@mysten-incubation/devstack 0.0.0

package/dist/plugins/walrus/snapshot.mjs

@@ -0,0 +1,53 @@
+import { Effect } from "effect";
+//#region src/plugins/walrus/snapshot.ts
+/** Build the Snapshotable contribution.
+*
+*  `app` / `stack` / `walrusName` are resolved at the plugin's
+*  acquire-time so the snapshot's identity guard can match the
+*  plugin's actual container labels.
+*
+*  `nodeCount` (local mode only) drives the per-node managed-container
+*  decls. Each storage node carries `role: storage-node-${i}` so the
+*  substrate's label filter pauses/commits each independently. */
+const makeSnapshotable = (mode, app, stack, walrusName, chain, nodeCount = 1) => {
+	const labels = (role) => ({
+		app,
+		stack,
+		plugin: "walrus",
+		role
+	});
+	switch (mode) {
+		case "local": {
+			const perNodeContainers = Array.from({ length: nodeCount }, (_, i) => labels(`storage-node-${i}`));
+			return {
+				kind: "snapshotable",
+				subtrees: [`walrus/${walrusName}/deploy/`],
+				managedContainers: perNodeContainers,
+				missingTolerance: "fine",
+				preRestore: Effect.succeed({
+					kind: "walrus",
+					mode: "local",
+					name: walrusName,
+					nodeCount,
+					chain
+				}),
+				postRestore: Effect.void,
+				secretMaterial: true
+			};
+		}
+		case "known": return {
+			kind: "snapshotable",
+			subtrees: [],
+			missingTolerance: "fine",
+			preRestore: Effect.succeed({
+				kind: "walrus",
+				mode: "known",
+				chain
+			})
+		};
+	}
+};
+//#endregion
+export { makeSnapshotable };
+
+//# sourceMappingURL=snapshot.mjs.map

package/dist/plugins/walrus/snapshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/walrus/snapshot.ts"],"sourcesContent":["// Walrus plugin — Snapshotable contribution.\n//\n// Distilled-doc reference (06-walrus.md §\"Persistence model\" +\n// §\"Hard requirements\" item 7):\n//   - `runtime/walrus/<name>/deploy/` MUST ride the snapshot tar.\n//     It holds storage-node private keys + per-node configs that\n//     `walrus-deploy` wrote; without them, a state-store entry that\n//     says \"walrus is already deployed\" cannot be honored on resume.\n//   - Local cluster: N storage-node containers' writable layers\n//     hold RocksDB at `/var/walrus/storage` — managed-containers\n//     declaration; runtime adapter pauses then `docker commit`.\n//     Per-node label tuple `role: storage-node-${i}` so the snapshot\n//     orchestrator's label filter resolves each node distinctly.\n//   - Known-deployment: no containers, no subtrees. The shape still\n//     exists so the identity guard fires on restore.\n//\n// Identity guard: contributes the deploy mode + chainId + (when\n// local) the `name` discriminator to the pre-restore identity\n// record. A snapshot taken in local mode restored under known\n// mode (or vice versa) refuses BEFORE any destructive mutation.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\n/** Discriminator passed to `makeSnapshotable` — narrower than the\n *  full mode union because the snapshot shape only cares about\n *  \"local with containers\" vs \"known with nothing\". */\nexport type WalrusSnapshotMode = 'local' | 'known';\n\n/** Build the Snapshotable contribution.\n *\n *  `app` / `stack` / `walrusName` are resolved at the plugin's\n *  acquire-time so the snapshot's identity guard can match the\n *  plugin's actual container labels.\n *\n *  `nodeCount` (local mode only) drives the per-node managed-container\n *  decls. Each storage node carries `role: storage-node-${i}` so the\n *  substrate's label filter pauses/commits each independently. */\nexport const makeSnapshotable = (\n\tmode: WalrusSnapshotMode,\n\tapp: string,\n\tstack: string,\n\twalrusName: string,\n\tchain: string,\n\tnodeCount = 1,\n): SnapshotableDecl => {\n\tconst labels = (role: string): ContainerLabelTuple => ({\n\t\tapp,\n\t\tstack,\n\t\tplugin: 'walrus',\n\t\trole,\n\t});\n\n\tswitch (mode) {\n\t\tcase 'local': {\n\t\t\tconst perNodeContainers: ReadonlyArray<ContainerLabelTuple> = Array.from(\n\t\t\t\t{ length: nodeCount },\n\t\t\t\t(_, i) => labels(`storage-node-${i}`),\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\t// `runtime/walrus/<name>/deploy/` — the deploy one-shot's\n\t\t\t\t// output dir. The substrate's runtime-dir root is\n\t\t\t\t// resolved at acquire; the path here is relative to it.\n\t\t\t\tsubtrees: [`walrus/${walrusName}/deploy/`],\n\t\t\t\tmanagedContainers: perNodeContainers,\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\t// Storage nodes need >10s to flush + checkpoint RocksDB\n\t\t\t\t// on `docker stop`; the snapshot quiesce mirrors the\n\t\t\t\t// stop grace (distilled-doc invariant 22). Default\n\t\t\t\t// \"pause container\" gives us this for free in the\n\t\t\t\t// substrate's adapter.\n\t\t\t\tpreRestore: Effect.succeed({\n\t\t\t\t\tkind: 'walrus' as const,\n\t\t\t\t\tmode: 'local' as const,\n\t\t\t\t\tname: walrusName,\n\t\t\t\t\tnodeCount,\n\t\t\t\t\tchain,\n\t\t\t\t}),\n\t\t\t\tpostRestore: Effect.void,\n\t\t\t\t// Storage-node keystores are secret material; the\n\t\t\t\t// substrate preserves 0o600 on round-trip.\n\t\t\t\tsecretMaterial: true,\n\t\t\t};\n\t\t}\n\t\tcase 'known': {\n\t\t\treturn {\n\t\t\t\tkind: 'snapshotable',\n\t\t\t\tsubtrees: [],\n\t\t\t\tmissingTolerance: 'fine',\n\t\t\t\tpreRestore: Effect.succeed({\n\t\t\t\t\tkind: 'walrus' as const,\n\t\t\t\t\tmode: 'known' as const,\n\t\t\t\t\tchain,\n\t\t\t\t}),\n\t\t\t};\n\t\t}\n\t}\n};\n"],"mappings":";;;;;;;;;;;AAuCA,MAAa,oBACZ,MACA,KACA,OACA,YACA,OACA,YAAY,MACU;CACtB,MAAM,UAAU,UAAuC;EACtD;EACA;EACA,QAAQ;EACR;EACA;AAED,SAAQ,MAAR;EACC,KAAK,SAAS;GACb,MAAM,oBAAwD,MAAM,KACnE,EAAE,QAAQ,WAAW,GACpB,GAAG,MAAM,OAAO,gBAAgB,IAAI,CACrC;AACD,UAAO;IACN,MAAM;IAIN,UAAU,CAAC,UAAU,WAAW,UAAU;IAC1C,mBAAmB;IACnB,kBAAkB;IAMlB,YAAY,OAAO,QAAQ;KAC1B,MAAM;KACN,MAAM;KACN,MAAM;KACN;KACA;KACA,CAAC;IACF,aAAa,OAAO;IAGpB,gBAAgB;IAChB;;EAEF,KAAK,QACJ,QAAO;GACN,MAAM;GACN,UAAU,EAAE;GACZ,kBAAkB;GAClB,YAAY,OAAO,QAAQ;IAC1B,MAAM;IACN,MAAM;IACN;IACA,CAAC;GACF"}

package/dist/plugins/walrus/storage-nodes.d.mts

@@ -0,0 +1,15 @@
+import { Effect, Scope } from "effect";
+
+//#region src/plugins/walrus/storage-nodes.d.ts
+/** Per-node descriptor — what the plugin resolved value surfaces
+ *  for downstream consumers (the `@mysten/walrus` SDK reads this). */
+interface WalrusStorageNode {
+  readonly nodeIndex: number;
+  readonly nodeId: string;
+  readonly publicKey: string;
+  readonly publicHostname: string;
+  readonly rpcUrl: string;
+}
+//#endregion
+export { WalrusStorageNode };
+//# sourceMappingURL=storage-nodes.d.mts.map

