@mysten-incubation/devstack 0.0.0

package/dist/runtime/docker/container.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.mjs","names":[],"sources":["../../../src/runtime/docker/container.ts"],"sourcesContent":["// Container lifecycle state machine.\n//\n// Architecture § Lifecycle states. The (missing | running-match |\n// running-mismatch | stopped-clean | stopped-unclean | stopped-\n// mismatch) input states map to (adopt | resume | recreate | fresh)\n// actions. The output handle is the running container.\n//\n// Architecture invariants encoded here:\n//\n//   §1  Name-atomic create — `docker create --name <stable>` collision\n//       triggers `docker start <name>` adopt-fallback (single shot;\n//       second collision = typed failure, no infinite loop).\n//   §2  Label-driven inventory — we use `docker container inspect <name>`\n//       for the single-container probe path (cheaper than label-filtered\n//       `ps`, and type-specific when container/network names collide), but\n//       the labels are still STAMPED on create so sweep can find us by\n//       labels later.\n//   §5  Async network-connect — `network.ts::waitForIp` is called\n//       after attach and before we declare ready.\n//   §9  RecreatePolicy enum routed in — `never` refuses to recreate;\n//       `on-failure` recreates on unclean shutdown + image mismatch;\n//       `on-config-change` recreates on image mismatch, port mismatch,\n//       or caller-supplied config hash mismatch.\n\nimport { Deferred, Effect, Ref, Scope, Schema } from 'effect';\n\nimport type {\n\tContainerHandle,\n\tContainerPortPublish,\n\tEnsureContainerSpec,\n\tPortBindingReconciliation,\n\tRecreatePolicy,\n} from '../../contracts/container-runtime.ts';\nimport { addClaim, removeClaim } from '../../substrate/runtime/cross-process/roster.ts';\nimport { StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { decodeJsonArrayElementSync } from '../../substrate/runtime/runtime-decode.ts';\nimport { DockerHost, DockerSpawner, dockerRun, dockerRunOk } from './client.ts';\nimport {\n\tContainerCreateFailed,\n\tContainerNameCollisionUnrecoverable,\n\tDaemonUnreachable,\n\tDockerInspectDecodeFailed,\n\tDockerInspectFailed,\n\ttype DockerRuntimeError,\n\tForeignDockerResource,\n\tRecreateRefused,\n} from './errors.ts';\nimport {\n\texpectedContainerOwnershipLabels,\n\tLabelKey,\n\townershipMismatchDetail,\n\trenderContainerLabels,\n} from './labels.ts';\nimport { connect, readIps, waitForIp } from './network.ts';\nimport {\n\tclassifyExit,\n\tisDaemonUnreachableStderr,\n\tisNameCollisionStderr,\n\tisNoSuchContainerStderr,\n\twrapCreateError,\n\twrapGeneric,\n} from './wrap.ts';\n\n// -----------------------------------------------------------------------------\n// State machine — pure decision (testable independently)\n// -----------------------------------------------------------------------------\n\nexport type InspectLifecycleState =\n\t| { readonly kind: 'running'; readonly exitCode: number }\n\t| { readonly kind: 'paused'; readonly exitCode: number }\n\t| { readonly kind: 'stopped'; readonly exitCode: number }\n\t| { readonly kind: 'unknown' };\n\n/** What `docker container inspect <name>` told us. Lifecycle facts are explicit:\n *  Docker may omit `State`, and absence means we cannot prove running,\n *  paused, or stopped state. */\nexport interface InspectFacts {\n\treadonly id: string;\n\treadonly lifecycle: InspectLifecycleState;\n\treadonly running: boolean;\n\treadonly paused: boolean;\n\treadonly exitCode: number | null;\n\t/** Create-time image ref recorded by Docker. For tagged builds this is\n\t *  usually the tag passed to `docker run`. */\n\treadonly image: string;\n\t/** Resolved image id from Docker inspect's top-level `Image` field. */\n\treadonly imageDigest?: string;\n\treadonly mounts?: ReadonlyArray<InspectMount>;\n\treadonly portBindings?: ReadonlyArray<string>;\n\treadonly ports?: ReadonlyArray<ContainerPortPublish>;\n\treadonly effectivePortBindings?: ReadonlyArray<string>;\n\treadonly effectivePorts?: ReadonlyArray<ContainerPortPublish>;\n\treadonly command?: ReadonlyArray<string>;\n\treadonly labels?: Readonly<Record<string, string>>;\n\treadonly networks?: ReadonlyArray<string>;\n}\n\nexport interface InspectMount {\n\treadonly source: string;\n\treadonly target: string;\n\treadonly readOnly?: boolean;\n}\n\n/** The closed set of actions the state machine can decide. */\nexport type RunAction =\n\t| { readonly kind: 'adopt'; readonly id: string }\n\t| { readonly kind: 'unpause-adopt'; readonly id: string }\n\t| { readonly kind: 'resume'; readonly id: string }\n\t| { readonly kind: 'recreate'; readonly id: string; readonly reason: RecreateReason }\n\t| { readonly kind: 'fresh' }\n\t| { readonly kind: 'refuse'; readonly reason: RecreateReason };\n\nexport type RecreateReason =\n\t| 'image-mismatch'\n\t| 'config-mismatch'\n\t| 'unclean-shutdown'\n\t| 'resume-failed'\n\t| 'unknown-state';\n\n/** Pure decision: given the inspect facts (or null = missing), the\n *  desired image + host port bindings, and the policy, what action\n *  do we take?\n *\n *  Tested directly without the subprocess seam. */\nexport const decideRunAction = (\n\tfacts: InspectFacts | null,\n\tdesiredImage: string,\n\tpolicy: RecreatePolicy,\n\tdesiredPortBindings: ReadonlyArray<string> = [],\n\tportBindingReconciliation: PortBindingReconciliation = 'exact',\n\tdesiredConfigHash?: string,\n\tdesiredImageDigest?: string,\n): RunAction => {\n\tif (facts === null) return { kind: 'fresh' };\n\tconst imageMatches =\n\t\tfacts.image === desiredImage ||\n\t\t(desiredImageDigest !== undefined &&\n\t\t\t(facts.image === desiredImageDigest || facts.imageDigest === desiredImageDigest));\n\tconst portsMatch = sameBindings(facts.portBindings ?? [], desiredPortBindings);\n\tconst portsCompatible =\n\t\tportsMatch ||\n\t\t(portBindingReconciliation === 'adopt-existing' &&\n\t\t\tsameBindingContainerPorts(facts.portBindings ?? [], desiredPortBindings));\n\tconst configMatches =\n\t\tdesiredConfigHash === undefined || facts.labels?.