refactor(sdk-core): unify sysio contracts behind a generated proxy

CLAUDE.md

@@ -209,6 +209,9 @@ All generated or modified code **must** include JSDoc comments (`/** ... */`), c
 - The `fix-hybrid-output.mjs` script must run after every build of hybrid packages or ESM imports will break in Node
 - `packages/sdk-core/src/contracts/sysio/authex` owns `sysio.authex` action builders, link table reads, and create-link proof helpers. Consumers should not duplicate the `createlink` message/signature rules locally.
 - AuthEx `links` reads use wire-sysio KV `index_name` queries with JSON-encoded bounds. Preserve KV row unwrapping, generated enum-name normalization, and compressed/uncompressed EM key equivalence.
+- `packages/sdk-core/src/contracts/sysio/Client.ts` is the generic transport facade for every generated system contract. Keep action/table names sourced from `SysioContractDefinitions`; keep workflow behavior in the `authex`, `msig`, and `reserv` domain clients.
+- `packages/sdk-core/src/contracts/sysio/Codecs.ts` is the only hand-written system-action codec registry. Add entries only when synchronous action construction is required; generated actions without a codec must retain the `AnyAction` fallback.
+- System-contract `prepare` prefers synchronous ABI encoding but must retain a typed `AnyAction` fallback so `APIClient` can resolve the deployed ABI. Never invent a default write authorization in the public SDK.
 - `packages/sdk-core/src/contracts/sysio/reserv` owns public `sysio.reserv` registry reads, normalized rows, matching, rewards, and read-only quote helpers. External-chain reserve custody belongs in the ABI/IDL-owning chain SDK.
 - `wallet-browser-ext` uses a global shim to avoid `new Function()` restrictions in Chrome MV3
 - Path aliases in tsconfig base resolve to `src/` for dev, but published packages use `lib/` — jest module name maps handle this mismatch

README.md

@@ -9,7 +9,7 @@ A monorepo containing shared TypeScript libraries for Wire applications, providi
 | [`@wireio/shared`](packages/shared/) | Core shared utilities (logging, guards, helpers) | [![npm](https://img.shields.io/npm/v/@wireio/shared)](https://www.npmjs.com/package/@wireio/shared) |
 | [`@wireio/shared-web`](packages/shared-web/) | Web-specific utilities | *private* |
 | [`@wireio/shared-node`](packages/shared-node/) | Node.js-specific utilities | *private* |
-| [`@wireio/sdk-core`](packages/sdk-core/) | Wire blockchain SDK core types, primitives, signing helpers, and system contract workflows such as `sysio.msig` and `sysio.reserv` | [![npm](https://img.shields.io/npm/v/@wireio/sdk-core)](https://www.npmjs.com/package/@wireio/sdk-core) |
+| [`@wireio/sdk-core`](packages/sdk-core/) | Wire blockchain SDK core types, primitives, signing helpers, generated `sysio` contract proxy, and domain workflows such as multisig and reserves | [![npm](https://img.shields.io/npm/v/@wireio/sdk-core)](https://www.npmjs.com/package/@wireio/sdk-core) |
 | [`@wireio/wallet-ext-sdk`](packages/wallet-ext-sdk/) | Client SDK for the Wire Wallet browser extension | [![npm](https://img.shields.io/npm/v/@wireio/wallet-ext-sdk)](https://www.npmjs.com/package/@wireio/wallet-ext-sdk) |
 | [`@wireio/wallet-browser-ext`](packages/wallet-browser-ext/) | Chrome extension developer wallet for Wire | *private* |
 

eslint.config.mjs

@@ -189,7 +189,6 @@ const InlineIifeDebtFiles = ["packages/wallet-browser-ext/src/inject/Provider.ts
 const NullUnionReturnDebtFiles = [
   "packages/sdk-core/src/contracts/Contract.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Capabilities.ts",
-  "packages/sdk-core/src/contracts/sysio/msig/Client.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Hash.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Proposal.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Status.ts",
@@ -219,7 +218,6 @@ const InlineTypeLiteralDebtFiles = [
   "packages/sdk-core/src/common/Connect.ts",
   "packages/sdk-core/src/common/Types.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Capabilities.ts",
-  "packages/sdk-core/src/contracts/sysio/msig/Client.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Proposal.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Status.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Transaction.ts",
@@ -261,7 +259,6 @@ const StringLiteralUnionDebtFiles = [
   "packages/sdk-core/src/common/Logo.ts",
   "packages/sdk-core/src/contracts/Contract.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Capabilities.ts",
-  "packages/sdk-core/src/contracts/sysio/msig/Client.ts",
   "packages/sdk-core/src/contracts/sysio/msig/Types.ts",
   "packages/shared/src/logging/context/LogContext.ts",
   "packages/wallet-browser-ext/src/popup/slices/WalletSlice.ts",
@@ -332,7 +329,6 @@ const RuleDebt = [
     files: [
       "packages/sdk-core/src/api/Client.ts",
       "packages/sdk-core/src/chain/PrivateKey.ts",
-      "packages/sdk-core/src/contracts/sysio/msig/Client.ts",
       "packages/shared/src/node/logging/appenders/FileAppender.ts"
     ]
   },

