@mysten-incubation/devstack 0.0.0

package/dist/plugins/seal/index.mjs

@@ -0,0 +1,235 @@
+import { definePlugin } from "../../substrate/plugin.mjs";
+import { pluginErrorContributions } from "../../api/plugin-errors.mjs";
+import { IdentityContext, StackPathsService } from "../../substrate/runtime/paths.mjs";
+import { defineModeNamespace } from "../../api/mode-narrowed-factory.mjs";
+import { ContainerRuntimeService } from "../../runtime/docker/service.mjs";
+import { suiResource } from "../sui/index.mjs";
+import { ArtifactPublisherService } from "../../substrate/runtime/artifact-publisher/index.mjs";
+import { chainProbeFor } from "../../substrate/runtime/strategy-registry/chain-probe-for.mjs";
+import { DEFAULT_KEY_SERVER_PORT, buildSealKeyServerPublicRoute, makeSealRoutable } from "./routable.mjs";
+import { sealPluginKey } from "./plugin-key.mjs";
+import { makeSealCodegenable } from "./codegen.mjs";
+import { SEAL_ERROR_TAGS } from "./errors.mjs";
+import { validateLiveInputs } from "./mode/live.mjs";
+import { buildSealNetworkName, deriveSealSubnetPrefix, sealNetworkCreateSpec } from "./key-server.mjs";
+import { bootLocalKeygen, resolveLocalKeygenOptions } from "./mode/local-keygen.mjs";
+import { makeSealResource } from "./registry-publish.mjs";
+import { makeKnownSnapshotable, makeLocalKeygenSnapshotable } from "./snapshot.mjs";
+import { bootSealService } from "./service.mjs";
+import { Effect, FileSystem, Path } from "effect";
+//#region src/plugins/seal/index.ts
+const sealErrorContributions = pluginErrorContributions(SEAL_ERROR_TAGS);
+/** Constants + shared knobs for the buildXyz helpers below. */
+const DEFAULT_NAME = "seal";
+/** Build the local-keygen-mode plugin. The service contributes
+*  Snapshotable (secret) + Codegenable + Routable.
+*
+*  Architecture mirror (walrus): `ContainerRuntimeService` +
+*  `IdentityContext` wired via the supervisor's plugin runtime context,
+*  artifact publisher publisher + chain probe yielded inside `acquire`. */
+const buildLocalKeygenPlugin = (opts) => {
+	const resolved = resolveLocalKeygenOptions(opts, "<default-seal-version>");
+	return definePlugin({
+		id: makeSealResource(resolved.name).id,
+		dependsOn: {
+			sui: suiResource,
+			signer: opts.signer
+		},
+		role: "service",
+		pluginKey: sealPluginKey(resolved.name),
+		start: (deps) => Effect.gen(function* () {
+			const { sui, signer: signerAccount } = deps;
+			const runtime = yield* ContainerRuntimeService;
+			const identity = yield* IdentityContext;
+			const publisher = yield* ArtifactPublisherService;
+			const stackPaths = yield* StackPathsService;
+			const fs = yield* FileSystem.FileSystem;
+			const path = yield* Path.Path;
+			const probe = yield* chainProbeFor(sui.chain);
+			const servicePath = path.join(stackPaths.stackRoot, "seal", resolved.name);
+			yield* fs.makeDirectory(servicePath, { recursive: true }).pipe(Effect.catch(() => Effect.void));
+			const sealNetworkName = buildSealNetworkName(identity.app, identity.stack, resolved.name);
+			const suiRpcUrlInNetwork = sui.hostGateway.rpcUrl;
+			const routed = buildSealKeyServerPublicRoute({
+				app: identity.app,
+				stack: identity.stack,
+				port: DEFAULT_KEY_SERVER_PORT
+			});
+			const sealSubnetPrefix = deriveSealSubnetPrefix({
+				app: identity.app,
+				stack: identity.stack,
+				sealName: resolved.name
+			});
+			yield* runtime.ensureNetwork(sealNetworkCreateSpec({
+				name: sealNetworkName,
+				app: identity.app,
+				stack: identity.stack
+			}, sealSubnetPrefix));
+			const boot = yield* bootLocalKeygen({
+				runtime,
+				publisher,
+				signer: signerAccount,
+				sdk: sui.sdk,
+				...sui.buildImage !== null ? { buildImage: sui.buildImage } : {},
+				chainProbe: probe,
+				chain: sui.chain,
+				servicePath,
+				containerName: `devstack-${identity.app}-${identity.stack}-seal-${resolved.name}-key-server`,
+				labels: {
+					app: identity.app,
+					stack: identity.stack,
+					plugin: "seal",
+					role: "key-server"
+				},
+				suiNetworkName: sealNetworkName,
+				suiRpcUrlInNetwork,
+				routedHostname: routed.hostname,
+				routedUrl: routed.url
+			}, resolved);
+			return {
+				...boot.keyServer,
+				mode: "local-keygen",
+				manager: boot.keyManager
+			};
+		}),
+		capabilities: ({ value: resolvedKs, runtime: acquireCtx }) => {
+			const bindings = {
+				name: resolved.name,
+				objectId: resolvedKs.objectId,
+				keyServerUrl: resolvedKs.keyServerUrl,
+				serverConfigs: resolvedKs.serverConfigs,
+				mode: "local-keygen"
+			};
+			return [
+				makeLocalKeygenSnapshotable({
+					name: resolved.name,
+					app: acquireCtx.identity.app,
+					stack: acquireCtx.identity.stack
+				}),
+				makeSealCodegenable(bindings),
+				makeSealRoutable({
+					name: resolved.name,
+					containerName: `devstack-${acquireCtx.identity.app}-${acquireCtx.identity.stack}-seal-${resolved.name}-key-server`
+				})
+			];
+		},
+		errorContributions: sealErrorContributions
+	});
+};
+/** Build the live-mode plugin. No Routable (URL is remote). */
+const buildLivePlugin = (opts) => {
+	const name = opts.name ?? DEFAULT_NAME;
+	const sealResource = makeSealResource(name);
+	const validated = validateLiveInputs({
+		name,
+		...opts
+	});
+	const bindings = {
+		name,
+		objectId: validated.objectId,
+		keyServerUrl: validated.keyServerUrl,
+		serverConfigs: [{
+			objectId: validated.objectId,
+			weight: 1
+		}],
+		mode: "live"
+	};
+	const snap = makeKnownSnapshotable({ name });
+	const codegen = makeSealCodegenable(bindings);
+	return definePlugin({
+		id: sealResource.id,
+		role: "task",
+		start: () => Effect.gen(function* () {
+			const mode = {
+				mode: "live",
+				name,
+				...opts
+			};
+			return {
+				...(yield* bootSealService(yield* ArtifactPublisherService, mode)).keyServer,
+				mode: "live",
+				manager: null
+			};
+		}),
+		capabilities: [snap, codegen],
+		errorContributions: sealErrorContributions
+	});
+};
+/** Build the fork-known-mode plugin. Same structure as live, but with
+*  dynamic capabilities so the codegen bindings carry the REAL
+*  objectId / keyServerUrl resolved at acquire (the user-supplied
+*  options may be undefined → resolved by the upstream lookup). */
+const buildForkKnownPlugin = (opts) => {
+	const name = opts.name ?? DEFAULT_NAME;
+	const sealResource = makeSealResource(name);
+	const snap = makeKnownSnapshotable({ name });
+	return definePlugin({
+		id: sealResource.id,
+		role: "task",
+		start: () => Effect.gen(function* () {
+			const mode = {
+				mode: "fork-known",
+				name,
+				...opts
+			};
+			return {
+				...(yield* bootSealService(yield* ArtifactPublisherService, mode)).keyServer,
+				mode: "fork-known",
+				manager: null
+			};
+		}),
+		capabilities: ({ value: resolvedKs }) => {
+			return [snap, makeSealCodegenable({
+				name,
+				objectId: resolvedKs.objectId,
+				keyServerUrl: resolvedKs.keyServerUrl,
+				serverConfigs: resolvedKs.serverConfigs,
+				mode: "fork-known"
+			})];
+		},
+		errorContributions: sealErrorContributions
+	});
+};
+/** Explicit Seal factory. `local-keygen` requires a signer; live and
+*  fork-known modes must be selected directly or through `sealFor`. */
+const seal = (opts) => {
+	switch (opts.mode) {
+		case "local-keygen": return buildLocalKeygenPlugin(opts);
+		case "live": return buildLivePlugin(opts);
+		case "fork-known": return buildForkKnownPlugin(opts);
+	}
+};
+/** Mode-narrowed factory namespace.
