@mysten-incubation/devstack 0.0.0

package/dist/plugins/postgres/routable.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/postgres/routable.ts"],"sourcesContent":["// Postgres plugin — optional Routable TCP contribution.\n//\n// Postgres is a raw-TCP service (no HTTP, no virtual-host concept), so\n// it participates in the router via the `wireProtocol: 'tcp'` variant\n// of `RoutableDecl`. Effects:\n//\n//   - The router orchestrator writes a TCP file-provider entry that\n//     binds the `postgres-tcp` entrypoint port (5432 by default) and\n//     forwards raw TCP to the container's shared-network IP+port.\n//   - The endpoint shows up in the manifest under `postgres-tcp` so\n//     codegen / build-integrations can resolve `127.0.0.1:5432` as\n//     the host-side dial address.\n//\n// PARALLEL-STACK NOTE. TCP has no virtual-host equivalent — a TCP\n// entrypoint port can serve exactly ONE backend per Traefik container.\n// Two parallel stacks each contributing a TCP postgres Routable on\n// `postgres-tcp` will fail collision detection at `contributeRoute`\n// time. Stacks that need parallel postgres backends should set\n// `opts.route: false` and dial the container in-network directly\n// (`networkAlias:5432`).\n//\n// CORS is omitted by construction — the TCP variant of `RoutableDecl`\n// doesn't carry a `cors` field.\n\nimport type { EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\n/** Canonical endpoint name — matches this plugin's router entrypoint. */\nexport const POSTGRES_TCP_ENDPOINT_NAME = 'postgres-tcp' as const;\nexport const POSTGRES_TCP_ENTRYPOINT_PORT = 5432;\n\nexport const POSTGRES_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: POSTGRES_TCP_ENDPOINT_NAME, port: POSTGRES_TCP_ENTRYPOINT_PORT, protocol: 'tcp' },\n];\n\n/** Construct the Postgres TCP Routable decl.\n *\n *  The `containerName` is whatever name the postgres `ensureContainer`\n *  call uses for its container — the router's upstream resolver maps\n *  the key back to the container's shared-network IP at dispatch-file\n *  write time. */\nexport const makePostgresRoutable = (parts: {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly name: string;\n\treadonly containerName: string;\n}): RoutableDecl => ({\n\tkind: 'routable',\n\tendpointName: POSTGRES_TCP_ENDPOINT_NAME,\n\tdispatchId: {\n\t\t// Include the instance name for readable diagnostics; the router\n\t\t// hashes the full `(app, stack, serviceKey, role)` tuple before\n\t\t// writing the global dispatch file.\n\t\tserviceKey: `postgres.${parts.app}.${parts.stack}.${parts.name}`,\n\t\trole: parts.name,\n\t},\n\tupstream: {\n\t\ttype: 'container',\n\t\tcontainerName: parts.containerName,\n\t\tcontainerPort: POSTGRES_TCP_ENTRYPOINT_PORT,\n\t},\n\twireProtocol: 'tcp',\n});\n"],"mappings":";;AA2BA,MAAa,6BAA6B;AAC1C,MAAa,+BAA+B;AAE5C,MAAa,uBAAsD,CAClE;CAAE,MAAM;CAA4B,MAAM;CAA8B,UAAU;CAAO,CACzF;;;;;;;AAQD,MAAa,wBAAwB,WAKhB;CACpB,MAAM;CACN,cAAc;CACd,YAAY;EAIX,YAAY,YAAY,MAAM,IAAI,GAAG,MAAM,MAAM,GAAG,MAAM;EAC1D,MAAM,MAAM;EACZ;CACD,UAAU;EACT,MAAM;EACN,eAAe,MAAM;EACrB,eAAe;EACf;CACD,cAAc;CACd"}

package/dist/plugins/postgres/service.d.mts

@@ -0,0 +1,50 @@
+import { Duration, Effect, Scope } from "effect";
+
+//#region src/plugins/postgres/service.d.ts
+/** Resolved Postgres handle — the tag's resolved value.
+ *
+ *  Distilled doc § Outputs: consumers read this to compose
+ *  `DATABASE_URL` strings. `url(db)` is the per-database composer;
+ *  `endpoint` is the cluster-level credentialed URL; `plainEndpoint`
+ *  is the manifest-safe URL (no password). */
+interface Postgres {
+  readonly name: string;
+  readonly user: string;
+  /** Credential. Held in-memory on the resolved value; manifest
+   *  projection strips it. Logging convention: never `console.log`
+   *  the entire handle — log `plainEndpoint` instead. */
+  readonly password: string;
+  readonly host: string;
+  readonly port: number;
+  readonly databases: ReadonlyArray<string>;
+  /** Cluster-level credentialed URL. */
+  readonly endpoint: string;
+  /** Cluster-level no-credentials URL. Manifest-safe. */
+  readonly plainEndpoint: string;
+  /** Per-database credentialed URL composer. */
+  readonly url: (db: string) => string;
+  /** Per-stack docker network the container is joined to. */
+  readonly containerNetwork: string;
+  /** In-network DNS alias siblings dial. */
+  readonly networkAlias: string;
+}
+/** Service options. Defaults track distilled-doc recommendations:
+ *  postgres 17-alpine is the latest LTS-stable at the time of writing
+ *  (one major up from the v3 service's 16-alpine pin). */
+interface PostgresServiceOptions {
+  readonly name?: string;
+  readonly version?: string;
+  readonly user?: string;
+  readonly password?: string;
+  readonly databases?: ReadonlyArray<string>;
+  readonly hostPort?: number;
+  readonly extraNetworks?: ReadonlyArray<string>;
+  readonly readyTimeoutMs?: number;
+  /** WAL-flush budget on `docker stop`. Default 20s (matches the
+   *  sui-indexer-db sidecar in v3). 10s (docker default) risks
+   *  SIGKILL on busy DBs → recovery mode on next boot. */
+  readonly stopGraceSeconds?: number;
+}
+//#endregion
+export { Postgres, PostgresServiceOptions };
+//# sourceMappingURL=service.d.mts.map