[LabelKey.configHash] === desiredConfigHash;\n\tif (facts.lifecycle.kind === 'unknown') {\n\t\treturn routeRecreate({ kind: 'recreate', id: facts.id, reason: 'unknown-state' }, policy);\n\t}\n\tif (facts.lifecycle.kind === 'paused') {\n\t\treturn imageMatches && portsCompatible && configMatches\n\t\t\t? { kind: 'unpause-adopt', id: facts.id }\n\t\t\t: routeRecreate(\n\t\t\t\t\t{\n\t\t\t\t\t\tkind: 'recreate',\n\t\t\t\t\t\tid: facts.id,\n\t\t\t\t\t\treason: imageMatches ? 'config-mismatch' : 'image-mismatch',\n\t\t\t\t\t},\n\t\t\t\t\tpolicy,\n\t\t\t\t);\n\t}\n\tif (facts.lifecycle.kind === 'running') {\n\t\treturn imageMatches && portsCompatible && configMatches\n\t\t\t? { kind: 'adopt', id: facts.id }\n\t\t\t: routeRecreate(\n\t\t\t\t\t{\n\t\t\t\t\t\tkind: 'recreate',\n\t\t\t\t\t\tid: facts.id,\n\t\t\t\t\t\treason: imageMatches ? 'config-mismatch' : 'image-mismatch',\n\t\t\t\t\t},\n\t\t\t\t\tpolicy,\n\t\t\t\t);\n\t}\n\tif (!imageMatches) {\n\t\t// Image mismatch ALWAYS wins (architecture §11).\n\t\treturn routeRecreate({ kind: 'recreate', id: facts.id, reason: 'image-mismatch' }, policy);\n\t}\n\tif (!portsCompatible) {\n\t\treturn routeRecreate({ kind: 'recreate', id: facts.id, reason: 'config-mismatch' }, policy);\n\t}\n\tif (!configMatches) {\n\t\treturn routeRecreate({ kind: 'recreate', id: facts.id, reason: 'config-mismatch' }, policy);\n\t}\n\tif (facts.lifecycle.exitCode === 137) {\n\t\t// Unclean shutdown — see architecture §G1 / §13.\n\t\t// `on-failure`: recreate. `never`: refuse. `on-config-change`:\n\t\t// resume — caller wants stopped container kept until config\n\t\t// changes, even if the prior exit was unclean.\n\t\tif (policy === 'on-failure') {\n\t\t\treturn { kind: 'recreate', id: facts.id, reason: 'unclean-shutdown' };\n\t\t}\n\t\tif (policy === 'never') {\n\t\t\treturn { kind: 'refuse', reason: 'unclean-shutdown' };\n\t\t}\n\t\treturn { kind: 'resume', id: facts.id };\n\t}\n\treturn { kind: 'resume', id: facts.id };\n};\n\n/** Route a recreate-class decision through the policy. */\nconst routeRecreate = (\n\taction: RunAction & { kind: 'recreate' },\n\tpolicy: RecreatePolicy,\n): RunAction => {\n\tif (policy === 'never') return { kind: 'refuse', reason: action.reason };\n\treturn action;\n};\n\nconst canonicalPortBindings = (\n\tports: ReadonlyArray<ContainerPortPublish> | undefined,\n): ReadonlyArray<string> =>\n\t[...(ports ?? [])]\n\t\t.map((p) => `${p.containerPort}/tcp=${normalizeHostIp(p.hostIp)}:${p.hostPort}`)\n\t\t.sort();\n\nconst sameBindings = (left: ReadonlyArray<string>, right: ReadonlyArray<string>): boolean =>\n\tleft.length === right.length && left.every((value, index) => value === right[index]);\n\nconst sameBindingContainerPorts = (\n\tleft: ReadonlyArray<string>,\n\tright: ReadonlyArray<string>,\n): boolean => {\n\tconst leftContainers = left.map(bindingContainerKey).sort();\n\tconst rightContainers = right.map(bindingContainerKey).sort();\n\treturn sameBindings(leftContainers, rightContainers);\n};\n\nconst bindingContainerKey = (binding: string): string => binding.split('=')[0] ?? binding;\n\nconst normalizeHostIp = (hostIp: string | undefined): string =>\n\thostIp === undefined || hostIp === '' ? '0.0.0.0' : hostIp;\n\nconst readPublishedPorts = (raw: unknown): ReadonlyArray<ContainerPortPublish> => {\n\tif (raw === null || typeof raw !== 'object') return [];\n\tconst out: ContainerPortPublish[] = [];\n\tfor (const [container, bindings] of Object.entries(raw)) {\n\t\tconst containerPort = Number(container.split('/')[0]);\n\t\tif (!Number.isInteger(containerPort) || containerPort <= 0) continue;\n\t\tif (!Array.isArray(bindings)) continue;\n\t\tfor (const binding of bindings) {\n\t\t\tif (binding === null || typeof binding !== 'object') continue;\n\t\t\tconst hostPort = (binding as { HostPort?: unknown }).HostPort;\n\t\t\tif (typeof hostPort !== 'string') continue;\n\t\t\tconst hostPortNumber = Number(hostPort);\n\t\t\tif (!Number.isInteger(hostPortNumber) || hostPortNumber <= 0) continue;\n\t\t\tconst hostIp = (binding as { HostIp?: unknown }).HostIp;\n\t\t\tout.push({\n\t\t\t\tcontainerPort,\n\t\t\t\thostPort: hostPortNumber,\n\t\t\t\t...(typeof hostIp === 'string' ? { hostIp: normalizeHostIp(hostIp) } : {}),\n\t\t\t});\n\t\t}\n\t}\n\treturn out.sort((a, b) => {\n\t\tif (a.containerPort !== b.containerPort) return a.containerPort - b.containerPort;\n\t\tconst hostIp = normalizeHostIp(a.hostIp).localeCompare(normalizeHostIp(b.hostIp));\n\t\treturn hostIp !== 0 ? hostIp : a.hostPort - b.hostPort;\n\t});\n};\n\nconst readMounts = (raw: unknown): ReadonlyArray<InspectMount> => {\n\tif (!Array.isArray(raw)) return [];\n\tconst out: InspectMount[] = [];\n\tfor (const mount of raw) {\n\t\tif (mount === null || typeof mount !== 'object') continue;\n\t\tconst source = (mount as { Source?: unknown }).Source;\n\t\tconst target = (mount as { Destination?: unknown }).Destination;\n\t\tif (typeof source !== 'string' || typeof target !== 'string') continue;\n\t\tconst rw = (mount as { RW?: unknown }).RW;\n\t\tout.push({\n\t\t\tsource,\n\t\t\ttarget,\n\t\t\t...(typeof rw === 'boolean' ? { readOnly: !rw } : {}),\n\t\t});\n\t}\n\treturn out;\n};\n\nconst readStringArray = (raw: unknown): ReadonlyArray<string> => {\n\tif (!Array.isArray(raw)) return [];\n\treturn raw.filter((value): value is string => typeof value === 'string');\n};\n\nconst readLabels = (raw: unknown): Readonly<Record<string, string>> => {\n\tif (raw === null || typeof raw !== 'object') return {};\n\tconst out: Record<string, string> = {};\n\tfor (const [key, value] of Object.entries(raw)) {\n\t\tif (typeof value === 'string') out[key] = value;\n\t}\n\treturn out;\n};\n\nconst readNetworks = (raw: unknown): ReadonlyArray<string> => {\n\tif (raw === null || typeof raw !