
         readonly None: Schema.Literal<true>;
@@ -57,14 +59,49 @@ export type ReconcileInput = Digest | Signed | SubmissionUnknown;
  * An extension that wraps a submission spells its own errors plus this, rather
  * than repeating four tags that will grow with the taxonomy.
  */
-export type SubmitError = ExecutionFailed | NotApplied | SubmissionUnknown | JournalError;
+export type SubmitError = ExecutionFailed | NotApplied | SubmissionUnknown | JournalError | TransportError;
 /**
  * Everything {@link run} can fail with, as one name: {@link SubmitError} plus
  * what building, preflighting and signing can produce.
  */
 export type RunError = BuildError | SimulationFailed | PolicyDenied | SigningError | SubmitError | TransportError;
-/** What one entry of `Tx.reconcileAll` settled to. */
-export type Reconciled = Executed | ExecutionFailed | NotApplied | SubmissionUnknown;
+/**
+ * What one entry of `Tx.reconcileAll` settled to, as a tagged union.
+ *
+ * Every case carries **one** discriminator in the same place: `_tag` is
+ * `"Executed"`, `"ExecutionFailed"`, `"NotApplied"` or `"SubmissionUnknown"`,
+ * and the payload is `executed` for the first and `error` for the other three.
+ * Before 0.1.2 this was a bare union of an `Executed` (which has no `_tag`) and
+ * three errors (which do), so the only way to tell a success from a failure was
+ * `"_tag" in entry` — a shape nothing could `Schema.match` or serialize.
+ *
+ * @since 0.1.2
+ */
+export declare const Reconciled: Schema.TaggedUnion<{
+    readonly ExecutionFailed: Schema.TaggedStruct<"ExecutionFailed", {
+        readonly error: typeof ExecutionFailed;
+    }>;
+    readonly SubmissionUnknown: Schema.TaggedStruct<"SubmissionUnknown", {
+        readonly error: typeof SubmissionUnknown;
+    }>;
+    readonly NotApplied: Schema.TaggedStruct<"NotApplied", {
+        readonly error: typeof NotApplied;
+    }>;
+    readonly Executed: Schema.TaggedStruct<"Executed", {
+        readonly executed: typeof Executed;
+    }>;
+}>;
+/** One settled entry of `Tx.reconcileAll`. @since 0.1.2 */
+export type Reconciled = typeof Reconciled.Type;
+/**
+ * The shape `Tx.reconcileAll` returned in 0.1.0 and 0.1.1: the four outcomes as
+ * a bare union, with the successful one carrying no discriminator at all.
+ *
+ * @deprecated Use {@link Reconciled}, whose cases all carry `_tag`. This name
+ * exists so a 0.1.1 consumer that spelled the old union in its own types still
+ * compiles.
+ */
+export type ReconciledOutcome = Executed | ExecutionFailed | NotApplied | SubmissionUnknown;
 /**
  * Builds a transaction into signable bytes.
  *
@@ -335,9 +372,16 @@ export declare const sponsored: (opts: {
  * `Tx.reconcile`, which either finds the transaction, proves it never applied,
  * or says it does not know.
  *
- * `TransportError` never escapes: once bytes may have been sent, "the network
- * was unreachable" is not an answer a caller can act on, so it becomes
- * `SubmissionUnknown` carrying the signed bytes.
+ * `TransportError` almost never escapes: once bytes may have been sent, "the
+ * network was unreachable" is not an answer a caller can act on, so it becomes
+ * `SubmissionUnknown` carrying the signed bytes. **The one exception is a node
+ * that refused the request outright** — gRPC `INVALID_ARGUMENT`, which is what
+ * a validator answers for malformed bytes or for a sponsored transaction
+ * carrying one signature. That answer came from the node, it is final, and
+ * nothing was executed, so it is reported as the `TransportError` it is rather
+ * than reconciled: a reconcile would go on to ask "is this digest on chain?",
+ * a question about a transaction that was never sent, and a lagging or scripted
+ * node can answer it yes.