package/dist/plugins/walrus/storage-nodes.mjs

@@ -0,0 +1,154 @@
+import { ProbeTimeoutError, exitCodeProbeResult, waitForProbe } from "../../substrate/runtime/probes.mjs";
+import { ensureManagedContainer } from "../../substrate/runtime/managed-container.mjs";
+import { setCurrentPluginPhase } from "../../substrate/runtime/current-plugin.mjs";
+import { walrusDeployMountPaths } from "./deploy-paths.mjs";
+import { walrusPluginError } from "./errors.mjs";
+import { Duration, Effect, Scope } from "effect";
+/** Default per-node ready-probe timeout. */
+const DEFAULT_NODE_READY_TIMEOUT_MS = 6e4;
+/** Distilled-doc invariant 9: the on-chain `public_port` value
+*  matches the global router entrypoint port. One canonical
+*  constant — opportunity #14 in the distilled doc was to deduplicate
+*  this across three files. */
+const WALRUS_ROUTER_PORT = 9185;
+/** Default container API port — each storage node binds this inside
+*  the container. Same value as the router port (the storage node's
+*  in-container bind matches the on-chain public_port). */
+const DEFAULT_CONTAINER_API_PORT = WALRUS_ROUTER_PORT;
+/** Compute the public hostname for one storage node. Mirrors
+*  v3's `routerHostname(identity, 'walrus-node-' + i)` shape
+*  (06-walrus.md §"Routes registered"). Main stack omits the stack
+*  segment; non-main inserts it after the service label. */
+const computePublicHostname = (app, stack, nodeIndex) => {
+	const base = `walrus-node-${nodeIndex}.${app}.localhost`;
+	return stack === "main" ? base : `walrus-node-${nodeIndex}.${stack}.${app}.localhost`;
+};
+const storageNodeConfigHash = (parts) => [
+	parts.deployConfigHash,
+	`node=${parts.nodeIndex}`,
+	`mount=${parts.deploySourceHostPath}->${parts.deployMountTarget}`,
+	`api=${parts.containerApiPort}`,
+	`net=${parts.walrusNetworkName},${parts.suiNetworkName}`
+].join("|");
+const buildWalrusNetworkName = (app, stack, walrusName) => `devstack-${app}-${stack}-walrus-${walrusName}-net`;
+/** Per-node TCP ready-probe interval. */
+const NODE_READY_PROBE_INTERVAL_MS = 500;
+/** Start the N-node committee.
+*
+*  Wiring (this body is the load-bearing path):
+*
+*    1. Defense-in-depth nodeCount guard.
+*    2. Fork a parallel-strategy child scope off the caller's scope so
+*       every node's `docker stop` finalizer fires concurrently on
+*       outer teardown — collapses shutdown wall-time from `N×grace` to
+*       `~max(grace)` (distilled-doc invariant 21).
+*    3. For each `i ∈ [0..N)`:
+*         a. `ensureContainer` on the wrapper image with pinned IP,
+*            label tuple, primary network attach (walrus net), recreate
+*            on config-change.
+*         b. TCP ready probe against `<publicHostname>:<routerPort>`
+*            with bounded retries until the outer `readyTimeoutMs`.
+*    4. Run [3] under `Effect.all({concurrency: 'unbounded'})` — boot
+*       parallelism collapses to ~max(perNode).
+*
+*  WHAT THE SUBSTRATE STILL OWES:
+*    - Secondary network attach (`Docker.networkConnect(suiNet)`).
+*      `EnsureContainerSpec.networkAttach` accepts an array, so passing
+*      `[walrusNet, suiNet]` would dual-home in one shot, but the
+*      runtime adapter currently treats the first entry as the primary
+*      and post-attaches the rest; the per-node pinned IP only attaches
+*      to the primary. The dual-home is documented inline below and
+*      relies on that adapter behavior. Storage nodes do not request
+*      faucet funds during boot; the secondary network is retained for
+*      future Sui-side in-network calls.
+*    - Per-node `networkAlias` (`walrus-node-<i>.localhost`). The
+*      contract doesn't expose alias plumbing yet; peer containers dial by
+*      container name, which docker DNS publishes. The architecture
+*      revision is tracked in `index.ts`.
+*    - Stop-grace duration propagation. The contract's `stop` takes a
+*      Duration but `ensureContainer` doesn't yet accept a default
+*      grace; the runtime adapter defaults to 10s. RocksDB needs 20s
+*      (distilled-doc invariant 22) — see opportunity below.
+*/
+const startStorageNodes = (runtime, spec) => Effect.gen(function* () {
+	if (spec.nodeCount < 1) return yield* Effect.fail(walrusPluginError("storage-node", `storage-nodes: nodeCount must be >= 1 (got ${spec.nodeCount})`));
+	const outerScope = yield* Effect.scope;
+	const nodeStopScope = yield* Scope.fork(outerScope, "parallel");
+	const stopGraceSeconds = spec.stopGraceSeconds ?? 20;
+	const readyTimeout = Duration.millis(spec.readyTimeoutMs ?? 6e4);
+	const deployMount = walrusDeployMountPaths(spec.deployHostMountPath, "/opt/walrus/runtime");
+	const indices = Array.from({ length: spec.nodeCount }, (_, i) => i);
+	const bootOne = (i) => Effect.gen(function* () {
+		const containerIp = `${spec.subnetPrefix}.${10 + i}`;
+		const containerName = `devstack-${spec.app}-${spec.stack}-walrus-${spec.walrusName}-node-${i}`;
+		const nodeHostname = `dryrun-node-${i}`;
+		const publicHostname = computePublicHostname(spec.app, spec.stack, i);
+		yield* setCurrentPluginPhase(`creating storage-node-${i} container ${containerName}`);
+		const ensureNode = ensureManagedContainer({
+			runtime,
+			identity: {
+				app: spec.app,
+				stack: spec.stack
+			},
+			plugin: "walrus",
+			role: `storage-node-${i}`,
+			spec: {
+				name: containerName,
+				image: spec.image,
+				recreate: "on-config-change",
+				configHash: storageNodeConfigHash({
+					deployConfigHash: spec.deployConfigHash,
+					nodeIndex: i,
+					deploySourceHostPath: deployMount.sourceHostPath,
+					deployMountTarget: deployMount.mountTarget,
+					containerApiPort: spec.containerApiPort,
+					walrusNetworkName: spec.walrusNetworkName,
+					suiNetworkName: spec.suiNetworkName
+				}),
+				env: {
+					HOSTNAME: nodeHostname,
+					DEPLOY_OUTPUT_DIR: deployMount.outputDirInContainer
+				},
+				stopGraceSeconds,
+				networkAttach: [spec.walrusNetworkName, spec.suiNetworkName],
+				extraHosts: { "host.docker.internal": "host-gateway" },
+				mounts: [{
+					source: deployMount.sourceHostPath,
+					target: deployMount.mountTarget,
+					readonly: true
+				}]
+			},
+			mapError: (cause) => walrusPluginError("storage-node", `walrus storage-node-${i} (ip=${containerIp}) ensureContainer failed: ${cause.reason}: ${cause.detail}`, { cause })
+		});
+		const handle = yield* Scope.provide(ensureNode, nodeStopScope);
+		yield* setCurrentPluginPhase(`waiting for storage-node-${i} on 127.0.0.1:${spec.containerApiPort}`);
+		yield* waitForProbe({
+			label: `walrus.storage-node.${i}`,
+			timeoutMs: Duration.toMillis(readyTimeout),
+			intervalMs: NODE_READY_PROBE_INTERVAL_MS,
+			probe: () => runtime.exec(handle, [
+				"sh",
+				"-c",
+				`nc -z 127.0.0.1 ${spec.containerApiPort} || exit 1`
+			]).pipe(Effect.map(exitCodeProbeResult))
+		}).pipe(Effect.mapError((cause) => {
+			if (cause instanceof ProbeTimeoutError) return walrusPluginError("storage-node", `storage-node-${i} never became ready within ${Duration.toMillis(readyTimeout)}ms (container=${containerName}, probe=127.0.0.1:${spec.containerApiPort}, publicUrl=http://${publicHostname}:${WALRUS_ROUTER_PORT}). The container was created, but walrus-node did not bind its API port. Check the storage-node container logs for the faucet, WAL exchange, or walrus-node run step that stalled.`, { cause: cause.lastError ?? cause.lastNotReady ?? cause });
+			return walrusPluginError("storage-node", `storage-node-${i} ready-probe exec failed: ${cause.reason}: ${cause.detail}`, { cause });
+		}));
+		return {
+			nodeIndex: i,
+			nodeId: `walrus-node-${i}`,
+			publicKey: `<bls-pubkey-storage-node-${i}>`,
+			publicHostname,
+			rpcUrl: `http://${publicHostname}:${WALRUS_ROUTER_PORT}`
+		};
+	}).pipe(Effect.withSpan(`devstack.plugin.walrus.storage-node-${i}.boot`, { attributes: {
+		"devstack.plugin": "walrus",
+		"walrus.node": i
+	} }));
+	return { nodes: yield* Effect.all(indices.map(bootOne), { concurrency: "unbounded" }) };
+}).pipe(Effect.withSpan("devstack.plugin.walrus.storage-nodes.boot", { attributes: { "devstack.plugin": "walrus" } }));
+//#endregion
+export { DEFAULT_CONTAINER_API_PORT, DEFAULT_NODE_READY_TIMEOUT_MS, WALRUS_ROUTER_PORT, buildWalrusNetworkName, computePublicHostname, startStorageNodes };
+
+//# sourceMappingURL=storage-nodes.mjs.map