package/dist/plugins/postgres/service.mjs

@@ -0,0 +1,145 @@
+import { expectNonEmptyArray } from "../../substrate/runtime/config-validation.mjs";
+import { ensureManagedContainer } from "../../substrate/runtime/managed-container.mjs";
+import { credentialedUrl, plainUrl, withDatabase } from "./connection.mjs";
+import { postgresConfigError, postgresPluginError } from "./errors.mjs";
+import { awaitReady, ensureDatabases } from "./db-ensure.mjs";
+import { Effect } from "effect";
+//#region src/plugins/postgres/service.ts
+const DEFAULT_VERSION = "17-alpine";
+const DEFAULT_USER = "devstack";
+const DEFAULT_DATABASES = ["devstack"];
+const DEFAULT_READY_TIMEOUT_MS = 3e4;
+const DEFAULT_STOP_GRACE_SECONDS = 20;
+const POSTGRES_PORT = 5432;
+/** Deterministic dev password from `(app, stack)`. Tradeoff
+*  documented in the distilled doc § Postgres-specific concerns:
+*  fine for a single-user dev tool, foot-gun if `hostPort` is set in
+*  a multi-user environment. The user-supplied `password` override on
+*  `PostgresServiceOptions` is the escape hatch. */
+const derivePassword = (app, stack) => `pg-${(app + stack).replace(/[^a-zA-Z0-9]/g, "")}`;
+const sanitizeAlias = (s) => s.replace(/[^a-zA-Z0-9-]/g, "-");
+/** Resolve user-supplied options against defaults + identity-derived
+*  values. Pure; safe to call before the Effect body runs. */
+const resolveOptions = (identity, opts) => {
+	const name = opts.name ?? "postgres";
+	const databases = expectNonEmptyArray(opts.databases ?? DEFAULT_DATABASES, {
+		field: "databases",
+		message: "postgres(): `databases` must be non-empty",
+		mkError: postgresConfigError
+	});
+	return {
+		name,
+		version: opts.version ?? DEFAULT_VERSION,
+		user: opts.user ?? DEFAULT_USER,
+		password: opts.password ?? derivePassword(identity.app, identity.stack),
+		databases,
+		hostPort: opts.hostPort,
+		extraNetworks: opts.extraNetworks ?? [],
+		readyTimeoutMs: opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,
+		stopGraceSeconds: opts.stopGraceSeconds ?? DEFAULT_STOP_GRACE_SECONDS
+	};
+};
+/** Resolve the vendored Dockerfile context path for THIS package.
+*
+*  The build context is the directory containing the Dockerfile
+*  (`<package>/images/postgres/`). We resolve it relative to this
+*  source file via `import.meta.url`, which works in both source
+*  (tsx) and built (.js) form because the layout is preserved.
+*
+*  Distilled doc § Open questions: long-term, this should move to
+*  the substrate's L1 image-build helper so all plugins resolve
+*  their build contexts the same way. For now, the resolution is
+*  local to the plugin. */
+const resolveImageContextPath = () => {
+	const here = new URL(import.meta.url);
+	const ctxUrl = new URL("../../../images/postgres/", here);
+	return decodeURIComponent(ctxUrl.pathname);
+};
+/** Build a `ContainerExec` view bound to a specific container handle.
+*  Thin adapter from the runtime's contract surface to the plugin's
+*  local exec seam. The runtime never promotes non-zero exit to
+*  failure here — the caller (pg_isready retry loop, createdb
+*  existence-check) decides. */
+const containerExec = (runtime, handle) => ({ run: (argv) => runtime.exec(handle, argv).pipe(Effect.catch((err) => Effect.succeed({
+	exitCode: 255,
+	stdout: "",
+	stderr: `runtime.exec failed: ${err.reason} — ${err.detail}`
+}))) });
+/** Boot the postgres service. The barrel composes this with the
+*  capability decls. */
+const bootPostgresService = (runtime, identity, opts) => Effect.gen(function* () {
+	const resolved = yield* Effect.try({
+		try: () => resolveOptions(identity, opts),
+		catch: (cause) => cause
+	});
+	const networkAlias = sanitizeAlias(`${resolved.name}-${identity.stack}`);
+	const containerNetwork = sanitizeAlias(`devstack-${identity.app}-${identity.stack}-postgres`);
+	yield* runtime.ensureNetwork({
+		name: containerNetwork,
+		app: identity.app,
+		stack: identity.stack
+	}).pipe(Effect.catch((cause) => Effect.fail(postgresPluginError("network-create", `failed to ensure postgres network '${containerNetwork}'`, cause))));
+	const imageRef = yield* runtime.ensureImage({
+		contextPath: resolveImageContextPath(),
+		dockerfile: "Dockerfile",
+		buildArgs: { POSTGRES_VERSION: resolved.version }
+	}).pipe(Effect.catch((cause) => Effect.fail(postgresPluginError("image-build", `failed to build postgres image (${resolved.version})`, cause))));
+	const containerHandle = yield* ensureManagedContainer({
+		runtime,
+		identity,
+		plugin: "postgres",
+		role: resolved.name,
+		spec: {
+			name: `${identity.app}-${identity.stack}-${resolved.name}`,
+			image: imageRef,
+			recreate: "on-config-change",
+			env: {
+				POSTGRES_USER: resolved.user,
+				POSTGRES_PASSWORD: resolved.password,
+				POSTGRES_DB: resolved.databases[0]
+			},
+			ports: resolved.hostPort !== void 0 ? [{
+				containerPort: POSTGRES_PORT,
+				hostPort: resolved.hostPort
+			}] : void 0,
+			stopGraceSeconds: resolved.stopGraceSeconds,
+			networkAttach: [containerNetwork, ...resolved.extraNetworks]
+		},
+		mapError: (cause) => postgresPluginError("container-start", `failed to start postgres container '${resolved.name}'`, cause)
+	});
+	const exec = containerExec(runtime, containerHandle);
+	yield* awaitReady(exec, resolved.user, resolved.databases[0], resolved.readyTimeoutMs);
+	yield* ensureDatabases(exec, resolved.user, resolved.databases);
+	const dnsName = `${identity.app}-${identity.stack}-${resolved.name}`;
+	const endpoint = credentialedUrl({
+		user: resolved.user,
+		password: resolved.password,
+		host: dnsName,
+		port: POSTGRES_PORT
+	});
+	const plainEndpoint = plainUrl(dnsName, POSTGRES_PORT);
+	return {
+		resolved,
+		handle: {
+			name: resolved.name,
+			user: resolved.user,
+			password: resolved.password,
+			host: dnsName,
+			port: POSTGRES_PORT,
+			databases: resolved.databases,
+			endpoint,
+			plainEndpoint,
+			url: (db) => withDatabase(endpoint, db),
+			containerNetwork,
+			networkAlias
+		},
+		containerHandle
+	};
+}).pipe(Effect.withSpan("postgres.boot", { attributes: {
+	"postgres.name": opts.name ?? "postgres",
+	"postgres.version": opts.version ?? DEFAULT_VERSION
+} }));
+//#endregion
+export { bootPostgresService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/plugins/postgres/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/postgres/service.ts"],"sourcesContent":["// Postgres plugin — service body (real boot).\n//\n// Lifecycle (distilled doc § Lifecycle states):\n//   1. Pre-start: identity (app + stack) resolved, deterministic\n//      strings (network name, alias, default password) computed.\n//   2. Per-stack docker network ensured (idempotent; survives the\n//      cycle that creates it).\n//   3. Vendored image ensured. The Dockerfile at\n//      `<package>/images/postgres/Dockerfile` does ONE thing:\n//      `ENV PGDATA=/var/lib/postgresql/data-devstack` so writes land in\n//      the container's writable layer rather than the upstream\n//      `VOLUME /var/lib/postgresql/data` path (which `docker commit`\n//      excludes). This is the single load-bearing invariant for\n//      snapshot integrity.\n//   4. Container started with `POSTGRES_USER` / `POSTGRES_PASSWORD` /\n//      `POSTGRES_DB` env. Joined to the per-stack network under a\n//      deterministic alias. Optional host-port publication.\n//   5. `pg_isready` retry loop runs against the bootstrap database\n//      via `runtime.exec`, bounded by `readyTimeoutMs`.\n//   6. Subsequent databases ensured idempotently via `psql -tAc`\n//      existence-check + `createdb`.\n//   7. Resolved `Postgres` handle returned. The substrate's outer\n//      machinery publishes the manifest projection (plain URL only).\n//\n// What this file does NOT do:\n//   - Pause/unpause around `docker commit` — engine-level (snapshot\n//     orchestrator walks `managedContainers` labels emitted by\n//     `snapshot.ts` and pauses them).\n//   - Manage schema migrations or run init SQL — schema is plugin-\n//     owned by consumers (distilled doc § Generic database-service\n//     requirements: \"no migrations, no init SQL, no schema\n//     management\").