  *
  * `JournalError` can only come from the `Signed` write, before anything has
  * been sent. Once the network has answered, a journal write that fails is
@@ -348,9 +392,97 @@ export declare const sponsored: (opts: {
  * Fails with: `ExecutionFailed` (applied on chain and failed; gas was charged),
  * `NotApplied` (provably never applied), `SubmissionUnknown` (the outcome is
  * not known and the bytes are in the error), `JournalError` (only before the
- * first send).
+ * first send), `TransportError` (only `INVALID_ARGUMENT`: the node refused the
+ * submission and nothing was executed).
  */
 export declare const submit: (signed: Signed) => Effect.Effect<Executed, SubmitError, Sui>;
+/**
+ * What a third party answers when it has submitted your bytes.
+ *
+ * Three shapes are understood, in this order: an SDK `TransactionResult` (the
+ * service ran `executeTransaction` and passed the whole thing on), a reduced
+ * execute envelope (anything with a `digest` or an `effects`, decoded through
+ * {@link Executed.fromPartial}), and a bare digest string. Anything else — a
+ * `void`, an acknowledgement with no digest — means "ask the chain", and
+ * `submitVia` reconciles by the digest it already has, which is the digest of
+ * the bytes it handed over.
+ *
+ * @since 0.1.2
+ */
+export type SubmitViaReply = unknown;
+/** Everything {@link submitVia} can fail with, before the sender's own errors. */
+export type SubmitViaError = ExecutionFailed | NotApplied | SubmissionUnknown | JournalError;
+/**
+ * Submits through **someone else** — a relay, a sponsorship service, a backend
+ * that holds the only key allowed to talk to the node — and keeps the journal
+ * and the evidence rules that `Tx.submit` would have kept.
+ *
+ * The bytes never reach `executeTransaction` here; `send` does whatever the
+ * service needs (an HTTP POST, a queue, another process) and answers with
+ * whatever the service returns. What this owns is everything around it:
+ *
+ * - a `Signed` journal entry is written **before** `send` is called, so a crash
+ *   between here and the service leaves the same record a direct submit leaves;
+ * - `send` is called **once**. A third party's submit is not known to be
+ *   idempotent and re-sending is not this function's decision;
+ * - the reply is turned into an `Executed` when it carries one (see
+ *   {@link SubmitViaReply}), and otherwise the chain is asked — by the digest
+ *   of the bytes that were handed over, which a co-signature does not change;
+ * - a failure from `send` is **ambiguous** unless it says otherwise, so it ends
+ *   in `Tx.reconcile` with the full evidence rules: the ordered expiry check,
+ *   the chain-identity guard, the versioned consumer check. A sender error that
+ *   **declares** `outcome: "not_applied"` on the instance — a 400 from the
+ *   service, a refusal before anything went out — is taken at its word and
+ *   fails straight through without spending a reconcile. A `TransportError` is
+ *   not that: the taxonomy calls it `not_applied`, but a transport failure
+ *   *talking to the relay* is exactly the ambiguous case, so it reconciles;
+ * - every terminal answer is journalled, exactly as `Tx.submit` journals it.
+ *
+ * Fails with: `ExecutionFailed`, `NotApplied`, `SubmissionUnknown` (carrying
+ * the signed bytes, with the sender's failure as its `cause`), `JournalError`
+ * (only from the write before `send`), and `E` — whatever `send` fails with —
+ * when that error declares `outcome: "not_applied"`.