== 'object') return [];\n\treturn Object.keys(raw).sort();\n};\n\nconst readLifecycleState = (\n\tstate:\n\t\t| {\n\t\t\t\treadonly Running: boolean;\n\t\t\t\treadonly Paused: boolean;\n\t\t\t\treadonly ExitCode: number;\n\t\t  }\n\t\t| undefined,\n): InspectLifecycleState => {\n\tif (state === undefined) return { kind: 'unknown' };\n\tif (state.Paused) return { kind: 'paused', exitCode: state.ExitCode };\n\tif (state.Running) return { kind: 'running', exitCode: state.ExitCode };\n\treturn { kind: 'stopped', exitCode: state.ExitCode };\n};\n\n// -----------------------------------------------------------------------------\n// Inspect — `docker container inspect <name>`\n// -----------------------------------------------------------------------------\n\nconst InspectSchema = Schema.Struct({\n\tId: Schema.String,\n\tImage: Schema.optional(Schema.String),\n\tMounts: Schema.optional(Schema.Unknown),\n\tHostConfig: Schema.optional(\n\t\tSchema.Struct({\n\t\t\tPortBindings: Schema.Unknown,\n\t\t}),\n\t),\n\tState: Schema.optional(\n\t\tSchema.Struct({\n\t\t\tRunning: Schema.Boolean,\n\t\t\tPaused: Schema.Boolean,\n\t\t\tExitCode: Schema.Number,\n\t\t}),\n\t),\n\tConfig: Schema.Struct({\n\t\tImage: Schema.String,\n\t\tCmd: Schema.optional(Schema.Unknown),\n\t\tLabels: Schema.optional(Schema.Unknown),\n\t}),\n\tNetworkSettings: Schema.Struct({\n\t\tNetworks: Schema.Unknown,\n\t\tPorts: Schema.optional(Schema.Unknown),\n\t}),\n});\n\nexport const inspectContainer = (\n\tname: string,\n): Effect.Effect<InspectFacts | null, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst res = yield* dockerRunOk('container', ['inspect', name]).pipe(\n\t\t\tEffect.mapError(wrapGeneric('docker.container.inspect')),\n\t\t);\n\t\tif (res.exitCode !== 0) {\n\t\t\tif (isNoSuchContainerStderr(res.stderr)) return null;\n\t\t\tif (isDaemonUnreachableStderr(res.stderr)) {\n\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\tnew DaemonUnreachable({\n\t\t\t\t\t\top: 'docker.container.inspect',\n\t\t\t\t\t\tdetail: 'docker daemon unreachable',\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew DockerInspectFailed({\n\t\t\t\t\tresource: 'container',\n\t\t\t\t\tname,\n\t\t\t\t\tstderr: res.stderr,\n\t\t\t\t\texitCode: res.exitCode,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\ttry {\n\t\t\tconst decoded = decodeJsonArrayElementSync(InspectSchema, res.stdout, {\n\t\t\t\tsource: `docker container inspect ${name}`,\n\t\t\t\tmissingMessage: 'inspect returned an empty result',\n\t\t\t\tmkError: (issue) =>\n\t\t\t\t\tnew DockerInspectDecodeFailed({\n\t\t\t\t\t\tresource: 'container',\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tdetail:\n\t\t\t\t\t\t\tissue.message === 'inspect returned an empty result'\n\t\t\t\t\t\t\t\t? issue.message\n\t\t\t\t\t\t\t\t: 'inspect returned malformed container JSON',\n\t\t\t\t\t\tcause: issue.cause,\n\t\t\t\t\t}),\n\t\t\t});\n\t\t\tconst lifecycle = readLifecycleState(decoded.State);\n\t\t\tconst effectivePorts = readPublishedPorts(decoded.NetworkSettings.Ports);\n\t\t\tconst ports =\n\t\t\t\tdecoded.HostConfig === undefined\n\t\t\t\t\t? effectivePorts\n\t\t\t\t\t: readPublishedPorts(decoded.HostConfig.PortBindings);\n\t\t\tconst mounts = readMounts(decoded.Mounts);\n\t\t\tconst command = readStringArray(decoded.Config.Cmd);\n\t\t\tconst labels = readLabels(decoded.Config.Labels);\n\t\t\tconst networks = readNetworks(decoded.NetworkSettings.Networks);\n\t\t\treturn {\n\t\t\t\tid: decoded.Id,\n\t\t\t\tlifecycle,\n\t\t\t\trunning: lifecycle.kind === 'running' || lifecycle.kind === 'paused',\n\t\t\t\tpaused: lifecycle.kind === 'paused',\n\t\t\t\texitCode: lifecycle.kind === 'unknown' ? null : lifecycle.exitCode,\n\t\t\t\t// The container's recorded image. Docker may omit the\n\t\t\t\t// top-level digest field, but lifecycle decisions need the\n\t\t\t\t// create-time ref from Config.Image.\n\t\t\t\timage: decoded.Config.Image,\n\t\t\t\t...(decoded.Image !== undefined ? { imageDigest: decoded.Image } : {}),\n\t\t\t\tmounts,\n\t\t\t\tportBindings: canonicalPortBindings(ports),\n\t\t\t\tports,\n\t\t\t\teffectivePortBindings: canonicalPortBindings(effectivePorts),\n\t\t\t\teffectivePorts,\n\t\t\t\tcommand,\n\t\t\t\tlabels,\n\t\t\t\tnetworks,\n\t\t\t};\n\t\t} catch (cause) {\n\t\t\treturn yield* Effect.fail(cause as DockerRuntimeError);\n\t\t}\n\t}).pipe(Effect.withSpan('runtime.docker.container.inspect'));\n\n// -----------------------------------------------------------------------------\n// Argv construction\n// -----------------------------------------------------------------------------\n\nconst createArgv = (\n\tspec: EnsureContainerSpec,\n\tcycle: number,\n\timageRef: string,\n): ReadonlyArray<string> => {\n\tconst args: Array<string> = ['-d', '--name', spec.name];\n\tconst configLabels: Readonly<Record<string, string>> | undefined =\n\t\tspec.configHash === undefined ? undefined : { [LabelKey.configHash]: spec.configHash };\n\tfor (const label of renderContainerLabels(spec.labels, cycle, configLabels)) {\n\t\targs.push('--label', label);\n\t}\n\tif (spec.env) {\n\t\tfor (const [k, v] of Object.entries(spec.env)) {\n\t\t\targs.push('--env', `${k}=${v}`);\n\t\t}\n\t}\n\tif (spec.ports) {\n\t\tfor (const p of spec.ports) {\n\t\t\tconst hostPrefix = p.hostIp === undefined ? '' : `${p.hostIp}:`;\n\t\t\targs.push('-p', `${hostPrefix}${p.hostPort}:${p.containerPort}`);\n\t\t}\n\t}\n\tif (spec.mounts) {\n\t\tfor (const m of spec.mounts) {\n\t\t\tconst ro = m.readonly ? ',readonly' : '';\n\t\t\targs.push('--mount', `type=bind,source=${m.source},target=${m.target}${ro}`);\n\t\t}\n\t}\n\tif (spec.networkAttach && spec.networkAttach.length > 0) {\n\t\t// First attach goes via --network; subsequent attaches via\n\t\t// post-start `network connect` so we can wait for IP readback.\n\t\targs.push('--network', spec.networkAttach[0]!);\n\t}\n\tif (spec.extraHosts) {\n\t\tfor (const [host, ip] of Object.entries(spec.extraHosts)) {\n\t\t\targs.push('--add-host', `${host}:${ip}`);\n\t\t}\n\t}\n\tif (spec.entrypoint) {\n\t\targs.push('--entrypoint', spec.entrypoint);\n\t}\n\targs.push(imageRef);\n\tif (spec.command) {\n\t\targs.push(...spec.command);\n\t}\n\treturn args;\n};\n\n// -----------------------------------------------------------------------------\n// Apply the state machine\n// -----------------------------------------------------------------------------\n\nconst handleOf = (\n\tid: string,\n\tname: string,\n\timageName: string,\n\tstatus: ContainerHandle['status'],\n\tips: ReadonlyArray<string>,\n\tports?: ReadonlyArray<ContainerPortPublish>,\n\tlabels?: EnsureContainerSpec['labels'],\n): ContainerHandle => ({\n\tid,\n\tname,\n\t...