\n//   - Register the stop finalizer — `ContainerRuntime.ensureContainer`\n//     owns the container's scope finalizer. The 20s WAL-flush grace is\n//     threaded into the container spec so Docker does not escalate busy\n//     databases at the runtime default.\n\nimport { Duration, Effect, type Scope } from 'effect';\n\nimport type { ContainerHandle, ContainerRuntime } from '../../contracts/container-runtime.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport { expectNonEmptyArray } from '../../substrate/runtime/config-validation.ts';\nimport { ensureManagedContainer } from '../../substrate/runtime/managed-container.ts';\nimport {\n\tcredentialedUrl,\n\tplainUrl,\n\twithDatabase,\n\ttype PostgresConnectionParts,\n} from './connection.ts';\nimport { awaitReady, ensureDatabases, type ContainerExec } from './db-ensure.ts';\nimport {\n\tpostgresPluginError,\n\tpostgresConfigError,\n\ttype DatabaseCreateFailed,\n\ttype PostgresConfigError,\n\ttype PostgresConnectionTimeout,\n\ttype PostgresPluginError,\n} from './errors.ts';\n\n/** Resolved Postgres handle — the tag's resolved value.\n *\n *  Distilled doc § Outputs: consumers read this to compose\n *  `DATABASE_URL` strings. `url(db)` is the per-database composer;\n *  `endpoint` is the cluster-level credentialed URL; `plainEndpoint`\n *  is the manifest-safe URL (no password). */\nexport interface Postgres {\n\treadonly name: string;\n\treadonly user: string;\n\t/** Credential. Held in-memory on the resolved value; manifest\n\t *  projection strips it. Logging convention: never `console.log`\n\t *  the entire handle — log `plainEndpoint` instead. */\n\treadonly password: string;\n\treadonly host: string;\n\treadonly port: number;\n\treadonly databases: ReadonlyArray<string>;\n\t/** Cluster-level credentialed URL. */\n\treadonly endpoint: string;\n\t/** Cluster-level no-credentials URL. Manifest-safe. */\n\treadonly plainEndpoint: string;\n\t/** Per-database credentialed URL composer. */\n\treadonly url: (db: string) => string;\n\t/** Per-stack docker network the container is joined to. */\n\treadonly containerNetwork: string;\n\t/** In-network DNS alias siblings dial. */\n\treadonly networkAlias: string;\n}\n\n/** Service options. Defaults track distilled-doc recommendations:\n *  postgres 17-alpine is the latest LTS-stable at the time of writing\n *  (one major up from the v3 service's 16-alpine pin). */\nexport interface PostgresServiceOptions {\n\treadonly name?: string;\n\treadonly version?: string;\n\treadonly user?: string;\n\treadonly password?: string;\n\treadonly databases?: ReadonlyArray<string>;\n\treadonly hostPort?: number;\n\treadonly extraNetworks?: ReadonlyArray<string>;\n\treadonly readyTimeoutMs?: number;\n\t/** WAL-flush budget on `docker stop`. Default 20s (matches the\n\t *  sui-indexer-db sidecar in v3). 10s (docker default) risks\n\t *  SIGKILL on busy DBs → recovery mode on next boot. */\n\treadonly stopGraceSeconds?: number;\n}\n\n/** Internal canonicalised options after defaults applied. */\nexport interface ResolvedPostgresOptions {\n\treadonly name: string;\n\treadonly version: string;\n\treadonly user: string;\n\treadonly password: string;\n\treadonly databases: ReadonlyArray<string>;\n\treadonly hostPort: number | undefined;\n\treadonly extraNetworks: ReadonlyArray<string>;\n\treadonly readyTimeoutMs: number;\n\treadonly stopGraceSeconds: number;\n}\n\nconst DEFAULT_VERSION = '17-alpine';\nconst DEFAULT_USER = 'devstack';\nconst DEFAULT_DATABASES = ['devstack'] as const;\nconst DEFAULT_READY_TIMEOUT_MS = 30_000;\nconst DEFAULT_STOP_GRACE_SECONDS = 20;\nconst POSTGRES_PORT = 5432;\n\n/** Deterministic dev password from `(app, stack)`. Tradeoff\n *  documented in the distilled doc § Postgres-specific concerns:\n *  fine for a single-user dev tool, foot-gun if `hostPort` is set in\n *  a multi-user environment. The user-supplied `password` override on\n *  `PostgresServiceOptions` is the escape hatch. */\nconst derivePassword = (app: string, stack: string): string =>\n\t`pg-${(app + stack).replace(/[^a-zA-Z0-9]/g, '')}`;\n\nconst sanitizeAlias = (s: string): string => s.replace(/[^a-zA-Z0-9-]/g, '-');\n\n/** Resolve user-supplied options against defaults + identity-derived\n *  values. Pure; safe to call before the Effect body runs. */\nexport const resolveOptions = (\n\tidentity: Identity,\n\topts: PostgresServiceOptions,\n): ResolvedPostgresOptions => {\n\tconst name = opts.name ?? 'postgres';\n\tconst databases = expectNonEmptyArray(opts.databases ?? DEFAULT_DATABASES, {\n\t\tfield: 'databases',\n\t\tmessage: 'postgres(): `databases` must be non-empty',\n\t\tmkError: postgresConfigError,\n\t});\n\treturn {\n\t\tname,\n\t\tversion: opts.version ?? DEFAULT_VERSION,\n\t\tuser: opts.user ?? DEFAULT_USER,\n\t\tpassword: opts.password ?? derivePassword(identity.app, identity.stack),\n\t\tdatabases,\n\t\thostPort: opts.hostPort,\n\t\textraNetworks: opts.extraNetworks ?? [],\n\t\treadyTimeoutMs: opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,\n\t\tstopGraceSeconds: opts.stopGraceSeconds ?? DEFAULT_STOP_GRACE_SECONDS,\n\t};\n};\n\n/** Bundled boot result for the barrel. The dynamic-capability factory\n *  projects resolved options + identity-derived strings onto the\n *  snapshot + codegen decls. */\nexport interface PostgresBootResult {\n\treadonly resolved: ResolvedPostgresOptions;\n\treadonly handle: Postgres;\n\treadonly containerHandle: ContainerHandle;\n}\n\n/** Resolve the vendored Dockerfile context path for THIS package.\n *\n *  The build context is the directory containing the Dockerfile\n *  (`<package>/images/postgres/`). We resolve it relative to this\n *  source file via `import.meta.url`, which works in both source\n *  (tsx) and built (.js) form because the layout is preserved.\n *\n *  Distilled doc § Open questions: long-term, this should move to\n *  the substrate's L1 image-build helper so all plugins resolve\n *  their build contexts the same way. For now, the resolution is\n *  local to the plugin. */\nconst resolveImageContextPath = (): string => {\n\t// `import.meta.url` is the URL of this module file. From\n\t// `<pkg>/src/plugins/postgres/service.ts` we walk up three\n\t// directories (`plugins/`, `src/`, `<pkg>/`) and then down into\n\t// `images/postgres/`.\n\tconst here = new URL(import.meta.url);\n\tconst ctxUrl = new URL('../../../images/postgres/', here);\n\t// File: URLs need decoding back to a host path for the docker CLI.\n\treturn decodeURIComponent(ctxUrl.pathname);\n};\n\n/** Build a `ContainerExec` view bound to a specific container handle.\n *  Thin adapter from the runtime's contract surface to the plugin's\n *  local exec seam. The runtime never promotes non-zero exit to\n *  failure here — the caller (pg_isready retry loop, createdb\n *  existence-check) decides. */\nconst containerExec = (runtime: ContainerRuntime, handle: ContainerHandle): ContainerExec => ({\n\trun: (argv) =>\n\t\truntime.exec(handle, argv).pipe(\n\t\t\t// Daemon-level failures (no such container, daemon\n\t\t\t// unreachable) collapse to a synthetic non-zero ExecResult\n\t\t\t// so the retry loop sees them and the typed timeout error\n\t\t\t// carries the daemon stderr as `lastStderr` for the cause\n\t\t\t// walker. We do NOT surface ContainerRuntimeError here —\n\t\t\t// the plugin's typed errors are the only failure shapes\n\t\t\t// `awaitReady` / `ensureDatabases` produce, and they\n\t\t\t// already carry the captured streams.\n\t\t\tEffect.catch((err) =>\n\t\t\t\tEffect.succeed({\n\t\t\t\t\texitCode: 255,\n\t\t\t\t\tstdout: '',\n\t\t\t\t\tstderr: `runtime.exec failed: ${err.reason} — ${err.detail}`,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n});\n\n/** Boot the postgres service. The barrel composes this with the\n *  capability decls. */\nexport const bootPostgresService = (\n\truntime: ContainerRuntime,\n\tidentity: Identity,\n\topts: PostgresServiceOptions,\n): Effect.Effect<\n\tPostgresBootResult,\n\tPostgresPluginError | PostgresConfigError | PostgresConnectionTimeout | DatabaseCreateFailed,\n\tScope.Scope\n> =>\n\tEffect.gen(function* () {\n\t\tconst resolved = yield* Effect.try({\n\t\t\ttry: () => resolveOptions(identity, opts),\n\t\t\tcatch: (cause) => cause as PostgresConfigError,\n\t\t});\n\n\t\t// Identity-derived strings. The naming pattern must match what\n\t\t// snapshot label-discovery uses — both call sites converge on\n\t\t// `(app, stack, plugin='postgres', role=<name>)`.