+ *
+ * @since 0.1.2
+ */
+export declare const submitVia: <E, R>(signed: {
+    readonly digest: string & import("effect/Brand").Brand<"Digest">;
+    readonly sender: string & import("effect/Brand").Brand<"SuiAddress">;
+    readonly signatures: readonly (string & import("effect/Brand").Brand<"Signature">)[];
+    readonly bytes: Uint8Array<ArrayBufferLike>;
+    readonly chain?: string | undefined;
+    readonly expiration?: {
+        readonly $kind: "None";
+        readonly None: true;
+    } | {
+        readonly $kind: "Epoch";
+        readonly Epoch: bigint;
+    } | {
+        readonly $kind: "ValidDuring";
+        readonly ValidDuring: {
+            readonly minEpoch: bigint | null;
+            readonly maxEpoch: bigint | null;
+            readonly minTimestamp: bigint | null;
+            readonly maxTimestamp: bigint | null;
+            readonly chain: string;
+            readonly nonce: number;
+        };
+    } | {
+        readonly $kind: "Validity";
+        readonly Validity: {
+            readonly allowedProposers: {
+                readonly epoch: bigint;
+                readonly proposers: readonly number[];
+            } | null;
+            readonly minEpoch: bigint | null;
+            readonly maxEpoch: bigint | null;
+            readonly minTimestamp: bigint | null;
+            readonly maxTimestamp: bigint | null;
+            readonly chain: string;
+            readonly nonce: number;
+        };
+    } | undefined;
+}, send: (bytes: Uint8Array, signatures: ReadonlyArray<Signature>) => Effect.Effect<SubmitViaReply, E, R>) => Effect.Effect<Executed, SubmitViaError | E, Sui | R>;
 /**
  * Finds out what happened to a transaction that was sent but never answered
  * for.
@@ -436,6 +568,14 @@ export declare const reconcile: (input: ReconcileInput) => Effect.Effect<Execute
  * explicit lifecycle (`Tx.build`, `Tx.sign`, `Tx.cosign`, `Tx.submit`) when the
  * two parties cannot both sign in one process.
  *
+ * **`onSigned` is the hook between signing and sending.** A program with its
+ * own record to keep — a batch row, an outbox, an idempotency key — has to
+ * write the digest before the first send, and that used to mean giving up
+ * `Tx.run` and reassembling `withSenderLock(build → sign → record → submit)` by
+ * hand. Pass `onSigned` instead: it runs inside the sender lock, after the last
+ * signature and before `Tx.submit`'s first `executeTransaction`, and failing it
+ * fails the run with nothing sent.
+ *
  * Fails with: `BuildError`, `SimulationFailed`, `PolicyDenied`, `SigningError`,
  * `ExecutionFailed`, `NotApplied`, `SubmissionUnknown`, `JournalError`,
  * `TransportError` (from the build reads; once bytes are sent, transport
@@ -449,11 +589,231 @@ export declare const run: (recipe: Transaction | Recipe, opts: {
      * the bytes name a gas owner that is not the sender.
      */
     readonly sponsor?: Signer;
+    /**
+     * Called with the signed bytes **after every signature is on them and
+     * before the first `executeTransaction`**, which is the one moment a
+     * consumer's own record has to be written: the digest is final from here
+     * on, and anything that happens next may have reached the network.
+     *
+     * `Tx.submit` already writes its `Signed` journal entry at this point; this
+     * is for the record the journal does not hold — a domain row joining the
+     * digest to a batch, an outbox, a log line an operator greps. It runs
+     * inside the sender lock, so it is ordered with the submission it belongs
+     * to.
+     *
+     * Failing it fails the run **before anything is sent**, which is why its
+     * error is a `JournalError`: that is the taxonomy's "the record could not
+     * be written and nothing has gone out yet", it is already in `Tx.run`'s
+     * union, and it is `not_applied`, so the documented retry idiom is correct.
+     * Map your own persistence failure into it
+     * (`Effect.mapError((cause) => new JournalError({ cause }))`).
+     *
+     * @since 0.1.2
+     */
+    readonly onSigned?: (signed: Signed) => Effect.Effect<void, JournalError>;
 }) => Effect.Effect<Executed, TransportError | SimulationFailed | ExecutionFailed | SubmissionUnknown | NotApplied | SigningError | BuildError | PolicyDenied | JournalError, Sui>;
+/**
+ * What the journal recorded for one digest, if anything.
