sui-effect 0.1.0

package/dist/services/Tx.js

@@ -0,0 +1,1224 @@
+import { GrpcCoreClient, isSuiGrpcClient } from "@mysten/sui/grpc";
+import { Transaction, TransactionDataBuilder } from "@mysten/sui/transactions";
+import { normalizeSuiAddress } from "@mysten/sui/utils";
+import { Cause, DateTime, Duration, Effect, Schema } from "effect";
+import { BuildError, ExecutionFailed, JournalError, NotApplied, PolicyDenied, SigningError, SimulationFailed, SubmissionUnknown, SuiError, TransportError } from "../domain/errors.js";
+import { EXECUTE_INCLUDE, Executed, fromTransactionResult } from "../domain/executed.js";
+import { isUnresolved, JournalEntry } from "../domain/journal-entry.js";
+import { Built, chainOf, Digest, maxEpochOf, maxTimestampMsOf, ObjectId, SignedTransaction, SuiAddress, TransactionExpiration, U32_MAX, Version } from "../domain/schemas.js";
+import { Journal } from "./Journal.js";
+import { SubmitConfig } from "./SubmitConfig.js";
+import { Sui } from "./Sui.js";
+/** The schema of {@link Signed}. */
+export const Signed = SignedTransaction;
+const decodeExpiration = Schema.decodeUnknownOption(TransactionExpiration);
+const decodeDigest = Schema.decodeUnknownEffect(Digest);
+const decodeDigestOption = Schema.decodeUnknownOption(Digest);
+const decodeVersion = Schema.decodeUnknownOption(Version);
+const decodeObjectId = Schema.decodeUnknownOption(ObjectId);
+const buildError = (message) => (cause) => new BuildError({ message, cause });
+/** The `u32` nonce a `ValidDuring` expiration carries as its replay guard. */
+const MAX_NONCE = U32_MAX;
+/**
+ * The gRPC resolve plugin, re-created over a client whose
+ * `transactionExecutionService.simulateTransaction` carries the Effect's
+ * `AbortSignal`.
+ *
+ * This is the one request `abortableClient`'s `core` proxy cannot reach.
+ * `GrpcCoreClient#resolveTransactionPlugin` closes over the private grpc client
+ * it was constructed with and calls `simulateTransaction(request)` with no
+ * second argument, while every other method on that class passes
+ * `{ abort: options.signal }`. So an interrupted `Tx.build` on a gRPC client
+ * ended — releasing the sender lock — with the resolver's simulate still in
+ * flight.
+ *
+ * Nothing is re-implemented. `GrpcCoreClient` is public
+ * (`@mysten/sui/grpc`), and its constructor takes the grpc client it will use:
+ * handing it a `SuiGrpcClient` whose `transactionExecutionService` adds
+ * `{ abort: signal }` and whose `core` is the already-signalled proxy gives back
+ * the SDK's **own** plugin, line for line, with the signal attached. The cache
+ * is shared through `base`, so nothing is read twice.
+ *
+ * Never fails.
+ */
+const grpcResolvePlugin = (client, core, signal) => {
+    const service = client.transactionExecutionService;
+    const abortable = new Proxy(service, {
+        get: (receiver, key) => {
+            const value = Reflect.get(receiver, key);
+            if (typeof value !== "function")
+                return value;
+            if (key !== "simulateTransaction") {
+                return (...args) => value.apply(receiver, args);
+            }
+            return (input, options) => value.call(receiver, input, {
+                ...(options ?? {}),
+                // A caller that passed its own signal keeps it; the resolver passes
+                // none, which is the whole bug.
+                abort: options?.["abort"] ?? signal
+            });
+        }
+    });
+    const shadow = new Proxy(client, {
+        get: (receiver, key) => {
+            // `setAddressBalanceTransactionExpirationFromSimulatedEpoch` reads
+            // `client.core.getChainIdentifier()` and `client.core
+            // .getCurrentSystemState()` out of this same object, so it gets the
+            // signalled core too.
+            if (key === "core")
+                return core;
+            if (key === "transactionExecutionService")
+                return abortable;
+            const value = Reflect.get(receiver, key);
+            return typeof value === "function"
+                ? value.bind(receiver)
+                : value;
+        }
+    });
+    return new GrpcCoreClient({
+        client: shadow,
+        base: client,
+        network: client.network
+    }).resolveTransactionPlugin();
+};
+/**
+ * The SDK client with the Effect's `AbortSignal` injected into every Core call.
+ *
+ * `Transaction#build` takes no signal: `BuildTransactionOptions` has no such
+ * field, and the gRPC resolve plugin simulates with whatever the client hands
+ * it. So an interrupted `Tx.build` used to end — releasing the sender lock —
+ * while the simulate it started stayed in flight. The only cancellation hook
+ * the SDK offers is the `signal` on each Core method, and the resolver reaches
+ * those through `options.client`, so a client whose `core` injects the signal is
+ * how an interrupt reaches the request.
+ *
+ * `resolveTransactionPlugin` is delegated untouched on every transport but
+ * gRPC, whose plugin simulates through a captured private client that no proxy
+ * of `core` can reach: there it is rebuilt by {@link grpcResolvePlugin}, which
+ * is the same SDK plugin over a client that carries the signal.
+ */
+const abortableClient = (client, signal) => {
+    const grpc = isSuiGrpcClient(client) ? client : undefined;
+    let core;
+    const inject = (target) => new Proxy(target, {
+        get: (receiver, key) => {
+            const value = Reflect.get(receiver, key);
+            if (typeof key !== "string")
+                return value;
+            if (key === "resolveTransactionPlugin") {
+                if (grpc !== undefined) {
+                    return () => grpcResolvePlugin(grpc, core ?? client.core, signal);
+                }
+                return typeof value === "function"
+                    ? (...args) => value.apply(receiver, args)
+                    : value;
+            }
+            if (typeof value === "function") {
+                return (options, ...rest) => value.call(receiver, { ...(options ?? {}), signal: options?.["signal"] ?? signal }, ...rest);
+            }
+            if (value !== null && typeof value === "object" &&
+                Object.getPrototypeOf(value) === Object.prototype) {
+                // `core.mvr` is a plain namespace of methods; it needs the same
+                // treatment and nothing else does.
+                return inject(value);
+            }
+            return value;
+        }
+    });
+    core = inject(client.core);
+    const coreProxy = core;
+    return new Proxy(client, {
+        get: (receiver, key) => {
+            if (key === "core")
+                return coreProxy;
+            const value = Reflect.get(receiver, key);
+            // Bound, so a method reached through the proxy still sees the real
+            // instance as `this` — a class with private fields would throw otherwise.
+            return typeof value === "function" ? value.bind(receiver) : value;
+        }
+    });
+};
+/**
+ * Whether the SDK will have to resolve this transaction, which is the same
+ * question as "will building simulate".