\n\t\tconst networkAlias = sanitizeAlias(`${resolved.name}-${identity.stack}`);\n\t\tconst containerNetwork = sanitizeAlias(`devstack-${identity.app}-${identity.stack}-postgres`);\n\n\t\t// 1. Ensure the per-stack docker network. Idempotent — no-op\n\t\t//    if the network already exists (warm resume).\n\t\tyield* runtime\n\t\t\t.ensureNetwork({\n\t\t\t\tname: containerNetwork,\n\t\t\t\tapp: identity.app,\n\t\t\t\tstack: identity.stack,\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\tpostgresPluginError(\n\t\t\t\t\t\t\t'network-create',\n\t\t\t\t\t\t\t`failed to ensure postgres network '${containerNetwork}'`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\n\t\t// 2. Ensure the vendored image. The Dockerfile sets PGDATA off\n\t\t//    the upstream VOLUME path so the writable layer captures\n\t\t//    PGDATA — the single load-bearing snapshot invariant\n\t\t//    (distilled doc § Postgres-specific concerns).\n\t\tconst imageRef = yield* runtime\n\t\t\t.ensureImage({\n\t\t\t\tcontextPath: resolveImageContextPath(),\n\t\t\t\tdockerfile: 'Dockerfile',\n\t\t\t\tbuildArgs: { POSTGRES_VERSION: resolved.version },\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\tpostgresPluginError(\n\t\t\t\t\t\t\t'image-build',\n\t\t\t\t\t\t\t`failed to build postgres image (${resolved.version})`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\n\t\t// 3. Start container. `networkAttach`'s first entry becomes the\n\t\t//    `--network` flag on `docker run -d`; subsequent entries\n\t\t//    are attached post-start with IP-readback (runtime owns\n\t\t//    that detail).\n\t\t//\n\t\t//    The runtime adapter does NOT yet thread the in-network\n\t\t//    alias through `--network-alias`; the network alias the\n\t\t//    handle exposes is the architecture-mandated value, but\n\t\t//    siblings should dial by `name` (the container name)\n\t\t//    which docker also publishes under the network. The\n\t\t//    architecture revision to add `networkAlias` to\n\t\t//    EnsureContainerSpec is flagged in `index.ts`.\n\t\tconst containerHandle = yield* ensureManagedContainer({\n\t\t\truntime,\n\t\t\tidentity,\n\t\t\tplugin: 'postgres',\n\t\t\trole: resolved.name,\n\t\t\tspec: {\n\t\t\t\tname: `${identity.app}-${identity.stack}-${resolved.name}`,\n\t\t\t\timage: imageRef,\n\t\t\t\trecreate: 'on-config-change',\n\t\t\t\tenv: {\n\t\t\t\t\tPOSTGRES_USER: resolved.user,\n\t\t\t\t\tPOSTGRES_PASSWORD: resolved.password,\n\t\t\t\t\tPOSTGRES_DB: resolved.databases[0]!,\n\t\t\t\t},\n\t\t\t\tports:\n\t\t\t\t\tresolved.hostPort !== undefined\n\t\t\t\t\t\t? [{ containerPort: POSTGRES_PORT, hostPort: resolved.hostPort }]\n\t\t\t\t\t\t: undefined,\n\t\t\t\tstopGraceSeconds: resolved.stopGraceSeconds,\n\t\t\t\tnetworkAttach: [containerNetwork, ...resolved.extraNetworks],\n\t\t\t},\n\t\t\tmapError: (cause) =>\n\t\t\t\tpostgresPluginError(\n\t\t\t\t\t'container-start',\n\t\t\t\t\t`failed to start postgres container '${resolved.name}'`,\n\t\t\t\t\tcause,\n\t\t\t\t),\n\t\t});\n\n\t\t// 4. Probe readiness via `pg_isready` against the bootstrap\n\t\t//    database. Server-aware probe — distilled doc § Postgres-\n\t\t//    specific concerns: TCP-listener readiness alone is\n\t\t//    insufficient (postgres opens the port before accepting\n\t\t//    queries).\n\t\tconst exec = containerExec(runtime, containerHandle);\n\t\tyield* awaitReady(exec, resolved.user, resolved.databases[0]!, resolved.readyTimeoutMs);\n\n\t\t// 5. Ensure subsequent databases idempotently. The bootstrap\n\t\t//    database (index 0) is image-entrypoint-created via\n\t\t//    POSTGRES_DB and skipped by `ensureDatabases`.\n\t\tyield* ensureDatabases(exec, resolved.user, resolved.databases);\n\n\t\t// 6. Resolve the handle. Host for in-stack siblings is the\n\t\t//    container name (which docker registers as a DNS entry on\n\t\t//    the attached network). When the substrate's\n\t\t//    `networkAlias` plumbing lands we'll swap to that; until\n\t\t//    then the container name is the stable in-network handle.\n\t\tconst dnsName = `${identity.app}-${identity.stack}-${resolved.name}`;\n\t\tconst parts: PostgresConnectionParts = {\n\t\t\tuser: resolved.user,\n\t\t\tpassword: resolved.password,\n\t\t\thost: dnsName,\n\t\t\tport: POSTGRES_PORT,\n\t\t};\n\t\tconst endpoint = credentialedUrl(parts);\n\t\tconst plainEndpoint = plainUrl(dnsName, POSTGRES_PORT);\n\n\t\tconst handle: Postgres = {\n\t\t\tname: resolved.name,\n\t\t\tuser: resolved.user,\n\t\t\tpassword: resolved.password,\n\t\t\thost: dnsName,\n\t\t\tport: POSTGRES_PORT,\n\t\t\tdatabases: resolved.databases,\n\t\t\tendpoint,\n\t\t\tplainEndpoint,\n\t\t\turl: (db) => withDatabase(endpoint, db),\n\t\t\tcontainerNetwork,\n\t\t\tnetworkAlias,\n\t\t};\n\n\t\treturn { resolved, handle, containerHandle };\n\t}).pipe(\n\t\tEffect.withSpan('postgres.boot', {\n\t\t\tattributes: {\n\t\t\t\t'postgres.name': opts.name ?? 'postgres',\n\t\t\t\t'postgres.version': opts.version ?? DEFAULT_VERSION,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Stop-grace duration. The substrate's finalizer plumbing reads this\n *  to set the docker-stop SIGTERM→SIGKILL window. 20s default avoids\n *  busy-DB SIGKILL → recovery-mode on next boot. */\nexport const stopGrace = (resolved: ResolvedPostgresOptions): Duration.Duration =>\n\tDuration.seconds(resolved.stopGraceSeconds);\n"],"mappings":";;;;;;;AAsHA,MAAM,kBAAkB;AACxB,MAAM,eAAe;AACrB,MAAM,oBAAoB,CAAC,WAAW;AACtC,MAAM,2BAA2B;AACjC,MAAM,6BAA6B;AACnC,MAAM,gBAAgB;;;;;;AAOtB,MAAM,kBAAkB,KAAa,UACpC,OAAO,MAAM,OAAO,QAAQ,iBAAiB,GAAG;AAEjD,MAAM,iBAAiB,MAAsB,EAAE,QAAQ,kBAAkB,IAAI;;;AAI7E,MAAa,kBACZ,UACA,SAC6B;CAC7B,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,YAAY,oBAAoB,KAAK,aAAa,mBAAmB;EAC1E,OAAO;EACP,SAAS;EACT,SAAS;EACT,CAAC;AACF,QAAO;EACN;EACA,SAAS,KAAK,WAAW;EACzB,MAAM,KAAK,QAAQ;EACnB,UAAU,KAAK,YAAY,eAAe,SAAS,KAAK,SAAS,MAAM;EACvE;EACA,UAAU,KAAK;EACf,eAAe,KAAK,iBAAiB,EAAE;EACvC,gBAAgB,KAAK,kBAAkB;EACvC,kBAAkB,KAAK,oBAAoB;EAC3C;;;;;;;;;;;;;AAuBF,MAAM,gCAAwC;CAK7C,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,IAAI;CACrC,MAAM,SAAS,IAAI,IAAI,6BAA6B,KAAK;AAEzD,QAAO,mBAAmB,OAAO,SAAS;;;;;;;AAQ3C,MAAM,iBAAiB,SAA2B,YAA4C,EAC7F,MAAM,SACL,QAAQ,KAAK,QAAQ,KAAK,CAAC,KAS1B,OAAO,OAAO,QACb,OAAO,QAAQ;CACd,UAAU;CACV,QAAQ;CACR,QAAQ,wBAAwB,IAAI,OAAO,KAAK,IAAI;CACpD,CAAC,CACF,CACD,EACF;;;AAID,MAAa,uBACZ,SACA,UACA,SAMA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,OAAO,OAAO,IAAI;EAClC,WAAW,eAAe,UAAU,KAAK;EACzC,QAAQ,UAAU;EAClB,CAAC;CAKF,MAAM,eAAe,cAAc,GAAG,SAAS,KAAK,GAAG,SAAS,QAAQ;CACxE,MAAM,mBAAmB,cAAc,YAAY,SAAS,IAAI,GAAG,SAAS,MAAM,WAAW;AAI7F,QAAO,QACL,cAAc;EACd,MAAM;EACN,KAAK,SAAS;EACd,OAAO,SAAS;EAChB,CAAC,CACD,KACA,OAAO,OAAO,UACb,OAAO,KACN,oBACC,kBACA,sCAAsC,iBAAiB,IACvD,MACA,CACD,CACD,CACD;CAMF,MAAM,WAAW,OAAO,QACtB,YAAY;EACZ,aAAa,yBAAyB;EACtC,YAAY;EACZ,WAAW,EAAE,kBAAkB,SAAS,SAAS;EACjD,CAAC,CACD,KACA,OAAO,OAAO,UACb,OAAO,KACN,oBACC,eACA,mCAAmC,SAAS,QAAQ,IACpD,MACA,CACD,CACD,CACD;CAcF,MAAM,kBAAkB,OAAO,uBAAuB;EACrD;EACA;EACA,QAAQ;EACR,MAAM,SAAS;EACf,MAAM;GACL,MAAM,GAAG,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,SAAS;GACpD,OAAO;GACP,UAAU;GACV,KAAK;IACJ,eAAe,SAAS;IACxB,mBAAmB,SAAS;IAC5B,aAAa,SAAS,UAAU;IAChC;GACD,OACC,SAAS,aAAa,KAAA,IACnB,CAAC;IAAE,eAAe;IAAe,UAAU,SAAS;IAAU,CAAC,GAC/D,KAAA;GACJ,kBAAkB,SAAS;GAC3B,eAAe,CAAC,kBAAkB,GAAG,SAAS,cAAc;GAC5D;EACD,WAAW,UACV,oBACC,mBACA,uCAAuC,SAAS,KAAK,IACrD,MACA;EACF,CAAC;CAOF,MAAM,OAAO,cAAc,SAAS,gBAAgB;AACpD,QAAO,WAAW,MAAM,SAAS,MAAM,SAAS,UAAU,IAAK,SAAS,eAAe;AAKvF,QAAO,gBAAgB,MAAM,SAAS,MAAM,SAAS,UAAU;CAO/D,MAAM,UAAU,GAAG,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,SAAS;CAO9D,MAAM,WAAW,gBAAgB;EALhC,MAAM,SAAS;EACf,UAAU,SAAS;EACnB,MAAM;EACN,MAAM;EAE+B,CAAC;CACvC,MAAM,gBAAgB,SAAS,SAAS,cAAc;AAgBtD,QAAO;EAAE;EAAU,QAAA;GAblB,MAAM,SAAS;GACf,MAAM,SAAS;GACf,UAAU,SAAS;GACnB,MAAM;GACN,MAAM;GACN,WAAW,SAAS;GACpB;GACA;GACA,MAAM,OAAO,aAAa,UAAU,GAAG;GACvC;GACA;GAGwB;EAAE;EAAiB;EAC3C,CAAC,KACF,OAAO,SAAS,iBAAiB,EAChC,YAAY;CACX,iBAAiB,KAAK,QAAQ;CAC9B,oBAAoB,KAAK,WAAW;CACpC,EACD,CAAC,CACF"}