+*
+*  Usage:
+*      const local = { mode: 'local' } as const;
+*      sealFor(local).localKeygen({signer})    // OK
+*      sealFor(local).forkKnown(...)           // type error: not in 'local' branch
+*
+*      const fork = { mode: 'fork' } as const;
+*      sealFor(fork).forkKnown({upstream})     // OK
+*      sealFor(fork).localKeygen({signer})     // type error: not in 'fork' branch
+*                                              // (distilled-doc invariant #8)
+*
+*  Distilled-doc invariant #8 (fork-localkeygen-refused): the
+*  fork-mode branch has NO `localKeygen` entry — that's the
+*  type-level refusal. */
+const sealFor = defineModeNamespace({
+	local: { localKeygen: (opts) => buildLocalKeygenPlugin(opts) },
+	live: {
+		testnet: (opts = {}) => buildLivePlugin({
+			network: "testnet",
+			...opts
+		}),
+		mainnet: (opts = {}) => buildLivePlugin({
+			network: "mainnet",
+			...opts
+		}),
+		custom: (opts) => buildLivePlugin(opts)
+	},
+	fork: { forkKnown: (opts) => buildForkKnownPlugin(opts) }
+});
+//#endregion
+export { seal, sealFor };
+
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/seal/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/seal/index.ts"],"sourcesContent":["// Seal plugin — barrel + factories.\n//\n// Architecture (07-seal.md): Seal is a local or known service plugin.\n// Three operative modes:\n//\n//   - `local-keygen`  — localnet, owns the master key. Heavy boot.\n//   - `live`          — testnet / mainnet, read-only handle to a\n//                       known deployment.\n//   - `fork-known`    — `*-fork` networks; routes to the wrapped\n//                       upstream's known deployment.\n//\n// Plus one type-level refusal:\n//\n//   - `fork-localkeygen-refused` — local-keygen ON `*-fork` is a\n//     synchronous throw at factory time (distilled-doc invariant #8).\n//\n// Public surface:\n//\n//   - `seal(opts)`              — explicit mode selection.\n//   - `sealFor(network).<mode>` — mode-narrowed factory namespace.\n//     Mode-narrowing makes `sealFor(forkNetwork).localKeygen(...)`\n//     a COMPILE-time refusal (architecture Tension 11 + type-prototype\n//     finding #4).\n//\n// Capability decls emitted:\n//\n//   1. Snapshotable        — local-keygen contributes secret material\n//                            subtree; known modes contribute the\n//                            empty shape.\n//   2. Codegenable         — `seal-key-server` bindings (server\n//                            configs + URL + objectId).\n//   3. Routable            — `seal-key-server` endpoint, local-keygen\n//                            only (known modes route to a remote URL\n//                            outside Traefik's purview).\n\nimport { Effect, FileSystem, Path } from 'effect';\n\nimport { definePlugin, type ResourceRef } from '../../api/define-plugin.ts';\nimport { defineModeNamespace } from '../../api/mode-narrowed-factory.ts';\nimport { pluginErrorContributions } from '../../api/plugin-errors.ts';\nimport { ContainerRuntimeService } from '../../runtime/docker/service.ts';\nimport { IdentityContext, StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { ArtifactPublisherService } from '../../substrate/runtime/artifact-publisher/index.ts';\nimport { chainProbeFor } from '../../substrate/runtime/strategy-registry/index.ts';\nimport type { AccountResourceId } from '../account/index.ts';\nimport type { AccountValue } from '../account/service.ts';\nimport { suiResource } from '../sui/index.ts';\n\nimport type { SealObjectProbeKey } from './deploy.ts';\nimport { sealPluginKey } from './plugin-key.ts';\nimport { makeSealCodegenable, type SealBindings } from './codegen.ts';\nimport { SEAL_ERROR_TAGS, type SealError } from './errors.ts';\nimport type { ForkUpstream } from './mode/fork-known.ts';\nimport type { KnownNetwork } from './mode/live.ts';\nimport { validateLiveInputs } from './mode/live.ts';\nimport {\n\tbuildSealNetworkName,\n\tDEFAULT_KEY_SERVER_PORT,\n\tderiveSealSubnetPrefix,\n\tsealNetworkCreateSpec,\n} from './key-server.ts';\nimport {\n\tbootLocalKeygen,\n\tresolveLocalKeygenOptions,\n\ttype LocalKeygenDeps,\n} from './mode/local-keygen.ts';\nimport {\n\tmakeSealResource,\n\ttype SealLocalKeygenResolved,\n\ttype SealKnownResolved,\n\ttype SealResolved,\n} from './registry-publish.ts';\nimport { buildSealKeyServerPublicRoute, makeSealRoutable } from './routable.ts';\nimport { makeKnownSnapshotable, makeLocalKeygenSnapshotable } from './snapshot.ts';\nimport { bootSealService, type SealMode } from './service.ts';\n\nconst sealErrorContributions = pluginErrorContributions(SEAL_ERROR_TAGS);\n\n// ---------------------------------------------------------------------------\n// Resource exports — distilled-doc §\"TypeScript exports consumed elsewhere\"\n// ---------------------------------------------------------------------------\n\nexport {\n\tmakeSealResource,\n\tsealResourceId,\n\ttype SealKeyServer,\n\ttype SealKeyServerEntry,\n\ttype SealResolved,\n\ttype SealLocalKeygenResolved,\n\ttype SealKnownResolved,\n\ttype SealResourceId,\n} from './registry-publish.ts';\nexport type { SealKeyManager } from './key-manager.ts';\nexport {\n\ttype SealError,\n\ttype SealAnyError,\n\ttype SealConfigError,\n\tSEAL_ERROR_TAGS,\n} from './errors.ts';\nexport type { SealBindings } from './codegen.ts';\n\n// ---------------------------------------------------------------------------\n// Options\n// ---------------------------------------------------------------------------\n\n/** Common options shared across all three modes. */\nexport interface SealCommonOptions {\n\treadonly name?: string;\n}\n\n/** A user-supplied signer account ref. The user passes the result of\n *  `account('publisher')` — NOT a magic-string token. Generic over the\n *  literal account name so the seal dependency edge preserves the\n *  per-account resource id. */\nexport type SealSignerMember<Name extends string = string> = ResourceRef<\n\tAccountResourceId<Name>,\n\tAccountValue\n>;\n\n/** Local-keygen mode options. The `signer` field is REQUIRED — the\n *  Move publish + on-chain register both need it. The mode-narrowed\n *  factory's TypeScript shape enforces this (no `signer?` here). */\nexport interface SealLocalKeygenOptions<\n\tSigner extends SealSignerMember = SealSignerMember,\n> extends SealCommonOptions {\n\t/** Signer for the seal Move publish + on-chain key-server register.\n\t *  Pass the result of `account('publisher')` — the same plugin/resource\n\t *  ref used elsewhere in the stack. The ref is threaded through\n\t *  `dependsOn` so the publish tx waits for the account's acquire\n\t *  (keypair mint + funding) to complete. */\n\treadonly signer: Signer;\n\treadonly version?: string;\n\treadonly movePackagePath?: string;\n\treadonly readyTimeoutMs?: number;\n\treadonly keyServerName?: string;\n\treadonly image?: { readonly pull: string } | { readonly build: { readonly context: string } };\n}\n\n/** Live-mode options (testnet / mainnet). */\nexport interface SealLiveOptions extends SealCommonOptions {\n\treadonly network?: KnownNetwork;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\n/** Fork-known-mode options. */\nexport interface SealForkKnownOptions extends SealCommonOptions {\n\treadonly upstream: ForkUpstream;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\nexport type SealOptions<Signer extends SealSignerMember = SealSignerMember> =\n\t| ({ readonly mode: 'local-keygen' } & SealLocalKeygenOptions<Signer>)\n\t| ({ readonly mode: 'live' } & SealLiveOptions)\n\t| ({ readonly mode: 'fork-known' } & SealForkKnownOptions);\n\n// ---------------------------------------------------------------------------\n// Plugin construction\n// ---------------------------------------------------------------------------\n\n/** Constants + shared knobs for the buildXyz helpers below. */\nconst DEFAULT_NAME = 'seal';\n\n/** Build the local-keygen-mode plugin. The service contributes\n *  Snapshotable (secret) + Codegenable + Routable.