(labels !== undefined ? { labels } : {}),\n\timageName,\n\tstatus,\n\tips,\n\t...(ports !== undefined ? { ports } : {}),\n});\n\n/** Force-remove by name. Used by recreate. Idempotent on\n *  \"no such container\". */\nconst forceRemove = (\n\tname: string,\n): Effect.Effect<void, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst res = yield* dockerRunOk('rm', ['-f', name]).pipe(\n\t\t\tEffect.mapError(wrapGeneric('docker.rm')),\n\t\t);\n\t\tif (res.exitCode !== 0 && !isNoSuchContainerStderr(res.stderr)) {\n\t\t\t// best-effort; we surface as a span event but do not fail\n\t\t\t// the rm step (the next create will collision-recover).\n\t\t\tyield* Effect.annotateCurrentSpan({ 'docker.rm.warning': res.stderr });\n\t\t}\n\t}).pipe(Effect.withSpan('runtime.docker.container.forceRemove'));\n\nconst ownershipFailure = (\n\tname: string,\n\texpected: Readonly<Record<string, string>>,\n\tactual: Readonly<Record<string, string>>,\n\tdetail: string,\n): ForeignDockerResource =>\n\tnew ForeignDockerResource({\n\t\tresource: 'container',\n\t\tname,\n\t\texpected,\n\t\tactual,\n\t\tdetail,\n\t});\n\nconst assertOwnedFacts = (\n\tname: string,\n\tfacts: InspectFacts,\n\tlabels: EnsureContainerSpec['labels'],\n): Effect.Effect<void, DockerRuntimeError> =>\n\tEffect.gen(function* () {\n\t\tconst expected = expectedContainerOwnershipLabels(labels);\n\t\tconst actual = facts.labels ?? {};\n\t\tconst mismatch = ownershipMismatchDetail(expected, actual);\n\t\tif (mismatch !== null) {\n\t\t\treturn yield* Effect.fail(ownershipFailure(name, expected, actual, mismatch));\n\t\t}\n\t});\n\nconst failUnknownCollisionLifecycle = (\n\tname: string,\n\tstage: 'before-start' | 'after-start',\n): Effect.Effect<never, DockerRuntimeError> =>\n\tEffect.fail(\n\t\tnew ContainerNameCollisionUnrecoverable({\n\t\t\tname,\n\t\t\tdetail: `name collision recovery refused unknown lifecycle state ${stage}`,\n\t\t}),\n\t);\n\nexport const assertContainerHandleOwned = (\n\thandle: ContainerHandle,\n): Effect.Effect<void, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tif (handle.labels === undefined) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\townershipFailure(handle.name, {}, {}, 'container handle has no ownership labels'),\n\t\t\t);\n\t\t}\n\t\tconst facts = yield* inspectContainer(handle.name);\n\t\tconst expected = expectedContainerOwnershipLabels(handle.labels);\n\t\tif (facts === null) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\townershipFailure(handle.name, expected, {}, 'container is missing'),\n\t\t\t);\n\t\t}\n\t\tif (facts.id !== handle.id) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\townershipFailure(handle.name, expected, facts.labels ?? {}, `id changed to ${facts.id}`),\n\t\t\t);\n\t\t}\n\t\tyield* assertOwnedFacts(handle.name, facts, handle.labels);\n\t}).pipe(Effect.withSpan('runtime.docker.container.assertOwned'));\n\nconst forceRemoveOwned = (\n\tname: string,\n\tid: string,\n\tlabels: EnsureContainerSpec['labels'],\n): Effect.Effect<void, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst current = yield* inspectContainer(name);\n\t\tif (current === null) return;\n\t\tif (current.id !== id) {\n\t\t\tconst expected = expectedContainerOwnershipLabels(labels);\n\t\t\treturn yield* Effect.fail(\n\t\t\t\townershipFailure(name, expected, current.labels ?? {}, `id changed to ${current.id}`),\n\t\t\t);\n\t\t}\n\t\tyield* assertOwnedFacts(name, current, labels);\n\t\tyield* forceRemove(name);\n\t});\n\n/** Single-shot start-and-adopt fallback after `docker create` exit-125\n *  with name-collision. Architecture §1 / G10 — one attempt; second\n *  collision is a typed failure. */\nconst startAndAdopt = (\n\tname: string,\n\tlabels: EnsureContainerSpec['labels'],\n): Effect.Effect<string, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst beforeStart = yield* inspectContainer(name);\n\t\tif (beforeStart === null) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew ContainerNameCollisionUnrecoverable({\n\t\t\t\t\tname,\n\t\t\t\t\tdetail: 'name collision but inspect found no container',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tyield* assertOwnedFacts(name, beforeStart, labels);\n\t\tif (beforeStart.lifecycle.kind === 'unknown') {\n\t\t\treturn yield* failUnknownCollisionLifecycle(name, 'before-start');\n\t\t}\n\t\tconst res = yield* dockerRunOk('start', [name]).pipe(\n\t\t\tEffect.mapError(wrapGeneric('docker.start')),\n\t\t);\n\t\tconst cls = classifyExit(res);\n\t\tif (cls.ok) {\n\t\t\tconst facts = yield* inspectContainer(name);\n\t\t\tif (facts === null) {\n\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\tnew ContainerNameCollisionUnrecoverable({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tdetail: 'peer collision + start succeeded + inspect missed',\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t}\n\t\t\tyield* assertOwnedFacts(name, facts, labels);\n\t\t\tif (facts.lifecycle.kind === 'unknown') {\n\t\t\t\treturn yield* failUnknownCollisionLifecycle(name, 'after-start');\n\t\t\t}\n\t\t\treturn facts.id;\n\t\t}\n\t\tif (isNoSuchContainerStderr(cls.stderr)) {\n\t\t\t// Peer rm'd between our collision and the start. The caller's\n\t\t\t// outer loop will see this as \"missing\" and promote to fresh.