+ *
+ * It mirrors the SDK's own `needsTransactionResolution`, which is not exported:
+ * the resolve plugin returns early — no gas-budget simulation, no plugin call
+ * at all — when every input is resolved and the gas price, budget and payment
+ * are already set. `Tx.build` promises a simulation before any bytes are
+ * signed, so when this says `false` it runs one itself.
+ *
+ * Bytes this version cannot read answer `false`, which costs one simulate and
+ * keeps the guarantee. Never fails.
+ */
+const willResolve = (tx) => {
+    try {
+        const data = tx.getData();
+        if (data.inputs.some((input) => input.UnresolvedObject !== undefined || input.UnresolvedPure !== undefined)) {
+            return true;
+        }
+        const gas = data.gasData;
+        if (!gas.price || !gas.budget)
+            return true;
+        const payment = gas.payment;
+        if (payment === null || payment === undefined)
+            return true;
+        if (payment.length === 0 && data.expiration == null)
+            return true;
+        return false;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * The object inputs the transaction has not resolved yet, which are exactly
+ * the ones the resolver is about to look up. Never fails.
+ */
+const unresolvedObjectIdsOf = (tx) => {
+    try {
+        return tx.getData().inputs
+            .map((input) => input.UnresolvedObject?.objectId)
+            .filter((id) => typeof id === "string");
+    }
+    catch {
+        return [];
+    }
+};
+/**
+ * The expiration a transaction was built with, read back out of the bytes so
+ * that what is recorded is what was signed rather than what was intended.
+ */
+const expirationOfBytes = (bytes) => {
+    try {
+        const data = TransactionDataBuilder.fromBytes(bytes);
+        if (data.expiration === null)
+            return undefined;
+        const decoded = decodeExpiration(data.expiration);
+        return decoded._tag === "Some" ? decoded.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/** The owned object inputs a transaction referenced, with the versions it pinned. */
+const ownedInputsOfBytes = (bytes) => {
+    try {
+        const data = TransactionDataBuilder.fromBytes(bytes);
+        const inputs = [];
+        for (const input of data.inputs) {
+            const object = input.Object;
+            if (object === undefined)
+                continue;
+            const owned = object.ImmOrOwnedObject ?? object.Receiving;
+            if (owned === undefined)
+                continue;
+            const version = decodeVersion(String(owned.version));
+            if (version._tag === "Some") {
+                inputs.push({ objectId: owned.objectId, version: version.value });
+            }
+        }
+        return inputs;
+    }
+    catch {
+        return [];
+    }
+};
+/**
+ * The gas coins a transaction pinned, which are owned inputs too: a sponsored
+ * transaction pays from an address balance and has none, but an ordinary one
+ * names its coins in `gasData.payment` rather than in `inputs`, and a coin that
+ * has moved on is exactly as good evidence as any other consumed input.
+ */
+const gasPaymentOfBytes = (bytes) => {
+    try {
+        const payment = TransactionDataBuilder.fromBytes(bytes).gasData.payment ?? [];
+        const refs = [];
+        for (const ref of payment) {
+            const version = decodeVersion(String(ref.version));
+            if (version._tag === "Some")
+                refs.push({ objectId: ref.objectId, version: version.value });
+        }
+        return refs;
+    }
+    catch {
+        return [];
+    }
+};
+/** Every object reference whose version these bytes pinned, inputs and gas alike. */
+const pinnedRefsOfBytes = (bytes) => [
+    ...ownedInputsOfBytes(bytes),
+    ...gasPaymentOfBytes(bytes)
+];
+/** The addresses a transaction's bytes will accept a signature from. */
+const signersOfBytes = (bytes) => {
+    try {
+        const data = TransactionDataBuilder.fromBytes(bytes);
+        return [data.sender, data.gasData.owner]
+            .filter((address) => typeof address === "string" && address.length > 0)
+            .map((address) => normalizeSuiAddress(address));
+    }
+    catch {
+        return [];
+    }
+};
+const gasBudgetOfBytes = (bytes) => {
+    try {
+        const budget = TransactionDataBuilder.fromBytes(bytes).gasData.budget;
+        return budget === null || budget === undefined ? undefined : BigInt(budget);
+    }
+    catch {
+        return undefined;
+    }
+};
+/** A timeout on an execute is a transport failure that may already have landed. */
+const timeoutAsTransport = (method) => (error) => error._tag === "TimeoutError"
+    ? new TransportError({
+        method,
+        retryable: true,
+        status: "DEADLINE_EXCEEDED",
+        cause: error
+    })
+    : error;
+const toTransaction = (input) => typeof input === "function"
+    ? Effect.try({
+        try: () => {
+            const tx = new Transaction();
+            input(tx);
+            return tx;
+        },
+        catch: buildError("the recipe threw")
+    })
+    : Effect.succeed(input);
+/**
+ * Builds a transaction into signable bytes.
+ *
+ * **Building always simulates.** On gRPC the SDK's resolve plugin simulates
+ * with checks enabled to choose the gas budget, and an execution failure there
+ * arrives as `SimulationFailed`. That costs nothing extra — but the resolver
+ * returns early for a transaction that was **already fully resolved** (every
+ * input resolved, gas price, budget and payment set), and then nothing
+ * simulates at all. `Tx.build` detects that case and runs one explicit
+ * `simulateTransaction` with checks enabled, so simulate-before-submit holds
+ * for every transaction: it costs nothing extra when the SDK had to resolve,
+ * and one call otherwise.
+ *
+ * An interrupted build cancels the request it started: the SDK is handed a
+ * client whose Core calls carry the Effect's `AbortSignal`.
+ *
+ * When the recipe set no expiration, `SubmitConfig.expiration` decides one.
+ * The default, `ValidDuring`, bounds the transaction to the **current epoch and
+ * the next**, names the chain (bytes signed for testnet cannot land on mainnet)
+ * and carries a `u32` nonce from `SubmitConfig.nonce`. There is **no
+ * wall-clock bound** unless `SubmitConfig.validFor` asks for one: no Sui
+ * network accepts a timestamp expiration yet, and a node refuses any
+ * transaction carrying one. The expiration that ends up in the bytes is
+ * recorded on the result, because it is what `Tx.reconcile` needs later to
+ * prove a transaction can no longer land.
+ *
+ * `Tx.build` takes no sender lock; `Tx.run` is what holds one from build
+ * through submit. Called on its own, two concurrent builds for one address can
+ * pick the same gas coin.
+ *
+ * Fails with: `BuildError` (the recipe threw, an input could not be resolved,
+ * or the budget the node chose is over `SubmitConfig.maxGasBudget`),
+ * `SimulationFailed` (the transaction would abort on chain),
+ * `TransportError`.
