Add Sui Move support to develop-secure-contracts (#11)

* develop-secure-contracts: add Sui Move support (#422)

Extend the cross-ecosystem develop-secure-contracts skill with Sui Move,
delivering the library-integration capability for Sui (no separate skill,
consistent with the other ecosystems).

- detect `.move` in the project file-glob search
- resolve dependencies from Move.toml `r.mvr` (source under ~/.move/ and the
  build mirror; `sui move build --doc` for code docs)
- add a Sui Move row to the repository/documentation lookup table
- note that Sui is deliberately not in the fixed category grid — discover its
  package set from llms.txt -> catalogs -> package READMEs/examples
- add a Sui Move Integration Notes section: no CLI generator (use pattern
  discovery + examples), and route conventions to their sources of truth
  (ARCHITECTURE.md, STYLEGUIDE.md, package README, docs site / API reference,
  and the setup-sui-contracts skill) rather than restating them

Methodology-first and discovery-driven: specifics that drift (slugs, module
lists, patterns) are read from the library's own metadata, not hardcoded.

* develop-secure-contracts: align Sui dep/docs paths with setup skill

Address PR review: make the Sui dependency-source and code-docs locations
precise and consistent with setup-sui-contracts — read exact signatures from
build/<pkg>/sources/dependencies/<move_package_name>/, and note dependency
docs land under build/<pkg>/docs/dependencies/<move_package_name>/.

* develop-secure-contracts: generic --build-env; run the full quality gate before finishing

- Use `--build-env <env>` (required whenever there are MVR deps) rather than
  enumerating `testnet|mainnet` (PR review).
- Note to run the project's full quality gate (build, test, prettier-move,
  lint) before finishing.

* develop-secure-contracts: distinct dep/project placeholders; route formatter to SSOT

Address PR review:
- Disambiguate `<pkg>`: use `<move_package_name>` for the Move.toml dependency
  key and `<project_package>` for the `build/.../` output directory.
- Quality-gate note no longer names a formatter; defer the exact commands and
  formatter to the setup-sui-contracts skill (single source of truth) instead
  of restating them.

* develop-secure-contracts: reach the API reference via the catalog Docs link

Address PR review: drop the ambiguous `.../<major>.x/api/<package>` path
(the URL segment isn't the Move package name); route to the canonical API
reference through each package's catalog `Docs` link instead.

* develop-secure-contracts: add Sui pattern-discovery test case (3.6)

Fresh-subagent case: integrate OZ RBAC into an existing Sui Move module —
verifies discovery from library metadata/examples (no CLI generator), import
via MVR (not copy), and reading installed dependency source for signatures.

* develop-secure-contracts: collapse the Sui section to a single llms.txt pointer

Addresses review feedback that the Sui-specific notes were too verbose for a
shared multi-ecosystem skill and polluted context for non-Sui readers. Replace
the "Sui Move Integration Notes" section and the grid paragraph with one concise
note that routes to llms.txt (the single entry point) + the setup-sui-contracts
skill, and trim the Step 1 dependency-location bullet to match its peers.

* develop-secure-contracts: drop stray `sui move build --doc` from test 3.6

The example omitted `--build-env`, which fails on MVR deps. The develop-secure
pattern-discovery path reads the installed source via the build mirror; the
`--doc` generation flow belongs to the setup-sui-contracts skill, so don't
duplicate it here.

* develop-secure-contracts: use MVR slug placeholder in test 3.6 setup

Genericize the concrete `@openzeppelin-move/access` slug to the
`@openzeppelin-move/<slug>` placeholder form used elsewhere in the skills, so
the scenario doesn't pin a specific registry slug that could drift.

Author: bidzyyys

dev/TESTING.md

@@ -249,6 +249,20 @@ Apply these checks to every test unless noted otherwise:
 - Does NOT blindly stack both — proposes a coherent approach (e.g., migrate to Ownable, or keep AccessControl and adjust roles)
 - Explains the conflict to the user
 
+### 3.6 Sui Move — pattern discovery from installed dependency
+
+**Setup:** A Sui Move project whose `Move.toml` already depends on an OpenZeppelin access package via MVR (`openzeppelin_access = { r.mvr = "@openzeppelin-move/<slug>" }`) and a module under `sources/` that uses it.
+
+**Prompt:**
+> Add role-based access control from OpenZeppelin to my Sui Move module.
+
+**Expected:**
+- `develop-secure-contracts` skill activates and follows the pattern-discovery methodology
+- Searches `**/*.move` and reads `Move.toml` `[dependencies]` to identify the installed OZ packages
+- Discovers the component from the library's own metadata/examples (`llms.txt` → package `README` → `examples/`), not a hardcoded list — and does NOT reach for a CLI generator (none exists for Sui)
+- Integrates by importing via the Move package name (`use <move_package_name>::<module>;`) — never copies library source
+- Reads the installed dependency source/doc-comments (e.g. under `build/<project_package>/sources/dependencies/…`) for exact signatures
+
 ---
 