\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew ContainerNameCollisionUnrecoverable({\n\t\t\t\t\tname,\n\t\t\t\t\tdetail: 'TOCTOU: start after collision found no container',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn yield* Effect.fail(\n\t\t\tnew ContainerNameCollisionUnrecoverable({\n\t\t\t\tname,\n\t\t\t\tdetail: `start-and-adopt failed: ${cls.stderr}`,\n\t\t\t}),\n\t\t);\n\t});\n\nconst freshCreate = (\n\tspec: EnsureContainerSpec,\n\tcycle: number,\n): Effect.Effect<string, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst args = createArgv(spec, cycle, spec.image.tag ?? spec.image.digest);\n\t\tconst created = yield* dockerRun('run', args).pipe(Effect.mapError(wrapCreateError(spec.name)));\n\t\treturn created.stdout.trim();\n\t});\n\nconst resumeStart = (\n\tname: string,\n): Effect.Effect<\n\t{ readonly ok: true } | { readonly ok: false; readonly stderr: string },\n\tDockerRuntimeError,\n\tDockerHost | DockerSpawner\n> =>\n\tEffect.gen(function* () {\n\t\tconst res = yield* dockerRunOk('start', [name]).pipe(\n\t\t\tEffect.mapError(wrapGeneric('docker.start')),\n\t\t);\n\t\tif (res.exitCode === 0) return { ok: true as const };\n\t\tif (isDaemonUnreachableStderr(res.stderr)) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew DaemonUnreachable({\n\t\t\t\t\top: 'docker.start',\n\t\t\t\t\tdetail: 'docker daemon unreachable',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn { ok: false as const, stderr: res.stderr };\n\t});\n\nconst recreateAfterResumeFailure = (\n\tid: string,\n\tspec: EnsureContainerSpec,\n\tdeps: EnsureContainerDeps,\n): Effect.Effect<string, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst routed = routeRecreate({ kind: 'recreate', id, reason: 'resume-failed' }, spec.recreate);\n\t\tif (routed.kind === 'refuse') {\n\t\t\treturn yield* Effect.fail(new RecreateRefused({ name: spec.name, reason: routed.reason }));\n\t\t}\n\t\tyield* forceRemoveOwned(spec.name, id, spec.labels);\n\t\treturn yield* createWithCollisionRecovery(spec, deps);\n\t});\n\nconst effectivePortsCompatible = (facts: InspectFacts, spec: EnsureContainerSpec): boolean => {\n\tconst desired = canonicalPortBindings(spec.ports);\n\tif (desired.length === 0) return true;\n\tconst actual = facts.effectivePortBindings ?? [];\n\tif (sameBindings(actual, desired)) return true;\n\treturn (\n\t\t(spec.portBindingReconciliation ?? 'exact') === 'adopt-existing' &&\n\t\tsameBindingContainerPorts(actual, desired)\n\t);\n};\n\nconst ensureEffectivePublishedPorts = (\n\tid: string,\n\tspec: EnsureContainerSpec,\n\tdeps: EnsureContainerDeps,\n): Effect.Effect<string, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tif ((spec.ports ?? []).length === 0) return id;\n\t\tconst facts = yield* inspectContainer(spec.name);\n\t\tif (facts === null || facts.id !== id || facts.lifecycle.kind !== 'running') return id;\n\t\tyield* assertOwnedFacts(spec.name, facts, spec.labels);\n\t\tif (effectivePortsCompatible(facts, spec)) return id;\n\t\tconst repairedId = yield* recreateAfterResumeFailure(id, spec, deps);\n\t\tconst repairedFacts = yield* inspectContainer(spec.name);\n\t\tif (\n\t\t\trepairedFacts !== null &&\n\t\t\trepairedFacts.id === repairedId &&\n\t\t\trepairedFacts.lifecycle.kind === 'running' &&\n\t\t\teffectivePortsCompatible(repairedFacts, spec)\n\t\t) {\n\t\t\treturn repairedId;\n\t\t}\n\t\treturn yield* Effect.fail(\n\t\t\tnew ContainerCreateFailed({\n\t\t\t\tname: spec.name,\n\t\t\t\tstderr: `container is running but Docker did not publish requested ports: desired=${JSON.stringify(\n\t\t\t\t\tcanonicalPortBindings(spec.ports),\n\t\t\t\t)} actual=${JSON.stringify(repairedFacts?.effectivePortBindings ?? [])}`,\n\t\t\t\texitCode: 0,\n\t\t\t}),\n\t\t);\n\t});\n\nconst stopWithGrace = (\n\tname: string,\n\tgraceSeconds: number,\n\tsignal?: string,\n): Effect.Effect<void, never, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst args: Array<string> = [];\n\t\tif (signal !== undefined) args.push('--signal', signal);\n\t\targs.push('--time', String(Math.max(0, Math.floor(graceSeconds))));\n\t\targs.push(name);\n\t\tyield* dockerRunOk('stop', args).pipe(\n\t\t\tEffect.catch(() => Effect.void),\n\t\t\tEffect.asVoid,\n\t\t);\n\t});\n\n// -----------------------------------------------------------------------------\n// Public surface\n// -----------------------------------------------------------------------------\n\n/** Per-name lock state. Map entry present = name is held; the value is\n *  the FIFO queue of waiter deferreds. Empty queue = held with no\n *  waiters. Map entry absent = free. */\nexport type PerNameLockState = ReadonlyMap<string, ReadonlyArray<Deferred.Deferred<void>>>;\n\nexport interface EnsureContainerDeps {\n\t/** Current engine cycle id; stamped as the `devstack.cycle` label. */\n\treadonly cycle: number;\n\t/** Process-local lock holder to serialize per-name actions within\n\t *  one Node process. Cross-process safety is the docker daemon's\n\t *  `--name` atomicity. */\n\treadonly perNameLock: Ref.Ref<PerNameLockState>;\n}\n\n/** Per-name lock acquire/release. The in-process serialization is the\n *  inspect→action window's invariant: two concurrent ensureContainer\n *  calls for the same name must not race between the read (inspect)\n *  and the write (create / start / recreate). Cross-process safety is\n *  separately the docker daemon's `--name` atomicity.\n *\n *  Implementation: a `Ref<Map<name, Deferred[]>>`. Acquire atomically\n *  claims the slot (free → enter with empty queue) or enqueues a fresh\n *  Deferred at the tail and awaits it. Release pops the head of the\n *  queue and completes that waiter — transferring ownership without a\n *  free intermediate window. Empty-queue release deletes the entry.\n *  No wall-clock polling: contention parks fibers on Deferred.await\n *  rather than spinning, so tests can use `it.effect` (TestClock) and\n *  contended-acquire ordering is FIFO by construction.\n *\n *  Exported for direct testing. */\nexport const acquirePerNameLock = (\n\tlock: Ref.Ref<PerNameLockState>,\n\tname: string,\n): Effect.Effect<void> =>\n\tEffect.gen(function* () {\n\t\tconst waiter = yield* Deferred.make<void>();\n\t\tconst claimed = yield* Ref.modify(lock, (m) => {\n\t\t\tconst queue = m.get(name);\n\t\t\tconst next = new Map(m);\n\t\t\tif (queue === undefined) {\n\t\t\t\t// Free → claim with empty waiter queue.\n\t\t\t\tnext.set(name, []);\n\t\t\t\treturn [true, next as PerNameLockState] as const;\n\t\t\t}\n\t\t\t// Held → enqueue and await.