package/dist/plugins/postgres/snapshot.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/plugins/postgres/snapshot.mjs

@@ -0,0 +1,32 @@
+import { Effect } from "effect";
+//#region src/plugins/postgres/snapshot.ts
+/** Build the Snapshotable contribution.
+*
+*  Container-bearing only; no host-side subtree. Postgres's entire
+*  state lives in the container's writable layer at the relocated
+*  `PGDATA` (see `service.ts` for the image build context). */
+const makeSnapshotable = (opts) => {
+	const labels = {
+		app: opts.app,
+		stack: opts.stack,
+		plugin: "postgres",
+		role: opts.name
+	};
+	const identity = {
+		kind: "postgres-server",
+		name: opts.name,
+		databases: Object.freeze([...opts.databases].sort())
+	};
+	return {
+		kind: "snapshotable",
+		subtrees: [],
+		managedContainers: [labels],
+		missingTolerance: "fine",
+		preRestore: Effect.succeed(identity),
+		postRestore: Effect.void
+	};
+};
+//#endregion
+export { makeSnapshotable };
+
+//# sourceMappingURL=snapshot.mjs.map

package/dist/plugins/postgres/snapshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/postgres/snapshot.ts"],"sourcesContent":["// Postgres plugin — Snapshotable contribution.\n//\n// Architecture §3: the snapshot orchestrator captures and restores\n// without naming the plugin. Postgres's contribution is the\n// container's writable layer — image-commit captures PGDATA only\n// because the vendored image relocates `PGDATA` OFF the upstream\n// `VOLUME /var/lib/postgresql/data` (which docker commit excludes).\n//\n// Identity contribution (distilled doc § Postgres-specific concerns +\n// architecture identity-guard pattern): the postgres \"server\n// identifier\" doubles as a guard. On restore we compare the\n// snapshot's stored postgres identity (server name + the set of\n// requested databases) against the resolver's current answer; if\n// the user pointed at a different cluster shape mid-cycle, the\n// identity-guard refuses BEFORE any destructive mutation.\n//\n// Stop-grace (distilled doc § Postgres-specific concerns): the service\n// threads a 20s Docker stop grace into the container spec, matching the\n// sui-indexer-db sidecar for the same image. This file's `quiesce`\n// Effect is intentionally `Effect.void` (the substrate engine pauses the\n// container around `docker commit`); the plugin only contributes the\n// LABEL TUPLE that lets the engine find it.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\n/** Identity payload contributed to the substrate's identity-guard.\n *  The substrate's pre-restore hook reads this; identity mismatch\n *  refuses the restore. Server name + ordered database list is the\n *  smallest tuple that distinguishes a postgres instance for snapshot\n *  purposes — image tag / version is intentionally NOT part of\n *  identity (a minor-version bump should restore cleanly). */\nexport interface PostgresIdentityPayload {\n\treadonly kind: 'postgres-server';\n\treadonly name: string;\n\treadonly databases: ReadonlyArray<string>;\n}\n\nexport interface MakeSnapshotableOptions {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly name: string;\n\treadonly databases: ReadonlyArray<string>;\n}\n\n/** Build the Snapshotable contribution.\n *\n *  Container-bearing only; no host-side subtree. Postgres's entire\n *  state lives in the container's writable layer at the relocated\n *  `PGDATA` (see `service.ts` for the image build context). */\nexport const makeSnapshotable = (opts: MakeSnapshotableOptions): SnapshotableDecl => {\n\tconst labels: ContainerLabelTuple = {\n\t\tapp: opts.app,\n\t\tstack: opts.stack,\n\t\tplugin: 'postgres',\n\t\trole: opts.name,\n\t};\n\n\tconst identity: PostgresIdentityPayload = {\n\t\tkind: 'postgres-server',\n\t\tname: opts.name,\n\t\t// Frozen list so the identity payload is structurally stable\n\t\t// across calls — the substrate hashes it for comparison.\n\t\tdatabases: Object.freeze([...opts.databases].sort()) as ReadonlyArray<string>,\n\t};\n\n\treturn {\n\t\tkind: 'snapshotable',\n\t\t// No host-tree subtree — all state lives in the container.\n\t\tsubtrees: [],\n\t\tmanagedContainers: [labels],\n\t\t// Engine-level pause-around-commit handles quiescence; the\n\t\t// plugin's contribution is just the label tuple above.\n\t\tmissingTolerance: 'fine',\n\t\tpreRestore: Effect.succeed(identity),\n\t\tpostRestore: Effect.void,\n\t};\n};\n"],"mappings":";;;;;;;AAmDA,MAAa,oBAAoB,SAAoD;CACpF,MAAM,SAA8B;EACnC,KAAK,KAAK;EACV,OAAO,KAAK;EACZ,QAAQ;EACR,MAAM,KAAK;EACX;CAED,MAAM,WAAoC;EACzC,MAAM;EACN,MAAM,KAAK;EAGX,WAAW,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,MAAM,CAAC;EACpD;AAED,QAAO;EACN,MAAM;EAEN,UAAU,EAAE;EACZ,mBAAmB,CAAC,OAAO;EAG3B,kBAAkB;EAClB,YAAY,OAAO,QAAQ,SAAS;EACpC,aAAa,OAAO;EACpB"}

package/dist/plugins/router-entrypoints.mjs

@@ -0,0 +1,21 @@
+import { SUI_ENTRYPOINTS } from "./sui/routable.mjs";
+import { HOST_SERVICE_ENTRYPOINTS } from "./host-service/routable.mjs";
+import { WALLET_ENTRYPOINTS } from "./wallet/routable.mjs";
+import { DEEPBOOK_ENTRYPOINTS } from "./deepbook/routable.mjs";
+import { POSTGRES_ENTRYPOINTS } from "./postgres/routable.mjs";
+import { SEAL_ENTRYPOINTS } from "./seal/routable.mjs";
+import { WALRUS_ENTRYPOINTS } from "./walrus/routable.mjs";
+//#region src/plugins/router-entrypoints.ts
+const BUILT_IN_ENTRYPOINTS = [
+	...SUI_ENTRYPOINTS,
+	...HOST_SERVICE_ENTRYPOINTS,
+	...WALLET_ENTRYPOINTS,
+	...WALRUS_ENTRYPOINTS,
+	...SEAL_ENTRYPOINTS,
+	...DEEPBOOK_ENTRYPOINTS,
+	...POSTGRES_ENTRYPOINTS
+];
+//#endregion
+export { BUILT_IN_ENTRYPOINTS };
+
+//# sourceMappingURL=router-entrypoints.mjs.map

package/dist/plugins/router-entrypoints.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"router-entrypoints.mjs","names":[],"sources":["../../src/plugins/router-entrypoints.ts"],"sourcesContent":["// Built-in plugin router entrypoints.\n//\n// The router orchestrator owns registry validation and collision checks.\n// Built-in plugins own their public listener names and ports.\n\nimport type { EntrypointDecl } from '../contracts/routable.ts';\nimport { DEEPBOOK_ENTRYPOINTS } from './deepbook/routable.ts';\nimport { HOST_SERVICE_ENTRYPOINTS } from './host-service/routable.ts';\nimport { POSTGRES_ENTRYPOINTS } from './postgres/routable.ts';\nimport { SEAL_ENTRYPOINTS } from './seal/routable.ts';\nimport { SUI_ENTRYPOINTS } from './sui/routable.ts';\nimport { WALLET_ENTRYPOINTS } from './wallet/routable.ts';\nimport { WALRUS_ENTRYPOINTS } from './walrus/routable.ts';\n\nexport const BUILT_IN_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t...SUI_ENTRYPOINTS,\n\t...HOST_SERVICE_ENTRYPOINTS,\n\t...WALLET_ENTRYPOINTS,\n\t...WALRUS_ENTRYPOINTS,\n\t...SEAL_ENTRYPOINTS,\n\t...DEEPBOOK_ENTRYPOINTS,\n\t...POSTGRES_ENTRYPOINTS,\n];\n"],"mappings":";;;;;;;;AAcA,MAAa,uBAAsD;CAClE,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH"}

package/dist/plugins/seal/bootstrap-assets/cargo-image.mjs

@@ -0,0 +1,59 @@
+import { sealError } from "../errors.mjs";
+import { DEFAULT_SEAL_REPO, DEFAULT_SEAL_VERSION } from "./source-fetch.mjs";
+import { Effect } from "effect";
+//#region src/plugins/seal/bootstrap-assets/cargo-image.ts
+/** Pinned rust toolchain for the upstream seal cargo build. Distilled-
+*  doc §Configuration defaults block. Pinned to match walrus's default
+*  so a shared rust:1.93 builder image can fan out builds. */
+const DEFAULT_SEAL_RUST_TOOLCHAIN = "1.93";
+/** Resolve the seal image. Two staged paths:
+*
+*   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked
+*        registry tag (or a locally-built fixture image like
+*        `seal-test-stub:latest`). Skips the docker build entirely
+*        and returns a bare `ImageRef` synthesized from the override
+*        tag. CI bakes the image once + pins the tag; the local-
+*        keygen boot just reads the env.
+*
+*   (b) Real build via `runtime.ensureImage` against the vendored
+*        Dockerfile at `packages/devstack/images/seal/`. The
+*        Dockerfile is a binary-fetch path (NOT a cargo compile) —
+*        the seal release workflow ships pre-built per-platform
+*        binaries (`seal-cli`, `key-server`) and we just fetch +
+*        package them. Build is content-addressed by docker; same
+*        Dockerfile + same SEAL_VERSION → same image hash. */
+const resolveSealCargoImage = (runtime, inputs) => Effect.gen(function* () {
+	const override = globalThis.process?.env?.SEAL_CARGO_IMAGE_OVERRIDE;
+	if (override && override.length > 0) return {
+		digest: override,
+		tag: override
+	};
+	const buildCtx = {
+		contextPath: new URL("../../../../images/", import.meta.url).pathname,
+		dockerfile: "seal/Dockerfile",
+		fingerprintPaths: [
+			"seal/Dockerfile",
+			"seal/entrypoint.sh",
+			"_shared/signal-forward.sh"
+		],
+		buildArgs: { SEAL_VERSION: inputs.sealRef }
+	};
+	return yield* runtime.ensureImage(buildCtx).pipe(Effect.mapError((cause) => sealError("image", {
+		name: "seal",
+		message: `seal image build failed: ${cause.reason}: ${cause.detail}. SEAL_VERSION=${inputs.sealRef} (from ${inputs.sealRepo}/releases). Set SEAL_CARGO_IMAGE_OVERRIDE=<tag> to bypass the build.`,
+		cause
+	})));
+}).pipe(Effect.withSpan("devstack.plugin.seal.cargoImage.resolve", { attributes: {
+	"seal.ref": inputs.sealRef,
+	"seal.rustToolchain": inputs.rustToolchain
+} }));
+/** Convenience: resolve via the default inputs. */
+const resolveDefaultSealCargoImage = (runtime) => resolveSealCargoImage(runtime, {
+	sealRepo: DEFAULT_SEAL_REPO,
+	sealRef: DEFAULT_SEAL_VERSION,
+	rustToolchain: DEFAULT_SEAL_RUST_TOOLCHAIN
+});
+//#endregion
+export { resolveDefaultSealCargoImage };
+
+//# sourceMappingURL=cargo-image.mjs.map