+ *
+ * `Tx.reconcileAll` returns **only the entries that were still unresolved**,
+ * because those are the ones it had work to do about; a transaction that had
+ * already settled — executed, failed, or proven never applied — is not in its
+ * answer and never will be. This is how to ask about one of those: the entry is
+ * `Executed`, `Failed` or `NotApplied` for a settled digest, `Signed` or
+ * `Unknown` for one still in flight, and `None` for a digest this journal has
+ * never seen (including every digest at all, when the journal is the in-memory
+ * default and the process restarted).
+ *
+ * It is exactly `(yield* Journal).get(digest)`, named so that the recovery path
+ * does not have to reach for the reference.
+ *
+ * Fails with: `JournalError`.
+ *
+ * @since 0.1.2
+ */
+export declare const recorded: (digest: string & import("effect/Brand").Brand<"Digest">) => Effect.Effect<Option.Option<{
+    readonly _tag: "Unknown";
+    readonly digest: string & import("effect/Brand").Brand<"Digest">;
+    readonly signed: {
+        readonly digest: string & import("effect/Brand").Brand<"Digest">;
+        readonly sender: string & import("effect/Brand").Brand<"SuiAddress">;
+        readonly signatures: readonly (string & import("effect/Brand").Brand<"Signature">)[];
+        readonly bytes: Uint8Array<ArrayBufferLike>;
+        readonly chain?: string | undefined;
+        readonly expiration?: {
+            readonly $kind: "None";
+            readonly None: true;
+        } | {
+            readonly $kind: "Epoch";
+            readonly Epoch: bigint;
+        } | {
+            readonly $kind: "ValidDuring";
+            readonly ValidDuring: {
+                readonly minEpoch: bigint | null;
+                readonly maxEpoch: bigint | null;
+                readonly minTimestamp: bigint | null;
+                readonly maxTimestamp: bigint | null;
+                readonly chain: string;
+                readonly nonce: number;
+            };
+        } | {
+            readonly $kind: "Validity";
+            readonly Validity: {
+                readonly allowedProposers: {
+                    readonly epoch: bigint;
+                    readonly proposers: readonly number[];
+                } | null;
+                readonly minEpoch: bigint | null;
+                readonly maxEpoch: bigint | null;
+                readonly minTimestamp: bigint | null;
+                readonly maxTimestamp: bigint | null;
+                readonly chain: string;
+                readonly nonce: number;
+            };
+        } | undefined;
+    };
+    readonly lastError: string;
+    readonly attempts: number;
+    readonly at: DateTime.Utc;
+} | {
+    readonly _tag: "NotApplied";
+    readonly digest: string & import("effect/Brand").Brand<"Digest">;
+    readonly evidence: "expired" | "inputConsumed";
+    readonly at: DateTime.Utc;
+} | {
+    readonly _tag: "Signed";
+    readonly digest: string & import("effect/Brand").Brand<"Digest">;
+    readonly signed: {
+        readonly digest: string & import("effect/Brand").Brand<"Digest">;
+        readonly sender: string & import("effect/Brand").Brand<"SuiAddress">;
+        readonly signatures: readonly (string & import("effect/Brand").Brand<"Signature">)[];
+        readonly bytes: Uint8Array<ArrayBufferLike>;
+        readonly chain?: string | undefined;
+        readonly expiration?: {
+            readonly $kind: "None";
+            readonly None: true;
+        } | {
+            readonly $kind: "Epoch";
+            readonly Epoch: bigint;
+        } | {
+            readonly $kind: "ValidDuring";
+            readonly ValidDuring: {
+                readonly minEpoch: bigint | null;
+                readonly maxEpoch: bigint | null;
+                readonly minTimestamp: bigint | null;
+                readonly maxTimestamp: bigint | null;
+                readonly chain: string;
+                readonly nonce: number;
+            };
+        } | {
+            readonly $kind: "Validity";
+            readonly Validity: {
+                readonly allowedProposers: {
+                    readonly epoch: bigint;