 ## 4. CLI Contract Generators

skills/develop-secure-contracts/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: develop-secure-contracts
-description: "Develop secure smart contracts using OpenZeppelin Contracts libraries. Use when users need to integrate OpenZeppelin library components — including token standards (ERC20, ERC721, ERC1155), access control (Ownable, AccessControl, AccessManager), security primitives (Pausable, ReentrancyGuard), governance (Governor, timelocks), or accounts (multisig, account abstraction) — into existing or new contracts. Covers pattern discovery from library source, CLI contract generators, and library-first integration. Supports Solidity, Cairo, Stylus, and Stellar."
+description: "Develop secure smart contracts using OpenZeppelin Contracts libraries. Use when users need to integrate OpenZeppelin library components — including token standards (ERC20, ERC721, ERC1155), access control (Ownable, AccessControl, AccessManager), security primitives (Pausable, ReentrancyGuard), governance (Governor, timelocks), or accounts (multisig, account abstraction) — into existing or new contracts. Covers pattern discovery from library source, CLI contract generators, and library-first integration. Supports Solidity, Cairo, Stylus, Stellar, and Sui Move."
 license: AGPL-3.0-only
 metadata:
   author: OpenZeppelin
@@ -18,7 +18,7 @@ For conceptual questions ("How does Ownable work?"), explain without generating
 
 Before generating code or suggesting changes:
 
-1. **Search the user's project** for existing contracts (`Glob` for `**/*.sol`, `**/*.cairo`, `**/*.rs`, etc.)
+1. **Search the user's project** for existing contracts (`Glob` for `**/*.sol`, `**/*.cairo`, `**/*.rs`, `**/*.move`, etc.)
 2. **Read the relevant contract files** to understand what already exists
 3. **Default to integration, not replacement** — when users say "add pausability" or "make it upgradeable", they mean modify their existing code, not generate something new. Only replace if explicitly requested ("start fresh", "replace this").
 
@@ -68,7 +68,7 @@ by reading dependency source code. Works for any ecosystem and any library versi
 ### Step 1: Identify Dependencies and Search the Library
 
 1. Search the project for contract files: `Glob` for `**/*.sol`, `**/*.cairo`, `**/*.rs`,
-   or the relevant extension from the lookup table below.
+   `**/*.move`, or the relevant extension from the lookup table below.
 2. Read import/use statements in existing contracts to identify which OpenZeppelin components
    are already in use.
 3. Locate the installed dependency in the project's dependency tree:
@@ -78,6 +78,8 @@ by reading dependency source code. Works for any ecosystem and any library versi
    - Stylus: resolve from `Cargo.toml` — source in `target/` or the cargo registry cache
      (`~/.cargo/registry/src/`)
    - Stellar: resolve from `Cargo.toml` — same cargo cache locations as Stylus
+   - Sui Move: resolve from `Move.toml` — after a build, the MVR source is cached under `~/.move/`
+     and mirrored per-dependency in `build/<project_package>/sources/dependencies/<move_package_name>/`
 4. Browse the dependency's directory listing to discover available components. Use `Glob`
    patterns against the installed source (e.g., `node_modules/@openzeppelin/contracts/**/*.sol`).
    Do not assume knowledge of the library's contents — always verify by listing directories.
@@ -137,6 +139,7 @@ between "contract without the feature" and "contract with the feature."
 | Cairo | [cairo-contracts](https://github.com/OpenZeppelin/cairo-contracts) | [docs.openzeppelin.com/contracts-cairo](https://docs.openzeppelin.com/contracts-cairo) | `.cairo` | Scarb cache (resolve from `Scarb.toml`) |
 | Stylus | [rust-contracts-stylus](https://github.com/OpenZeppelin/rust-contracts-stylus) | [docs.openzeppelin.com/contracts-stylus](https://docs.openzeppelin.com/contracts-stylus) | `.rs` | Cargo cache (`~/.cargo/registry/src/`) |
 | Stellar | [stellar-contracts](https://github.com/OpenZeppelin/stellar-contracts) ([Architecture](https://github.com/OpenZeppelin/stellar-contracts/blob/main/Architecture.md)) | [docs.openzeppelin.com/stellar-contracts](https://docs.openzeppelin.com/stellar-contracts) | `.rs` | Cargo cache (`~/.cargo/registry/src/`) |
+| Sui Move | [contracts-sui](https://github.com/OpenZeppelin/contracts-sui) ([llms.txt](https://raw.githubusercontent.com/OpenZeppelin/contracts-sui/main/llms.txt) · [ARCHITECTURE](https://raw.githubusercontent.com/OpenZeppelin/contracts-sui/main/ARCHITECTURE.md)) | [docs.openzeppelin.com/contracts-sui](https://docs.openzeppelin.com/contracts-sui) | `.move` | Move Registry cache (`~/.move/`, resolve from `Move.toml`) |
 
 ### Directory Structure Conventions
 
@@ -153,6 +156,8 @@ Where to find components within each repository:
 
 Browse these paths first when searching for a component.
 
+**Sui Move** isn't in this fixed grid and has no `@openzeppelin/contracts-cli` generator, so always use the pattern-discovery methodology above — adapt a package's `examples/` as the canonical integration recipe and import via MVR rather than copying source. Discover everything else (the package set, composition and style conventions, exact APIs, and the toolchain) from the library's own metadata, starting at [`llms.txt`](https://raw.githubusercontent.com/OpenZeppelin/contracts-sui/main/llms.txt); the `setup-sui-contracts` skill covers the full setup, dependency, `--build-env` build, and quality-gate flow.
+
 ### Known Version-Specific Considerations
 
 Do not assume override points from prior knowledge — always verify by reading the installed source. Functions that were `virtual` in an older version may no longer be in the current one, making them non-overridable. The source NatSpec will indicate the correct override point (e.g., `NOTE: This function is not virtual, {X} should be overridden instead`).