\n *\n *  Architecture mirror (walrus): `ContainerRuntimeService` +\n *  `IdentityContext` wired via the supervisor's plugin runtime context,\n *  artifact publisher publisher + chain probe yielded inside `acquire`. */\nconst buildLocalKeygenPlugin = <const Signer extends SealSignerMember>(\n\topts: SealLocalKeygenOptions<Signer>,\n) => {\n\t// Synchronous factory-time defaults. Localnet-signer-required is\n\t// enforced by the typed `signer:` field on\n\t// SealLocalKeygenOptions.\n\tconst resolved = resolveLocalKeygenOptions(opts, '<default-seal-version>');\n\n\tconst sealResource = makeSealResource(resolved.name);\n\n\treturn definePlugin({\n\t\tid: sealResource.id,\n\t\tdependsOn: { sui: suiResource, signer: opts.signer },\n\t\trole: 'service',\n\t\tpluginKey: sealPluginKey(resolved.name),\n\t\tstart: (deps) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst { sui, signer: signerAccount } = deps;\n\t\t\t\t// Substrate-context primitives:\n\t\t\t\t//   - `ContainerRuntimeService` + `IdentityContext` arrive\n\t\t\t\t//     via the supervisor's plugin runtime context.\n\t\t\t\t//   - `ArtifactPublisher` is the substrate-level\n\t\t\t\t//     publisher (cache → verify → produce → register cycle).\n\t\t\t\t//   - Chain probe is looked up via the\n\t\t\t\t//     StrategyRegistry under `chain-probe:<chainId>`; the\n\t\t\t\t//     Sui plugin registered it during its own acquire.\n\t\t\t\t//     The probe is yielded eagerly so the dep edge fails\n\t\t\t\t//     fast if sui's chain-probe registration is missing,\n\t\t\t\t//     matching walrus's pattern.\n\t\t\t\t//   - `StackPathsService` resolves the per-stack on-disk\n\t\t\t\t//     root so the key-server config + master-key.env\n\t\t\t\t//     bind-mount sources are real paths (not the\n\t\t\t\t//     `<runtime>/...` template).\n\t\t\t\tconst runtime = yield* ContainerRuntimeService;\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\tconst publisher = yield* ArtifactPublisherService;\n\t\t\t\tconst stackPaths = yield* StackPathsService;\n\t\t\t\tconst fs = yield* FileSystem.FileSystem;\n\t\t\t\tconst path = yield* Path.Path;\n\t\t\t\tconst probe = yield* chainProbeFor<SealObjectProbeKey>(sui.chain);\n\n\t\t\t\t// Resolve the seal service dir from the per-stack paths\n\t\t\t\t// bundle. The dir must exist before the key-server's\n\t\t\t\t// bind-mounts (config yaml + master-key env-file).\n\t\t\t\tconst servicePath = path.join(stackPaths.stackRoot, 'seal', resolved.name);\n\t\t\t\tyield* fs\n\t\t\t\t\t.makeDirectory(servicePath, { recursive: true })\n\t\t\t\t\t.pipe(Effect.catch(() => Effect.void));\n\n\t\t\t\t// Cross-container DNS: seal's key-server dials sui RPC via\n\t\t\t\t// `host.docker.internal`. The sui plugin binds a brokered\n\t\t\t\t// host port; the SDK publish/register path runs from the host\n\t\t\t\t// process and does not need the container network.\n\t\t\t\t//\n\t\t\t\t// Architectural decision (B5): seal owns its OWN docker\n\t\t\t\t// network for the key-server's network attachment;\n\t\t\t\t// sui-side hops go through the host gateway. Mirrors\n\t\t\t\t// walrus's pattern (see plugins/walrus/index.ts §B5).\n\t\t\t\tconst sealNetworkName = buildSealNetworkName(identity.app, identity.stack, resolved.name);\n\t\t\t\tconst suiRpcUrlInNetwork = sui.hostGateway.rpcUrl;\n\t\t\t\tconst routed = buildSealKeyServerPublicRoute({\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tport: DEFAULT_KEY_SERVER_PORT,\n\t\t\t\t});\n\n\t\t\t\t// Idempotent network create — the long-running key-server\n\t\t\t\t// attaches to this name. The seal boot pipeline doesn't own\n\t\t\t\t// the create (unlike walrus's local-cluster which calls\n\t\t\t\t// `ensureNetwork` from its mode body); we call it here\n\t\t\t\t// because the substrate's `acquire` is the only seam that\n\t\t\t\t// holds both the runtime + the identity needed for the\n\t\t\t\t// per-stack label tuple.\n\t\t\t\tconst sealSubnetPrefix = deriveSealSubnetPrefix({\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\tsealName: resolved.name,\n\t\t\t\t});\n\t\t\t\tyield* runtime.ensureNetwork(\n\t\t\t\t\tsealNetworkCreateSpec(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: sealNetworkName,\n\t\t\t\t\t\t\tapp: identity.app,\n\t\t\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsealSubnetPrefix,\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tconst localKeygenDeps: LocalKeygenDeps = {\n\t\t\t\t\truntime,\n\t\t\t\t\tpublisher,\n\t\t\t\t\tsigner: signerAccount,\n\t\t\t\t\tsdk: sui.sdk,\n\t\t\t\t\t...(sui.buildImage !== null ? { buildImage: sui.buildImage } : {}),\n\t\t\t\t\tchainProbe: probe,\n\t\t\t\t\tchain: sui.chain,\n\t\t\t\t\tservicePath,\n\t\t\t\t\tcontainerName: `devstack-${identity.app}-${identity.stack}-seal-${resolved.name}-key-server`,\n\t\t\t\t\tlabels: {\n\t\t\t\t\t\tapp: identity.app,\n\t\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\t\tplugin: 'seal',\n\t\t\t\t\t\trole: 'key-server',\n\t\t\t\t\t},\n\t\t\t\t\tsuiNetworkName: sealNetworkName,\n\t\t\t\t\tsuiRpcUrlInNetwork,\n\t\t\t\t\troutedHostname: routed.hostname,\n\t\t\t\t\troutedUrl: routed.url,\n\t\t\t\t};\n\n\t\t\t\tconst boot = (yield* bootLocalKeygen(\n\t\t\t\t\tlocalKeygenDeps,\n\t\t\t\t\tresolved,\n\t\t\t\t)) satisfies SealLocalKeygenResolved;\n\n\t\t\t\tconst resolvedValue: SealResolved = {\n\t\t\t\t\t...boot.keyServer,\n\t\t\t\t\tmode: 'local-keygen',\n\t\t\t\t\tmanager: boot.keyManager,\n\t\t\t\t};\n\t\t\t\treturn resolvedValue;\n\t\t\t}),\n\t\t// Dynamic capability factory — receives the resolved\n\t\t// `SealKeyServer` + acquire context. Stamps the REAL\n\t\t// objectId / keyServerUrl into codegen bindings and the\n\t\t// real identity app/stack into the snapshot decl.\n\t\tcapabilities: ({ value: resolvedKs, runtime: acquireCtx }) => {\n\t\t\tconst bindings: SealBindings = {\n\t\t\t\tname: resolved.name,\n\t\t\t\tobjectId: resolvedKs.objectId,\n\t\t\t\tkeyServerUrl: resolvedKs.keyServerUrl,\n\t\t\t\tserverConfigs: resolvedKs.serverConfigs,\n\t\t\t\tmode: 'local-keygen',\n\t\t\t};\n\t\t\tconst snap = makeLocalKeygenSnapshotable({\n\t\t\t\tname: resolved.name,\n\t\t\t\tapp: acquireCtx.identity.app,\n\t\t\t\tstack: acquireCtx.identity.stack,\n\t\t\t});\n\t\t\tconst codegen = makeSealCodegenable(bindings);\n\t\t\tconst routable = makeSealRoutable({\n\t\t\t\tname: resolved.name,\n\t\t\t\tcontainerName: `devstack-${acquireCtx.identity.app}-${acquireCtx.identity.stack}-seal-${resolved.name}-key-server`,\n\t\t\t});\n\t\t\treturn [snap, codegen, routable] as const;\n\t\t},\n\t\terrorContributions: sealErrorContributions,\n\t});\n};\n\n/** Build the live-mode plugin. No Routable (URL is remote). */\nconst buildLivePlugin = (opts: SealLiveOptions) => {\n\tconst name = opts.name ?? DEFAULT_NAME;\n\tconst sealResource = makeSealResource(name);\n\t// Validate inputs at factory time so misconfigurations fail\n\t// before any plugin row starts work.