+                    readonly proposers: readonly number[];
+                } | null;
+                readonly minEpoch: bigint | null;
+                readonly maxEpoch: bigint | null;
+                readonly minTimestamp: bigint | null;
+                readonly maxTimestamp: bigint | null;
+                readonly chain: string;
+                readonly nonce: number;
+            };
+        } | undefined;
+    };
+    readonly signedAt: DateTime.Utc;
+} | {
+    readonly at: DateTime.Utc;
+    readonly digest: string & import("effect/Brand").Brand<"Digest">;
+    readonly _tag: "Executed";
+    readonly checkpoint?: bigint | undefined;
+} | {
+    readonly _tag: "Failed";
+    readonly digest: string & import("effect/Brand").Brand<"Digest">;
+    readonly reason: {
+        readonly $kind: "MoveAbort";
+        readonly MoveAbort: {
+            readonly abortCode: bigint;
+            readonly location?: {
+                readonly function?: number | undefined;
+                readonly package?: string | undefined;
+                readonly module?: string | undefined;
+                readonly functionName?: string | undefined;
+                readonly instruction?: number | undefined;
+            } | undefined;
+            readonly cleverError?: {
+                readonly value?: string | undefined;
+                readonly errorCode?: number | undefined;
+                readonly lineNumber?: number | undefined;
+                readonly constantName?: string | undefined;
+                readonly constantType?: string | undefined;
+            } | undefined;
+        };
+    } | {
+        readonly $kind: "SizeError";
+        readonly SizeError: {
+            readonly name: string;
+            readonly size: number;
+            readonly maxSize: number;
+        };
+    } | {
+        readonly $kind: "CommandArgumentError";
+        readonly CommandArgumentError: {
+            readonly argument: number;
+            readonly name: string;
+        };
+    } | {
+        readonly $kind: "TypeArgumentError";
+        readonly TypeArgumentError: {
+            readonly typeArgument: number;
+            readonly name: string;
+        };
+    } | {
+        readonly $kind: "PackageUpgradeError";
+        readonly PackageUpgradeError: {
+            readonly name: string;
+            readonly digest?: string | undefined;
+            readonly packageId?: string | undefined;
+        };
+    } | {
+        readonly $kind: "IndexError";
+        readonly IndexError: {
+            readonly index?: number | undefined;
+            readonly subresult?: number | undefined;
+        };
+    } | {
+        readonly $kind: "CoinDenyListError";
+        readonly CoinDenyListError: {
+            readonly coinType: string;
+            readonly name: string;
+            readonly address?: string | undefined;
+        };
+    } | {
+        readonly $kind: "CongestedObjects";
+        readonly CongestedObjects: {
+            readonly name: string;
+            readonly objects: readonly string[];
+        };
+    } | {
+        readonly $kind: "ObjectIdError";
+        readonly ObjectIdError: {
+            readonly objectId: string;
+            readonly name?: string | undefined;
+        };
+    } | {
+        readonly $kind: "Unknown";
+    };
+    readonly at: DateTime.Utc;
+}>, JournalError, never>;
 /**
  * Settles every unresolved entry in the journal: the explicit startup call a
  * long-lived application makes after building a durable `Journal`.
  *
+ * **Only unresolved entries come back.** `Signed` and `Unknown` are the tags
+ * that still need an answer; a digest that already settled is not in the
+ * journal's unresolved index and is not in this array. Ask about one of those
+ * with {@link recorded}.
+ *
  * Nothing here fails per entry: each one settles to an `Executed`, an
  * `ExecutionFailed`, a `NotApplied` or a `SubmissionUnknown`, in the order the
  * journal listed them, and the journal is updated to match. Every settled entry
@@ -469,7 +829,19 @@ export declare const run: (recipe: Transaction | Recipe, opts: {
  *
  * Fails with: `JournalError`, `TransportError`.