package/dist/plugins/walrus/storage-nodes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-nodes.mjs","names":[],"sources":["../../../src/plugins/walrus/storage-nodes.ts"],"sourcesContent":["// Walrus storage-node committee lifecycle.\n//\n// Distilled-doc reference (06-walrus.md §\"Capabilities CONSUMED\" +\n// §\"Lifecycle phase 4\"): N storage-node containers, pinned IPs on a\n// per-stack /24 docker network. Each node carries one Traefik route\n// via the `Routable` capability; the router binds host port 9185 once\n// globally and dispatches by `Host:` header.\n//\n// Substrate-side responsibilities:\n//   - `ContainerRuntime.ensureContainer` per node — content-addressed\n//     image, label tuple, recreate policy.\n//   - Parallel `Effect.all({concurrency: 'unbounded'})` over [0..N) —\n//     concurrent boot.\n//   - Per-node stop finalizer fires in a *forked parallel scope* so\n//     teardown collapses to ~max(grace) instead of summing graces\n//     (distilled-doc invariant 21 — \"StopFinalizerScope MUST be a\n//     forked parallel scope\").\n//\n// What we DON'T own here:\n//   - Plugin row narration.\n//   - The faucet-strategy registration — `faucet-strategy.ts`.\n//   - The deploy one-shot — `deploy.ts`.\n\nimport { Duration, Effect, Scope } from 'effect';\n\nimport type {\n\tContainerHandle,\n\tContainerRuntime,\n\tImageRef,\n} from '../../contracts/container-runtime.ts';\nimport {\n\tProbeTimeoutError,\n\texitCodeProbeResult,\n\twaitForProbe,\n} from '../../substrate/runtime/probes.ts';\nimport { setCurrentPluginPhase } from '../../substrate/runtime/current-plugin.ts';\nimport { ensureManagedContainer } from '../../substrate/runtime/managed-container.ts';\nimport { walrusDeployMountPaths } from './deploy-paths.ts';\nimport { walrusPluginError, type WalrusPluginError } from './errors.ts';\n\n/** Default per-node grace window. Storage nodes maintain RocksDB-\n *  backed state; need >10s to flush and checkpoint on `docker stop`.\n *  Distilled-doc invariant 22. */\nexport const DEFAULT_NODE_STOP_GRACE_SECONDS = 20;\n\n/** Default per-node ready-probe timeout. */\nexport const DEFAULT_NODE_READY_TIMEOUT_MS = 60_000;\n\n/** Distilled-doc invariant 9: the on-chain `public_port` value\n *  matches the global router entrypoint port. One canonical\n *  constant — opportunity #14 in the distilled doc was to deduplicate\n *  this across three files. */\nexport const WALRUS_ROUTER_PORT = 9185;\n\n/** Default container API port — each storage node binds this inside\n *  the container. Same value as the router port (the storage node's\n *  in-container bind matches the on-chain public_port). */\nexport const DEFAULT_CONTAINER_API_PORT = WALRUS_ROUTER_PORT;\n\n/** Per-node descriptor — what the plugin resolved value surfaces\n *  for downstream consumers (the `@mysten/walrus` SDK reads this). */\nexport interface WalrusStorageNode {\n\treadonly nodeIndex: number;\n\treadonly nodeId: string;\n\treadonly publicKey: string;\n\treadonly publicHostname: string;\n\treadonly rpcUrl: string;\n}\n\n/** Storage-node startup config — the plugin's local-cluster mode\n *  passes this in once per cluster boot. */\nexport interface StorageNodesSpec {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly walrusName: string;\n\treadonly image: ImageRef;\n\treadonly nodeCount: number;\n\t/** Pre-allocated /24 prefix from `subnetForStack`. Example:\n\t *  `'10.42.7'` (the third octet is hashed per stack). */\n\treadonly subnetPrefix: string;\n\treadonly containerApiPort: number;\n\treadonly walrusNetworkName: string;\n\treadonly suiNetworkName: string;\n\treadonly deployHostMountPath: string;\n\t/** Fingerprint of the deploy outputs mounted into each node. */\n\treadonly deployConfigHash: string;\n\treadonly stopGraceSeconds?: number;\n\treadonly readyTimeoutMs?: number;\n}\n\n/** Result of starting the committee — descriptors used by the\n *  plugin's resolved value. */\nexport interface StorageNodesAcquired {\n\treadonly nodes: ReadonlyArray<WalrusStorageNode>;\n}\n\n/** Distilled-doc invariant 1: pinned IPs start at `<prefix>.10`.\n *  Centralized so the deploy one-shot's `WALRUS_LISTENING_IPS` env\n *  var and the per-node `--ip` pin compute from one source. */\nexport const WALRUS_NODE_IP_BASE = 10;\n\n/** Compute the public hostname for one storage node. Mirrors\n *  v3's `routerHostname(identity, 'walrus-node-' + i)` shape\n *  (06-walrus.md §\"Routes registered\"). Main stack omits the stack\n *  segment; non-main inserts it after the service label. */\nexport const computePublicHostname = (app: string, stack: string, nodeIndex: number): string => {\n\tconst base = `walrus-node-${nodeIndex}.${app}.localhost`;\n\treturn stack === 'main' ? base : `walrus-node-${nodeIndex}.${stack}.${app}.localhost`;\n};\n\nexport const storageNodeConfigHash = (parts: {\n\treadonly deployConfigHash: string;\n\treadonly nodeIndex: number;\n\treadonly deploySourceHostPath: string;\n\treadonly deployMountTarget: string;\n\treadonly containerApiPort: number;\n\treadonly walrusNetworkName: string;\n\treadonly suiNetworkName: string;\n}): string =>\n\t[\n\t\tparts.deployConfigHash,\n\t\t`node=${parts.nodeIndex}`,\n\t\t`mount=${parts.deploySourceHostPath}->${parts.deployMountTarget}`,\n\t\t`api=${parts.containerApiPort}`,\n\t\t`net=${parts.walrusNetworkName},${parts.suiNetworkName}`,\n\t].join('|');\n\nexport const buildWalrusNetworkName = (app: string, stack: string, walrusName: string): string =>\n\t`devstack-${app}-${stack}-walrus-${walrusName}-net`;\n\n/** Per-node TCP ready-probe interval. */\nconst NODE_READY_PROBE_INTERVAL_MS = 500;\n\n/** Start the N-node committee.\n *\n *  Wiring (this body is the load-bearing path):\n *\n *    1. Defense-in-depth nodeCount guard.\n *    2. Fork a parallel-strategy child scope off the caller's scope so\n *       every node's `docker stop` finalizer fires concurrently on\n *       outer teardown — collapses shutdown wall-time from `N×grace` to\n *       `~max(grace)` (distilled-doc invariant 21).\n *    3. For each `i ∈ [0..N)`:\n *         a. `ensureContainer` on the wrapper image with pinned IP,\n *            label tuple, primary network attach (walrus net), recreate\n *            on config-change.\n *         b. TCP ready probe against `<publicHostname>:<routerPort>`\n *            with bounded retries until the outer `readyTimeoutMs`.\n *    4. Run [3] under `Effect.all({concurrency: 'unbounded'})` — boot\n *       parallelism collapses to ~max(perNode).\n *\n *  WHAT THE SUBSTRATE STILL OWES:\n *    - Secondary network attach (`Docker.networkConnect(suiNet)`).\n *      `EnsureContainerSpec.networkAttach` accepts an array, so passing\n *      `[walrusNet, suiNet]` would dual-home in one shot, but the\n *      runtime adapter currently treats the first entry as the primary\n *      and post-attaches the rest; the per-node pinned IP only attaches\n *      to the primary. The dual-home is documented inline below and\n *      relies on that adapter behavior. Storage nodes do not request\n *      faucet funds during boot; the secondary network is retained for\n *      future Sui-side in-network calls.\n *    - Per-node `networkAlias` (`walrus-node-<i>.localhost`). The\n *      contract doesn't expose alias plumbing yet; peer containers dial by\n *      container name, which docker DNS publishes. The architecture\n *      revision is tracked in `index.ts`.\n *    - Stop-grace duration propagation. The contract's `stop` takes a\n *      Duration but `ensureContainer` doesn't yet accept a default\n *      grace; the runtime adapter defaults to 10s. RocksDB needs 20s\n *      (distilled-doc invariant 22) — see opportunity below.\n */\nexport const startStorageNodes = (\n\truntime: ContainerRuntime,\n\tspec: StorageNodesSpec,\n): Effect.Effect<StorageNodesAcquired, WalrusPluginError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tif (spec.nodeCount < 1) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalrusPluginError(\n\t\t\t\t\t'storage-node',\n\t\t\t\t\t`storage-nodes: nodeCount must be >= 1 (got ${spec.nodeCount})`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\n\t\t// Fork a parallel stop-scope. Per-node `ensureContainer` finalizers\n\t\t// fire here on outer teardown; closing the parallel scope races\n\t\t// the per-container `docker stop`s instead of summing them.\n\t\tconst outerScope = yield* Effect.scope;\n\t\tconst nodeStopScope = yield* Scope.fork(outerScope, 'parallel');\n\n\t\tconst stopGraceSeconds = spec.stopGraceSeconds ?? DEFAULT_NODE_STOP_GRACE_SECONDS;\n\t\tconst readyTimeout = Duration.millis(spec.readyTimeoutMs ?? DEFAULT_NODE_READY_TIMEOUT_MS);\n\t\tconst deployMount = walrusDeployMountPaths(spec.deployHostMountPath, '/opt/walrus/runtime');\n\n\t\tconst indices = Array.from({ length: spec.nodeCount }, (_, i) => i);\n\n\t\tconst bootOne = (i: number): Effect.Effect<WalrusStorageNode, WalrusPluginError, Scope.Scope> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst containerIp = `${spec.subnetPrefix}.