+ */
+export const build = Effect.fn("Tx.build")(function* (input, opts) {
+    const sui = yield* Sui;
+    const config = yield* SubmitConfig;
+    const tx = yield* toTransaction(input);
+    yield* Effect.try({
+        try: () => {
+            tx.setSender(opts.sender);
+            if (opts.gasOwner !== undefined)
+                tx.setGasOwner(opts.gasOwner);
+        },
+        catch: buildError("the transaction rejected its sender")
+    });
+    if (tx.getData().expiration == null) {
+        const expiration = yield* defaultExpiration(sui, config);
+        if (expiration !== undefined) {
+            yield* Effect.try({
+                try: () => tx.setExpiration(expiration),
+                catch: buildError("the transaction rejected its expiration")
+            });
+        }
+    }
+    const resolving = willResolve(tx);
+    const unresolved = unresolvedObjectIdsOf(tx);
+    const bytes = yield* sui.core
+        .use((client, signal) => tx.build({ client: abortableClient(client, signal) }))
+        .pipe(Effect.catchTag(["ObjectNotFound", "ObjectDeleted", "ObjectUnavailable", "TransactionNotFound"], (error) => Effect.fail(new BuildError({ message: `an input could not be resolved: ${SuiError.describe(error)}`, cause: error }))), 
+    // A gRPC resolver that cannot find an input answers `NOT_FOUND` from
+    // `simulateTransaction` rather than raising the SDK's `ObjectError`, and
+    // that arrived as a bare `TransportError { method: "use" }` naming
+    // nothing. It is a `BuildError` like every other unresolvable input, and
+    // it names the object inputs the resolver was about to look up.
+    Effect.catchTag("TransportError", (error) => Effect.fail(error.status === "NOT_FOUND"
+        ? new BuildError({
+            message: "an input could not be resolved: the node answered NOT_FOUND" +
+                (unresolved.length === 0 ? "" : ` for one of ${unresolved.join(", ")}`),
+            cause: error
+        })
+        : error)));
+    if (!resolving) {
+        // The SDK resolved nothing, so it simulated nothing. One explicit simulate
+        // with checks enabled keeps the promise `Tx.run` is built on: nothing is
+        // signed that was not first shown to execute.
+        yield* sui.simulate(bytes);
+    }
+    const budget = gasBudgetOfBytes(bytes);
+    if (budget !== undefined && budget > config.maxGasBudget) {
+        return yield* new BuildError({
+            message: `the gas budget ${budget} is over the configured maximum ${config.maxGasBudget}`,
+            cause: budget
+        });
+    }
+    const digest = yield* decodeDigest(TransactionDataBuilder.getDigestFromBytes(bytes)).pipe(Effect.mapError((issue) => new BuildError({ message: `the built bytes have no readable digest: ${issue.message}`, cause: issue })));
+    const expiration = expirationOfBytes(bytes);
+    return {
+        digest,
+        bytes,
+        sender: opts.sender,
+        // The chain these bytes were built against, so `Tx.reconcile` can refuse to
+        // reason about them with a node on another one — including for the
+        // expiration variants that name no chain themselves.
+        chain: sui.chainId,
+        ...(opts.gasOwner === undefined ? {} : { gasOwner: opts.gasOwner }),
+        ...(expiration === undefined ? {} : { expiration })
+    };
+});
+/** The epoch a system-state read reported, as a number the expiration can carry. */
+const epochOf = (epoch) => Effect.try({
+    try: () => BigInt(epoch),
+    catch: (cause) => new TransportError({
+        method: "getCurrentSystemState",
+        retryable: false,
+        status: "INVALID_ARGUMENT",
+        cause: `the node reported epoch ${epoch}, which is not a number: ${String(cause)}`
+    })
+});
+/**
+ * The nonce for a default `ValidDuring` expiration, from
+ * `SubmitConfig.nonce`, checked to be the `u32` the wire carries.
+ *
+ * A custom allocator that answers something else is a configuration mistake and
+ * fails the build, rather than producing bytes a validator refuses.
+ */
+const nonceOf = (config) => Effect.flatMap(config.nonce, (nonce) => Number.isInteger(nonce) && nonce >= 0 && nonce <= MAX_NONCE
+    ? Effect.succeed(nonce)
+    : Effect.fail(
+    // A `BuildError`, not a `TransportError`: nothing was sent, no node was
+    // asked, and the build is what failed. `SubmitConfig.ts` and DESIGN
+    // section 6 both say so.
+    new BuildError({
+        message: `SubmitConfig.nonce produced ${nonce}, which is not a u32 (0 to ${MAX_NONCE})`,
+        cause: nonce
+    })));
+/** The expiration `Tx.build` sets when the recipe set none. */
+const defaultExpiration = Effect.fn("Tx.defaultExpiration")(function* (sui, config) {
+    switch (config.expiration) {
+        case "none":
+            return undefined;
+        case "epoch": {
+            const { systemState } = yield* sui.core.getCurrentSystemState();
+            return { Epoch: systemState.epoch };
+        }
+        case "validDuring": {
+            const { systemState } = yield* sui.core.getCurrentSystemState();
+            const epoch = yield* epochOf(systemState.epoch);
+            const nonce = yield* nonceOf(config);
+            const maxTimestamp = config.validFor === undefined
+                ? null
+                : (BigInt(DateTime.toEpochMillis(yield* sui.chainTime)) +
+                    BigInt(Duration.toMillis(config.validFor))).toString();
+            return {
+                ValidDuring: {
+                    // Epochs, not a clock. The validator rule is that a transaction must
+                    // either have address-owned inputs or an expiration of at most two
+                    // epochs, so a bound of some other kind is rejected outright for a
+                    // PTB whose only object inputs are shared and for every
+                    // `Tx.sponsored` transaction, which pays gas from an address balance
+                    // and therefore has no gas coins either. Two epochs is the widest
+                    // the rule allows.
+                    minEpoch: epoch.toString(),
+                    maxEpoch: (epoch + 1n).toString(),
+                    minTimestamp: null,
+                    // Null unless `SubmitConfig.validFor` asks for one: a live devnet
+                    // node refuses any transaction carrying a timestamp bound with
+                    // "Feature is not supported: Timestamp-based transaction expiration
+                    // is not yet supported", epochs alongside it or not.
+                    maxTimestamp,
+                    chain: sui.chainId,
+                    nonce
+                }
+            };
+        }
+    }
+});
+/**
+ * Refuses a signer whose address the bytes will not accept.
+ *
+ * A transaction takes a signature from its sender and, when it is sponsored,
+ * from its gas owner. A signature from anyone else is rejected by the node with
+ * a non-retryable `INVALID_ARGUMENT`, which `Tx.submit` can only report as
+ * `SubmissionUnknown` — exit 3, "reconcile before doing anything else" — for a
+ * transaction that never had a chance. Catching it here makes a misconfigured
+ * credential a `SigningError` before any bytes are sent.
+ *
+ * The addresses come from the bytes rather than from `Built.sender`, so the
+ * check is against what was actually signed. Bytes this version cannot parse
+ * are let through: refusing to sign because the guard could not read them would
+ * be worse than the failure it prevents.