\n\tconst validated = validateLiveInputs({ name, ...opts });\n\tconst bindings: SealBindings = {\n\t\tname,\n\t\tobjectId: validated.objectId,\n\t\tkeyServerUrl: validated.keyServerUrl,\n\t\tserverConfigs: [{ objectId: validated.objectId, weight: 1 }],\n\t\tmode: 'live',\n\t};\n\tconst snap = makeKnownSnapshotable({ name });\n\tconst codegen = makeSealCodegenable(bindings);\n\n\treturn definePlugin({\n\t\tid: sealResource.id,\n\t\trole: 'task',\n\t\tstart: () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst mode: SealMode = { mode: 'live', name, ...opts };\n\t\t\t\tconst publisher = yield* ArtifactPublisherService;\n\t\t\t\tconst resolved = (yield* bootSealService(publisher, mode)) as SealKnownResolved;\n\t\t\t\treturn {\n\t\t\t\t\t...resolved.keyServer,\n\t\t\t\t\tmode: 'live',\n\t\t\t\t\tmanager: null,\n\t\t\t\t} satisfies SealResolved;\n\t\t\t}),\n\t\tcapabilities: [snap, codegen] as const,\n\t\terrorContributions: sealErrorContributions,\n\t});\n};\n\n/** Build the fork-known-mode plugin. Same structure as live, but with\n *  dynamic capabilities so the codegen bindings carry the REAL\n *  objectId / keyServerUrl resolved at acquire (the user-supplied\n *  options may be undefined → resolved by the upstream lookup). */\nconst buildForkKnownPlugin = (opts: SealForkKnownOptions) => {\n\tconst name = opts.name ?? DEFAULT_NAME;\n\tconst sealResource = makeSealResource(name);\n\tconst snap = makeKnownSnapshotable({ name });\n\n\treturn definePlugin({\n\t\tid: sealResource.id,\n\t\trole: 'task',\n\t\tstart: () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst mode: SealMode = { mode: 'fork-known', name, ...opts };\n\t\t\t\tconst publisher = yield* ArtifactPublisherService;\n\t\t\t\tconst resolved = (yield* bootSealService(publisher, mode)) as SealKnownResolved;\n\t\t\t\treturn {\n\t\t\t\t\t...resolved.keyServer,\n\t\t\t\t\tmode: 'fork-known',\n\t\t\t\t\tmanager: null,\n\t\t\t\t} satisfies SealResolved;\n\t\t\t}),\n\t\tcapabilities: ({ value: resolvedKs }) => {\n\t\t\tconst bindings: SealBindings = {\n\t\t\t\tname,\n\t\t\t\tobjectId: resolvedKs.objectId,\n\t\t\t\tkeyServerUrl: resolvedKs.keyServerUrl,\n\t\t\t\tserverConfigs: resolvedKs.serverConfigs,\n\t\t\t\tmode: 'fork-known',\n\t\t\t};\n\t\t\treturn [snap, makeSealCodegenable(bindings)] as const;\n\t\t},\n\t\terrorContributions: sealErrorContributions,\n\t});\n};\n\n// ---------------------------------------------------------------------------\n// User-facing factories\n// ---------------------------------------------------------------------------\n\n/** Explicit Seal factory. `local-keygen` requires a signer; live and\n *  fork-known modes must be selected directly or through `sealFor`. */\nexport const seal = <const Signer extends SealSignerMember = SealSignerMember>(\n\topts: SealOptions<Signer>,\n) => {\n\tswitch (opts.mode) {\n\t\tcase 'local-keygen':\n\t\t\treturn buildLocalKeygenPlugin(opts);\n\t\tcase 'live':\n\t\t\treturn buildLivePlugin(opts);\n\t\tcase 'fork-known':\n\t\t\treturn buildForkKnownPlugin(opts);\n\t}\n};\n\n/** Mode-narrowed factory namespace.\n *\n *  Usage:\n *      const local = { mode: 'local' } as const;\n *      sealFor(local).localKeygen({signer})    // OK\n *      sealFor(local).forkKnown(...)           // type error: not in 'local' branch\n *\n *      const fork = { mode: 'fork' } as const;\n *      sealFor(fork).forkKnown({upstream})     // OK\n *      sealFor(fork).localKeygen({signer})     // type error: not in 'fork' branch\n *                                              // (distilled-doc invariant #8)\n *\n *  Distilled-doc invariant #8 (fork-localkeygen-refused): the\n *  fork-mode branch has NO `localKeygen` entry — that's the\n *  type-level refusal. */\nexport const sealFor = defineModeNamespace({\n\tlocal: {\n\t\tlocalKeygen: <const Signer extends SealSignerMember>(opts: SealLocalKeygenOptions<Signer>) =>\n\t\t\tbuildLocalKeygenPlugin(opts),\n\t},\n\tlive: {\n\t\ttestnet: (opts: Omit<SealLiveOptions, 'network'> = {}) =>\n\t\t\tbuildLivePlugin({ network: 'testnet', ...opts }),\n\t\tmainnet: (opts: Omit<SealLiveOptions, 'network'> = {}) =>\n\t\t\tbuildLivePlugin({ network: 'mainnet', ...opts }),\n\t\tcustom: (\n\t\t\topts: Required<Pick<SealLiveOptions, 'objectId' | 'keyServerUrl'>> & SealLiveOptions,\n\t\t) => buildLivePlugin(opts),\n\t},\n\tfork: {\n\t\tforkKnown: (opts: SealForkKnownOptions) => buildForkKnownPlugin(opts),\n\t},\n});\n\n// ---------------------------------------------------------------------------\n// Type-only error re-export\n// ---------------------------------------------------------------------------\n\nexport type { SealError as SealAcquireError };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4EA,MAAM,yBAAyB,yBAAyB,gBAAgB;;AAsFxE,MAAM,eAAe;;;;;;;AAQrB,MAAM,0BACL,SACI;CAIJ,MAAM,WAAW,0BAA0B,MAAM,yBAAyB;AAI1E,QAAO,aAAa;EACnB,IAHoB,iBAAiB,SAAS,KAG9B,CAAC;EACjB,WAAW;GAAE,KAAK;GAAa,QAAQ,KAAK;GAAQ;EACpD,MAAM;EACN,WAAW,cAAc,SAAS,KAAK;EACvC,QAAQ,SACP,OAAO,IAAI,aAAa;GACvB,MAAM,EAAE,KAAK,QAAQ,kBAAkB;GAgBvC,MAAM,UAAU,OAAO;GACvB,MAAM,WAAW,OAAO;GACxB,MAAM,YAAY,OAAO;GACzB,MAAM,aAAa,OAAO;GAC1B,MAAM,KAAK,OAAO,WAAW;GAC7B,MAAM,OAAO,OAAO,KAAK;GACzB,MAAM,QAAQ,OAAO,cAAkC,IAAI,MAAM;GAKjE,MAAM,cAAc,KAAK,KAAK,WAAW,WAAW,QAAQ,SAAS,KAAK;AAC1E,UAAO,GACL,cAAc,aAAa,EAAE,WAAW,MAAM,CAAC,CAC/C,KAAK,OAAO,YAAY,OAAO,KAAK,CAAC;GAWvC,MAAM,kBAAkB,qBAAqB,SAAS,KAAK,SAAS,OAAO,SAAS,KAAK;GACzF,MAAM,qBAAqB,IAAI,YAAY;GAC3C,MAAM,SAAS,8BAA8B;IAC5C,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,MAAM;IACN,CAAC;GASF,MAAM,mBAAmB,uBAAuB;IAC/C,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,UAAU,SAAS;IACnB,CAAC;AACF,UAAO,QAAQ,cACd,sBACC;IACC,MAAM;IACN,KAAK,SAAS;IACd,OAAO,SAAS;IAChB,EACD,iBACA,CACD;GAwBD,MAAM,OAAQ,OAAO,gBACpB;IAtBA;IACA;IACA,QAAQ;IACR,KAAK,IAAI;IACT,GAAI,IAAI,eAAe,OAAO,EAAE,YAAY,IAAI,YAAY,GAAG,EAAE;IACjE,YAAY;IACZ,OAAO,IAAI;IACX;IACA,eAAe,YAAY,SAAS,IAAI,GAAG,SAAS,MAAM,QAAQ,SAAS,KAAK;IAChF,QAAQ;KACP,KAAK,SAAS;KACd,OAAO,SAAS;KAChB,QAAQ;KACR,MAAM;KACN;IACD,gBAAgB;IAChB;IACA,gBAAgB,OAAO;IACvB,WAAW,OAAO;IAIH,EACf,SACA;AAOD,UAAO;IAJN,GAAG,KAAK;IACR,MAAM;IACN,SAAS,KAAK;IAEK;IACnB;EAKH,eAAe,EAAE,OAAO,YAAY,SAAS,iBAAiB;GAC7D,MAAM,WAAyB;IAC9B,MAAM,SAAS;IACf,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,eAAe,WAAW;IAC1B,MAAM;IACN;AAWD,UAAO;IAVM,4BAA4B;KACxC,MAAM,SAAS;KACf,KAAK,WAAW,SAAS;KACzB,OAAO,WAAW,SAAS;KAC3B,CAMW;IALI,oBAAoB,SAKf;IAJJ,iBAAiB;KACjC,MAAM,SAAS;KACf,eAAe,YAAY,WAAW,SAAS,IAAI,GAAG,WAAW,SAAS,MAAM,QAAQ,SAAS,KAAK;KACtG,CAC8B;IAAC;;EAEjC,oBAAoB;EACpB,CAAC;;;AAIH,MAAM,mBAAmB,SAA0B;CAClD,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,eAAe,iBAAiB,KAAK;CAG3C,MAAM,YAAY,mBAAmB;EAAE;EAAM,GAAG;EAAM,CAAC;CACvD,MAAM,WAAyB;EAC9B;EACA,UAAU,UAAU;EACpB,cAAc,UAAU;EACxB,eAAe,CAAC;GAAE,UAAU,UAAU;GAAU,QAAQ;GAAG,CAAC;EAC5D,MAAM;EACN;CACD,MAAM,OAAO,sBAAsB,EAAE,MAAM,CAAC;CAC5C,MAAM,UAAU,oBAAoB,SAAS;AAE7C,QAAO,aAAa;EACnB,IAAI,aAAa;EACjB,MAAM;EACN,aACC,OAAO,IAAI,aAAa;GACvB,MAAM,OAAiB;IAAE,MAAM;IAAQ;IAAM,GAAG;IAAM;AAGtD,UAAO;IACN,IAAG,OAFqB,gBAAgB,OADhB,0BAC2B,KAAK,EAE5C;IACZ,MAAM;IACN,SAAS;IACT;IACA;EACH,cAAc,CAAC,MAAM,QAAQ;EAC7B,oBAAoB;EACpB,CAAC;;;;;;AAOH,MAAM,wBAAwB,SAA+B;CAC5D,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,eAAe,iBAAiB,KAAK;CAC3C,MAAM,OAAO,sBAAsB,EAAE,MAAM,CAAC;AAE5C,QAAO,aAAa;EACnB,IAAI,aAAa;EACjB,MAAM;EACN,aACC,OAAO,IAAI,aAAa;GACvB,MAAM,OAAiB;IAAE,MAAM;IAAc;IAAM,GAAG;IAAM;AAG5D,UAAO;IACN,IAAG,OAFqB,gBAAgB,OADhB,0BAC2B,KAAK,EAE5C;IACZ,MAAM;IACN,SAAS;IACT;IACA;EACH,eAAe,EAAE,OAAO,iBAAiB;AAQxC,UAAO,CAAC,MAAM,oBAAoB;IANjC;IACA,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,eAAe,WAAW;IAC1B,MAAM;IAEmC,CAAC,CAAC;;EAE7C,oBAAoB;EACpB,CAAC;;;;AASH,MAAa,QACZ,SACI;AACJ,SAAQ,KAAK,MAAb;EACC,KAAK,eACJ,QAAO,uBAAuB,KAAK;EACpC,KAAK,OACJ,QAAO,gBAAgB,KAAK;EAC7B,KAAK,aACJ,QAAO,qBAAqB,KAAK;;;;;;;;;;;;;;;;;;AAmBpC,MAAa,UAAU,oBAAoB;CAC1C,OAAO,EACN,cAAqD,SACpD,uBAAuB,KAAK,EAC7B;CACD,MAAM;EACL,UAAU,OAAyC,EAAE,KACpD,gBAAgB;GAAE,SAAS;GAAW,GAAG;GAAM,CAAC;EACjD,UAAU,OAAyC,EAAE,KACpD,gBAAgB;GAAE,SAAS;GAAW,GAAG;GAAM,CAAC;EACjD,SACC,SACI,gBAAgB,KAAK;EAC1B;CACD,MAAM,EACL,YAAY,SAA+B,qBAAqB,KAAK,EACrE;CACD,CAAC"}

package/dist/plugins/seal/key-manager.d.mts

@@ -0,0 +1,22 @@
+import { SealError } from "./errors.mjs";
+import { Effect } from "effect";
+
+//#region src/plugins/seal/key-manager.d.ts
+/** Local-only admin handle. Produced by the `localKeygen` mode ONLY
+ *  (distilled-doc invariant #15 — known-deployment modes do NOT
+ *  produce a manager, since we don't own the master key).