  */
-export declare const reconcileAll: () => Effect.Effect<readonly Reconciled[], TransportError | JournalError, Sui>;
+export declare const reconcileAll: () => Effect.Effect<readonly ({
+    readonly _tag: "ExecutionFailed";
+    readonly error: ExecutionFailed;
+} | {
+    readonly _tag: "SubmissionUnknown";
+    readonly error: SubmissionUnknown;
+} | {
+    readonly _tag: "NotApplied";
+    readonly error: NotApplied;
+} | {
+    readonly _tag: "Executed";
+    readonly executed: Executed;
+})[], TransportError | JournalError, Sui>;
 /**
  * The lifecycle, namespaced the way the spec spells it: `Tx.build`, `Tx.sign`,
  * `Tx.cosign`, `Tx.sponsored`, `Tx.submit`, `Tx.reconcile`, `Tx.run`,
@@ -672,7 +1044,219 @@ export declare const Tx: {
         readonly gasOwner: SuiAddress;
     }) => (recipe: Recipe) => Recipe;
     readonly submit: (signed: Signed) => Effect.Effect<Executed, SubmitError, Sui>;
+    readonly submitVia: <E, R>(signed: {
+        readonly digest: string & import("effect/Brand").Brand<"Digest">;
+        readonly sender: string & import("effect/Brand").Brand<"SuiAddress">;
+        readonly signatures: readonly (string & import("effect/Brand").Brand<"Signature">)[];
+        readonly bytes: Uint8Array<ArrayBufferLike>;
+        readonly chain?: string | undefined;
+        readonly expiration?: {
+            readonly $kind: "None";
+            readonly None: true;
+        } | {
+            readonly $kind: "Epoch";
+            readonly Epoch: bigint;
+        } | {
+            readonly $kind: "ValidDuring";
+            readonly ValidDuring: {
+                readonly minEpoch: bigint | null;
+                readonly maxEpoch: bigint | null;
+                readonly minTimestamp: bigint | null;
+                readonly maxTimestamp: bigint | null;
+                readonly chain: string;
+                readonly nonce: number;
+            };
+        } | {
+            readonly $kind: "Validity";
+            readonly Validity: {
+                readonly allowedProposers: {
+                    readonly epoch: bigint;
+                    readonly proposers: readonly number[];
+                } | null;
+                readonly minEpoch: bigint | null;
+                readonly maxEpoch: bigint | null;
+                readonly minTimestamp: bigint | null;
+                readonly maxTimestamp: bigint | null;
+                readonly chain: string;
+                readonly nonce: number;
+            };
+        } | undefined;
+    }, send: (bytes: Uint8Array, signatures: ReadonlyArray<Signature>) => Effect.Effect<SubmitViaReply, E, R>) => Effect.Effect<Executed, SubmitViaError | E, Sui | R>;
     readonly reconcile: (input: ReconcileInput) => Effect.Effect<Executed, TransportError | ExecutionFailed | SubmissionUnknown | NotApplied, Sui>;
+    readonly recorded: (digest: string & import("effect/Brand").Brand<"Digest">) => Effect.Effect<Option.Option<{
+        readonly _tag: "Unknown";
+        readonly digest: string & import("effect/Brand").Brand<"Digest">;
+        readonly signed: {
+            readonly digest: string & import("effect/Brand").Brand<"Digest">;
+            readonly sender: string & import("effect/Brand").Brand<"SuiAddress">;
+            readonly signatures: readonly (string & import("effect/Brand").Brand<"Signature">)[];
+            readonly bytes: Uint8Array<ArrayBufferLike>;
+            readonly chain?: string | undefined;
+            readonly expiration?: {
+                readonly $kind: "None";
+                readonly None: true;
+            } | {
+                readonly $kind: "Epoch";
+                readonly Epoch: bigint;
+            } | {
+                readonly $kind: "ValidDuring";
+                readonly ValidDuring: {
+                    readonly minEpoch: bigint | null;
+                    readonly maxEpoch: bigint | null;
+                    readonly minTimestamp: bigint | null;
+                    readonly maxTimestamp: bigint | null;
+                    readonly chain: string;
+                    readonly nonce: number;
+                };
+            } | {
+                readonly $kind: "Validity";
+                readonly Validity: {