+ */
+const assertSignerAddress = (bytes, signer) => Effect.suspend(() => {
+    const allowed = signersOfBytes(bytes);
+    if (allowed.length === 0)
+        return Effect.void;
+    const address = normalizeSuiAddress(signer.address);
+    if (allowed.includes(address))
+        return Effect.void;
+    return Effect.fail(new SigningError({
+        cause: `this signer signs as ${signer.address}, which is neither the transaction's sender` +
+            ` nor its gas owner (${allowed.join(", ")}); the node would reject the signature`
+    }));
+});
+/**
+ * Signs built bytes.
+ *
+ * The signer's address must be the transaction's sender or, for a sponsored
+ * transaction, its gas owner; anything else is a `SigningError` rather than a
+ * rejection at execution time. A `Signer.remote` therefore has to report the
+ * address it signs as truthfully.
+ *
+ * Fails with: `SigningError`.
+ */
+export const sign = Effect.fn("Tx.sign")(function* (built, signer) {
+    yield* assertSignerAddress(built.bytes, signer);
+    const signature = yield* signer.signTransaction(built.bytes);
+    return {
+        digest: built.digest,
+        bytes: built.bytes,
+        signatures: [signature],
+        sender: built.sender,
+        ...(built.expiration === undefined ? {} : { expiration: built.expiration }),
+        // Carried forward from the build, so `Tx.reconcile` knows which chain these
+        // bytes belong to even when the expiration names none.
+        ...(built.chain === undefined ? {} : { chain: built.chain })
+    };
+});
+/**
+ * Adds one more signature to already signed bytes, for a sponsored or
+ * multi-party transaction. The bytes are untouched, so both parties sign
+ * exactly the same transaction.
+ *
+ * As in {@link sign}, the co-signer's address must be the sender or the gas
+ * owner named in the bytes.
+ *
+ * Fails with: `SigningError`.
+ */
+export const cosign = Effect.fn("Tx.cosign")(function* (signed, signer) {
+    yield* assertSignerAddress(signed.bytes, signer);
+    const signature = yield* signer.signTransaction(signed.bytes);
+    return { ...signed, signatures: [...signed.signatures, signature] };
+});
+/**
+ * Turns a recipe into a sponsored one: the sender owns the transaction, the
+ * gas owner pays, and gas comes from the sponsor's address balance rather than
+ * from coin objects, so the two parties never have to agree on a gas coin and
+ * can sign in either order.
+ *
+ * Never fails; the recipe it returns throws only if the recipe it wraps does,
+ * which `Tx.build` reports as `BuildError`.
+ */
+export const sponsored = (opts) => (recipe) => (tx) => {
+    recipe(tx);
+    tx.setSender(opts.sender);
+    tx.setGasOwner(opts.gasOwner);
+    tx.setGasPayment([]);
+};
+const journalSigned = Effect.fn("Tx.journalSigned")(function* (signed) {
+    const journal = yield* Journal;
+    const now = yield* DateTime.now;
+    yield* journal.put(JournalEntry.cases.Signed.make({ _tag: "Signed", digest: signed.digest, signed, signedAt: now }));
+});
+const journalOutcome = Effect.fn("Tx.journalOutcome")(function* (entry) {
+    const journal = yield* Journal;
+    yield* journal.put(entry);
+});
+/**
+ * Records an outcome the network has already given, and never changes it.
+ *
+ * `JournalError` is reserved for the write that happens **before** the first
+ * `executeTransaction`: failing there is honest, because nothing has been sent
+ * and the caller can safely try again. Once execute or reconcile has answered,
+ * a journal that cannot be written is an operational problem, not a different
+ * outcome — reporting a charged `ExecutionFailed` as `JournalError` would put
+ * it on exit 4, "not applied, safe to retry", and the documented retry idiom
+ * would send the transaction a second time. So the failure is logged with the
+ * digest and swallowed, and the answer stands.
+ */
+const journalSettled = (entry) => journalOutcome(entry).pipe(Effect.catchTag("JournalError", (error) => Effect.logError("the submission journal could not record a settled transaction; the outcome stands", error)), Effect.annotateLogs({ digest: entry.digest, entry: entry._tag }));
+const executedEntry = Effect.fn("Tx.executedEntry")(function* (executed) {
+    const now = yield* DateTime.now;
+    return JournalEntry.cases.Executed.make({
+        _tag: "Executed",
+        digest: executed.digest,
+        ...(executed.checkpoint === null ? {} : { checkpoint: executed.checkpoint }),
+        at: now
+    });
+});
+const failedEntry = Effect.fn("Tx.failedEntry")(function* (error) {
+    const now = yield* DateTime.now;
+    return JournalEntry.cases.Failed.make({
+        _tag: "Failed",
+        digest: error.digest,
+        reason: error.reason,
+        at: now
+    });
+});
+const notAppliedEntry = Effect.fn("Tx.notAppliedEntry")(function* (error) {
+    const now = yield* DateTime.now;
+    return JournalEntry.cases.NotApplied.make({
+        _tag: "NotApplied",
+        digest: error.digest,
+        evidence: error.evidence,
+        at: now
+    });
+});
+const unknownEntry = Effect.fn("Tx.unknownEntry")(function* (signed, lastError, attempts) {
+    const now = yield* DateTime.now;
+    return JournalEntry.cases.Unknown.make({
+        _tag: "Unknown",
+        digest: signed.digest,
+        signed,
+        lastError,
+        attempts,
+        at: now
+    });
+});
+/**
+ * Waits for an execution to be visible to reads, before `Tx.submit` returns and
+ * the sender lock is released.
+ *
+ * Execute and indexing are two different things on a Sui node: a transaction
+ * that executed is not necessarily one the next `getObject` or the next build's
+ * input resolution can see. Serializing per sender stops two builds picking the
+ * same gas coin; it does not stop the second build resolving that coin at the
+ * version the first one already spent. `waitForTransaction` is the SDK's own
+ * answer, and holding the lock across it is what makes "the next `Tx.run` from
+ * this sender sees this one" true.
+ *
+ * **It never changes the outcome.** The transaction executed; that is a fact,
+ * and a wait that times out or fails does not unmake it. The failure is logged
+ * with the digest and `Tx.submit` returns the `Executed` it already has. Turn
+ * the wait off with `SubmitConfig.awaitVisibility: false` and bound it with
+ * `SubmitConfig.visibilityTimeout`. Never fails.
+ */
+const awaitVisible = (sui, config, digest) => config.awaitVisibility === false ? Effect.void : sui.core
+    .waitForTransaction({ digest })
+    .pipe(Effect.timeout(config.visibilityTimeout), Effect.asVoid, 
+// `Effect.catch`, not `Effect.catchCause`: a timeout, a `TransportError`
+// and a `TransactionNotFound` are the failures this is allowed to swallow
+// — a **defect** is a bug, and turning one into a warning line hid it
+// behind an outcome that was going to stand anyway.