+ *
+ *  Fields:
+ *   - `masterKeyEnvFile` — absolute path to the 0o600 env-file
+ *     (snapshot-survived).
+ *   - `rotate` — re-derive the BLS keypair, register a fresh
+ *     on-chain `KeyServer`, restart the container. NOT a hot-swap
+ *     (callers that captured the read-side tag before rotate hold
+ *     pre-rotation values until a hot-restart). */
+interface SealKeyManager {
+  readonly masterKeyEnvFile: string;
+  readonly rotate: Effect.Effect<void, SealError>;
+}
+//#endregion
+export { SealKeyManager };
+//# sourceMappingURL=key-manager.d.mts.map

package/dist/plugins/seal/key-manager.mjs

@@ -0,0 +1,22 @@
+import { sealError } from "./errors.mjs";
+import { Effect } from "effect";
+//#region src/plugins/seal/key-manager.ts
+const makeKeyManager = (inputs) => ({
+	masterKeyEnvFile: inputs.masterKeyEnvFile,
+	rotate: inputs.rotateImpl
+});
+/** The full rotate pipeline (regenerate keypair → register new
+*  on-chain `KeyServer` object → re-render config + env-file →
+*  restart container → re-probe `/health` → atomically update the
+*  state-store cache) is not implemented in this branch. The
+*  rotateImpl placeholder fails-closed with a typed `rotate`-phase
+*  error so callers see an actionable failure rather than silently
+*  succeeding. */
+const stubRotate = (name) => Effect.fail(sealError("rotate", {
+	name,
+	message: "seal.key-manager: rotate is not implemented in this branch"
+}));
+//#endregion
+export { makeKeyManager, stubRotate };
+
+//# sourceMappingURL=key-manager.mjs.map

package/dist/plugins/seal/key-manager.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-manager.mjs","names":[],"sources":["../../../src/plugins/seal/key-manager.ts"],"sourcesContent":["// Seal plugin — master-key staging + rotate.\n//\n// Distilled-doc invariant #23: the `R` channel on\n// `SealKeyManager.rotate` MUST be `never`. The acquire body\n// captures the substrate services (ChildProcessSpawner, Identity,\n// ContainerRuntime) at acquire-time and pre-provides them via\n// `Effect.provideService` so the surfaced `rotate` is\n// `Effect<void, SealError>`.\n//\n// This file declares the user-facing `SealKeyManager` shape; the\n// rotate body is supplied by the caller (mode/local-keygen.ts) as\n// a pre-provided closure.\n\nimport { Effect } from 'effect';\n\nimport { sealError, type SealError } from './errors.ts';\n\n// ---------------------------------------------------------------------------\n// User-facing shape — distilled doc §\"SealKeyManager interface\"\n// ---------------------------------------------------------------------------\n\n/** Local-only admin handle. Produced by the `localKeygen` mode ONLY\n *  (distilled-doc invariant #15 — known-deployment modes do NOT\n *  produce a manager, since we don't own the master key).\n *\n *  Fields:\n *   - `masterKeyEnvFile` — absolute path to the 0o600 env-file\n *     (snapshot-survived).\n *   - `rotate` — re-derive the BLS keypair, register a fresh\n *     on-chain `KeyServer`, restart the container. NOT a hot-swap\n *     (callers that captured the read-side tag before rotate hold\n *     pre-rotation values until a hot-restart). */\nexport interface SealKeyManager {\n\treadonly masterKeyEnvFile: string;\n\treadonly rotate: Effect.Effect<void, SealError>;\n}\n\n// ---------------------------------------------------------------------------\n// makeKeyManager — pre-provides the substrate services\n// ---------------------------------------------------------------------------\n\n/** Inputs the manager closes over. The caller (mode/local-keygen.ts)\n *  has already captured the substrate services AND the per-instance\n *  context (name, signer, image, etc.); this helper just assembles\n *  the consumer-facing shape with `rotate` bound. */\nexport interface MakeKeyManagerInputs {\n\treadonly name: string;\n\treadonly masterKeyEnvFile: string;\n\t/** The rotate body, with services already provided. Distilled-doc\n\t *  invariant #23 — `R = never` on the consumer-facing surface. */\n\treadonly rotateImpl: Effect.Effect<void, SealError>;\n}\n\nexport const makeKeyManager = (inputs: MakeKeyManagerInputs): SealKeyManager => ({\n\tmasterKeyEnvFile: inputs.masterKeyEnvFile,\n\trotate: inputs.rotateImpl,\n});\n\n// ---------------------------------------------------------------------------\n// Rotate body — not implemented in this branch\n// ---------------------------------------------------------------------------\n\n/** The full rotate pipeline (regenerate keypair → register new\n *  on-chain `KeyServer` object → re-render config + env-file →\n *  restart container → re-probe `/health` → atomically update the\n *  state-store cache) is not implemented in this branch. The\n *  rotateImpl placeholder fails-closed with a typed `rotate`-phase\n *  error so callers see an actionable failure rather than silently\n *  succeeding. */\nexport const stubRotate = (name: string): Effect.Effect<void, SealError> =>\n\tEffect.fail(\n\t\tsealError('rotate', {\n\t\t\tname,\n\t\t\tmessage: 'seal.key-manager: rotate is not implemented in this branch',\n\t\t}),\n\t);\n"],"mappings":";;;AAqDA,MAAa,kBAAkB,YAAkD;CAChF,kBAAkB,OAAO;CACzB,QAAQ,OAAO;CACf;;;;;;;;AAaD,MAAa,cAAc,SAC1B,OAAO,KACN,UAAU,UAAU;CACnB;CACA,SAAS;CACT,CAAC,CACF"}

package/dist/plugins/seal/key-server.mjs

@@ -0,0 +1,175 @@
+import { ProbeTimeoutError, exitCodeProbeResult, waitForProbe } from "../../substrate/runtime/probes.mjs";
+import { ensureManagedContainer } from "../../substrate/runtime/managed-container.mjs";
+import { DEFAULT_KEY_SERVER_PORT, SEAL_KEY_SERVER_ENDPOINT_NAME } from "./routable.mjs";
+import { sealError } from "./errors.mjs";
+import { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from "./keygen.mjs";
+import { Effect } from "effect";
+import { basename, dirname } from "node:path";
+/** Inside-container config path. The binary reads `CONFIG_PATH` to
+*  locate the rendered yaml. */
+const INSIDE_CONFIG_PATH = "/etc/seal/key-server-config.yaml";
+/** Inside-container master-key env-file path. The entrypoint shell
+*  sources this before exec'ing the daemon (Hard requirement #3 +
+*  #7). */
+const INSIDE_MASTER_KEY_ENVFILE = "/etc/seal/master-key.env";
+const INSIDE_RUNTIME_ROOT = "/devstack/runtime";
+/** Container-side env defaults. NB: `MASTER_KEY` is NOT here — it
+*  flows via the bind-mounted env-file sourced by the entrypoint
+*  shell. Distilled-doc invariant #3. */
+const CONTAINER_ENV = {
+	CONFIG_PATH: INSIDE_CONFIG_PATH,
+	MASTER_KEY_ENVFILE: INSIDE_MASTER_KEY_ENVFILE,
+	RUST_LOG: "info"
+};
+const HOST_GATEWAY_EXTRA_HOSTS = { "host.docker.internal": "host-gateway" };
+const buildSealNetworkName = (app, stack, sealName) => `devstack-${app}-${stack}-seal-${sealName}-net`;
+/** Seal's key-server network gets a deterministic /24 so repeated
+*  local runs do not consume Docker's default bridge address pools. */
+const deriveSealSubnetPrefix = (identity) => {
+	const key = `${identity.app}\0${identity.stack}\0${identity.sealName}\0seal`;
+	let hash = 2166136261;
+	for (let i = 0; i < key.length; i += 1) {
+		hash ^= key.charCodeAt(i);
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	const bucket = hash % (64 * 256);
+	return `10.${128 + Math.floor(bucket / 256)}.${bucket % 256}`;
+};
+const sealNetworkCreateSpec = (spec, subnetPrefix) => ({
+	...spec,
+	subnet: `${subnetPrefix}.0/24`,
+	gateway: `${subnetPrefix}.1`
+});
+/** Per-probe interval inside the bounded retry. */
+const READY_PROBE_INTERVAL_MS = 500;
+/** Build the container spec. Distilled-doc invariants #1, #3, #5
+*  encoded here:
+*
+*   - `routedUrl` is the SAME value the on-chain Move call registers.
+*   - `env` is `CONTAINER_ENV` (no MASTER_KEY); `masterKeyEnvFileHostPath`
+*     bind-mount carries the secret.