\n\t\t\tnext.set(name, [...queue, waiter]);\n\t\t\treturn [false, next as PerNameLockState] as const;\n\t\t});\n\t\tif (claimed) return;\n\t\t// Park until the current holder releases and completes our\n\t\t// deferred. Interrupt-cleanup: if we're interrupted while\n\t\t// queued, drop our deferred from the queue so a future\n\t\t// release doesn't transfer ownership to a dead waiter.\n\t\tyield* Deferred.await(waiter).pipe(\n\t\t\tEffect.onInterrupt(() =>\n\t\t\t\tRef.update(lock, (m) => {\n\t\t\t\t\tconst queue = m.get(name);\n\t\t\t\t\tif (queue === undefined) return m;\n\t\t\t\t\tconst filtered = queue.filter((d) => d !== waiter);\n\t\t\t\t\tif (filtered.length === queue.length) return m;\n\t\t\t\t\tconst next = new Map(m);\n\t\t\t\t\tnext.set(name, filtered);\n\t\t\t\t\treturn next as PerNameLockState;\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t});\n\nexport const releasePerNameLock = (\n\tlock: Ref.Ref<PerNameLockState>,\n\tname: string,\n): Effect.Effect<void> =>\n\tEffect.gen(function* () {\n\t\tconst head = yield* Ref.modify(lock, (m) => {\n\t\t\tconst queue = m.get(name);\n\t\t\tif (queue === undefined) return [undefined, m] as const;\n\t\t\tconst next = new Map(m);\n\t\t\tif (queue.length === 0) {\n\t\t\t\tnext.delete(name);\n\t\t\t\treturn [undefined, next as PerNameLockState] as const;\n\t\t\t}\n\t\t\tconst [first, ...rest] = queue;\n\t\t\tnext.set(name, rest);\n\t\t\treturn [first, next as PerNameLockState] as const;\n\t\t});\n\t\tif (head !== undefined) {\n\t\t\tyield* Deferred.succeed(head, undefined);\n\t\t}\n\t});\n\n/** Idempotent ensure: apply the state machine, register a scope\n *  finalizer that stops the container + releases the cross-process\n *  claim.\n *\n *  Returns the running container handle (id + name + status + ips). */\nexport const ensureContainer = (\n\tspec: EnsureContainerSpec,\n\tdeps: EnsureContainerDeps,\n): Effect.Effect<\n\tContainerHandle,\n\tDockerRuntimeError,\n\tDockerHost | DockerSpawner | StackPathsService | Scope.Scope\n> =>\n\tEffect.gen(function* () {\n\t\t// Per-name lock holds the inspect → applyAction window. We release\n\t\t// immediately after applyAction returns (success or typed failure)\n\t\t// so concurrent callers for the SAME name serialize at the\n\t\t// \"decide what to do\" step, but the lock does not outlive the\n\t\t// state-machine resolution. `acquireUseRelease` ensures the\n\t\t// release fires on interrupt/defect too.\n\t\tconst desiredImageRef = spec.image.tag ?? spec.image.digest;\n\t\tconst id = yield* Effect.acquireUseRelease(\n\t\t\tacquirePerNameLock(deps.perNameLock, spec.name),\n\t\t\t() =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst facts = yield* inspectContainer(spec.name);\n\t\t\t\t\tif (facts !== null) {\n\t\t\t\t\t\tyield* assertOwnedFacts(spec.name, facts, spec.labels);\n\t\t\t\t\t}\n\t\t\t\t\tconst action = decideRunAction(\n\t\t\t\t\t\tfacts,\n\t\t\t\t\t\tdesiredImageRef,\n\t\t\t\t\t\tspec.recreate,\n\t\t\t\t\t\tcanonicalPortBindings(spec.ports),\n\t\t\t\t\t\tspec.portBindingReconciliation ?? 'exact',\n\t\t\t\t\t\tspec.configHash,\n\t\t\t\t\t\tspec.image.digest,\n\t\t\t\t\t);\n\t\t\t\t\tconst id = yield* applyAction(action, spec, deps);\n\t\t\t\t\treturn yield* ensureEffectivePublishedPorts(id, spec, deps);\n\t\t\t\t}),\n\t\t\t() => releasePerNameLock(deps.perNameLock, spec.name),\n\t\t);\n\t\tyield* assertContainerHandleOwned({\n\t\t\tid,\n\t\t\tname: spec.name,\n\t\t\tlabels: spec.labels,\n\t\t\timageName: spec.image.tag ?? spec.image.digest,\n\t\t\tstatus: 'running',\n\t\t\tips: [],\n\t\t});\n\n\t\t// Architecture §5 — secondary network attaches (any beyond the\n\t\t// first, which is wired in via `--network` on create) must wait\n\t\t// for IP allocation before we declare ready.\n\t\tconst secondaries = (spec.networkAttach ?? []).slice(1);\n\t\tfor (const net of secondaries) {\n\t\t\tyield* connect(spec.name, net);\n\t\t\tyield* waitForIp(spec.name, net);\n\t\t}\n\n\t\tconst ips = yield* readIps(spec.name);\n\t\tconst refreshedFacts = yield* inspectContainer(spec.name);\n\t\tconst ports = refreshedFacts?.effectivePorts ?? refreshedFacts?.ports ?? spec.ports;\n\n\t\t// Register cross-process claim and scope-bound release. The\n\t\t// stop finalizer fires on scope close if the same container id\n\t\t// still owns the stable name. Restore may deliberately remove a\n\t\t// claimed container and a later acquire may reuse the name before\n\t\t// this scope closes; the old finalizer must not stop that newer\n\t\t// container. Architecture §13: stop is uninterruptible.\n\t\tconst paths = yield* StackPathsService;\n\t\tconst mapSubstrateError = (cause: unknown): DockerRuntimeError =>\n\t\t\tnew DaemonUnreachable({\n\t\t\t\top: 'cross-process.claim',\n\t\t\t\tdetail: `cross-process claim mutation failed: ${String(cause)}`,\n\t\t\t\tcause,\n\t\t\t});\n\t\tyield* addClaim(\n\t\t\t{ stackLockFile: paths.stackLockFile, rosterFile: paths.rosterFile },\n\t\t\tspec.name,\n\t\t).pipe(Effect.mapError(mapSubstrateError));\n\n\t\tyield* Effect.addFinalizer(() =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst current = yield* inspectContainer(spec.name).pipe(\n\t\t\t\t\tEffect.catch(() => Effect.succeed(null)),\n\t\t\t\t);\n\t\t\t\tif (current?.id === id) {\n\t\t\t\t\tyield* stopWithGrace(spec.name, spec.stopGraceSeconds ?? 10);\n\t\t\t\t}\n\t\t\t\tyield* removeClaim(\n\t\t\t\t\t{ stackLockFile: paths.stackLockFile, rosterFile: paths.rosterFile },\n\t\t\t\t\tspec.name,\n\t\t\t\t).pipe(Effect.catch(() => Effect.succeed({ lastClaimReleased: false })));\n\t\t\t}).pipe(Effect.uninterruptible),\n\t\t);\n\n\t\treturn handleOf(\n\t\t\tid,\n\t\t\tspec.name,\n\t\t\tspec.image.tag ?? spec.image.digest,\n\t\t\t'running',\n\t\t\tips,\n\t\t\tports,\n\t\t\tspec.labels,\n\t\t);\n\t}).pipe(Effect.withSpan('runtime.docker.container.ensure'));\n\n/** Apply the decided action. Recovers from name-collision via\n *  one-shot start-and-adopt; second collision surfaces typed. */\nconst applyAction = (\n\taction: RunAction,\n\tspec: EnsureContainerSpec,\n\tdeps: EnsureContainerDeps,\n): Effect.Effect<string, DockerRuntimeError, DockerHost | DockerSpawner | Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tswitch (action.kind) {\n\t\t\tcase 