${WALRUS_NODE_IP_BASE + i}`;\n\t\t\t\tconst containerName = `devstack-${spec.app}-${spec.stack}-walrus-${spec.walrusName}-node-${i}`;\n\t\t\t\tconst nodeHostname = `dryrun-node-${i}`;\n\t\t\t\tconst publicHostname = computePublicHostname(spec.app, spec.stack, i);\n\n\t\t\t\tyield* setCurrentPluginPhase(`creating storage-node-${i} container ${containerName}`);\n\t\t\t\t// Acquire under the forked parallel stop scope so the\n\t\t\t\t// finalizer (docker stop) joins the per-node fan-out race.\n\t\t\t\tconst ensureNode: Effect.Effect<ContainerHandle, WalrusPluginError, Scope.Scope> =\n\t\t\t\t\tensureManagedContainer<WalrusPluginError>({\n\t\t\t\t\t\truntime,\n\t\t\t\t\t\tidentity: { app: spec.app, stack: spec.stack },\n\t\t\t\t\t\tplugin: 'walrus',\n\t\t\t\t\t\trole: `storage-node-${i}`,\n\t\t\t\t\t\tspec: {\n\t\t\t\t\t\t\tname: containerName,\n\t\t\t\t\t\t\timage: spec.image,\n\t\t\t\t\t\t\trecreate: 'on-config-change',\n\t\t\t\t\t\t\tconfigHash: storageNodeConfigHash({\n\t\t\t\t\t\t\t\tdeployConfigHash: spec.deployConfigHash,\n\t\t\t\t\t\t\t\tnodeIndex: i,\n\t\t\t\t\t\t\t\tdeploySourceHostPath: deployMount.sourceHostPath,\n\t\t\t\t\t\t\t\tdeployMountTarget: deployMount.mountTarget,\n\t\t\t\t\t\t\t\tcontainerApiPort: spec.containerApiPort,\n\t\t\t\t\t\t\t\twalrusNetworkName: spec.walrusNetworkName,\n\t\t\t\t\t\t\t\tsuiNetworkName: spec.suiNetworkName,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\tenv: {\n\t\t\t\t\t\t\t\tHOSTNAME: nodeHostname,\n\t\t\t\t\t\t\t\tDEPLOY_OUTPUT_DIR: deployMount.outputDirInContainer,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tstopGraceSeconds,\n\t\t\t\t\t\t\t// Primary network owns the pinned `--ip`; the\n\t\t\t\t\t\t\t// secondary attach gives docker DNS for the sui\n\t\t\t\t\t\t\t// network. The adapter treats [0] as primary.\n\t\t\t\t\t\t\tnetworkAttach: [spec.walrusNetworkName, spec.suiNetworkName],\n\t\t\t\t\t\t\t// `host-gateway` resolves `host.docker.internal` to\n\t\t\t\t\t\t\t// the host's loopback inside the container — Docker\n\t\t\t\t\t\t\t// Desktop wires this automatically on macOS/Windows\n\t\t\t\t\t\t\t// but native Linux Docker requires the explicit\n\t\t\t\t\t\t\t// `--add-host` flag. Storage nodes dial sui's\n\t\t\t\t\t\t\t// host-bound RPC + faucet via this hostname.\n\t\t\t\t\t\t\textraHosts: { 'host.docker.internal': 'host-gateway' },\n\t\t\t\t\t\t\tmounts: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t// Mount the stack root and point the entrypoint at\n\t\t\t\t\t\t\t\t\t// the deploy child. Docker Desktop can reject\n\t\t\t\t\t\t\t\t\t// freshly-created nested bind sources immediately\n\t\t\t\t\t\t\t\t\t// after a wiped stack recreates them.\n\t\t\t\t\t\t\t\t\tsource: deployMount.sourceHostPath,\n\t\t\t\t\t\t\t\t\ttarget: deployMount.mountTarget,\n\t\t\t\t\t\t\t\t\treadonly: true,\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t},\n\t\t\t\t\t\tmapError: (cause) =>\n\t\t\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t\t\t'storage-node',\n\t\t\t\t\t\t\t\t`walrus storage-node-${i} (ip=${containerIp}) ensureContainer failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t\t\t{ cause },\n\t\t\t\t\t\t\t),\n\t\t\t\t\t});\n\t\t\t\tconst handle: ContainerHandle = yield* Scope.provide(ensureNode, nodeStopScope);\n\n\t\t\t\t// TCP ready probe. We exec a tiny `nc`-style probe inside\n\t\t\t\t// the container against its own listener — proves the\n\t\t\t\t// in-container HTTP server bound and is accepting before\n\t\t\t\t// declaring ready. `exec` only fails on daemon-level\n\t\t\t\t// errors; a non-zero exit code is treated as \"retry\"\n\t\t\t\t// (the same policy postgres uses for `pg_isready`).\n\t\t\t\tyield* setCurrentPluginPhase(\n\t\t\t\t\t`waiting for storage-node-${i} on 127.0.0.1:${spec.containerApiPort}`,\n\t\t\t\t);\n\t\t\t\tyield* waitForProbe({\n\t\t\t\t\tlabel: `walrus.storage-node.${i}`,\n\t\t\t\t\ttimeoutMs: Duration.toMillis(readyTimeout),\n\t\t\t\t\tintervalMs: NODE_READY_PROBE_INTERVAL_MS,\n\t\t\t\t\tprobe: () =>\n\t\t\t\t\t\truntime\n\t\t\t\t\t\t\t.exec(handle, [\n\t\t\t\t\t\t\t\t'sh',\n\t\t\t\t\t\t\t\t'-c',\n\t\t\t\t\t\t\t\t// busybox-style portable probe: open TCP, write\n\t\t\t\t\t\t\t\t// nothing, exit. `nc -z` is the common form.\n\t\t\t\t\t\t\t\t`nc -z 127.0.0.1 ${spec.containerApiPort} || exit 1`,\n\t\t\t\t\t\t\t])\n\t\t\t\t\t\t\t.pipe(Effect.map(exitCodeProbeResult)),\n\t\t\t\t}).pipe(\n\t\t\t\t\tEffect.mapError((cause) => {\n\t\t\t\t\t\tif (cause instanceof ProbeTimeoutError) {\n\t\t\t\t\t\t\treturn walrusPluginError(\n\t\t\t\t\t\t\t\t'storage-node',\n\t\t\t\t\t\t\t\t`storage-node-${i} never became ready within ${Duration.toMillis(readyTimeout)}ms ` +\n\t\t\t\t\t\t\t\t\t`(container=${containerName}, probe=127.0.0.1:${spec.containerApiPort}, ` +\n\t\t\t\t\t\t\t\t\t`publicUrl=http://${publicHostname}:${WALRUS_ROUTER_PORT}). ` +\n\t\t\t\t\t\t\t\t\t`The container was created, but walrus-node did not bind its API port. ` +\n\t\t\t\t\t\t\t\t\t`Check the storage-node container logs for the faucet, WAL exchange, or ` +\n\t\t\t\t\t\t\t\t\t`walrus-node run step that stalled.`,\n\t\t\t\t\t\t\t\t{ cause: cause.lastError ?? cause.lastNotReady ?? cause },\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn walrusPluginError(\n\t\t\t\t\t\t\t'storage-node',\n\t\t\t\t\t\t\t`storage-node-${i} ready-probe exec failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t\t{ cause },\n\t\t\t\t\t\t);\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\t\t\treturn {\n\t\t\t\t\tnodeIndex: i,\n\t\t\t\t\t// Stable node-id derived from name. The on-chain\n\t\t\t\t\t// public_key + bls12-381 keypair lives inside the\n\t\t\t\t\t// per-node keystore the deploy one-shot emitted;\n\t\t\t\t\t// this descriptor is the routing handle, not the\n\t\t\t\t\t// crypto identity. The SDK consumer reads the\n\t\t\t\t\t// public key off `packageConfig` rather than this\n\t\t\t\t\t// per-node descriptor.\n\t\t\t\t\tnodeId: `walrus-node-${i}`,\n\t\t\t\t\tpublicKey: `<bls-pubkey-storage-node-${i}>`,\n\t\t\t\t\tpublicHostname,\n\t\t\t\t\t// Router-fronted URL on the well-known walrus\n\t\t\t\t\t// entrypoint port — Traefik routes by Host: header.\n\t\t\t\t\trpcUrl: `http://${publicHostname}:${WALRUS_ROUTER_PORT}`,\n\t\t\t\t} satisfies WalrusStorageNode;\n\t\t\t}).pipe(\n\t\t\t\tEffect.withSpan(`devstack.plugin.walrus.storage-node-${i}.boot`, {\n\t\t\t\t\tattributes: { 'devstack.plugin': 'walrus', 'walrus.node': i },\n\t\t\t\t}),\n\t\t\t);\n\n\t\tconst nodes = yield* Effect.all(indices.map(bootOne), {\n\t\t\tconcurrency: 'unbounded',\n\t\t});\n\n\t\treturn { nodes };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.walrus.storage-nodes.boot', {\n\t\t\tattributes: { 'devstack.plugin': 'walrus' },\n\t\t}),\n\t);\n"],"mappings":";;;;;;;AA8CA,MAAa,gCAAgC;;;;;AAM7C,MAAa,qBAAqB;;;;AAKlC,MAAa,6BAA6B;;;;;AAgD1C,MAAa,yBAAyB,KAAa,OAAe,cAA8B;CAC/F,MAAM,OAAO,eAAe,UAAU,GAAG,IAAI;AAC7C,QAAO,UAAU,SAAS,OAAO,eAAe,UAAU,GAAG,MAAM,GAAG,IAAI;;AAG3E,MAAa,yBAAyB,UASrC;CACC,MAAM;CACN,QAAQ,MAAM;CACd,SAAS,MAAM,qBAAqB,IAAI,MAAM;CAC9C,OAAO,MAAM;CACb,OAAO,MAAM,kBAAkB,GAAG,MAAM;CACxC,CAAC,KAAK,IAAI;AAEZ,MAAa,0BAA0B,KAAa,OAAe,eAClE,YAAY,IAAI,GAAG,MAAM,UAAU,WAAW;;AAG/C,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCrC,MAAa,qBACZ,SACA,SAEA,OAAO,IAAI,aAAa;AACvB,KAAI,KAAK,YAAY,EACpB,QAAO,OAAO,OAAO,KACpB,kBACC,gBACA,8CAA8C,KAAK,UAAU,GAC7D,CACD;CAMF,MAAM,aAAa,OAAO,OAAO;CACjC,MAAM,gBAAgB,OAAO,MAAM,KAAK,YAAY,WAAW;CAE/D,MAAM,mBAAmB,KAAK,oBAAA;CAC9B,MAAM,eAAe,SAAS,OAAO,KAAK,kBAAA,IAAgD;CAC1F,MAAM,cAAc,uBAAuB,KAAK,qBAAqB,sBAAsB;CAE3F,MAAM,UAAU,MAAM,KAAK,EAAE,QAAQ,KAAK,WAAW,GAAG,GAAG,MAAM,EAAE;CAEnE,MAAM,WAAW,MAChB,OAAO,IAAI,aAAa;EACvB,MAAM,cAAc,GAAG,KAAK,aAAa,GAAA,KAAyB;EAClE,MAAM,gBAAgB,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,KAAK,WAAW,QAAQ;EAC3F,MAAM,eAAe,eAAe;EACpC,MAAM,iBAAiB,sBAAsB,KAAK,KAAK,KAAK,OAAO,EAAE;AAErE,SAAO,sBAAsB,yBAAyB,EAAE,aAAa,gBAAgB;EAGrF,MAAM,aACL,uBAA0C;GACzC;GACA,UAAU;IAAE,KAAK,KAAK;IAAK,OAAO,KAAK;IAAO;GAC9C,QAAQ;GACR,MAAM,gBAAgB;GACtB,MAAM;IACL,MAAM;IACN,OAAO,KAAK;IACZ,UAAU;IACV,YAAY,sBAAsB;KACjC,kBAAkB,KAAK;KACvB,WAAW;KACX,sBAAsB,YAAY;KAClC,mBAAmB,YAAY;KAC/B,kBAAkB,KAAK;KACvB,mBAAmB,KAAK;KACxB,gBAAgB,KAAK;KACrB,CAAC;IACF,KAAK;KACJ,UAAU;KACV,mBAAmB,YAAY;KAC/B;IACD;IAIA,eAAe,CAAC,KAAK,mBAAmB,KAAK,eAAe;IAO5D,YAAY,EAAE,wBAAwB,gBAAgB;IACtD,QAAQ,CACP;KAKC,QAAQ,YAAY;KACpB,QAAQ,YAAY;KACpB,UAAU;KACV,CACD;IACD;GACD,WAAW,UACV,kBACC,gBACA,uBAAuB,EAAE,OAAO,YAAY,4BAA4B,MAAM,OAAO,IAAI,MAAM,UAC/F,EAAE,OAAO,CACT;GACF,CAAC;EACH,MAAM,SAA0B,OAAO,MAAM,QAAQ,YAAY,cAAc;AAQ/E,SAAO,sBACN,4BAA4B,EAAE,gBAAgB,KAAK,mBACnD;AACD,SAAO,aAAa;GACnB,OAAO,uBAAuB;GAC9B,WAAW,SAAS,SAAS,aAAa;GAC1C,YAAY;GACZ,aACC,QACE,KAAK,QAAQ;IACb;IACA;IAGA,mBAAmB,KAAK,iBAAiB;IACzC,CAAC,CACD,KAAK,OAAO,IAAI,oBAAoB,CAAC;GACxC,CAAC,CAAC,KACF,OAAO,UAAU,UAAU;AAC1B,OAAI,iBAAiB,kBACpB,QAAO,kBACN,gBACA,gBAAgB,EAAE,6BAA6B,SAAS,SAAS,aAAa,CAAC,gBAChE,cAAc,oBAAoB,KAAK,iBAAiB,qBAClD,eAAe,GAAG,mBAAmB,qLAI1D,EAAE,OAAO,MAAM,aAAa,MAAM,gBAAgB,OAAO,CACzD;AAEF,UAAO,kBACN,gBACA,gBAAgB,EAAE,4BAA4B,MAAM,OAAO,IAAI,MAAM,UACrE,EAAE,OAAO,CACT;IACA,CACF;AAED,SAAO;GACN,WAAW;GAQX,QAAQ,eAAe;GACvB,WAAW,4BAA4B,EAAE;GACzC;GAGA,QAAQ,UAAU,eAAe,GAAG;GACpC;GACA,CAAC,KACF,OAAO,SAAS,uCAAuC,EAAE,QAAQ,EAChE,YAAY;EAAE,mBAAmB;EAAU,eAAe;EAAG,EAC7D,CAAC,CACF;AAMF,QAAO,EAAE,OAAA,OAJY,OAAO,IAAI,QAAQ,IAAI,QAAQ,EAAE,EACrD,aAAa,aACb,CAAC,EAEc;EACf,CAAC,KACF,OAAO,SAAS,6CAA6C,EAC5D,YAAY,EAAE,mBAAmB,UAAU,EAC3C,CAAC,CACF"}