+*   - `routing[]` lists the seal-key-server entrypoint; the spec returned has
+*     NO `ports:` field (it's not modelled). */
+const buildKeyServerSpec = (inputs) => {
+	const masterKeyEnvFileHostPath = `${inputs.servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;
+	const configHostPath = `${inputs.servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;
+	const runtimeRootHostPath = dirname(dirname(inputs.servicePath));
+	const serviceDirName = basename(inputs.servicePath);
+	const configContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${KEY_SERVER_CONFIG_BASENAME}`;
+	const masterKeyEnvFileContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${MASTER_KEY_ENVFILE_BASENAME}`;
+	inputs.routedHostname;
+	return {
+		image: inputs.image,
+		containerName: inputs.containerName,
+		labels: inputs.labels,
+		configHostPath,
+		masterKeyEnvFileHostPath,
+		runtimeRootHostPath,
+		configContainerPath,
+		masterKeyEnvFileContainerPath,
+		configFingerprint: inputs.configFingerprint,
+		network: inputs.suiNetwork,
+		routing: [{
+			name: SEAL_KEY_SERVER_ENDPOINT_NAME,
+			entrypoint: SEAL_KEY_SERVER_ENDPOINT_NAME,
+			servicePort: DEFAULT_KEY_SERVER_PORT
+		}],
+		routedUrl: inputs.routedUrl,
+		readyTimeoutMs: inputs.readyTimeoutMs ?? 6e4,
+		stopGraceSeconds: 15,
+		containerPort: DEFAULT_KEY_SERVER_PORT
+	};
+};
+const buildKeyServerEnsureContainerSpec = (spec) => ({
+	name: spec.containerName,
+	image: spec.image,
+	labels: spec.labels,
+	recreate: "on-config-change",
+	configHash: [
+		"seal-key-server",
+		`runtime=${spec.runtimeRootHostPath}`,
+		`config=${spec.configContainerPath}`,
+		`master=${spec.masterKeyEnvFileContainerPath}`,
+		`content=${spec.configFingerprint}`,
+		`network=${spec.network}`
+	].join("|"),
+	env: {
+		...CONTAINER_ENV,
+		CONFIG_PATH: spec.configContainerPath,
+		MASTER_KEY_ENVFILE: spec.masterKeyEnvFileContainerPath
+	},
+	stopGraceSeconds: spec.stopGraceSeconds,
+	networkAttach: [spec.network],
+	extraHosts: HOST_GATEWAY_EXTRA_HOSTS,
+	mounts: [{
+		source: spec.runtimeRootHostPath,
+		target: INSIDE_RUNTIME_ROOT,
+		readonly: true
+	}]
+});
+/** Start the long-running key-server container.
+*
+*  Wiring:
+*
+*    1. `runtime.ensureContainer` — content-addressed image, label
+*       tuple, recreate-on-config-change. Two bind mounts: the
+*       rendered yaml (read-only) + the master-key env-file
+*       (read-only). NO `ports:` — Traefik dispatches by Host:
+*       header on the well-known `seal-key-server` entrypoint port.
+*    2. In-container ready probe via `runtime.exec` — issues an
+*       HTTP GET against `http://127.0.0.1:2024/health`. Bounded
+*       retries until `readyTimeoutMs`. We shell out to `curl`
+*       (present in the vendored `debian:bookworm-slim` base) +
+*       fall back to `nc -z` for the stub image which doesn't
+*       carry curl. Both probes hit the same socket; curl
+*       additionally confirms the binary has parsed CONFIG_PATH
+*       and is serving the upstream's `/health` route (returns
+*       `{name,version,status:"up"}` once boot completes —
+*       distilled-doc §"Container start + ready").
+*
+*  Stop semantics: scope-close runs `ensureContainer`'s finalizer
+*  which calls `docker stop` with the Seal-specific grace window. */
+const startKeyServer = (runtime, spec, name) => Effect.gen(function* () {
+	const { labels, ...containerSpec } = buildKeyServerEnsureContainerSpec(spec);
+	const handle = yield* ensureManagedContainer({
+		runtime,
+		labels,
+		spec: containerSpec,
+		mapError: (cause) => sealError("container", {
+			name,
+			message: `seal key-server (name=${spec.containerName}) ensureContainer failed: ${cause.reason}: ${cause.detail}`,
+			cause
+		})
+	});
+	const directProbeUrl = `http://127.0.0.1:${spec.containerPort}/health`;
+	yield* waitForProbe({
+		label: `seal.key-server.${name}`,
+		timeoutMs: spec.readyTimeoutMs,
+		intervalMs: READY_PROBE_INTERVAL_MS,
+		probe: () => runtime.exec(handle, [
+			"sh",
+			"-c",
+			`(command -v curl >/dev/null 2>&1 && curl -fsS -m 2 ${directProbeUrl} >/dev/null) || nc -z 127.0.0.1 ${spec.containerPort} || exit 1`
+		]).pipe(Effect.map(exitCodeProbeResult))
+	}).pipe(Effect.mapError((cause) => {
+		if (cause instanceof ProbeTimeoutError) return sealError("ready", {
+			name,
+			message: `seal key-server never became ready within ${spec.readyTimeoutMs}ms (directProbeUrl=${directProbeUrl}, routedUrl=${spec.routedUrl})`,
+			cause: cause.lastError ?? cause.lastNotReady ?? cause
+		});
+		return sealError("ready", {
+			name,
+			message: `seal key-server ready-probe exec failed: ${cause.reason}: ${cause.detail}`,
+			cause
+		});
+	}));
+	return { containerName: spec.containerName };
+}).pipe(Effect.withSpan("devstack.plugin.seal.keyServer.start", { attributes: {
+	"seal.name": name,
+	"seal.containerName": spec.containerName,
+	"seal.routedUrl": spec.routedUrl
+} }));
+//#endregion
+export { buildKeyServerSpec, buildSealNetworkName, deriveSealSubnetPrefix, sealNetworkCreateSpec, startKeyServer };
+
+//# sourceMappingURL=key-server.mjs.map

package/dist/plugins/seal/key-server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-server.mjs","names":[],"sources":["../../../src/plugins/seal/key-server.ts"],"sourcesContent":["// Seal plugin — long-running key-server container lifecycle.\n//\n// Distilled-doc invariants pinned by this file:\n//\n//   #1 (KeyServer.url == routed hostname): the URL handed to the\n//      on-chain Move call MUST equal the routed hostname stamped on\n//      the `seal-key-server` route. We resolve the URL ONCE via the\n//      router (see `routable.ts`) and pipe the same value into both\n//      the Move register pass (`deploy.ts` + `registry-publish.ts`)\n//      and this file's container spec.\n//\n//   #3 (env-file not -e MASTER_KEY=…): the container is launched\n//      with `envFiles: [<masterKeyEnvFile>]` and a `env:` map that\n//      does NOT contain `MASTER_KEY`. Distilled doc §Hard\n//      requirements #3 — the inline form surfaces the key in host\n//      process env + docker inspect output.\n//\n//      IMPLEMENTATION CONSTRAINT: the L1 `EnsureContainerSpec`\n//      contract today does NOT expose an `envFiles:` slot — only\n//      `env:`. We work around this by bind-mounting the env-file\n//      into the container under a stack-root bind mount; the cargo\n//      image's entrypoint shell (see Hard requirement #7) is\n//      responsible for `set -a; . \"$MASTER_KEY_ENVFILE\"; set +a`\n//      BEFORE exec'ing the daemon, so the secret never appears in\n//      `docker inspect`. ARCHITECTURE REVISION TRACKED: add `envFiles`\n//      to `EnsureContainerSpec`.\n//\n//   #5 (NO host-port publish): the `ports:` field is INTENTIONALLY\n//      absent from the `EnsureContainerSpec` we pass to the runtime.\n//      Traefik dispatches by Host: header from the well-known router\n//      entrypoint `seal-key-server`.\n//\n//   #7 (signal-forwarding entrypoint shell): the cargo-built image\n//      embeds the entrypoint shell that traps SIGTERM and forwards\n//      SIGTERM to the key-server child. Distilled doc §Hard\n//      requirements #21. The image declares the right entrypoint;\n//      this file does NOT re-declare it.\n\nimport { Effect, type Scope } from 'effect';\nimport { basename, dirname } from 'node:path';\n\nimport type {\n\tContainerHandle,\n\tContainerRuntime,\n\tEnsureContainerSpec,\n\tEnsureNetworkSpec,\n\tImageRef,\n} from '../../contracts/container-runtime.ts';\nimport type { ContainerLabelTuple } from '../../contracts/snapshotable.ts';\nimport {\n\tProbeTimeoutError,\n\texitCodeProbeResult,\n\twaitForProbe,\n} from '../../substrate/runtime/probes.ts';\nimport { ensureManagedContainer } from '../../substrate/runtime/managed-container.ts';\nimport { sealError, type SealError } from './errors.ts';\nimport { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from './keygen.ts';\nimport { DEFAULT_KEY_SERVER_PORT, SEAL_KEY_SERVER_ENDPOINT_NAME } from './routable.ts';\n\nexport { DEFAULT_KEY_SERVER_PORT } from './routable.