+Effect.catch(() => Effect.logWarning("the transaction executed but did not become visible to reads within" +
+    " SubmitConfig.visibilityTimeout; the outcome stands")), Effect.annotateLogs({ digest }), Effect.withSpan("Tx.awaitVisible"));
+/**
+ * Sends signed bytes, and does not stop caring until it knows what happened.
+ *
+ * Before the first `executeTransaction` it writes a `Signed` journal entry, so
+ * a process that dies mid-flight leaves a record of bytes that may be on the
+ * wire. A retryable transport failure or a timeout re-sends the identical bytes
+ * on `SubmitConfig.resubmit`; nothing is ever rebuilt, so a retry can only land
+ * the transaction that was already signed. When the retries run out it runs
+ * `Tx.reconcile`, which either finds the transaction, proves it never applied,
+ * or says it does not know.
+ *
+ * `TransportError` never escapes: once bytes may have been sent, "the network
+ * was unreachable" is not an answer a caller can act on, so it becomes
+ * `SubmissionUnknown` carrying the signed bytes.
+ *
+ * `JournalError` can only come from the `Signed` write, before anything has
+ * been sent. Once the network has answered, a journal write that fails is
+ * logged with `Effect.logError` and the answer stands, because "the journal is
+ * broken" is not a thing a caller can act on and reporting it in place of a
+ * charged `ExecutionFailed` would invite a second submission.
+ *
+ * Fails with: `ExecutionFailed` (applied on chain and failed; gas was charged),
+ * `NotApplied` (provably never applied), `SubmissionUnknown` (the outcome is
+ * not known and the bytes are in the error), `JournalError` (only before the
+ * first send).
+ */
+export const submit = Effect.fn("Tx.submit")(function* (signed) {
+    const sui = yield* Sui;
+    const config = yield* SubmitConfig;
+    yield* journalSigned(signed);
+    let attempts = 0;
+    const once = Effect.suspend(() => {
+        attempts += 1;
+        return sui.core.executeTransaction({
+            transaction: signed.bytes,
+            signatures: [...signed.signatures],
+            include: EXECUTE_INCLUDE
+        }).pipe(Effect.timeout(config.executeTimeout), Effect.mapError(timeoutAsTransport("executeTransaction")));
+    });
+    const result = yield* once.pipe(Effect.retry({
+        schedule: config.resubmit,
+        times: Math.max(config.resubmitAttempts - 1, 0),
+        while: (error) => error.retryable
+    }), Effect.flatMap(fromTransactionResult), Effect.catchTag("DecodeError", (error) => Effect.fail(new TransportError({ method: "executeTransaction", retryable: false, cause: error }))), Effect.result);
+    if (result._tag === "Success") {
+        yield* journalSettled(yield* executedEntry(result.success));
+        yield* awaitVisible(sui, config, signed.digest);
+        return result.success;
+    }
+    const failure = result.failure;
+    if (failure._tag === "ExecutionFailed") {
+        yield* journalSettled(yield* failedEntry(failure));
+        return yield* failure;
+    }
+    // Bytes may have reached the network: the only honest next step is to ask.
+    return yield* reconcileSigned(signed, failure, attempts);
+});
+/** `reconcile` plus the journal bookkeeping `submit` owes after it. */
+const reconcileSigned = Effect.fn("Tx.reconcileSigned")(function* (signed, lastError, attempts) {
+    const settled = yield* Effect.result(reconcile(signed));
+    if (settled._tag === "Success") {
+        yield* journalSettled(yield* executedEntry(settled.success));
+        return settled.success;
+    }
+    const failure = settled.failure;
+    switch (failure._tag) {
+        case "ExecutionFailed":
+            yield* journalSettled(yield* failedEntry(failure));
+            return yield* failure;
+        case "NotApplied":
+            // Terminal: the transaction was proven never to have applied, so the
+            // journal records that rather than leaving an `Unknown` nothing will
+            // ever settle.
+            yield* journalSettled(yield* notAppliedEntry(failure));
+            return yield* failure;
+        default: {
+            const unknown = failure._tag === "SubmissionUnknown"
+                ? failure
+                : new SubmissionUnknown({ digest: signed.digest, signed, cause: failure });
+            yield* journalSettled(yield* unknownEntry(signed, SuiError.describe(lastError), attempts));
+            return yield* unknown;
+        }
+    }
+});
+const inputOf = (input) => {
+    if (typeof input === "string")
+        return { digest: input };
+    if (input instanceof SubmissionUnknown) {
+        return input.signed === undefined
+            ? { digest: input.digest }
+            : { digest: input.digest, signed: input.signed };
+    }
+    return { digest: input.digest, signed: input };
+};
+/**
+ * One read of a pinned object, asking for the digest that last mutated it.
+ *
+ * `previousTransaction` is the whole point of the read: it is the only field
+ * that says *which* transaction moved the object on, and therefore the only
+ * thing that can tell "someone else spent our input" from "we spent it
+ * ourselves and the node has not caught up". The include set asks for nothing
+ * else — no `content`, so a version bump on an object whose Move type we cannot
+ * decode is still readable evidence.
+ *
+ * Fails with: `TransportError`.
+ */
+const inputStateOf = Effect.fn("Tx.inputStateOf")(function* (sui, objectId) {
+    const found = yield* Effect.result(sui.core.getObject({ objectId, include: { previousTransaction: true } }));
+    if (found._tag !== "Success") {
+        // Deleted, wrapped, or the node would not say: there is no version and no
+        // consuming digest to reason about, only absence.
+        if (found.failure._tag === "TransportError")
+            return yield* found.failure;
+        return { _tag: "Absent" };
+    }
+    const object = found.success.object;
+    const version = yield* Effect.try({
+        try: () => BigInt(object.version),
+        catch: (cause) => new TransportError({
+            method: "getObject",
+            retryable: false,
+            cause: `the node reported version ${object.version} for ${objectId}: ${String(cause)}`
+        })
+    });
+    return {
+        _tag: "Present",
+        version,
+        previousTransaction: object.previousTransaction ?? undefined
+    };
+});
+/**
+ * The version of one object that a given transaction took as **input**, read
+ * out of that transaction's own effects.
+ *
+ * `changedObjects[].inputVersion` is the only field on the network that answers
+ * "which version did this transaction consume": there is no `v + 1` rule to
+ * lean on, because Sui stamps every output of a transaction with that
+ * transaction's **Lamport version** — `max(input versions) + 1` across all of
+ * its inputs — so an owned object read alongside a newer gas coin jumps from
+ * version 4 to 6,436,928 and the object "at version 5" never existed.
+ *
+ * A transaction that **failed** on chain still consumed its inputs, so its
+ * effects are read out of `ExecutionFailed` as readily as out of `Executed`.
+ * `undefined` means the question cannot be answered here — the node does not
+ * serve that transaction, or its effects do not mention this object (it was
+ * created rather than consumed).
+ *
+ * Fails with: `TransportError`.