package/dist/plugins/walrus/wal-swap.d.mts

@@ -0,0 +1,2 @@
+import { Effect } from "effect";
+import { Transaction } from "@mysten/sui/transactions";

package/dist/plugins/walrus/wal-swap.mjs

@@ -0,0 +1,58 @@
+import { walrusPluginError } from "./errors.mjs";
+import { Effect, Schema } from "effect";
+import { Transaction } from "@mysten/sui/transactions";
+//#region src/plugins/walrus/wal-swap.ts
+const WalExchangeObjectShape = Schema.Struct({
+	objectId: Schema.String,
+	type: Schema.String
+});
+const resolveWalExchange = (probe, exchangeObjectId) => Effect.gen(function* () {
+	if (exchangeObjectId === void 0) return null;
+	const found = yield* probe.get({
+		kind: "object",
+		objectId: exchangeObjectId
+	}, WalExchangeObjectShape, "lenient").pipe(Effect.mapError((cause) => walrusPluginError("exchange", `walrus.exchange: failed to resolve exchange object ${exchangeObjectId}: ${cause.reason}: ${cause.detail}`, { cause })));
+	if (found === null) return null;
+	const packageId = found.type.split("::")[0];
+	if (packageId === void 0 || !packageId.startsWith("0x")) return yield* Effect.fail(walrusPluginError("exchange", `walrus.exchange: unexpected exchange object type "${found.type}" — expected "<pkg>::wal_exchange::Exchange"`));
+	return {
+		objectId: exchangeObjectId,
+		packageId
+	};
+});
+const buildWalSwapTransaction = (args) => {
+	const tx = new Transaction();
+	tx.setSender(args.signerAddress);
+	const paymentCoin = tx.coin({
+		balance: args.paymentMist,
+		type: "0x2::sui::SUI",
+		useGasCoin: true
+	});
+	const walCoin = tx.moveCall({
+		target: `${args.exchange.packageId}::wal_exchange::exchange_all_for_wal`,
+		arguments: [tx.object(args.exchange.objectId), paymentCoin]
+	});
+	tx.transferObjects([walCoin], tx.pure.address(args.recipientAddress));
+	return tx;
+};
+const swapAccountSuiForWal = (args) => args.account.withTransactionSigner((lockedSigner) => Effect.gen(function* () {
+	const tx = buildWalSwapTransaction({
+		signerAddress: args.account.address,
+		recipientAddress: args.recipientAddress,
+		exchange: args.exchange,
+		paymentMist: args.paymentMist
+	});
+	const txBytes = yield* Effect.tryPromise({
+		try: () => tx.build({ client: args.sdk.client }),
+		catch: (cause) => walrusPluginError("fund-wal", `walrus.fundWal: transaction serialization failed for account '${args.account.name}'.`, { cause })
+	});
+	return { digest: (yield* lockedSigner.signAndExecute(txBytes).pipe(Effect.mapError((cause) => walrusPluginError("fund-wal", `walrus.fundWal: SUI -> WAL swap failed for ${args.recipientAddress} using account '${args.account.name}' (address=${args.account.address}) against exchange ${args.exchange.objectId}.`, { cause })))).digest };
+})).pipe(Effect.withSpan("devstack.plugin.walrus.fundWal", { attributes: {
+	"walrus.fund.account": args.account.name,
+	"walrus.fund.address": args.recipientAddress,
+	"walrus.fund.exchange": args.exchange.objectId
+} }));
+//#endregion
+export { resolveWalExchange, swapAccountSuiForWal };
+
+//# sourceMappingURL=wal-swap.mjs.map