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — mirror v3 `seal/internal.ts:102-103`\n// ---------------------------------------------------------------------------\n\n/** Default `/health` probe timeout. */\nexport const DEFAULT_READY_TIMEOUT_MS = 60_000 as const;\n\n/** Inside-container config path. The binary reads `CONFIG_PATH` to\n *  locate the rendered yaml. */\nexport const INSIDE_CONFIG_PATH = '/etc/seal/key-server-config.yaml' as const;\n\n/** Inside-container master-key env-file path. The entrypoint shell\n *  sources this before exec'ing the daemon (Hard requirement #3 +\n *  #7). */\nexport const INSIDE_MASTER_KEY_ENVFILE = '/etc/seal/master-key.env' as const;\n\nconst INSIDE_RUNTIME_ROOT = '/devstack/runtime' as const;\n\n/** Container-side env defaults. NB: `MASTER_KEY` is NOT here — it\n *  flows via the bind-mounted env-file sourced by the entrypoint\n *  shell. Distilled-doc invariant #3. */\nexport const CONTAINER_ENV: Readonly<Record<string, string>> = {\n\tCONFIG_PATH: INSIDE_CONFIG_PATH,\n\tMASTER_KEY_ENVFILE: INSIDE_MASTER_KEY_ENVFILE,\n\tRUST_LOG: 'info',\n};\n\nexport const HOST_GATEWAY_EXTRA_HOSTS: Readonly<Record<string, string>> = {\n\t'host.docker.internal': 'host-gateway',\n};\n\nexport const buildSealNetworkName = (app: string, stack: string, sealName: string): string =>\n\t`devstack-${app}-${stack}-seal-${sealName}-net`;\n\nexport interface SealNetworkIdentity {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly sealName: string;\n}\n\n/** Seal's key-server network gets a deterministic /24 so repeated\n *  local runs do not consume Docker's default bridge address pools. */\nexport const deriveSealSubnetPrefix = (identity: SealNetworkIdentity): string => {\n\tconst key = `${identity.app}\\0${identity.stack}\\0${identity.sealName}\\0seal`;\n\tlet hash = 0x811c9dc5;\n\tfor (let i = 0; i < key.length; i += 1) {\n\t\thash ^= key.charCodeAt(i);\n\t\thash = Math.imul(hash, 0x01000193) >>> 0;\n\t}\n\tconst bucket = hash % (64 * 256);\n\tconst secondOctet = 128 + Math.floor(bucket / 256);\n\tconst thirdOctet = bucket % 256;\n\treturn `10.${secondOctet}.${thirdOctet}`;\n};\n\nexport const sealNetworkCreateSpec = <Spec extends EnsureNetworkSpec>(\n\tspec: Spec,\n\tsubnetPrefix: string,\n): Spec & Required<Pick<EnsureNetworkSpec, 'subnet' | 'gateway'>> => ({\n\t...spec,\n\tsubnet: `${subnetPrefix}.0/24`,\n\tgateway: `${subnetPrefix}.1`,\n});\n\n/** Per-probe interval inside the bounded retry. */\nconst READY_PROBE_INTERVAL_MS = 500;\n\n// ---------------------------------------------------------------------------\n// Spec shape\n// ---------------------------------------------------------------------------\n\n/** The container spec produced for the long-running key-server. This\n *  is the substrate-blind value the ContainerRuntime adapter\n *  consumes. */\nexport interface KeyServerContainerSpec {\n\t/** Image ref from the Seal image resolver. */\n\treadonly image: ImageRef;\n\t/** Composed container name (substrate folds `<app>-<stack>-…`). */\n\treadonly containerName: string;\n\t/** Label tuple — drives the snapshot orchestrator's filter +\n\t *  `inspectByLabels`. */\n\treadonly labels: ContainerLabelTuple;\n\t/** Mount source on host — the rendered key-server-config.yaml. */\n\treadonly configHostPath: string;\n\t/** Env-file holding `MASTER_KEY=<hex>`. Mode-bit 0o600 inside\n\t *  0o700 parent. Distilled-doc invariant #2. Bind-mounted (see\n\t *  file header for the missing-envFiles workaround). */\n\treadonly masterKeyEnvFileHostPath: string;\n\t/** Mount source on host. Docker Desktop can reject freshly-created\n\t *  nested file/leaf-directory bind sources even when a parent mount\n\t *  can see them, so key-server mounts the stack root and points the\n\t *  entrypoint at the config/envfile inside that mount. */\n\treadonly runtimeRootHostPath: string;\n\treadonly configContainerPath: string;\n\treadonly masterKeyEnvFileContainerPath: string;\n\t/** Fingerprint of config contents that affect key-server boot. */\n\treadonly configFingerprint: string;\n\t/** Inner docker network for sui DNS resolution. */\n\treadonly network: string;\n\t/** Router routing spec — Traefik file-provider stamped per\n\t *  container. Distilled-doc invariant #5 (no host-port publish). */\n\treadonly routing: ReadonlyArray<{\n\t\treadonly name: string;\n\t\treadonly entrypoint: string;\n\t\treadonly servicePort: number;\n\t}>;\n\t/** Routed URL — `<routedUrl>/health` is what the ready probe\n\t *  would hit if/when an HTTP probe contract lands. Today we use\n\t *  an exec-based probe (see `startKeyServer`). */\n\treadonly routedUrl: string;\n\t/** Timeout for the ready probe. */\n\treadonly readyTimeoutMs: number;\n\t/** Graceful stop deadline. Distilled-doc invariant #21 — the\n\t *  entrypoint shell forwards Docker's SIGTERM to the key-server. */\n\treadonly stopGraceSeconds: number;\n\t/** In-container port the daemon binds. */\n\treadonly containerPort: number;\n}\n\n// ---------------------------------------------------------------------------\n// Spec builder\n// ---------------------------------------------------------------------------\n\n/** Inputs to assemble the container spec. */\nexport interface KeyServerSpecInputs {\n\treadonly name: string;\n\treadonly image: ImageRef;\n\treadonly containerName: string;\n\treadonly labels: ContainerLabelTuple;\n\treadonly suiNetwork: string;\n\treadonly servicePath: string;\n\treadonly configFingerprint: string;\n\treadonly routedHostname: string;\n\treadonly routedUrl: string;\n\treadonly readyTimeoutMs?: number;\n}\n\n/** Build the container spec. Distilled-doc invariants #1, #3, #5\n *  encoded here:\n *\n *   - `routedUrl` is the SAME value the on-chain Move call registers.\n *   - `env` is `CONTAINER_ENV` (no MASTER_KEY); `masterKeyEnvFileHostPath`\n *     bind-mount carries the secret.\n *   - `routing[]` lists the seal-key-server entrypoint; the spec returned has\n *     NO `ports:` field (it's not modelled). */\nexport const buildKeyServerSpec = (inputs: KeyServerSpecInputs): KeyServerContainerSpec => {\n\tconst masterKeyEnvFileHostPath = `${inputs.servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\tconst configHostPath = `${inputs.servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;\n\tconst runtimeRootHostPath = dirname(dirname(inputs.servicePath));\n\tconst serviceDirName = basename(inputs.servicePath);\n\tconst configContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${KEY_SERVER_CONFIG_BASENAME}`;\n\tconst masterKeyEnvFileContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\tvoid inputs.routedHostname; // flows through routedUrl\n\treturn {\n\t\timage: inputs.image,\n\t\tcontainerName: inputs.containerName,\n\t\tlabels: inputs.labels,\n\t\tconfigHostPath,\n\t\tmasterKeyEnvFileHostPath,\n\t\truntimeRootHostPath,\n\t\tconfigContainerPath,\n\t\tmasterKeyEnvFileContainerPath,\n\t\tconfigFingerprint: inputs.configFingerprint,\n\t\tnetwork: inputs.suiNetwork,\n\t\trouting: [\n\t\t\t{\n\t\t\t\tname: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\t\t\t\tentrypoint: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\t\t\t\tservicePort: DEFAULT_KEY_SERVER_PORT,\n\t\t\t},\n\t\t],\n\t\troutedUrl: inputs.routedUrl,\n\t\treadyTimeoutMs: inputs.