package/dist/plugins/seal/bootstrap-assets/cargo-image.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargo-image.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/cargo-image.ts"],"sourcesContent":["// Seal vendored-Dockerfile docker image.\n//\n// The upstream seal release ships pre-built `seal-cli` + `key-server`\n// binaries per platform, and our vendored Dockerfile at\n// `images/seal/Dockerfile` just fetches and packages them.\n//\n// Resolution paths (mirror walrus's two-stage dispatch — distilled-doc\n// §\"Pinned upstream version\" + §\"Optional pre-built image tag override\"):\n//\n//   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env — points at a pre-baked\n//        registry tag (or a locally-tagged image like `seal-test-stub:latest`).\n//        Skips the docker build entirely. The on-disk image is\n//        content-addressed by the registry; we just thread it through.\n//\n//   (b) Real build via `runtime.ensureImage({ contextPath,\n//        dockerfile: 'Dockerfile', buildArgs: { SEAL_VERSION } })`\n//        against the vendored Dockerfile at `images/seal/`. Mirrors\n//        the sui plugin's `resolveImage` shape.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tContainerBuildContext,\n\tContainerRuntime,\n\tImageRef,\n} from '../../../contracts/container-runtime.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { DEFAULT_SEAL_REPO, DEFAULT_SEAL_VERSION } from './source-fetch.ts';\n\n// ---------------------------------------------------------------------------\n/** Pinned rust toolchain for the upstream seal cargo build. Distilled-\n *  doc §Configuration defaults block. Pinned to match walrus's default\n *  so a shared rust:1.93 builder image can fan out builds. */\nexport const DEFAULT_SEAL_RUST_TOOLCHAIN = '1.93' as const;\n\n/** Inputs to the seal image resolver. */\nexport interface SealCargoImageInputs<Ref extends string = string, RustV extends string = string> {\n\treadonly sealRepo: typeof DEFAULT_SEAL_REPO;\n\treadonly sealRef: Ref;\n\treadonly rustToolchain: RustV;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Resolve the seal image. Two staged paths:\n *\n *   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked\n *        registry tag (or a locally-built fixture image like\n *        `seal-test-stub:latest`). Skips the docker build entirely\n *        and returns a bare `ImageRef` synthesized from the override\n *        tag. CI bakes the image once + pins the tag; the local-\n *        keygen boot just reads the env.\n *\n *   (b) Real build via `runtime.ensureImage` against the vendored\n *        Dockerfile at `packages/devstack/images/seal/`. The\n *        Dockerfile is a binary-fetch path (NOT a cargo compile) —\n *        the seal release workflow ships pre-built per-platform\n *        binaries (`seal-cli`, `key-server`) and we just fetch +\n *        package them. Build is content-addressed by docker; same\n *        Dockerfile + same SEAL_VERSION → same image hash. */\nexport const resolveSealCargoImage = (\n\truntime: ContainerRuntime,\n\tinputs: SealCargoImageInputs,\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst override = (globalThis as { process?: { env?: Record<string, string | undefined> } })\n\t\t\t.process?.env?.SEAL_CARGO_IMAGE_OVERRIDE;\n\t\tif (override && override.length > 0) {\n\t\t\t// Trust-the-tag path. Compose the resolved shape from the\n\t\t\t// pinned tag — the digest is opaque (substrate's\n\t\t\t// content-addressed cache will re-resolve via `docker\n\t\t\t// inspect` when it materializes the image).\n\t\t\treturn { digest: override, tag: override } satisfies ImageRef;\n\t\t}\n\t\t// Vendored-Dockerfile path. Same shape as sui's `resolveImage`\n\t\t// (plugins/sui/mode/local.ts:resolveImage). Context is `images/`\n\t\t// (NOT `images/seal/`) so the Dockerfile can `COPY` the shared\n\t\t// `_shared/signal-forward.sh` snippet alongside the seal-specific\n\t\t// entrypoint. The Dockerfile builds in two stages: (1) ubuntu\n\t\t// base, fetch + chmod the per-arch binaries from the seal release\n\t\t// URL; (2) debian:bookworm-slim runtime with the signal-\n\t\t// forwarding entrypoint shell wrapped around `key-server`.\n\t\tconst buildCtx: ContainerBuildContext = {\n\t\t\tcontextPath: new URL('../../../../images/', import.meta.url).pathname,\n\t\t\tdockerfile: 'seal/Dockerfile',\n\t\t\tfingerprintPaths: ['seal/Dockerfile', 'seal/entrypoint.sh', '_shared/signal-forward.sh'],\n\t\t\tbuildArgs: { SEAL_VERSION: inputs.sealRef },\n\t\t};\n\t\treturn yield* runtime.ensureImage(buildCtx).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal image build failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t`SEAL_VERSION=${inputs.sealRef} (from ${inputs.sealRepo}/releases). ` +\n\t\t\t\t\t\t`Set SEAL_CARGO_IMAGE_OVERRIDE=<tag> to bypass the build.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.cargoImage.resolve', {\n\t\t\tattributes: {\n\t\t\t\t'seal.ref': inputs.sealRef,\n\t\t\t\t'seal.rustToolchain': inputs.rustToolchain,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealCargoImage = (\n\truntime: ContainerRuntime,\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tresolveSealCargoImage(runtime, {\n\t\tsealRepo: DEFAULT_SEAL_REPO,\n\t\tsealRef: DEFAULT_SEAL_VERSION,\n\t\trustToolchain: DEFAULT_SEAL_RUST_TOOLCHAIN,\n\t});\n"],"mappings":";;;;;;;AAiCA,MAAa,8BAA8B;;;;;;;;;;;;;;;;;AA6B3C,MAAa,yBACZ,SACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAY,WAChB,SAAS,KAAK;AAChB,KAAI,YAAY,SAAS,SAAS,EAKjC,QAAO;EAAE,QAAQ;EAAU,KAAK;EAAU;CAU3C,MAAM,WAAkC;EACvC,aAAa,IAAI,IAAI,uBAAuB,OAAO,KAAK,IAAI,CAAC;EAC7D,YAAY;EACZ,kBAAkB;GAAC;GAAmB;GAAsB;GAA4B;EACxF,WAAW,EAAE,cAAc,OAAO,SAAS;EAC3C;AACD,QAAO,OAAO,QAAQ,YAAY,SAAS,CAAC,KAC3C,OAAO,UAAU,UAChB,UAAU,SAAS;EAClB,MAAM;EACN,SACC,4BAA4B,MAAM,OAAO,IAAI,MAAM,OAAO,iBAC1C,OAAO,QAAQ,SAAS,OAAO,SAAS;EAEzD;EACA,CAAC,CACF,CACD;EACA,CAAC,KACF,OAAO,SAAS,2CAA2C,EAC1D,YAAY;CACX,YAAY,OAAO;CACnB,sBAAsB,OAAO;CAC7B,EACD,CAAC,CACF;;AAGF,MAAa,gCACZ,YAEA,sBAAsB,SAAS;CAC9B,UAAU;CACV,SAAS;CACT,eAAe;CACf,CAAC"}

package/dist/plugins/seal/bootstrap-assets/source-fetch.mjs

@@ -0,0 +1,132 @@
+import { stageAndSwap } from "../../../substrate/runtime/stage-and-swap/index.mjs";
+import { sealError } from "../errors.mjs";
+import { Effect, FileSystem, Path } from "effect";
+//#region src/plugins/seal/bootstrap-assets/source-fetch.ts
+/** Default upstream repo URL — distilled doc §"External" reference. */
+const DEFAULT_SEAL_REPO = "https://github.com/MystenLabs/seal";
+/** Pinned default ref. Distilled-doc invariant #11: this MUST match
+*  the cargo binary's version (the Dockerfile's `SEAL_VERSION` build
+*  arg). They move in lockstep. */
+const DEFAULT_SEAL_VERSION = "seal-v0.6.6";
+/** Subdirectory containing the Move package. */
+const DEFAULT_SEAL_MOVE_SUBDIR = "move/seal";
+/** Pinned helper image for the git clone one-shot. `alpine/git`
+*  uses `git` as its entrypoint, so the clone argv starts at
+*  `clone`. */
+const SEAL_SOURCE_FETCH_IMAGE = "alpine/git:2.52.0";
+const SEAL_SOURCE_FETCH_TIMEOUT_MS = 5 * 6e4;
+const env = () => globalThis.process?.env ?? {};
+const processId = () => String(globalThis.process?.pid ?? "unknown");
+let scratchCounter = 0;
+const nextScratchPaths = (cacheDir) => {
+	scratchCounter = scratchCounter + 1;
+	const suffix = `${processId()}.${scratchCounter}`;
+	return {
+		stagingPath: `${cacheDir}.staging.${suffix}`,
+		backupPath: `${cacheDir}.backup.${suffix}`
+	};
+};
+const sealSourceCacheDir = (ref) => {
+	return `${env().HOME ?? "/tmp"}/.cache/devstack-rewrite/seal-src/${encodeURIComponent(ref)}`;
+};
+const sealSourcePublishLockPath = (ref) => `${sealSourceCacheDir(ref)}.publish.lock`;
+const sourceImageRef = {
+	digest: SEAL_SOURCE_FETCH_IMAGE,
+	tag: SEAL_SOURCE_FETCH_IMAGE
+};
+const outputTail = (value) => value.slice(-1e3);
+const hostCloneUser = () => {
+	const process = globalThis.process;
+	if (typeof process?.getuid !== "function" || typeof process.getgid !== "function") return;
+	return `${process.getuid()}:${process.getgid()}`;
+};
+const resolveSealSource = (runtime, inputs) => Effect.gen(function* () {
+	const override = env().SEAL_MOVE_SOURCE_OVERRIDE;
+	if (override && override.length > 0) return {
+		repo: inputs.repo,
+		ref: inputs.ref,
+		subdir: inputs.subdir,
+		path: override
+	};
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const cacheDir = sealSourceCacheDir(inputs.ref);
+	const subdirPath = path.join(cacheDir, inputs.subdir);
+	if (yield* fs.exists(subdirPath).pipe(Effect.catch(() => Effect.succeed(false)))) return {
+		repo: inputs.repo,
+		ref: inputs.ref,
+		subdir: inputs.subdir,
+		path: subdirPath
+	};
+	const { stagingPath, backupPath } = nextScratchPaths(cacheDir);
+	yield* stageAndSwap({
+		targetPath: cacheDir,
+		stagingPath,
+		backupPath,
+		build: Effect.gen(function* () {
+			const result = yield* Effect.scoped(runtime.runOneShot({
+				image: sourceImageRef,
+				entrypoint: "git",
+				user: hostCloneUser(),
+				argv: [
+					"clone",
+					"--depth",
+					"1",
+					"--branch",
+					inputs.ref,
+					inputs.repo,
+					"/out"
+				],
+				mounts: [{
+					source: stagingPath,
+					target: "/out"
+				}],
+				timeoutMillis: SEAL_SOURCE_FETCH_TIMEOUT_MS
+			}).pipe(Effect.mapError((cause) => sealError("image", {
+				name: "seal",
+				message: `seal move-source: git clone one-shot failed: ${cause.reason}: ${cause.detail}. Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,
+				cause
+			}))));
+			if (result.exitCode !== 0) return yield* Effect.fail(sealError("image", {
+				name: "seal",
+				message: `seal move-source: git clone exited ${result.exitCode}. Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,
+				exitCode: result.exitCode,
+				stdout: outputTail(result.stdout),
+				stderr: outputTail(result.stderr)
+			}));
+			const stagedSubdir = path.join(stagingPath, inputs.subdir);
+			if (!(yield* fs.exists(stagedSubdir).pipe(Effect.catch(() => Effect.succeed(false))))) return yield* Effect.fail(sealError("image", {
+				name: "seal",
+				message: `seal move-source: clone completed but ${inputs.subdir} was missing from ${inputs.repo}@${inputs.ref}.`
+			}));
+		}),
+		publishLockPath: sealSourcePublishLockPath(inputs.ref)
+	}).pipe(Effect.mapError((cause) => {
+		if (cause._tag === "SealError") return cause;
+		return sealError("image", {
+			name: "seal",
+			message: `seal move-source: cache publish failed at ${cause.stage}`,
+			cause
+		});
+	}));
+	return {
+		repo: inputs.repo,
+		ref: inputs.ref,
+		subdir: inputs.subdir,
+		path: subdirPath
+	};
+}).pipe(Effect.withSpan("devstack.plugin.seal.moveSource.resolve", { attributes: {
+	"seal.repo": inputs.repo,
+	"seal.ref": inputs.ref,
+	"seal.subdir": inputs.subdir
+} }));
+/** Convenience: resolve via the default inputs. */
+const resolveDefaultSealSource = (runtime) => resolveSealSource(runtime, {
+	repo: DEFAULT_SEAL_REPO,
+	ref: DEFAULT_SEAL_VERSION,
+	subdir: DEFAULT_SEAL_MOVE_SUBDIR
+});
+//#endregion
+export { DEFAULT_SEAL_REPO, DEFAULT_SEAL_VERSION, resolveDefaultSealSource };
+
+//# sourceMappingURL=source-fetch.mjs.map