package/dist/plugins/walrus/wal-swap.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wal-swap.mjs","names":[],"sources":["../../../src/plugins/walrus/wal-swap.ts"],"sourcesContent":["import { Effect, Schema } from 'effect';\nimport { Transaction } from '@mysten/sui/transactions';\n\nimport type { ChainProbe } from '../../contracts/chain-probe.ts';\nimport type { AccountValue } from '../account/index.ts';\nimport { walrusPluginError, type WalrusPluginError } from './errors.ts';\n\nexport interface WalExchangeHandle {\n\treadonly objectId: string;\n\treadonly packageId: string;\n}\n\nexport type WalExchangeProbeKey = { readonly kind: 'object'; readonly objectId: string };\n\nexport interface WalSwapSdk {\n\treadonly client: unknown;\n}\n\nexport interface WalAccountSwapRequest {\n\treadonly account: AccountValue;\n\treadonly sdk: WalSwapSdk;\n\treadonly exchange: WalExchangeHandle;\n\treadonly recipientAddress: string;\n\treadonly paymentMist: bigint;\n}\n\nconst WalExchangeObjectShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.String,\n});\n\nexport const resolveWalExchange = (\n\tprobe: ChainProbe<WalExchangeProbeKey>,\n\texchangeObjectId: string | undefined,\n): Effect.Effect<WalExchangeHandle | null, WalrusPluginError> =>\n\tEffect.gen(function* () {\n\t\tif (exchangeObjectId === undefined) return null;\n\t\tconst found = yield* probe\n\t\t\t.get({ kind: 'object', objectId: exchangeObjectId }, WalExchangeObjectShape, 'lenient')\n\t\t\t.pipe(\n\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'exchange',\n\t\t\t\t\t\t`walrus.exchange: failed to resolve exchange object ${exchangeObjectId}: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t{ cause },\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\tif (found === null) return null;\n\t\tconst packageId = found.type.split('::')[0];\n\t\tif (packageId === undefined || !packageId.startsWith('0x')) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalrusPluginError(\n\t\t\t\t\t'exchange',\n\t\t\t\t\t`walrus.exchange: unexpected exchange object type \"${found.type}\" — expected \"<pkg>::wal_exchange::Exchange\"`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn { objectId: exchangeObjectId, packageId };\n\t});\n\nexport const buildWalSwapTransaction = (args: {\n\treadonly signerAddress: string;\n\treadonly recipientAddress: string;\n\treadonly exchange: WalExchangeHandle;\n\treadonly paymentMist: bigint;\n}): Transaction => {\n\tconst tx = new Transaction();\n\ttx.setSender(args.signerAddress);\n\tconst paymentCoin = tx.coin({\n\t\tbalance: args.paymentMist,\n\t\ttype: '0x2::sui::SUI',\n\t\tuseGasCoin: true,\n\t});\n\tconst walCoin = tx.moveCall({\n\t\ttarget: `${args.exchange.packageId}::wal_exchange::exchange_all_for_wal`,\n\t\targuments: [tx.object(args.exchange.objectId), paymentCoin],\n\t});\n\ttx.transferObjects([walCoin], tx.pure.address(args.recipientAddress));\n\treturn tx;\n};\n\ntype TransactionBuildClient = Parameters<Transaction['build']>[0] extends\n\t| { readonly client?: infer Client }\n\t| undefined\n\t? Client\n\t: never;\n\nexport const swapAccountSuiForWal = (\n\targs: WalAccountSwapRequest,\n): Effect.Effect<{ readonly digest: string }, WalrusPluginError> =>\n\targs.account\n\t\t.withTransactionSigner((lockedSigner) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst tx = buildWalSwapTransaction({\n\t\t\t\t\tsignerAddress: args.account.address,\n\t\t\t\t\trecipientAddress: args.recipientAddress,\n\t\t\t\t\texchange: args.exchange,\n\t\t\t\t\tpaymentMist: args.paymentMist,\n\t\t\t\t});\n\t\t\t\tconst txBytes = yield* Effect.tryPromise({\n\t\t\t\t\ttry: () =>\n\t\t\t\t\t\ttx.build({\n\t\t\t\t\t\t\tclient: args.sdk.client as TransactionBuildClient,\n\t\t\t\t\t\t}),\n\t\t\t\t\tcatch: (cause): WalrusPluginError =>\n\t\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t\t'fund-wal',\n\t\t\t\t\t\t\t`walrus.fundWal: transaction serialization failed for account '${args.account.name}'.`,\n\t\t\t\t\t\t\t{ cause },\n\t\t\t\t\t\t),\n\t\t\t\t});\n\t\t\t\tconst receipt = yield* lockedSigner\n\t\t\t\t\t.signAndExecute(txBytes)\n\t\t\t\t\t.pipe(\n\t\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t\t(cause): WalrusPluginError =>\n\t\t\t\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t\t\t\t'fund-wal',\n\t\t\t\t\t\t\t\t\t`walrus.fundWal: SUI -> WAL swap failed for ${args.recipientAddress} ` +\n\t\t\t\t\t\t\t\t\t\t`using account '${args.account.name}' (address=${args.account.address}) ` +\n\t\t\t\t\t\t\t\t\t\t`against exchange ${args.exchange.objectId}.`,\n\t\t\t\t\t\t\t\t\t{ cause },\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\treturn { digest: receipt.digest };\n\t\t\t}),\n\t\t)\n\t\t.pipe(\n\t\t\tEffect.withSpan('devstack.plugin.walrus.fundWal', {\n\t\t\t\tattributes: {\n\t\t\t\t\t'walrus.fund.account': args.account.name,\n\t\t\t\t\t'walrus.fund.address': args.recipientAddress,\n\t\t\t\t\t'walrus.fund.exchange': args.exchange.objectId,\n\t\t\t\t},\n\t\t\t}),\n\t\t);\n"],"mappings":";;;;AA0BA,MAAM,yBAAyB,OAAO,OAAO;CAC5C,UAAU,OAAO;CACjB,MAAM,OAAO;CACb,CAAC;AAEF,MAAa,sBACZ,OACA,qBAEA,OAAO,IAAI,aAAa;AACvB,KAAI,qBAAqB,KAAA,EAAW,QAAO;CAC3C,MAAM,QAAQ,OAAO,MACnB,IAAI;EAAE,MAAM;EAAU,UAAU;EAAkB,EAAE,wBAAwB,UAAU,CACtF,KACA,OAAO,UAAU,UAChB,kBACC,YACA,sDAAsD,iBAAiB,IAAI,MAAM,OAAO,IAAI,MAAM,UAClG,EAAE,OAAO,CACT,CACD,CACD;AACF,KAAI,UAAU,KAAM,QAAO;CAC3B,MAAM,YAAY,MAAM,KAAK,MAAM,KAAK,CAAC;AACzC,KAAI,cAAc,KAAA,KAAa,CAAC,UAAU,WAAW,KAAK,CACzD,QAAO,OAAO,OAAO,KACpB,kBACC,YACA,qDAAqD,MAAM,KAAK,8CAChE,CACD;AAEF,QAAO;EAAE,UAAU;EAAkB;EAAW;EAC/C;AAEH,MAAa,2BAA2B,SAKrB;CAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,IAAG,UAAU,KAAK,cAAc;CAChC,MAAM,cAAc,GAAG,KAAK;EAC3B,SAAS,KAAK;EACd,MAAM;EACN,YAAY;EACZ,CAAC;CACF,MAAM,UAAU,GAAG,SAAS;EAC3B,QAAQ,GAAG,KAAK,SAAS,UAAU;EACnC,WAAW,CAAC,GAAG,OAAO,KAAK,SAAS,SAAS,EAAE,YAAY;EAC3D,CAAC;AACF,IAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,KAAK,QAAQ,KAAK,iBAAiB,CAAC;AACrE,QAAO;;AASR,MAAa,wBACZ,SAEA,KAAK,QACH,uBAAuB,iBACvB,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,wBAAwB;EAClC,eAAe,KAAK,QAAQ;EAC5B,kBAAkB,KAAK;EACvB,UAAU,KAAK;EACf,aAAa,KAAK;EAClB,CAAC;CACF,MAAM,UAAU,OAAO,OAAO,WAAW;EACxC,WACC,GAAG,MAAM,EACR,QAAQ,KAAK,IAAI,QACjB,CAAC;EACH,QAAQ,UACP,kBACC,YACA,iEAAiE,KAAK,QAAQ,KAAK,KACnF,EAAE,OAAO,CACT;EACF,CAAC;AAeF,QAAO,EAAE,SAAQ,OAdM,aACrB,eAAe,QAAQ,CACvB,KACA,OAAO,UACL,UACA,kBACC,YACA,8CAA8C,KAAK,iBAAiB,kBACjD,KAAK,QAAQ,KAAK,aAAa,KAAK,QAAQ,QAAQ,qBAClD,KAAK,SAAS,SAAS,IAC5C,EAAE,OAAO,CACT,CACF,CACD,EACuB,QAAQ;EAChC,CACF,CACA,KACA,OAAO,SAAS,kCAAkC,EACjD,YAAY;CACX,uBAAuB,KAAK,QAAQ;CACpC,uBAAuB,KAAK;CAC5B,wBAAwB,KAAK,SAAS;CACtC,EACD,CAAC,CACF"}

package/dist/primitives/artifact-publisher.d.mts

@@ -0,0 +1,12 @@
+import { Effect, Schema, Scope } from "effect";
+
+//#region src/primitives/artifact-publisher.d.ts
+/** Tagged error from a publish round. */
+interface ArtifactPublishError {
+  readonly _tag: 'ArtifactPublishError';
+  readonly reason: 'produce-failed' | 'verify-exhausted' | 'cache-corrupt';
+  readonly detail: string;
+}
+//#endregion
+export { ArtifactPublishError };
+//# sourceMappingURL=artifact-publisher.d.mts.map

package/dist/primitives/cache.d.mts

@@ -0,0 +1 @@
+import { Effect } from "effect";