+                    readonly allowedProposers: {
+                        readonly epoch: bigint;
+                        readonly proposers: readonly number[];
+                    } | null;
+                    readonly minEpoch: bigint | null;
+                    readonly maxEpoch: bigint | null;
+                    readonly minTimestamp: bigint | null;
+                    readonly maxTimestamp: bigint | null;
+                    readonly chain: string;
+                    readonly nonce: number;
+                };
+            } | undefined;
+        };
+        readonly lastError: string;
+        readonly attempts: number;
+        readonly at: DateTime.Utc;
+    } | {
+        readonly _tag: "NotApplied";
+        readonly digest: string & import("effect/Brand").Brand<"Digest">;
+        readonly evidence: "expired" | "inputConsumed";
+        readonly at: DateTime.Utc;
+    } | {
+        readonly _tag: "Signed";
+        readonly digest: string & import("effect/Brand").Brand<"Digest">;
+        readonly signed: {
+            readonly digest: string & import("effect/Brand").Brand<"Digest">;
+            readonly sender: string & import("effect/Brand").Brand<"SuiAddress">;
+            readonly signatures: readonly (string & import("effect/Brand").Brand<"Signature">)[];
+            readonly bytes: Uint8Array<ArrayBufferLike>;
+            readonly chain?: string | undefined;
+            readonly expiration?: {
+                readonly $kind: "None";
+                readonly None: true;
+            } | {
+                readonly $kind: "Epoch";
+                readonly Epoch: bigint;
+            } | {
+                readonly $kind: "ValidDuring";
+                readonly ValidDuring: {
+                    readonly minEpoch: bigint | null;
+                    readonly maxEpoch: bigint | null;
+                    readonly minTimestamp: bigint | null;
+                    readonly maxTimestamp: bigint | null;
+                    readonly chain: string;
+                    readonly nonce: number;
+                };
+            } | {
+                readonly $kind: "Validity";
+                readonly Validity: {
+                    readonly allowedProposers: {
+                        readonly epoch: bigint;
+                        readonly proposers: readonly number[];
+                    } | null;
+                    readonly minEpoch: bigint | null;
+                    readonly maxEpoch: bigint | null;
+                    readonly minTimestamp: bigint | null;
+                    readonly maxTimestamp: bigint | null;
+                    readonly chain: string;
+                    readonly nonce: number;
+                };
+            } | undefined;
+        };
+        readonly signedAt: DateTime.Utc;
+    } | {
+        readonly at: DateTime.Utc;
+        readonly digest: string & import("effect/Brand").Brand<"Digest">;
+        readonly _tag: "Executed";
+        readonly checkpoint?: bigint | undefined;
+    } | {
+        readonly _tag: "Failed";
+        readonly digest: string & import("effect/Brand").Brand<"Digest">;
+        readonly reason: {
+            readonly $kind: "MoveAbort";
+            readonly MoveAbort: {
+                readonly abortCode: bigint;
+                readonly location?: {
+                    readonly function?: number | undefined;
+                    readonly package?: string | undefined;
+                    readonly module?: string | undefined;
+                    readonly functionName?: string | undefined;
+                    readonly instruction?: number | undefined;
+                } | undefined;
+                readonly cleverError?: {
+                    readonly value?: string | undefined;
+                    readonly errorCode?: number | undefined;
+                    readonly lineNumber?: number | undefined;
+                    readonly constantName?: string | undefined;
+                    readonly constantType?: string | undefined;
+                } | undefined;
+            };
+        } | {
+            readonly $kind: "SizeError";
+            readonly SizeError: {
+                readonly name: string;
+                readonly size: number;