package/dist/plugins/seal/bootstrap-assets/source-fetch.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-fetch.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/source-fetch.ts"],"sourcesContent":["// Seal git-fetched source tree.\n//\n// Resolution paths (mirror walrus's three-stage dispatch):\n//\n//   (a) Caller-pinned `movePackagePath` opt — local-keygen mode\n//        short-circuits before calling this resolver.\n//\n//   (b) `SEAL_MOVE_SOURCE_OVERRIDE` env var — points at a pre-fetched\n//        on-disk path. Trust-the-path; no I/O. Useful in CI where the\n//        repo is checked out once and reused.\n//\n//   (c) Real git fetch via `runtime.runOneShot({ image: 'alpine/git:2.52.0',\n//        mounts: [stagingDir→/out], argv: ['clone',...] })`, staged\n//        into the per-host source cache before returning the host\n//        `move/seal` subdir.\n\nimport { Effect, FileSystem, Path, type Scope } from 'effect';\n\nimport type { ContainerRuntime } from '../../../contracts/container-runtime.ts';\nimport { stageAndSwap } from '../../../substrate/runtime/stage-and-swap/index.ts';\nimport { sealError, type SealError } from '../errors.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — distilled-doc §\"External / upstream sources\"\n// ---------------------------------------------------------------------------\n\n/** Default upstream repo URL — distilled doc §\"External\" reference. */\nexport const DEFAULT_SEAL_REPO = 'https://github.com/MystenLabs/seal' as const;\n\n/** Pinned default ref. Distilled-doc invariant #11: this MUST match\n *  the cargo binary's version (the Dockerfile's `SEAL_VERSION` build\n *  arg). They move in lockstep. */\nexport const DEFAULT_SEAL_VERSION = 'seal-v0.6.6' as const;\n\n/** Subdirectory containing the Move package. */\nexport const DEFAULT_SEAL_MOVE_SUBDIR = 'move/seal' as const;\n\n/** Pinned helper image for the git clone one-shot. `alpine/git`\n *  uses `git` as its entrypoint, so the clone argv starts at\n *  `clone`. */\nexport const SEAL_SOURCE_FETCH_IMAGE = 'alpine/git:2.52.0' as const;\n\nconst SEAL_SOURCE_FETCH_TIMEOUT_MS = 5 * 60_000;\n\n// ---------------------------------------------------------------------------\n// Resolved value\n// ---------------------------------------------------------------------------\n\n/** Resolved value for the cloned `move/seal` subdir. The local-keygen\n *  mode's acquire body threads this into `publishSealPackage(...)`. */\nexport interface SealSourceFetchResolved {\n\treadonly repo: string;\n\treadonly ref: string;\n\treadonly subdir: string;\n\treadonly path: string;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Inputs to the source resolver. */\nexport interface SealSourceFetchInputs<Ref extends string = string> {\n\treadonly repo: typeof DEFAULT_SEAL_REPO;\n\treadonly ref: Ref;\n\treadonly subdir: typeof DEFAULT_SEAL_MOVE_SUBDIR;\n}\n\nconst env = (): Record<string, string | undefined> =>\n\t(globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ?? {};\n\nconst processId = (): string =>\n\tString((globalThis as { process?: { pid?: number } }).process?.pid ?? 'unknown');\n\nlet scratchCounter = 0;\n\nconst nextScratchPaths = (\n\tcacheDir: string,\n): { readonly stagingPath: string; readonly backupPath: string } => {\n\tscratchCounter = scratchCounter + 1;\n\tconst suffix = `${processId()}.${scratchCounter}`;\n\treturn {\n\t\tstagingPath: `${cacheDir}.staging.${suffix}`,\n\t\tbackupPath: `${cacheDir}.backup.${suffix}`,\n\t};\n};\n\nexport const sealSourceCacheDir = (ref: string): string => {\n\tconst home = env().HOME ?? '/tmp';\n\treturn `${home}/.cache/devstack-rewrite/seal-src/${encodeURIComponent(ref)}`;\n};\n\nexport const sealSourcePublishLockPath = (ref: string): string =>\n\t`${sealSourceCacheDir(ref)}.publish.lock`;\n\nconst sourceImageRef = { digest: SEAL_SOURCE_FETCH_IMAGE, tag: SEAL_SOURCE_FETCH_IMAGE } as const;\n\nconst outputTail = (value: string): string => value.slice(-1000);\n\nconst hostCloneUser = (): string | undefined => {\n\tconst process = (\n\t\tglobalThis as {\n\t\t\tprocess?: { getuid?: () => number; getgid?: () => number };\n\t\t}\n\t).process;\n\tif (typeof process?.getuid !== 'function' || typeof process.getgid !== 'function') {\n\t\treturn undefined;\n\t}\n\treturn `${process.getuid()}:${process.getgid()}`;\n};\n\nexport const resolveSealSource = (\n\truntime: ContainerRuntime,\n\tinputs: SealSourceFetchInputs,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\tconst override = env().SEAL_MOVE_SOURCE_OVERRIDE;\n\t\tif (override && override.length > 0) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: override,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = yield* Path.Path;\n\t\tconst cacheDir = sealSourceCacheDir(inputs.ref);\n\t\tconst subdirPath = path.join(cacheDir, inputs.subdir);\n\t\tconst cached = yield* fs.exists(subdirPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (cached) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: subdirPath,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst { stagingPath, backupPath } = nextScratchPaths(cacheDir);\n\t\tyield* stageAndSwap({\n\t\t\ttargetPath: cacheDir,\n\t\t\tstagingPath,\n\t\t\tbackupPath,\n\t\t\tbuild: Effect.gen(function* () {\n\t\t\t\tconst result = yield* Effect.scoped(\n\t\t\t\t\truntime\n\t\t\t\t\t\t.runOneShot({\n\t\t\t\t\t\t\timage: sourceImageRef,\n\t\t\t\t\t\t\tentrypoint: 'git',\n\t\t\t\t\t\t\tuser: hostCloneUser(),\n\t\t\t\t\t\t\targv: ['clone', '--depth', '1', '--branch', inputs.ref, inputs.repo, '/out'],\n\t\t\t\t\t\t\tmounts: [{ source: stagingPath, target: '/out' }],\n\t\t\t\t\t\t\ttimeoutMillis: SEAL_SOURCE_FETCH_TIMEOUT_MS,\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\t`seal move-source: git clone one-shot failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tif (result.exitCode !== 0) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t`seal move-source: git clone exited ${result.exitCode}. ` +\n\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\t\t\tstdout: outputTail(result.stdout),\n\t\t\t\t\t\t\tstderr: outputTail(result.stderr),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst stagedSubdir = path.join(stagingPath, inputs.subdir);\n\t\t\t\tconst stagedSubdirExists = yield* fs\n\t\t\t\t\t.exists(stagedSubdir)\n\t\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\tif (!stagedSubdirExists) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage: `seal move-source: clone completed but ${inputs.subdir} was missing from ${inputs.repo}@${inputs.ref}.`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}),\n\t\t\tpublishLockPath: sealSourcePublishLockPath(inputs.ref),\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause): SealError => {\n\t\t\t\tif (cause._tag === 'SealError') return cause;\n\t\t\t\treturn sealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage: `seal move-source: cache publish failed at ${cause.stage}`,\n\t\t\t\t\tcause,\n\t\t\t\t});\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\trepo: inputs.repo,\n\t\t\tref: inputs.ref,\n\t\t\tsubdir: inputs.subdir,\n\t\t\tpath: subdirPath,\n\t\t} satisfies SealSourceFetchResolved;\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.moveSource.resolve', {\n\t\t\tattributes: {\n\t\t\t\t'seal.repo': inputs.repo,\n\t\t\t\t'seal.ref': inputs.ref,\n\t\t\t\t'seal.subdir': inputs.subdir,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealSource = (\n\truntime: ContainerRuntime,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tresolveSealSource(runtime, {\n\t\trepo: DEFAULT_SEAL_REPO,\n\t\tref: DEFAULT_SEAL_VERSION,\n\t\tsubdir: DEFAULT_SEAL_MOVE_SUBDIR,\n\t});\n"],"mappings":";;;;;AA2BA,MAAa,oBAAoB;;;;AAKjC,MAAa,uBAAuB;;AAGpC,MAAa,2BAA2B;;;;AAKxC,MAAa,0BAA0B;AAEvC,MAAM,+BAA+B,IAAI;AA0BzC,MAAM,YACJ,WAA0E,SAAS,OAAO,EAAE;AAE9F,MAAM,kBACL,OAAQ,WAA8C,SAAS,OAAO,UAAU;AAEjF,IAAI,iBAAiB;AAErB,MAAM,oBACL,aACmE;AACnE,kBAAiB,iBAAiB;CAClC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG;AACjC,QAAO;EACN,aAAa,GAAG,SAAS,WAAW;EACpC,YAAY,GAAG,SAAS,UAAU;EAClC;;AAGF,MAAa,sBAAsB,QAAwB;AAE1D,QAAO,GADM,KAAK,CAAC,QAAQ,OACZ,oCAAoC,mBAAmB,IAAI;;AAG3E,MAAa,6BAA6B,QACzC,GAAG,mBAAmB,IAAI,CAAC;AAE5B,MAAM,iBAAiB;CAAE,QAAQ;CAAyB,KAAK;CAAyB;AAExF,MAAM,cAAc,UAA0B,MAAM,MAAM,KAAM;AAEhE,MAAM,sBAA0C;CAC/C,MAAM,UACL,WAGC;AACF,KAAI,OAAO,SAAS,WAAW,cAAc,OAAO,QAAQ,WAAW,WACtE;AAED,QAAO,GAAG,QAAQ,QAAQ,CAAC,GAAG,QAAQ,QAAQ;;AAG/C,MAAa,qBACZ,SACA,WAMA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,KAAK,CAAC;AACvB,KAAI,YAAY,SAAS,SAAS,EACjC,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;CAGF,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,WAAW,mBAAmB,OAAO,IAAI;CAC/C,MAAM,aAAa,KAAK,KAAK,UAAU,OAAO,OAAO;AAErD,KAAI,OADkB,GAAG,OAAO,WAAW,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,CAE1F,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;CAGF,MAAM,EAAE,aAAa,eAAe,iBAAiB,SAAS;AAC9D,QAAO,aAAa;EACnB,YAAY;EACZ;EACA;EACA,OAAO,OAAO,IAAI,aAAa;GAC9B,MAAM,SAAS,OAAO,OAAO,OAC5B,QACE,WAAW;IACX,OAAO;IACP,YAAY;IACZ,MAAM,eAAe;IACrB,MAAM;KAAC;KAAS;KAAW;KAAK;KAAY,OAAO;KAAK,OAAO;KAAM;KAAO;IAC5E,QAAQ,CAAC;KAAE,QAAQ;KAAa,QAAQ;KAAQ,CAAC;IACjD,eAAe;IACf,CAAC,CACD,KACA,OAAO,UAAU,UAChB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,gDAAgD,MAAM,OAAO,IAAI,MAAM,OAAO;IAE/E;IACA,CAAC,CACF,CACD,CACF;AAED,OAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,sCAAsC,OAAO,SAAS;IAEvD,UAAU,OAAO;IACjB,QAAQ,WAAW,OAAO,OAAO;IACjC,QAAQ,WAAW,OAAO,OAAO;IACjC,CAAC,CACF;GAGF,MAAM,eAAe,KAAK,KAAK,aAAa,OAAO,OAAO;AAI1D,OAAI,EAAC,OAH6B,GAChC,OAAO,aAAa,CACpB,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEhD,QAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SAAS,yCAAyC,OAAO,OAAO,oBAAoB,OAAO,KAAK,GAAG,OAAO,IAAI;IAC9G,CAAC,CACF;IAED;EACF,iBAAiB,0BAA0B,OAAO,IAAI;EACtD,CAAC,CAAC,KACF,OAAO,UAAU,UAAqB;AACrC,MAAI,MAAM,SAAS,YAAa,QAAO;AACvC,SAAO,UAAU,SAAS;GACzB,MAAM;GACN,SAAS,6CAA6C,MAAM;GAC5D;GACA,CAAC;GACD,CACF;AAED,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;EACA,CAAC,KACF,OAAO,SAAS,2CAA2C,EAC1D,YAAY;CACX,aAAa,OAAO;CACpB,YAAY,OAAO;CACnB,eAAe,OAAO;CACtB,EACD,CAAC,CACF;;AAGF,MAAa,4BACZ,YAMA,kBAAkB,SAAS;CAC1B,MAAM;CACN,KAAK;CACL,QAAQ;CACR,CAAC"}