packages/sdk-core/README.md

@@ -16,22 +16,48 @@ const client = new contracts.sysio.msig.MsigClient({ client: api })
 const detail = await client.getProposalDetail("alice", "upgrade1")
 ```
 
-System contract descriptors also feed a generic typed client factory. The current registry includes `sysio.msig`; future generated metadata can add the rest of the system contracts without changing the factory shape.
+## Generated system-contract proxy
+
+`contracts.sysio.createClient({ client })` exposes every contract in the
+generated `SysioContractDefinitions` registry. Contract, action, and table
+members are typed from `SysioContractMapping`, validated at runtime, and cached
+after their first access. Its `actions.<name>.prepare/invoke` and
+`tables.<name>.query` surface mirrors Wire Tools' `getSysioContract`. Use either
+the concise root syntax or `getSysioContract` when the contract name is dynamic.
 
 ```ts
-const msig = contracts.sysio.createClient({ client: api, name: "msig" })
-const approve = msig.actions.approve(
+import { SysioContracts } from "@wireio/sdk-core"
+
+const sysio = contracts.sysio.createClient({ client: api })
+const msig = sysio.msig
+const epoch = sysio.getSysioContract(SysioContracts.SysioContractName.epoch)
+
+const approve = msig.actions.approve.prepare(
   {
     proposer: "alice",
     proposal_name: "upgrade1",
     level: { actor: "bob", permission: "active" },
     proposal_hash: null
   },
-  ["bob@active"]
+  { authorization: ["bob@active"] }
 )
-const proposals = await msig.tables.proposal.rows({ scope: "alice" })
+const proposals = await msig.tables.proposal.query({ scope: "alice" })
+
+await epoch.actions.advance.invoke({}, { authorization: ["operator@active"] })
 ```
 
+`prepare` returns an ABI-encoded `Action` when a local runtime codec or caller
+ABI can encode the action. If synchronous encoding is unavailable or fails, it
+returns the same generated data as a typed `AnyAction`; `APIClient` resolves the
+deployed ABI when that payload is invoked or pushed. Authorization is empty by
+default and must be supplied explicitly for writes.
+
+The `AuthexClient`, `MsigClient`, and `ReserveClient` classes remain the public
+domain facades for proof creation, proposal compatibility, reserve
+normalization, and other workflow behavior. Each exposes `contractClient` for
+lower-level generated action and table access without duplicating transport
+logic.
+
 The multisig module supports:
 
 - unsigned action builders for `propose`, `approve`, `unapprove`, `cancel`, `exec`, `invalidate`, and read-only `getproposal`
@@ -54,8 +80,6 @@ const links = await authex.getLinks("alice")
 
 Current wire-sysio nodes expose `links` as a KV table. `AuthexClient` uses the deployed named indexes and JSON bounds, unwraps KV rows through `ChainAPI`, normalizes generated enum-name responses, and treats compressed/uncompressed EM public-key renderings as the same external key.
 
-The system contract descriptor registry includes `authex`, `msig`, and `reserv`.
-
 ## Reserves
 
 `contracts.sysio.reserv` provides normalized reserve registry reads,
@@ -69,7 +93,7 @@ const pending = await reserves.listReserves({
   status: SysioReservReservestatus.RESERVE_STATUS_PENDING
 })
 
-const action = reserves.buildMatchReserveAction({
+await reserves.pushMatchReserve({
   chainCode: "ETHEREUM",
   tokenCode: "ETH",
   reserveCode: "PRIMARY",
@@ -78,10 +102,6 @@ const action = reserves.buildMatchReserveAction({
 })
 ```
 
-The generic descriptor registry also accepts
-`contracts.sysio.createClient({ client: api, name: "reserv" })` for typed public
-action and table access.
-
 ## Install
 
 ```sh