Architecture
Understand the Trust Stack monorepo, runtime services, and trust boundaries.
Trust Stack is a monorepo with a strict separation between transaction authority, on-chain policy, and off-chain discovery.
StarKey wallet
└─ signs typed transaction requests
└─ Supra MoveVM package
├─ isolated objects and vaults
└─ exact lifecycle events
└─ continuous Go indexer
├─ PostgreSQL read model
├─ public and partner APIs
├─ signed webhook delivery
└─ marketing/public-proof UIRepository map
| Path | Responsibility |
|---|---|
move/trust-stack | Core standard-asset modules and deterministic Move tests |
move/dexlyn-lp-lock | Separate Dexlyn V1 legacy Coin adapter boundary |
packages/supra-client | RPC, transaction preparation, BCS, and receipt primitives |
packages/supra-wallet | StarKey connector and React wallet state |
packages/trust-stack | Domain schemas, typed transaction builders, state readers, and event parsers |
packages/ui | Shared shadcn-derived UI primitives |
apps/dapp | Wallet workspace and all write/management flows |
apps/indexer-api | Go ingestion, PostgreSQL storage, read APIs, uploads, partners, and webhooks |
apps/marketing | Public product site and proof explorers |
apps/docs | Self-hosted Fumadocs handbook |
Write path
The browser parses a form into a validated intent. The domain package converts it to an exact Move function, type arguments, and BCS arguments. The Supra client fills sender, sequence, gas, chain, and expiry. StarKey signs and submits. The dApp waits for finality, reconciles the expected event, and re-reads state when the workflow supports it.
The Go API is not part of this path and has no wallet key.
Read path
The continuous indexer follows configured package event streams, validates the chain-ID response header and Supra emission proof, parses exact event schemas, and writes idempotent records. Public clients query bounded HTTP endpoints. Claim and management screens still read current Move state before signing.
Deployment boundaries
- Frontends may be hosted independently of the API.
- PostgreSQL remains private to the service network.
- Only the read API and content-addressed media need a public service origin.
- Partner API secrets belong on the server and never in
NEXT_PUBLIC_*variables. - Package addresses and chain ID are reviewed source constants, not arbitrary browser input.