+ */
+const consumedVersionOf = Effect.fn("Tx.consumedVersionOf")(function* (sui, by, objectId) {
+    const decoded = decodeDigestOption(by);
+    if (decoded._tag !== "Some")
+        return undefined;
+    const found = yield* Effect.result(sui.getTransaction(decoded.value));
+    if (found._tag === "Failure" && found.failure._tag === "TransportError") {
+        return yield* found.failure;
+    }
+    const effects = found._tag === "Success"
+        ? found.success.effects
+        : found.failure._tag === "ExecutionFailed"
+            ? found.failure.effects
+            : undefined;
+    if (effects === undefined)
+        return undefined;
+    const wanted = normalizeSuiAddress(objectId);
+    for (const change of effects.changedObjects) {
+        if (normalizeSuiAddress(change.objectId) !== wanted)
+            continue;
+        return change.inputVersion ?? undefined;
+    }
+    return undefined;
+});
+/**
+ * Reads every object the bytes pinned — owned inputs and gas coins alike — and
+ * says what their current state proves.
+ *
+ * A version that has not moved proves nothing and the next reference is tried.
+ * A version that has moved (or an object that is gone) says only *that* it
+ * moved; it does not say **who** moved it, and that is the whole question.
+ *
+ * The live object's `previousTransaction` names the **latest** mutation, which
+ * is not necessarily the consumer of the version these bytes pinned: T can
+ * consume version 3 and U version 4, and the object then names U. So the answer
+ * is read out of that transaction's own effects:
+ *
+ * - `previousTransaction` is **our** digest: the transaction applied, whatever
+ *   the read replica that answered `getTransaction` thought;
+ * - it is a **different** digest, and that transaction's effects report
+ *   `inputVersion` **equal to the version we pinned**: those exact bytes can
+ *   never execute again, and that is the one thing `NotApplied
+ *   { inputConsumed }` may be built on;
+ * - it is a different digest whose `inputVersion` is **greater** than ours:
+ *   something between the two consumed our version and the node does not serve
+ *   the state in between, so nothing is proven;
+ * - nothing readable at all — a deleted object, a node that names no
+ *   transaction, a transaction the node has pruned — proves nothing either way.
+ *
+ * **Every pinned reference is tried.** A gas coin that merely moved on, or an
+ * input whose consumer cannot be read, does not end the search: the first
+ * inconclusive reference is remembered and the next one is read, and the
+ * remembered reason is only reported when no reference proved anything. Giving
+ * up on the first moved reference is how a reconcile with `AppliedByUs`
+ * evidence one read away returned `SubmissionUnknown`.
+ *
+ * Fails with: `TransportError`.
+ */
+const inputEvidence = Effect.fn("Tx.inputEvidence")(function* (sui, digest, signed) {
+    let inconclusive;
+    const remember = (objectId, reason) => {
+        if (inconclusive === undefined)
+            inconclusive = { _tag: "Unreadable", objectId, reason };
+    };
+    for (const pinned of pinnedRefsOfBytes(signed.bytes)) {
+        const decoded = decodeObjectId(pinned.objectId);
+        if (decoded._tag !== "Some")
+            continue;
+        const objectId = decoded.value;
+        const state = yield* inputStateOf(sui, objectId);
+        if (state._tag === "Present" && state.version <= pinned.version)
+            continue;
+        if (state._tag === "Absent") {
+            remember(objectId, "it is gone, and a deleted object names no transaction");
+            continue;
+        }
+        const by = state.previousTransaction;
+        if (by === undefined) {
+            remember(objectId, "the node served the object but named no transaction as its last mutation");
+            continue;
+        }
+        if (by === digest)
+            return { _tag: "AppliedByUs", objectId };
+        const consumed = yield* consumedVersionOf(sui, by, objectId);
+        if (consumed === undefined) {
+            remember(objectId, `the node does not say which version transaction ${by}, which last mutated it, consumed`);
+            continue;
+        }
+        if (consumed === pinned.version)
+            return { _tag: "ConsumedByOther", objectId, by };
+        remember(objectId, `transaction ${by} consumed version ${consumed} of it, not the version ${pinned.version}` +
+            " these bytes pinned, and the state in between is not served");
+    }
+    return inconclusive ?? { _tag: "NoEvidence" };
+});
+/** The epoch the node currently reports. Fails with: `TransportError`. */
+const currentEpoch = Effect.fn("Tx.currentEpoch")(function* (sui) {
+    const { systemState } = yield* sui.core.getCurrentSystemState();
+    return yield* epochOf(systemState.epoch);
+});
+/**
+ * Whether the transaction's expiration window is observably closed **right
+ * now**: the current epoch is past its `maxEpoch`, or `chainTime` is past its
+ * `maxTimestamp` by more than `SubmitConfig.expiryMargin`.
+ *
+ * One observation of this is not evidence of anything (see `reconcile`); it is
+ * the thing that has to hold twice, around a `getTransaction` miss each time.
+ *
+ * Fails with: `TransportError`.
+ */
+const expiryClosed = Effect.fn("Tx.expiryClosed")(function* (sui, config, signed) {
+    const lastEpoch = maxEpochOf(signed.expiration);
+    if (lastEpoch !== undefined) {
+        // Epochs first: they are what the default expiration carries, and unlike a
+        // wall clock an epoch is a consensus fact, so no skew margin is needed.
+        const epoch = yield* currentEpoch(sui);
+        if (epoch > lastEpoch)
+            return true;
+    }
+    const bound = maxTimestampMsOf(signed.expiration);
+    if (bound !== undefined) {
+        const now = yield* sui.chainTime;
+        const margin = BigInt(Duration.toMillis(config.expiryMargin));
+        if (BigInt(DateTime.toEpochMillis(now)) > bound + margin)
+            return true;
+    }
+    return false;
+});
+/**
+ * The chain these bytes belong to: the one the expiration names, or the one
+ * `Tx.build` recorded for the variants that name none. `undefined` when neither
+ * is available, which is every hand-built `Signed` from before this field
+ * existed.
+ */
+const chainOfSigned = (signed) => chainOf(signed.expiration) ?? signed.chain;
+/**
+ * Finds out what happened to a transaction that was sent but never answered
+ * for.
+ *
+ * A transaction the node knows is `Executed`, or `ExecutionFailed` when it
+ * applied and aborted. A transaction the node does not know is only ever
+ * `NotApplied` on evidence, and there are exactly two kinds:
+ *
+ * - `"expired"`, under an **ordered and repeated** rule, because a closed
+ *   expiration window proves only that the bytes cannot execute *later*, not
+ *   that they did not execute *earlier*, and a transaction can execute between
+ *   a lookup and an expiry check. So: the window must be observed closed, then
+ *   `getTransaction` must miss, then — after `SubmitConfig.reconcileRecheck`
+ *   (two seconds by default, through the `Clock`) — both must hold again. Any
+ *   other order, or a single observation, is `SubmissionUnknown`. Set
+ *   `SubmitConfig.expiryEvidence: "never"` to disable the rule entirely, which
+ *   is what a deployment behind a mixed-node load balancer wants. The residual
+ *   risk is a node whose transaction index lags its epoch view;
+ * - `"inputConsumed"` when the transaction that last mutated a pinned object is
+ *   a **different** one **and its own effects report `inputVersion` equal to
+ *   the version these bytes pinned**, so those exact bytes can never execute
+ *   again.