package/dist/plugins/seal/codegen.d.mts

@@ -0,0 +1,19 @@
+import { SealKeyServerEntry } from "./registry-publish.mjs";
+
+//#region src/plugins/seal/codegen.d.ts
+/** Codegen-emitted shape for seal. Mirrors the read-side resolved
+ *  value (sans the per-instance defaults like `weight`). The
+ *  bindings emitter writes a TypeScript file exporting these. */
+interface SealBindings {
+  readonly name: string;
+  readonly objectId: string;
+  readonly keyServerUrl: string;
+  readonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;
+  /** Mode marker so the bindings file knows whether to surface the
+   *  admin rotate Effect-construction shim (distilled-doc invariant
+   *  #15 — only local-keygen mode produces a manager). */
+  readonly mode: 'local-keygen' | 'live' | 'fork-known';
+}
+//#endregion
+export { SealBindings };
+//# sourceMappingURL=codegen.d.mts.map

package/dist/plugins/seal/codegen.mjs

@@ -0,0 +1,16 @@
+import { Effect } from "effect";
+//#region src/plugins/seal/codegen.ts
+/** Build the Codegenable contribution for a seal instance. */
+const makeSealCodegenable = (bindings) => ({
+	kind: "codegenable",
+	emitterName: "seal-key-server",
+	outputPath: `seal/${bindings.name}.ts`,
+	emit: (ctx) => Effect.sync(() => {
+		ctx.exportConst("sealBindings", bindings);
+		return ctx.done();
+	})
+});
+//#endregion
+export { makeSealCodegenable };
+
+//# sourceMappingURL=codegen.mjs.map

package/dist/plugins/seal/codegen.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/seal/codegen.ts"],"sourcesContent":["// Seal plugin — Codegenable contribution.\n//\n// Distilled-doc §\"Outputs\": the seal plugin contributes ONE codegen\n// emit shape — the `seal-key-server` config the user-facing\n// bindings consume to construct a `SealClient`. The orchestrator\n// reads this contribution + every other plugin's; the heavy\n// codegen substrate (file writing, type-export grouping) lives in\n// the codegen orchestrator (architecture §6).\n//\n// Tag id discipline:\n//\n//   - The emitter name `'seal-key-server'` is pinned here so the\n//     generated output and orchestrator attribution stay stable.\n\nimport { Effect } from 'effect';\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\nimport type { SealKeyServerEntry } from './registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Bindings shape\n// ---------------------------------------------------------------------------\n\n/** Codegen-emitted shape for seal. Mirrors the read-side resolved\n *  value (sans the per-instance defaults like `weight`). The\n *  bindings emitter writes a TypeScript file exporting these. */\nexport interface SealBindings {\n\treadonly name: string;\n\treadonly objectId: string;\n\treadonly keyServerUrl: string;\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\t/** Mode marker so the bindings file knows whether to surface the\n\t *  admin rotate Effect-construction shim (distilled-doc invariant\n\t *  #15 — only local-keygen mode produces a manager). */\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n}\n\n// ---------------------------------------------------------------------------\n// Decl builder\n// ---------------------------------------------------------------------------\n\n/** Build the Codegenable contribution for a seal instance. */\nexport const makeSealCodegenable = (\n\tbindings: SealBindings,\n): CodegenableDecl<'seal-key-server'> => ({\n\tkind: 'codegenable',\n\temitterName: 'seal-key-server',\n\toutputPath: `seal/${bindings.name}.ts`,\n\temit: (ctx) =>\n\t\tEffect.sync(() => {\n\t\t\tctx.exportConst('sealBindings', bindings satisfies SealBindings);\n\t\t\treturn ctx.done();\n\t\t}),\n});\n"],"mappings":";;;AA0CA,MAAa,uBACZ,cACyC;CACzC,MAAM;CACN,aAAa;CACb,YAAY,QAAQ,SAAS,KAAK;CAClC,OAAO,QACN,OAAO,WAAW;AACjB,MAAI,YAAY,gBAAgB,SAAgC;AAChE,SAAO,IAAI,MAAM;GAChB;CACH"}