+                readonly maxSize: number;
+            };
+        } | {
+            readonly $kind: "CommandArgumentError";
+            readonly CommandArgumentError: {
+                readonly argument: number;
+                readonly name: string;
+            };
+        } | {
+            readonly $kind: "TypeArgumentError";
+            readonly TypeArgumentError: {
+                readonly typeArgument: number;
+                readonly name: string;
+            };
+        } | {
+            readonly $kind: "PackageUpgradeError";
+            readonly PackageUpgradeError: {
+                readonly name: string;
+                readonly digest?: string | undefined;
+                readonly packageId?: string | undefined;
+            };
+        } | {
+            readonly $kind: "IndexError";
+            readonly IndexError: {
+                readonly index?: number | undefined;
+                readonly subresult?: number | undefined;
+            };
+        } | {
+            readonly $kind: "CoinDenyListError";
+            readonly CoinDenyListError: {
+                readonly coinType: string;
+                readonly name: string;
+                readonly address?: string | undefined;
+            };
+        } | {
+            readonly $kind: "CongestedObjects";
+            readonly CongestedObjects: {
+                readonly name: string;
+                readonly objects: readonly string[];
+            };
+        } | {
+            readonly $kind: "ObjectIdError";
+            readonly ObjectIdError: {
+                readonly objectId: string;
+                readonly name?: string | undefined;
+            };
+        } | {
+            readonly $kind: "Unknown";
+        };
+        readonly at: DateTime.Utc;
+    }>, JournalError, never>;
     readonly run: (recipe: Transaction | Recipe, opts: {
         readonly signer: Signer;
         readonly gasOwner?: SuiAddress;
@@ -681,7 +1265,41 @@ export declare const Tx: {
          * the bytes name a gas owner that is not the sender.
          */
         readonly sponsor?: Signer;
+        /**
+         * Called with the signed bytes **after every signature is on them and
+         * before the first `executeTransaction`**, which is the one moment a
+         * consumer's own record has to be written: the digest is final from here
+         * on, and anything that happens next may have reached the network.
+         *
+         * `Tx.submit` already writes its `Signed` journal entry at this point; this
+         * is for the record the journal does not hold — a domain row joining the
+         * digest to a batch, an outbox, a log line an operator greps. It runs
+         * inside the sender lock, so it is ordered with the submission it belongs
+         * to.
+         *
+         * Failing it fails the run **before anything is sent**, which is why its
+         * error is a `JournalError`: that is the taxonomy's "the record could not
+         * be written and nothing has gone out yet", it is already in `Tx.run`'s
+         * union, and it is `not_applied`, so the documented retry idiom is correct.
+         * Map your own persistence failure into it
+         * (`Effect.mapError((cause) => new JournalError({ cause }))`).
+         *
+         * @since 0.1.2
+         */
+        readonly onSigned?: (signed: Signed) => Effect.Effect<void, JournalError>;
     }) => Effect.Effect<Executed, TransportError | SimulationFailed | ExecutionFailed | SubmissionUnknown | NotApplied | SigningError | BuildError | PolicyDenied | JournalError, Sui>;
-    readonly reconcileAll: () => Effect.Effect<readonly Reconciled[], TransportError | JournalError, Sui>;
+    readonly reconcileAll: () => Effect.Effect<readonly ({
+        readonly _tag: "ExecutionFailed";
+        readonly error: ExecutionFailed;
+    } | {
+        readonly _tag: "SubmissionUnknown";
+        readonly error: SubmissionUnknown;
+    } | {
+        readonly _tag: "NotApplied";
+        readonly error: NotApplied;
+    } | {
+        readonly _tag: "Executed";
+        readonly executed: Executed;
+    })[], TransportError | JournalError, Sui>;
 };
 //# sourceMappingURL=Tx.d.ts.map