+ *
+ * An input that merely advanced is not evidence: the transaction being
+ * reconciled is itself the likeliest thing to have advanced it, and calling
+ * that `NotApplied` would tell the documented retry idiom to execute the
+ * caller's intent a second time. When the live object names *our* digest the
+ * transaction applied and `getTransaction` is asked again; when the consuming
+ * transaction took a **later** version than ours — which is the common case,
+ * because Sui stamps every output with the transaction's Lamport version and
+ * the object "one version on" from ours usually never existed — nothing is
+ * proven and the answer is `SubmissionUnknown`, which carries the bytes so a
+ * later process, or a person, can settle it. Every pinned reference is tried
+ * before that answer is given.
+ *
+ * **Chain identity is checked before anything is asked.** Bytes built for one
+ * chain must never be declared expired by another chain's epoch, which a
+ * process-wide journal holding two networks' submissions makes easy to do. A
+ * mismatch is `SubmissionUnknown` naming both chains.
+ *
+ * **No `TransportError` escapes.** A recovery read that fails says nothing
+ * about whether the transaction applied, and `SuiError.outcome` puts
+ * `TransportError` on `"not_applied"` — which would tell a wrapper to retry a
+ * submission whose outcome is genuinely unknown. Every read failure here
+ * becomes `SubmissionUnknown` carrying the digest, the bytes and the cause. The
+ * tag stays in the signature so the union does not shrink under callers.
+ *
+ * Given only a `Digest` there can be no evidence, so an unknown transaction is
+ * always `SubmissionUnknown`. Pass the `Signed` bytes (or the
+ * `SubmissionUnknown` that carries them) to get the evidence rules.
+ *
+ * Fails with: `ExecutionFailed`, `NotApplied`, `SubmissionUnknown`,
+ * `TransportError`.
+ */
+export const reconcile = Effect.fn("Tx.reconcile")(function* (input) {
+    const sui = yield* Sui;
+    const config = yield* SubmitConfig;
+    const { digest, signed } = inputOf(input);
+    return yield* recover(sui, config, digest, signed).pipe(Effect.catchTag("TransportError", (error) => Effect.fail(new SubmissionUnknown({
+        digest,
+        ...(signed === undefined ? {} : { signed }),
+        cause: error
+    }))));
+});
+/** The body of {@link reconcile}, before its read failures become unknown. */
+const recover = Effect.fn("Tx.recover")(function* (sui, config, digest, signed) {
+    const unknown = (cause) => new SubmissionUnknown({
+        digest,
+        // Absent when `reconcile` was given only a digest: there is then nothing
+        // to re-send, and saying so is better than inventing empty bytes.
+        ...(signed === undefined ? {} : { signed }),
+        cause
+    });
+    if (signed !== undefined) {
+        const chain = chainOfSigned(signed);
+        if (chain !== undefined && chain !== sui.chainId) {
+            return yield* unknown(`these bytes were built for chain ${chain} and this Sui is on ${sui.chainId};` +
+                " nothing this node says about them is evidence");
+        }
+    }
+    /** One `getTransaction`, with "the node does not know it" as a value. */
+    const lookup = Effect.fn("Tx.recover.lookup")(function* () {
+        const found = yield* Effect.result(sui.getTransaction(digest));
+        if (found._tag === "Success")
+            return found.success;
+        if (found.failure._tag !== "TransactionNotFound")
+            return yield* found.failure;
+        return undefined;
+    });
+    const first = yield* lookup();
+    if (first !== undefined)
+        return first;
+    if (signed === undefined) {
+        return yield* unknown("the node does not know this digest and the signed bytes are not available");
+    }
+    if (config.expiryEvidence === "epochThenMiss") {
+        // Ordered, and repeated: closed, then missing, then — after a delay —
+        // closed and missing again. Anything else proves nothing.
+        if (yield* expiryClosed(sui, config, signed)) {
+            const second = yield* lookup();
+            if (second !== undefined)
+                return second;
+            yield* Effect.sleep(config.reconcileRecheck);
+            if (yield* expiryClosed(sui, config, signed)) {
+                const third = yield* lookup();
+                if (third !== undefined)
+                    return third;
+                return yield* new NotApplied({ digest, evidence: "expired" });
+            }
+        }
+    }
+    const evidence = yield* inputEvidence(sui, digest, signed);
+    switch (evidence._tag) {
+        case "ConsumedByOther":
+            return yield* new NotApplied({ digest, evidence: "inputConsumed" });
+        case "AppliedByUs": {
+            // Object ${objectId} names this very transaction as the one that last
+            // mutated it, so it applied; the `getTransaction` above was answered by a
+            // node that had not caught up. Ask once more for the receipt.
+            const again = yield* lookup();
+            if (again !== undefined)
+                return again;
+            return yield* unknown(`object ${evidence.objectId} names this transaction as the one that last mutated it,` +
+                " so it applied, but the node still does not serve it");
+        }
+        case "Unreadable":
+            return yield* unknown(`object ${evidence.objectId} has moved on or is gone, and ${evidence.reason},` +
+                " so nothing is proven");
+        case "NoEvidence":
+            return yield* unknown("the node does not know this digest and nothing proves it cannot land");
+    }
+});
+/**
+ * The signer for an address the bytes require a second signature from, or a
+ * `SigningError` saying which address is missing one.
+ */
+const assertSponsor = (gasOwner, sponsor) => {
+    if (sponsor === undefined) {
+        return Effect.fail(new SigningError({
+            cause: `this transaction's gas owner is ${gasOwner}, which is not the sender:` +
+                " a sponsored transaction needs that party's signature too. Pass" +
+                " Tx.run(recipe, { signer, gasOwner, sponsor }), or build, sign, cosign and" +
+                " submit the steps yourself when the two parties cannot both sign here"
+        }));
+    }
+    if (normalizeSuiAddress(sponsor.address) !== normalizeSuiAddress(gasOwner)) {
+        return Effect.fail(new SigningError({
+            cause: `the sponsor signs as ${sponsor.address}, but this transaction's gas owner` +
+                ` is ${gasOwner}`
+        }));
+    }
+    return Effect.succeed(sponsor);
+};
+/**
+ * Build, preflight, sign and submit, with the sender lock held throughout.
+ *
+ * Gas coins are chosen during build, so two transactions from one address that
+ * overlap can pick the same coin and one of them will fail on chain. `Tx.run`
+ * holds the sender lock from build through submit, which is the whole reason to
+ * prefer it over calling the steps separately.