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,\n\t\tstopGraceSeconds: 15,\n\t\tcontainerPort: DEFAULT_KEY_SERVER_PORT,\n\t};\n};\n\nexport const buildKeyServerEnsureContainerSpec = (\n\tspec: KeyServerContainerSpec,\n): EnsureContainerSpec => ({\n\tname: spec.containerName,\n\timage: spec.image,\n\tlabels: spec.labels,\n\trecreate: 'on-config-change',\n\tconfigHash: [\n\t\t'seal-key-server',\n\t\t`runtime=${spec.runtimeRootHostPath}`,\n\t\t`config=${spec.configContainerPath}`,\n\t\t`master=${spec.masterKeyEnvFileContainerPath}`,\n\t\t`content=${spec.configFingerprint}`,\n\t\t`network=${spec.network}`,\n\t].join('|'),\n\t// Distilled-doc invariant #3 — MASTER_KEY is NOT here.\n\t// The bind-mounted env-file is sourced by the entrypoint\n\t// shell BEFORE the daemon exec. See file header on the\n\t// L1 `envFiles:` gap.\n\tenv: {\n\t\t...CONTAINER_ENV,\n\t\tCONFIG_PATH: spec.configContainerPath,\n\t\tMASTER_KEY_ENVFILE: spec.masterKeyEnvFileContainerPath,\n\t},\n\tstopGraceSeconds: spec.stopGraceSeconds,\n\tnetworkAttach: [spec.network],\n\t// Distilled-doc invariant #5 — `ports` intentionally absent.\n\textraHosts: HOST_GATEWAY_EXTRA_HOSTS,\n\tmounts: [\n\t\t{\n\t\t\tsource: spec.runtimeRootHostPath,\n\t\t\ttarget: INSIDE_RUNTIME_ROOT,\n\t\t\treadonly: true,\n\t\t},\n\t],\n});\n\n// ---------------------------------------------------------------------------\n// Start procedure — real ContainerRuntime wiring\n// ---------------------------------------------------------------------------\n\n/** Start the long-running key-server container.\n *\n *  Wiring:\n *\n *    1. `runtime.ensureContainer` — content-addressed image, label\n *       tuple, recreate-on-config-change. Two bind mounts: the\n *       rendered yaml (read-only) + the master-key env-file\n *       (read-only). NO `ports:` — Traefik dispatches by Host:\n *       header on the well-known `seal-key-server` entrypoint port.\n *    2. In-container ready probe via `runtime.exec` — issues an\n *       HTTP GET against `http://127.0.0.1:2024/health`. Bounded\n *       retries until `readyTimeoutMs`. We shell out to `curl`\n *       (present in the vendored `debian:bookworm-slim` base) +\n *       fall back to `nc -z` for the stub image which doesn't\n *       carry curl. Both probes hit the same socket; curl\n *       additionally confirms the binary has parsed CONFIG_PATH\n *       and is serving the upstream's `/health` route (returns\n *       `{name,version,status:\"up\"}` once boot completes —\n *       distilled-doc §\"Container start + ready\").\n *\n *  Stop semantics: scope-close runs `ensureContainer`'s finalizer\n *  which calls `docker stop` with the Seal-specific grace window. */\nexport const startKeyServer = (\n\truntime: ContainerRuntime,\n\tspec: KeyServerContainerSpec,\n\tname: string,\n): Effect.Effect<{ readonly containerName: string }, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst ensureSpec = buildKeyServerEnsureContainerSpec(spec);\n\t\tconst { labels, ...containerSpec } = ensureSpec;\n\t\tconst handle: ContainerHandle = yield* ensureManagedContainer({\n\t\t\truntime,\n\t\t\tlabels,\n\t\t\tspec: containerSpec,\n\t\t\tmapError: (cause) =>\n\t\t\t\tsealError('container', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal key-server (name=${spec.containerName}) ensureContainer failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\n\t\t// Exec-based ready probe — distilled-doc §\"Container start +\n\t\t// ready\". The vendored debian:bookworm-slim base ships\n\t\t// `curl`; the e2e stub image (alpine) ships busybox `nc`. We\n\t\t// probe with curl first (real `/health` round-trip — confirms\n\t\t// the daemon parsed CONFIG_PATH AND bound the listener) and\n\t\t// fall back to `nc -z` (TCP-only — confirms only the socket\n\t\t// is listening). One of the two MUST succeed on a healthy\n\t\t// container.\n\t\t//\n\t\t// `/health` returns `{name, version, status: \"up\"}` once the\n\t\t// binary finishes config + master-key load. Pre-boot we\n\t\t// expect connection-refused → curl returns non-zero, retry.\n\t\tconst directProbeUrl = `http://127.0.0.1:${spec.containerPort}/health`;\n\t\tyield* waitForProbe({\n\t\t\tlabel: `seal.key-server.${name}`,\n\t\t\ttimeoutMs: spec.readyTimeoutMs,\n\t\t\tintervalMs: READY_PROBE_INTERVAL_MS,\n\t\t\tprobe: () =>\n\t\t\t\truntime\n\t\t\t\t\t.exec(handle, [\n\t\t\t\t\t\t'sh',\n\t\t\t\t\t\t'-c',\n\t\t\t\t\t\t`(command -v curl >/dev/null 2>&1 && ` +\n\t\t\t\t\t\t\t`curl -fsS -m 2 ${directProbeUrl} >/dev/null) ` +\n\t\t\t\t\t\t\t`|| nc -z 127.0.0.1 ${spec.containerPort} ` +\n\t\t\t\t\t\t\t`|| exit 1`,\n\t\t\t\t\t])\n\t\t\t\t\t.pipe(Effect.map(exitCodeProbeResult)),\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) => {\n\t\t\t\tif (cause instanceof ProbeTimeoutError) {\n\t\t\t\t\treturn sealError('ready', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t`seal key-server never became ready within ${spec.readyTimeoutMs}ms ` +\n\t\t\t\t\t\t\t`(directProbeUrl=${directProbeUrl}, routedUrl=${spec.routedUrl})`,\n\t\t\t\t\t\tcause: cause.lastError ?? cause.lastNotReady ?? cause,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn sealError('ready', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal key-server ready-probe exec failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\tcause,\n\t\t\t\t});\n\t\t\t}),\n\t\t);\n\n\t\treturn { containerName: spec.containerName };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.keyServer.start', {\n\t\t\tattributes: {\n\t\t\t\t'seal.name': name,\n\t\t\t\t'seal.containerName': spec.containerName,\n\t\t\t\t'seal.routedUrl': spec.routedUrl,\n\t\t\t},\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;AAsEA,MAAa,qBAAqB;;;;AAKlC,MAAa,4BAA4B;AAEzC,MAAM,sBAAsB;;;;AAK5B,MAAa,gBAAkD;CAC9D,aAAa;CACb,oBAAoB;CACpB,UAAU;CACV;AAED,MAAa,2BAA6D,EACzE,wBAAwB,gBACxB;AAED,MAAa,wBAAwB,KAAa,OAAe,aAChE,YAAY,IAAI,GAAG,MAAM,QAAQ,SAAS;;;AAU3C,MAAa,0BAA0B,aAA0C;CAChF,MAAM,MAAM,GAAG,SAAS,IAAI,IAAI,SAAS,MAAM,IAAI,SAAS,SAAS;CACrE,IAAI,OAAO;AACX,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;AACvC,UAAQ,IAAI,WAAW,EAAE;AACzB,SAAO,KAAK,KAAK,MAAM,SAAW,KAAK;;CAExC,MAAM,SAAS,QAAQ,KAAK;AAG5B,QAAO,MAFa,MAAM,KAAK,MAAM,SAAS,IAAI,CAEzB,GADN,SAAS;;AAI7B,MAAa,yBACZ,MACA,kBACqE;CACrE,GAAG;CACH,QAAQ,GAAG,aAAa;CACxB,SAAS,GAAG,aAAa;CACzB;;AAGD,MAAM,0BAA0B;;;;;;;;;AAgFhC,MAAa,sBAAsB,WAAwD;CAC1F,MAAM,2BAA2B,GAAG,OAAO,YAAY,GAAG;CAC1D,MAAM,iBAAiB,GAAG,OAAO,YAAY,GAAG;CAChD,MAAM,sBAAsB,QAAQ,QAAQ,OAAO,YAAY,CAAC;CAChE,MAAM,iBAAiB,SAAS,OAAO,YAAY;CACnD,MAAM,sBAAsB,GAAG,oBAAoB,QAAQ,eAAe,GAAG;CAC7E,MAAM,gCAAgC,GAAG,oBAAoB,QAAQ,eAAe,GAAG;AAClF,QAAO;AACZ,QAAO;EACN,OAAO,OAAO;EACd,eAAe,OAAO;EACtB,QAAQ,OAAO;EACf;EACA;EACA;EACA;EACA;EACA,mBAAmB,OAAO;EAC1B,SAAS,OAAO;EAChB,SAAS,CACR;GACC,MAAM;GACN,YAAY;GACZ,aAAa;GACb,CACD;EACD,WAAW,OAAO;EAClB,gBAAgB,OAAO,kBAAA;EACvB,kBAAkB;EAClB,eAAe;EACf;;AAGF,MAAa,qCACZ,UAC0B;CAC1B,MAAM,KAAK;CACX,OAAO,KAAK;CACZ,QAAQ,KAAK;CACb,UAAU;CACV,YAAY;EACX;EACA,WAAW,KAAK;EAChB,UAAU,KAAK;EACf,UAAU,KAAK;EACf,WAAW,KAAK;EAChB,WAAW,KAAK;EAChB,CAAC,KAAK,IAAI;CAKX,KAAK;EACJ,GAAG;EACH,aAAa,KAAK;EAClB,oBAAoB,KAAK;EACzB;CACD,kBAAkB,KAAK;CACvB,eAAe,CAAC,KAAK,QAAQ;CAE7B,YAAY;CACZ,QAAQ,CACP;EACC,QAAQ,KAAK;EACb,QAAQ;EACR,UAAU;EACV,CACD;CACD;;;;;;;;;;;;;;;;;;;;;;;AA4BD,MAAa,kBACZ,SACA,MACA,SAEA,OAAO,IAAI,aAAa;CAEvB,MAAM,EAAE,QAAQ,GAAG,kBADA,kCAAkC,KACN;CAC/C,MAAM,SAA0B,OAAO,uBAAuB;EAC7D;EACA;EACA,MAAM;EACN,WAAW,UACV,UAAU,aAAa;GACtB;GACA,SAAS,yBAAyB,KAAK,cAAc,4BAA4B,MAAM,OAAO,IAAI,MAAM;GACxG;GACA,CAAC;EACH,CAAC;CAcF,MAAM,iBAAiB,oBAAoB,KAAK,cAAc;AAC9D,QAAO,aAAa;EACnB,OAAO,mBAAmB;EAC1B,WAAW,KAAK;EAChB,YAAY;EACZ,aACC,QACE,KAAK,QAAQ;GACb;GACA;GACA,sDACmB,eAAe,kCACX,KAAK,cAAc;GAE1C,CAAC,CACD,KAAK,OAAO,IAAI,oBAAoB,CAAC;EACxC,CAAC,CAAC,KACF,OAAO,UAAU,UAAU;AAC1B,MAAI,iBAAiB,kBACpB,QAAO,UAAU,SAAS;GACzB;GACA,SACC,6CAA6C,KAAK,eAAe,qBAC9C,eAAe,cAAc,KAAK,UAAU;GAChE,OAAO,MAAM,aAAa,MAAM,gBAAgB;GAChD,CAAC;AAEH,SAAO,UAAU,SAAS;GACzB;GACA,SAAS,4CAA4C,MAAM,OAAO,IAAI,MAAM;GAC5E;GACA,CAAC;GACD,CACF;AAED,QAAO,EAAE,eAAe,KAAK,eAAe;EAC3C,CAAC,KACF,OAAO,SAAS,wCAAwC,EACvD,YAAY;CACX,aAAa;CACb,sBAAsB,KAAK;CAC3B,kBAAkB,KAAK;CACvB,EACD,CAAC,CACF"}