package/dist/runtime/built-in-plugin-layers.mjs

@@ -0,0 +1,49 @@
+import { CapabilitySinksService } from "../substrate/runtime/capability-sinks/service.mjs";
+import { layerCapabilitySinksDefault } from "../substrate/runtime/capability-sinks/layer.mjs";
+import { discoverCoinsFromPublish } from "../plugins/coin/discovery.mjs";
+import { CoinRegistryService, coinRegistryLayer } from "../plugins/coin/registry.mjs";
+import { LOCAL_PACKAGE_PUBLISHED_KIND } from "../plugins/package/publish-output.mjs";
+import { PackageRegistryService, layerPackageRegistry } from "../plugins/package/registry.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/runtime/built-in-plugin-layers.ts
+const layerBuiltInPluginServices = Layer.mergeAll(coinRegistryLayer, layerPackageRegistry);
+const publishResultSink = (coinRegistry) => ({
+	kind: LOCAL_PACKAGE_PUBLISHED_KIND,
+	accept: (decl) => Effect.gen(function* () {
+		for (const discovered of discoverCoinsFromPublish(decl.output)) {
+			const record = {
+				key: (discovered.symbol ?? discovered.witness).toLowerCase(),
+				type: discovered.fullCoinType,
+				witness: discovered.witness,
+				moduleName: discovered.moduleName,
+				decimals: discovered.decimals ?? 0,
+				...discovered.symbol === void 0 ? {} : { symbol: discovered.symbol },
+				...discovered.displayName === void 0 ? {} : { displayName: discovered.displayName },
+				...discovered.iconUrl === void 0 ? {} : { iconUrl: discovered.iconUrl },
+				...!discovered.publisherOwnsCap || discovered.treasuryCapId === void 0 ? {} : { treasuryCapId: discovered.treasuryCapId },
+				...discovered.metadataId === void 0 ? {} : { metadataId: discovered.metadataId },
+				packageId: decl.packageId,
+				publishingPackageName: decl.packageName
+			};
+			yield* coinRegistry.register(record);
+		}
+	})
+});
+const layerBuiltInCapabilitySinks = (orchestrator) => {
+	return Layer.effectDiscard(Effect.gen(function* () {
+		const sinks = yield* CapabilitySinksService;
+		const coinRegistry = yield* CoinRegistryService;
+		yield* sinks.registerSink(publishResultSink(coinRegistry));
+	})).pipe(Layer.provideMerge(layerCapabilitySinksDefault(orchestrator)));
+};
+const layerBuiltInPluginRuntime = (orchestrator) => layerBuiltInCapabilitySinks(orchestrator).pipe(Layer.provideMerge(layerBuiltInPluginServices));
+const extendBuiltInPluginContext = (ctx) => Effect.gen(function* () {
+	const coinRegistry = yield* CoinRegistryService;
+	const packageRegistry = yield* PackageRegistryService;
+	const capabilitySinks = yield* CapabilitySinksService;
+	return ctx.pipe(Context.add(CoinRegistryService, coinRegistry), Context.add(PackageRegistryService, packageRegistry), Context.add(CapabilitySinksService, capabilitySinks));
+});
+//#endregion
+export { extendBuiltInPluginContext, layerBuiltInPluginRuntime };
+
+//# sourceMappingURL=built-in-plugin-layers.mjs.map

package/dist/runtime/built-in-plugin-layers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plugin-layers.mjs","names":[],"sources":["../../src/runtime/built-in-plugin-layers.ts"],"sourcesContent":["// Built-in plugin runtime composition.\n//\n// L0 substrate builds only name-blind services. This module is the higher-level\n// composition point for built-in plugin services and built-in capability sinks.\n\nimport { Context, Effect, Layer } from 'effect';\n\nimport { discoverCoinsFromPublish } from '../plugins/coin/discovery.ts';\nimport {\n\tCoinRegistryService,\n\tcoinRegistryLayer,\n\ttype CoinRecord,\n} from '../plugins/coin/registry.ts';\nimport {\n\tLOCAL_PACKAGE_PUBLISHED_KIND,\n\ttype LocalPackagePublishedDecl,\n} from '../plugins/package/publish-output.ts';\nimport { PackageRegistryService, layerPackageRegistry } from '../plugins/package/registry.ts';\nimport {\n\tCapabilitySinksService,\n\tlayerCapabilitySinksDefault,\n\ttype CapabilitySink,\n\ttype OrchestratorSinks,\n} from '../substrate/runtime/capability-sinks/index.ts';\n\nexport const layerBuiltInPluginServices: Layer.Layer<CoinRegistryService | PackageRegistryService> =\n\tLayer.mergeAll(coinRegistryLayer, layerPackageRegistry);\n\nconst publishResultSink = (\n\tcoinRegistry: typeof CoinRegistryService.Service,\n): CapabilitySink<typeof LOCAL_PACKAGE_PUBLISHED_KIND, LocalPackagePublishedDecl> => ({\n\tkind: LOCAL_PACKAGE_PUBLISHED_KIND,\n\taccept: (decl) =>\n\t\tEffect.gen(function* () {\n\t\t\tfor (const discovered of discoverCoinsFromPublish(decl.output)) {\n\t\t\t\tconst record: CoinRecord = {\n\t\t\t\t\tkey: (discovered.symbol ?? discovered.witness).toLowerCase(),\n\t\t\t\t\ttype: discovered.fullCoinType,\n\t\t\t\t\twitness: discovered.witness,\n\t\t\t\t\tmoduleName: discovered.moduleName,\n\t\t\t\t\tdecimals: discovered.decimals ?? 0,\n\t\t\t\t\t...(discovered.symbol === undefined ? {} : { symbol: discovered.symbol }),\n\t\t\t\t\t...(discovered.displayName === undefined ? {} : { displayName: discovered.displayName }),\n\t\t\t\t\t...(discovered.iconUrl === undefined ? {} : { iconUrl: discovered.iconUrl }),\n\t\t\t\t\t...(!discovered.publisherOwnsCap || discovered.treasuryCapId === undefined\n\t\t\t\t\t\t? {}\n\t\t\t\t\t\t: { treasuryCapId: discovered.treasuryCapId }),\n\t\t\t\t\t...(discovered.metadataId === undefined ? {} : { metadataId: discovered.metadataId }),\n\t\t\t\t\tpackageId: decl.packageId,\n\t\t\t\t\tpublishingPackageName: decl.packageName,\n\t\t\t\t};\n\t\t\t\tyield* coinRegistry.register(record);\n\t\t\t}\n\t\t}),\n});\n\nexport const layerBuiltInCapabilitySinks = (\n\torchestrator: OrchestratorSinks,\n): Layer.Layer<CapabilitySinksService, never, CoinRegistryService | PackageRegistryService> => {\n\tconst registerBuiltInPluginSinks = Layer.effectDiscard(\n\t\tEffect.gen(function* () {\n\t\t\tconst sinks = yield* CapabilitySinksService;\n\t\t\tconst coinRegistry = yield* CoinRegistryService;\n\t\t\tyield* sinks.registerSink(publishResultSink(coinRegistry));\n\t\t}),\n\t);\n\treturn registerBuiltInPluginSinks.pipe(\n\t\tLayer.provideMerge(layerCapabilitySinksDefault(orchestrator)),\n\t);\n};\n\nexport const layerBuiltInPluginRuntime = (\n\torchestrator: OrchestratorSinks,\n): Layer.Layer<CoinRegistryService | PackageRegistryService | CapabilitySinksService> =>\n\tlayerBuiltInCapabilitySinks(orchestrator).pipe(Layer.provideMerge(layerBuiltInPluginServices));\n\nexport const extendBuiltInPluginContext = (\n\tctx: Context.Context<never>,\n): Effect.Effect<\n\tContext.Context<never>,\n\tnever,\n\tCoinRegistryService | PackageRegistryService | CapabilitySinksService\n> =>\n\tEffect.gen(function* () {\n\t\tconst coinRegistry = yield* CoinRegistryService;\n\t\tconst packageRegistry = yield* PackageRegistryService;\n\t\tconst capabilitySinks = yield* CapabilitySinksService;\n\t\treturn ctx.pipe(\n\t\t\tContext.add(CoinRegistryService, coinRegistry),\n\t\t\tContext.add(PackageRegistryService, packageRegistry),\n\t\t\tContext.add(CapabilitySinksService, capabilitySinks),\n\t\t) as Context.Context<never>;\n\t});\n"],"mappings":";;;;;;;;AAyBA,MAAa,6BACZ,MAAM,SAAS,mBAAmB,qBAAqB;AAExD,MAAM,qBACL,kBACqF;CACrF,MAAM;CACN,SAAS,SACR,OAAO,IAAI,aAAa;AACvB,OAAK,MAAM,cAAc,yBAAyB,KAAK,OAAO,EAAE;GAC/D,MAAM,SAAqB;IAC1B,MAAM,WAAW,UAAU,WAAW,SAAS,aAAa;IAC5D,MAAM,WAAW;IACjB,SAAS,WAAW;IACpB,YAAY,WAAW;IACvB,UAAU,WAAW,YAAY;IACjC,GAAI,WAAW,WAAW,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,WAAW,QAAQ;IACxE,GAAI,WAAW,gBAAgB,KAAA,IAAY,EAAE,GAAG,EAAE,aAAa,WAAW,aAAa;IACvF,GAAI,WAAW,YAAY,KAAA,IAAY,EAAE,GAAG,EAAE,SAAS,WAAW,SAAS;IAC3E,GAAI,CAAC,WAAW,oBAAoB,WAAW,kBAAkB,KAAA,IAC9D,EAAE,GACF,EAAE,eAAe,WAAW,eAAe;IAC9C,GAAI,WAAW,eAAe,KAAA,IAAY,EAAE,GAAG,EAAE,YAAY,WAAW,YAAY;IACpF,WAAW,KAAK;IAChB,uBAAuB,KAAK;IAC5B;AACD,UAAO,aAAa,SAAS,OAAO;;GAEpC;CACH;AAED,MAAa,+BACZ,iBAC8F;AAQ9F,QAPmC,MAAM,cACxC,OAAO,IAAI,aAAa;EACvB,MAAM,QAAQ,OAAO;EACrB,MAAM,eAAe,OAAO;AAC5B,SAAO,MAAM,aAAa,kBAAkB,aAAa,CAAC;GACzD,CAE8B,CAAC,KACjC,MAAM,aAAa,4BAA4B,aAAa,CAAC,CAC7D;;AAGF,MAAa,6BACZ,iBAEA,4BAA4B,aAAa,CAAC,KAAK,MAAM,aAAa,2BAA2B,CAAC;AAE/F,MAAa,8BACZ,QAMA,OAAO,IAAI,aAAa;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,kBAAkB,OAAO;CAC/B,MAAM,kBAAkB,OAAO;AAC/B,QAAO,IAAI,KACV,QAAQ,IAAI,qBAAqB,aAAa,EAC9C,QAAQ,IAAI,wBAAwB,gBAAgB,EACpD,QAAQ,IAAI,wBAAwB,gBAAgB,CACpD;EACA"}