+ *
+ * The address that matters is the one whose coins are being spent, which is the
+ * **gas owner** when there is one: two sponsored runs for different senders
+ * paid by one sponsor are exactly the case that picks the same coin twice. When
+ * sender and gas owner differ, both locks are held, in ascending address order
+ * — a fixed order, so two runs that each need the same pair cannot deadlock by
+ * taking them the other way round.
+ *
+ * When `SubmitConfig.preflight` is set it costs one extra simulate, and is
+ * where spend limits and target policies refuse a transaction before anything
+ * is signed.
+ *
+ * **A sponsored run needs both signatures.** A transaction whose gas owner is
+ * not its sender is signed by *both* parties; one signature is bytes a
+ * validator rejects. So when `opts.gasOwner` differs from the signer's address
+ * — or when the recipe itself set a different gas owner, which `Tx.sponsored`
+ * does — `opts.sponsor` is required and co-signs the same bytes. Without it
+ * `Tx.run` fails with `SigningError` naming the address whose signature is
+ * missing, before anything is built when the gas owner was given as an option
+ * and immediately after the build when it came out of the recipe. Use the
+ * explicit lifecycle (`Tx.build`, `Tx.sign`, `Tx.cosign`, `Tx.submit`) when the
+ * two parties cannot both sign in one process.
+ *
+ * Fails with: `BuildError`, `SimulationFailed`, `PolicyDenied`, `SigningError`,
+ * `ExecutionFailed`, `NotApplied`, `SubmissionUnknown`, `JournalError`,
+ * `TransportError` (from the build reads; once bytes are sent, transport
+ * failures become `SubmissionUnknown`).
+ */
+export const run = Effect.fn("Tx.run")(function* (recipe, opts) {
+    const sui = yield* Sui;
+    const config = yield* SubmitConfig;
+    const sender = opts.signer.address;
+    // Normalized on both sides: `0x2` and its 64-character spelling are one
+    // address, and comparing them as written took two locks on one account — in
+    // whichever order the two spellings happened to sort.
+    const locked = opts.gasOwner === undefined ||
+        normalizeSuiAddress(opts.gasOwner) === normalizeSuiAddress(sender)
+        ? [sender]
+        : [sender, opts.gasOwner].sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+    // Before anything is built: a gas owner the caller named, with no signer for
+    // it, can never produce bytes a validator accepts.
+    if (opts.gasOwner !== undefined && normalizeSuiAddress(opts.gasOwner) !== normalizeSuiAddress(sender)) {
+        yield* assertSponsor(opts.gasOwner, opts.sponsor);
+    }
+    const body = Effect.gen(function* () {
+        const built = yield* build(recipe, {
+            sender,
+            ...(opts.gasOwner === undefined ? {} : { gasOwner: opts.gasOwner })
+        });
+        const preflight = config.preflight;
+        if (preflight !== undefined) {
+            const simulation = yield* sui.simulate(built.bytes);
+            yield* preflight(simulation);
+        }
+        let signed = yield* sign(built, opts.signer);
+        // Read back out of the bytes, so a recipe that set its own gas owner —
+        // which `Tx.sponsored` does — is covered as well as the option.
+        for (const required of signersOfBytes(built.bytes)) {
+            if (required === normalizeSuiAddress(sender))
+                continue;
+            const sponsor = yield* assertSponsor(required, opts.sponsor);
+            signed = yield* cosign(signed, sponsor);
+        }
+        return yield* submit(signed);
+    });
+    return yield* config.lockSender
+        ? locked.reduceRight((inner, address) => sui.withSenderLock(address)(inner), body)
+        : body;
+});
+/**
+ * Settles every unresolved entry in the journal: the explicit startup call a
+ * long-lived application makes after building a durable `Journal`.
+ *
+ * Nothing here fails per entry: each one settles to an `Executed`, an
+ * `ExecutionFailed`, a `NotApplied` or a `SubmissionUnknown`, in the order the
+ * journal listed them, and the journal is updated to match. Every settled entry
+ * gets the same evidence rules `Tx.reconcile` applies — the ordered, repeated
+ * expiry rule, the chain-identity guard and the versioned consumer check — so a
+ * startup never reports a transaction that applied as `NotApplied`, and a
+ * recovery read that fails becomes that entry's `SubmissionUnknown` rather than
+ * escaping as a `TransportError` the taxonomy would call "not applied".
+ *
+ * The whole call fails only if the journal itself cannot be **read**: a write
+ * that fails after an entry has been settled is logged and the answer stands,
+ * the same rule `Tx.submit` follows.
+ *
+ * Fails with: `JournalError`, `TransportError`.
+ */
+export const reconcileAll = Effect.fn("Tx.reconcileAll")(function* () {
+    const journal = yield* Journal;
+    const entries = yield* journal.listUnresolved;
+    const settled = [];
+    for (const entry of entries) {
+        if (!isUnresolved(entry))
+            continue;
+        const attempts = entry._tag === "Unknown" ? entry.attempts : 1;
+        const result = yield* Effect.result(reconcile(entry.signed));
+        if (result._tag === "Success") {
+            yield* journalSettled(yield* executedEntry(result.success));
+            settled.push(result.success);
+            continue;
+        }
+        const failure = result.failure;
+        switch (failure._tag) {
+            case "ExecutionFailed":
+                yield* journalSettled(yield* failedEntry(failure));
+                settled.push(failure);
+                break;
+            case "NotApplied":
+                // Terminal, so the entry leaves the unresolved index: without this a
+                // durable journal would hold a proven-dead submission forever and
+                // `onUnresolved: "fail"` would refuse to build for the life of it.
+                yield* journalSettled(yield* notAppliedEntry(failure));
+                settled.push(failure);
+                break;
+            default: {
+                // `Tx.reconcile` converts every recovery read failure into
+                // `SubmissionUnknown`, so `TransportError` is in its signature and
+                // never in its values; it is mapped here anyway rather than given a
+                // case of its own that nothing could reach. Either way the failure
+                // settles **this** entry and the loop goes on, instead of aborting a
+                // whole startup on one unreachable read.
+                const unresolvedOutcome = failure._tag === "SubmissionUnknown"
+                    ? failure
+                    : new SubmissionUnknown({
+                        digest: entry.digest,
+                        signed: entry.signed,
+                        cause: failure
+                    });
+                yield* journalSettled(yield* unknownEntry(entry.signed, SuiError.describe(failure), attempts));
+                settled.push(unresolvedOutcome);
+                break;
+            }
+        }
+    }
+    return settled;
+});
+/**
+ * The lifecycle, namespaced the way the spec spells it: `Tx.build`, `Tx.sign`,
+ * `Tx.cosign`, `Tx.sponsored`, `Tx.submit`, `Tx.reconcile`, `Tx.run`,
+ * `Tx.reconcileAll`.
+ */
+export const Tx = {
+    build,
+    sign,
+    cosign,
+    sponsored,
+    submit,
+    reconcile,
+    run,
+    reconcileAll
+};
+//# sourceMappingURL=Tx.js.map