package/dist/runtime/docker/client.d.mts

@@ -0,0 +1,2 @@
+import { Context, Effect, Layer } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";

package/dist/runtime/docker/client.mjs

@@ -0,0 +1,54 @@
+import { capture } from "../../substrate/runtime/observability/subprocess-capture.mjs";
+import { Context, Effect, Layer } from "effect";
+import { ChildProcess } from "effect/unstable/process";
+//#region src/runtime/docker/client.ts
+var DockerHost = class extends Context.Service()("@devstack-rewrite/runtime-docker/DockerHost") {};
+const layerDockerHostDefault = Layer.succeed(DockerHost)({});
+/** A spawner service exposing `spawn`. Held as a service so tests can
+*  inject a stub. In production this is `ChildProcessSpawner.make()`
+*  from `effect/unstable/process` (provided via `@effect/platform-node`). */
+var DockerSpawner = class extends Context.Service()("@devstack-rewrite/runtime-docker/DockerSpawner") {};
+const buildEnv = (host) => {
+	const env = {};
+	if (host.dockerHost !== void 0) env.DOCKER_HOST = host.dockerHost;
+	return env;
+};
+/** Build a `ChildProcess.Command` from `(verb, ...args)`. The verb is
+*  separate so observability span attributes can pin the
+*  high-cardinality `args` separately from the `devstack.op` tag. */
+const dockerCommand = (host, verb, args, overrideEnv = {}) => {
+	const bin = host.bin ?? "docker";
+	const env = {
+		...buildEnv(host),
+		...overrideEnv
+	};
+	return ChildProcess.make(bin, [verb, ...args], {
+		env,
+		extendEnv: true
+	});
+};
+/** Capture a docker invocation, fail on non-zero exit. Use when any
+*  non-zero exit is a failure case (most write operations). */
+const dockerRun = (verb, args, opts) => Effect.gen(function* () {
+	const host = yield* DockerHost;
+	return yield* capture(yield* DockerSpawner, dockerCommand(host, verb, args), {
+		...opts,
+		op: `docker.${verb}`,
+		nonZeroIsFailure: true
+	});
+});
+/** Capture a docker invocation, return the `CaptureResult` regardless
+*  of exit. Use when the caller classifies stderr or wants the exit
+*  code (lifecycle state machine, inventory). */
+const dockerRunOk = (verb, args, opts) => Effect.gen(function* () {
+	const host = yield* DockerHost;
+	return yield* capture(yield* DockerSpawner, dockerCommand(host, verb, args), {
+		...opts,
+		op: `docker.${verb}`,
+		nonZeroIsFailure: false
+	});
+});
+//#endregion
+export { DockerHost, DockerSpawner, dockerCommand, dockerRun, dockerRunOk, layerDockerHostDefault };
+
+//# sourceMappingURL=client.mjs.map

package/dist/runtime/docker/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.mjs","names":[],"sources":["../../../src/runtime/docker/client.ts"],"sourcesContent":["// Thin `docker` CLI wrapper.\n//\n// Every subprocess invocation flows through the L0 subprocess-capture\n// primitive (one capture function, one error class). This module owns:\n//\n//   - The argv constructor (`dockerArgv`).\n//   - The `DOCKER_HOST` env passthrough (architecture §7: one-daemon\n//     assumption, env override supported).\n//   - Two convenience verbs: `run` (capture-with-success-or-fail-by-exit)\n//     and `runOk` (capture, return CaptureResult regardless of exit so\n//     the caller can classify stderr). NO docker compose anywhere.\n//\n// No service names appear here. No stderr-pattern classification —\n// that's in `wrap.ts`. This file is mechanical argv + spawn.\n\nimport { Context, Effect, Layer } from 'effect';\nimport { ChildProcess } from 'effect/unstable/process';\nimport { ChildProcessSpawner } from 'effect/unstable/process';\n\nimport {\n\tcapture,\n\ttype CaptureError,\n\ttype CaptureOptions,\n\ttype CaptureResult,\n} from '../../substrate/runtime/observability/subprocess-capture.ts';\n\n// -----------------------------------------------------------------------------\n// Daemon-host configuration\n// -----------------------------------------------------------------------------\n\n/** Optional `DOCKER_HOST` override. When absent we let the docker CLI\n *  resolve its default socket (Unix: `/var/run/docker.sock`; macOS\n *  Desktop: `unix:///var/run/docker.sock`; remote daemon if the user\n *  set `DOCKER_HOST` in their own env). */\nexport interface DockerHostShape {\n\treadonly dockerHost?: string;\n\t/** Optional explicit binary path (default `docker`). Tests use\n\t *  this to point at a stub; otherwise we resolve via PATH. */\n\treadonly bin?: string;\n}\n\nexport class DockerHost extends Context.Service<DockerHost, DockerHostShape>()(\n\t'@devstack-rewrite/runtime-docker/DockerHost',\n) {}\n\nexport const layerDockerHostDefault: Layer.Layer<DockerHost> = Layer.succeed(DockerHost)({});\n\nexport const layerDockerHost = (shape: DockerHostShape): Layer.Layer<DockerHost> =>\n\tLayer.succeed(DockerHost)(shape);\n\n// -----------------------------------------------------------------------------\n// Spawner injection\n// -----------------------------------------------------------------------------\n\n/** A spawner service exposing `spawn`. Held as a service so tests can\n *  inject a stub. In production this is `ChildProcessSpawner.make()`\n *  from `effect/unstable/process` (provided via `@effect/platform-node`). */\nexport class DockerSpawner extends Context.Service<\n\tDockerSpawner,\n\tReturnType<typeof ChildProcessSpawner.make>\n>()('@devstack-rewrite/runtime-docker/DockerSpawner') {}\n\n// -----------------------------------------------------------------------------\n// Argv construction\n// -----------------------------------------------------------------------------\n\nconst buildEnv = (host: DockerHostShape): Record<string, string> => {\n\tconst env: Record<string, string> = {};\n\tif (host.dockerHost !== undefined) env.DOCKER_HOST = host.dockerHost;\n\treturn env;\n};\n\n/** Build a `ChildProcess.Command` from `(verb, ...args)`. The verb is\n *  separate so observability span attributes can pin the\n *  high-cardinality `args` separately from the `devstack.op` tag. */\nexport const dockerCommand = (\n\thost: DockerHostShape,\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\toverrideEnv: Readonly<Record<string, string>> = {},\n): ChildProcess.Command => {\n\tconst bin = host.bin ?? 'docker';\n\tconst env = { ...buildEnv(host), ...overrideEnv };\n\treturn ChildProcess.make(bin, [verb, ...args], { env, extendEnv: true });\n};\n\n// -----------------------------------------------------------------------------\n// Capture verbs\n// -----------------------------------------------------------------------------\n\n/** Capture a docker invocation, fail on non-zero exit. Use when any\n *  non-zero exit is a failure case (most write operations). */\nexport const dockerRun = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: true,\n\t\t});\n\t});\n\n/** Capture a docker invocation, return the `CaptureResult` regardless\n *  of exit. Use when the caller classifies stderr or wants the exit\n *  code (lifecycle state machine, inventory). */\nexport const dockerRunOk = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: false,\n\t\t});\n\t});\n"],"mappings":";;;;AAyCA,IAAa,aAAb,cAAgC,QAAQ,SAAsC,CAC7E,8CACA,CAAC;AAEF,MAAa,yBAAkD,MAAM,QAAQ,WAAW,CAAC,EAAE,CAAC;;;;AAY5F,IAAa,gBAAb,cAAmC,QAAQ,SAGxC,CAAC,iDAAiD,CAAC;AAMtD,MAAM,YAAY,SAAkD;CACnE,MAAM,MAA8B,EAAE;AACtC,KAAI,KAAK,eAAe,KAAA,EAAW,KAAI,cAAc,KAAK;AAC1D,QAAO;;;;;AAMR,MAAa,iBACZ,MACA,MACA,MACA,cAAgD,EAAE,KACxB;CAC1B,MAAM,MAAM,KAAK,OAAO;CACxB,MAAM,MAAM;EAAE,GAAG,SAAS,KAAK;EAAE,GAAG;EAAa;AACjD,QAAO,aAAa,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE;EAAE;EAAK,WAAW;EAAM,CAAC;;;;AASzE,MAAa,aACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;AAEpB,QAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,KAAK,EAAE;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;EAClB,CAAC;EACD;;;;AAKH,MAAa,eACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;AAEpB,QAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,KAAK,EAAE;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;EAClB,CAAC;EACD"}

package/dist/runtime/docker/container.d.mts

@@ -0,0 +1 @@
+import { Deferred, Effect, Ref, Scope } from "effect";