'adopt':\n\t\t\t\treturn action.id;\n\t\t\tcase 'unpause-adopt':\n\t\t\t\tyield* assertContainerHandleOwned({\n\t\t\t\t\tid: action.id,\n\t\t\t\t\tname: spec.name,\n\t\t\t\t\tlabels: spec.labels,\n\t\t\t\t\timageName: spec.image.tag ?? spec.image.digest,\n\t\t\t\t\tstatus: 'paused',\n\t\t\t\t\tips: [],\n\t\t\t\t});\n\t\t\t\tyield* unpause(spec.name);\n\t\t\t\treturn action.id;\n\t\t\tcase 'resume': {\n\t\t\t\tyield* assertContainerHandleOwned({\n\t\t\t\t\tid: action.id,\n\t\t\t\t\tname: spec.name,\n\t\t\t\t\tlabels: spec.labels,\n\t\t\t\t\timageName: spec.image.tag ?? spec.image.digest,\n\t\t\t\t\tstatus: 'exited',\n\t\t\t\t\tips: [],\n\t\t\t\t});\n\t\t\t\tconst started = yield* resumeStart(spec.name);\n\t\t\t\tif (!started.ok) {\n\t\t\t\t\treturn yield* recreateAfterResumeFailure(action.id, spec, deps);\n\t\t\t\t}\n\t\t\t\treturn action.id;\n\t\t\t}\n\t\t\tcase 'recreate': {\n\t\t\t\tyield* forceRemoveOwned(spec.name, action.id, spec.labels);\n\t\t\t\treturn yield* createWithCollisionRecovery(spec, deps);\n\t\t\t}\n\t\t\tcase 'fresh':\n\t\t\t\treturn yield* createWithCollisionRecovery(spec, deps);\n\t\t\tcase 'refuse':\n\t\t\t\treturn yield* Effect.fail(new RecreateRefused({ name: spec.name, reason: action.reason }));\n\t\t}\n\t});\n\n/** `docker run -d` with single-shot start-and-adopt fallback on\n *  name-collision. */\nconst createWithCollisionRecovery = (\n\tspec: EnsureContainerSpec,\n\tdeps: EnsureContainerDeps,\n): Effect.Effect<string, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tfreshCreate(spec, deps.cycle).pipe(\n\t\tEffect.catchTag('ContainerNameCollisionUnrecoverable', () =>\n\t\t\tstartAndAdopt(spec.name, spec.labels),\n\t\t),\n\t\t// If the original create surfaced a typed `ContainerCreateFailed`\n\t\t// where stderr was name-collision (sometimes the create variant\n\t\t// surfaces with that), attempt the same start-and-adopt.\n\t\tEffect.catchTag('ContainerCreateFailed', (err) =>\n\t\t\tisNameCollisionStderr(err.stderr) ? startAndAdopt(spec.name, spec.labels) : Effect.fail(err),\n\t\t),\n\t);\n\n// -----------------------------------------------------------------------------\n// Stop / commit / pause — used by the snapshot orchestrator\n// -----------------------------------------------------------------------------\n\nexport const stop = (\n\tname: string,\n\tgraceSeconds: number,\n\tsignal?: string,\n): Effect.Effect<void, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tstopWithGrace(name, graceSeconds, signal).pipe(Effect.asVoid);\n\nexport const pause = (\n\tname: string,\n): Effect.Effect<void, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tyield* dockerRun('pause', [name]).pipe(Effect.mapError(wrapGeneric('docker.pause')));\n\t}).pipe(Effect.withSpan('runtime.docker.container.pause'));\n\nexport const unpause = (\n\tname: string,\n): Effect.Effect<void, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tyield* dockerRun('unpause', [name]).pipe(Effect.mapError(wrapGeneric('docker.unpause')));\n\t}).pipe(Effect.withSpan('runtime.docker.container.unpause'));\n\n/** `docker commit <name> <tag>` — writable layer → image. Used by\n *  snapshot capture. */\nexport const commit = (\n\tname: string,\n\ttag: string,\n): Effect.Effect<string, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst res = yield* dockerRun('commit', [name, tag]).pipe(\n\t\t\tEffect.mapError(wrapGeneric('docker.commit')),\n\t\t);\n\t\tconst digest = res.stdout.trim();\n\t\tif (digest.length === 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew ContainerCreateFailed({\n\t\t\t\t\tname,\n\t\t\t\t\tstderr: 'commit returned empty digest',\n\t\t\t\t\texitCode: 0,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn digest;\n\t}).pipe(Effect.withSpan('runtime.docker.container.commit'));\n"],"mappings":";;;;;;;;;;;;;;;AA4HA,MAAa,mBACZ,OACA,cACA,QACA,sBAA6C,EAAE,EAC/C,4BAAuD,SACvD,mBACA,uBACe;AACf,KAAI,UAAU,KAAM,QAAO,EAAE,MAAM,SAAS;CAC5C,MAAM,eACL,MAAM,UAAU,gBACf,uBAAuB,KAAA,MACtB,MAAM,UAAU,sBAAsB,MAAM,gBAAgB;CAE/D,MAAM,kBADa,aAAa,MAAM,gBAAgB,EAAE,EAAE,oBAE/C,IACT,8BAA8B,oBAC9B,0BAA0B,MAAM,gBAAgB,EAAE,EAAE,oBAAoB;CAC1E,MAAM,gBACL,sBAAsB,KAAA,KAAa,MAAM,SAAS,SAAS,gBAAgB;AAC5E,KAAI,MAAM,UAAU,SAAS,UAC5B,QAAO,cAAc;EAAE,MAAM;EAAY,IAAI,MAAM;EAAI,QAAQ;EAAiB,EAAE,OAAO;AAE1F,KAAI,MAAM,UAAU,SAAS,SAC5B,QAAO,gBAAgB,mBAAmB,gBACvC;EAAE,MAAM;EAAiB,IAAI,MAAM;EAAI,GACvC,cACA;EACC,MAAM;EACN,IAAI,MAAM;EACV,QAAQ,eAAe,oBAAoB;EAC3C,EACD,OACA;AAEJ,KAAI,MAAM,UAAU,SAAS,UAC5B,QAAO,gBAAgB,mBAAmB,gBACvC;EAAE,MAAM;EAAS,IAAI,MAAM;EAAI,GAC/B,cACA;EACC,MAAM;EACN,IAAI,MAAM;EACV,QAAQ,eAAe,oBAAoB;EAC3C,EACD,OACA;AAEJ,KAAI,CAAC,aAEJ,QAAO,cAAc;EAAE,MAAM;EAAY,IAAI,MAAM;EAAI,QAAQ;EAAkB,EAAE,OAAO;AAE3F,KAAI,CAAC,gBACJ,QAAO,cAAc;EAAE,MAAM;EAAY,IAAI,MAAM;EAAI,QAAQ;EAAmB,EAAE,OAAO;AAE5F,KAAI,CAAC,cACJ,QAAO,cAAc;EAAE,MAAM;EAAY,IAAI,MAAM;EAAI,QAAQ;EAAmB,EAAE,OAAO;AAE5F,KAAI,MAAM,UAAU,aAAa,KAAK;AAKrC,MAAI,WAAW,aACd,QAAO;GAAE,MAAM;GAAY,IAAI,MAAM;GAAI,QAAQ;GAAoB;AAEtE,MAAI,WAAW,QACd,QAAO;GAAE,MAAM;GAAU,QAAQ;GAAoB;AAEtD,SAAO;GAAE,MAAM;GAAU,IAAI,MAAM;GAAI;;AAExC,QAAO;EAAE,MAAM;EAAU,IAAI,MAAM;EAAI;;;AAIxC,MAAM,iBACL,QACA,WACe;AACf,KAAI,WAAW,QAAS,QAAO;EAAE,MAAM;EAAU,QAAQ,OAAO;EAAQ;AACxE,QAAO;;AAGR,MAAM,yBACL,UAEA,CAAC,GAAI,SAAS,EAAE,CAAE,CAChB,KAAK,MAAM,GAAG,EAAE,cAAc,OAAO,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,CAC/E,MAAM;AAET,MAAM,gBAAgB,MAA6B,UAClD,KAAK,WAAW,MAAM,UAAU,KAAK,OAAO,OAAO,UAAU,UAAU,MAAM,OAAO;AAErF,MAAM,6BACL,MACA,UACa;AAGb,QAAO,aAFgB,KAAK,IAAI,oBAAoB,CAAC,MAEnB,EADV,MAAM,IAAI,oBAAoB,CAAC,MACJ,CAAC;;AAGrD,MAAM,uBAAuB,YAA4B,QAAQ,MAAM,IAAI,CAAC,MAAM;AAElF,MAAM,mBAAmB,WACxB,WAAW,KAAA,KAAa,WAAW,KAAK,YAAY;AAErD,MAAM,sBAAsB,QAAsD;AACjF,KAAI,QAAQ,QAAQ,OAAO,QAAQ,SAAU,QAAO,EAAE;CACtD,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,WAAW,aAAa,OAAO,QAAQ,IAAI,EAAE;EACxD,MAAM,gBAAgB,OAAO,UAAU,MAAM,IAAI,CAAC,GAAG;AACrD,MAAI,CAAC,OAAO,UAAU,cAAc,IAAI,iBAAiB,EAAG;AAC5D,MAAI,CAAC,MAAM,QAAQ,SAAS,CAAE;AAC9B,OAAK,MAAM,WAAW,UAAU;AAC/B,OAAI,YAAY,QAAQ,OAAO,YAAY,SAAU;GACrD,MAAM,WAAY,QAAmC;AACrD,OAAI,OAAO,aAAa,SAAU;GAClC,MAAM,iBAAiB,OAAO,SAAS;AACvC,OAAI,CAAC,OAAO,UAAU,eAAe,IAAI,kBAAkB,EAAG;GAC9D,MAAM,SAAU,QAAiC;AACjD,OAAI,KAAK;IACR;IACA,UAAU;IACV,GAAI,OAAO,WAAW,WAAW,EAAE,QAAQ,gBAAgB,OAAO,EAAE,GAAG,EAAE;IACzE,CAAC;;;AAGJ,QAAO,IAAI,MAAM,GAAG,MAAM;AACzB,MAAI,EAAE,kBAAkB,EAAE,cAAe,QAAO,EAAE,gBAAgB,EAAE;EACpE,MAAM,SAAS,gBAAgB,EAAE,OAAO,CAAC,cAAc,gBAAgB,EAAE,OAAO,CAAC;AACjF,SAAO,WAAW,IAAI,SAAS,EAAE,WAAW,EAAE;GAC7C;;AAGH,MAAM,cAAc,QAA8C;AACjE,KAAI,CAAC,MAAM,QAAQ,IAAI,CAAE,QAAO,EAAE;CAClC,MAAM,MAAsB,EAAE;AAC9B,MAAK,MAAM,SAAS,KAAK;AACxB,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU;EACjD,MAAM,SAAU,MAA+B;EAC/C,MAAM,SAAU,MAAoC;AACpD,MAAI,OAAO,WAAW,YAAY,OAAO,WAAW,SAAU;EAC9D,MAAM,KAAM,MAA2B;AACvC,MAAI,KAAK;GACR;GACA;GACA,GAAI,OAAO,OAAO,YAAY,EAAE,UAAU,CAAC,IAAI,GAAG,EAAE;GACpD,CAAC;;AAEH,QAAO;;AAGR,MAAM,mBAAmB,QAAwC;AAChE,KAAI,CAAC,MAAM,QAAQ,IAAI,CAAE,QAAO,EAAE;AAClC,QAAO,IAAI,QAAQ,UAA2B,OAAO,UAAU,SAAS;;AAGzE,MAAM,cAAc,QAAmD;AACtE,KAAI,QAAQ,QAAQ,OAAO,QAAQ,SAAU,QAAO,EAAE;CACtD,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,CAC7C,KAAI,OAAO,UAAU,SAAU,KAAI,OAAO;AAE3C,QAAO;;AAGR,MAAM,gBAAgB,QAAwC;AAC7D,KAAI,QAAQ,QAAQ,OAAO,QAAQ,SAAU,QAAO,EAAE;AACtD,QAAO,OAAO,KAAK,IAAI,CAAC,MAAM;;AAG/B,MAAM,sBACL,UAO2B;AAC3B,KAAI,UAAU,KAAA,EAAW,QAAO,EAAE,MAAM,WAAW;AACnD,KAAI,MAAM,OAAQ,QAAO;EAAE,MAAM;EAAU,UAAU,MAAM;EAAU;AACrE,KAAI,MAAM,QAAS,QAAO;EAAE,MAAM;EAAW,UAAU,MAAM;EAAU;AACvE,QAAO;EAAE,MAAM;EAAW,UAAU,MAAM;EAAU;;AAOrD,MAAM,gBAAgB,OAAO,OAAO;CACnC,IAAI,OAAO;CACX,OAAO,OAAO,SAAS,OAAO,OAAO;CACrC,QAAQ,OAAO,SAAS,OAAO,QAAQ;CACvC,YAAY,OAAO,SAClB,OAAO,OAAO,EACb,cAAc,OAAO,SACrB,CAAC,CACF;CACD,OAAO,OAAO,SACb,OAAO,OAAO;EACb,SAAS,OAAO;EAChB,QAAQ,OAAO;EACf,UAAU,OAAO;EACjB,CAAC,CACF;CACD,QAAQ,OAAO,OAAO;EACrB,OAAO,OAAO;EACd,KAAK,OAAO,SAAS,OAAO,QAAQ;EACpC,QAAQ,OAAO,SAAS,OAAO,QAAQ;EACvC,CAAC;CACF,iBAAiB,OAAO,OAAO;EAC9B,UAAU,OAAO;EACjB,OAAO,OAAO,SAAS,OAAO,QAAQ;EACtC,CAAC;CACF,CAAC;AAEF,MAAa,oBACZ,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAM,OAAO,YAAY,aAAa,CAAC,WAAW,KAAK,CAAC,CAAC,KAC9D,OAAO,SAAS,YAAY,2BAA2B,CAAC,CACxD;AACD,KAAI,IAAI,aAAa,GAAG;AACvB,MAAI,wBAAwB,IAAI,OAAO,CAAE,QAAO;AAChD,MAAI,0BAA0B,IAAI,OAAO,CACxC,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;GACrB,IAAI;GACJ,QAAQ;GACR,CAAC,CACF;AAEF,SAAO,OAAO,OAAO,KACpB,IAAI,oBAAoB;GACvB,UAAU;GACV;GACA,QAAQ,IAAI;GACZ,UAAU,IAAI;GACd,CAAC,CACF;;AAEF,KAAI;EACH,MAAM,UAAU,2BAA2B,eAAe,IAAI,QAAQ;GACrE,QAAQ,4BAA4B;GACpC,gBAAgB;GAChB,UAAU,UACT,IAAI,0BAA0B;IAC7B,UAAU;IACV;IACA,QACC,MAAM,YAAY,qCACf,MAAM,UACN;IACJ,OAAO,MAAM;IACb,CAAC;GACH,CAAC;EACF,MAAM,YAAY,mBAAmB,QAAQ,MAAM;EACnD,MAAM,iBAAiB,mBAAmB,QAAQ,gBAAgB,MAAM;EACxE,MAAM,QACL,QAAQ,eAAe,KAAA,IACpB,iBACA,mBAAmB,QAAQ,WAAW,aAAa;EACvD,MAAM,SAAS,WAAW,QAAQ,OAAO;EACzC,MAAM,UAAU,gBAAgB,QAAQ,OAAO,IAAI;EACnD,MAAM,SAAS,WAAW,QAAQ,OAAO,OAAO;EAChD,MAAM,WAAW,aAAa,QAAQ,gBAAgB,SAAS;AAC/D,SAAO;GACN,IAAI,QAAQ;GACZ;GACA,SAAS,UAAU,SAAS,aAAa,UAAU,SAAS;GAC5D,QAAQ,UAAU,SAAS;GAC3B,UAAU,UAAU,SAAS,YAAY,OAAO,UAAU;GAI1D,OAAO,QAAQ,OAAO;GACtB,GAAI,QAAQ,UAAU,KAAA,IAAY,EAAE,aAAa,QAAQ,OAAO,GAAG,EAAE;GACrE;GACA,cAAc,sBAAsB,MAAM;GAC1C;GACA,uBAAuB,sBAAsB,eAAe;GAC5D;GACA;GACA;GACA;GACA;UACO,OAAO;AACf,SAAO,OAAO,OAAO,KAAK,MAA4B;;EAEtD,CAAC,KAAK,OAAO,SAAS,mCAAmC,CAAC;AAM7D,MAAM,cACL,MACA,OACA,aAC2B;CAC3B,MAAM,OAAsB;EAAC;EAAM;EAAU,KAAK;EAAK;CACvD,MAAM,eACL,KAAK,eAAe,KAAA,IAAY,KAAA,IAAY,GAAG,SAAS,aAAa,KAAK,YAAY;AACvF,MAAK,MAAM,SAAS,sBAAsB,KAAK,QAAQ,OAAO,aAAa,CAC1E,MAAK,KAAK,WAAW,MAAM;AAE5B,KAAI,KAAK,IACR,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,IAAI,CAC5C,MAAK,KAAK,SAAS,GAAG,EAAE,GAAG,IAAI;AAGjC,KAAI,KAAK,MACR,MAAK,MAAM,KAAK,KAAK,OAAO;EAC3B,MAAM,aAAa,EAAE,WAAW,KAAA,IAAY,KAAK,GAAG,EAAE,OAAO;AAC7D,OAAK,KAAK,MAAM,GAAG,aAAa,EAAE,SAAS,GAAG,EAAE,gBAAgB;;AAGlE,KAAI,KAAK,OACR,MAAK,MAAM,KAAK,KAAK,QAAQ;EAC5B,MAAM,KAAK,EAAE,WAAW,cAAc;AACtC,OAAK,KAAK,WAAW,oBAAoB,EAAE,OAAO,UAAU,EAAE,SAAS,KAAK;;AAG9E,KAAI,KAAK,iBAAiB,KAAK,cAAc,SAAS,EAGrD,MAAK,KAAK,aAAa,KAAK,cAAc,GAAI;AAE/C,KAAI,KAAK,WACR,MAAK,MAAM,CAAC,MAAM,OAAO,OAAO,QAAQ,KAAK,WAAW,CACvD,MAAK,KAAK,cAAc,GAAG,KAAK,GAAG,KAAK;AAG1C,KAAI,KAAK,WACR,MAAK,KAAK,gBAAgB,KAAK,WAAW;AAE3C,MAAK,KAAK,SAAS;AACnB,KAAI,KAAK,QACR,MAAK,KAAK,GAAG,KAAK,QAAQ;AAE3B,QAAO;;AAOR,MAAM,YACL,IACA,MACA,WACA,QACA,KACA,OACA,YACsB;CACtB;CACA;CACA,GAAI,WAAW,KAAA,IAAY,EAAE,QAAQ,GAAG,EAAE;CAC1C;CACA;CACA;CACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;CACxC;;;AAID,MAAM,eACL,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAM,OAAO,YAAY,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,KAClD,OAAO,SAAS,YAAY,YAAY,CAAC,CACzC;AACD,KAAI,IAAI,aAAa,KAAK,CAAC,wBAAwB,IAAI,OAAO,CAG7D,QAAO,OAAO,oBAAoB,EAAE,qBAAqB,IAAI,QAAQ,CAAC;EAEtE,CAAC,KAAK,OAAO,SAAS,uCAAuC,CAAC;AAEjE,MAAM,oBACL,MACA,UACA,QACA,WAEA,IAAI,sBAAsB;CACzB,UAAU;CACV;CACA;CACA;CACA;CACA,CAAC;AAEH,MAAM,oBACL,MACA,OACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,iCAAiC,OAAO;CACzD,MAAM,SAAS,MAAM,UAAU,EAAE;CACjC,MAAM,WAAW,wBAAwB,UAAU,OAAO;AAC1D,KAAI,aAAa,KAChB,QAAO,OAAO,OAAO,KAAK,iBAAiB,MAAM,UAAU,QAAQ,SAAS,CAAC;EAE7E;AAEH,MAAM,iCACL,MACA,UAEA,OAAO,KACN,IAAI,oCAAoC;CACvC;CACA,QAAQ,2DAA2D;CACnE,CAAC,CACF;AAEF,MAAa,8BACZ,WAEA,OAAO,IAAI,aAAa;AACvB,KAAI,OAAO,WAAW,KAAA,EACrB,QAAO,OAAO,OAAO,KACpB,iBAAiB,OAAO,MAAM,EAAE,EAAE,EAAE,EAAE,2CAA2C,CACjF;CAEF,MAAM,QAAQ,OAAO,iBAAiB,OAAO,KAAK;CAClD,MAAM,WAAW,iCAAiC,OAAO,OAAO;AAChE,KAAI,UAAU,KACb,QAAO,OAAO,OAAO,KACpB,iBAAiB,OAAO,MAAM,UAAU,EAAE,EAAE,uBAAuB,CACnE;AAEF,KAAI,MAAM,OAAO,OAAO,GACvB,QAAO,OAAO,OAAO,KACpB,iBAAiB,OAAO,MAAM,UAAU,MAAM,UAAU,EAAE,EAAE,iBAAiB,MAAM,KAAK,CACxF;AAEF,QAAO,iBAAiB,OAAO,MAAM,OAAO,OAAO,OAAO;EACzD,CAAC,KAAK,OAAO,SAAS,uCAAuC,CAAC;AAEjE,MAAM,oBACL,MACA,IACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO,iBAAiB,KAAK;AAC7C,KAAI,YAAY,KAAM;AACtB,KAAI,QAAQ,OAAO,IAAI;EACtB,MAAM,WAAW,iCAAiC,OAAO;AACzD,SAAO,OAAO,OAAO,KACpB,iBAAiB,MAAM,UAAU,QAAQ,UAAU,EAAE,EAAE,iBAAiB,QAAQ,KAAK,CACrF;;AAEF,QAAO,iBAAiB,MAAM,SAAS,OAAO;AAC9C,QAAO,YAAY,KAAK;EACvB;;;;AAKH,MAAM,iBACL,MACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,cAAc,OAAO,iBAAiB,KAAK;AACjD,KAAI,gBAAgB,KACnB,QAAO,OAAO,OAAO,KACpB,IAAI,oCAAoC;EACvC;EACA,QAAQ;EACR,CAAC,CACF;AAEF,QAAO,iBAAiB,MAAM,aAAa,OAAO;AAClD,KAAI,YAAY,UAAU,SAAS,UAClC,QAAO,OAAO,8BAA8B,MAAM,eAAe;CAKlE,MAAM,MAAM,aAAa,OAHN,YAAY,SAAS,CAAC,KAAK,CAAC,CAAC,KAC/C,OAAO,SAAS,YAAY,eAAe,CAAC,CAC5C,CAC4B;AAC7B,KAAI,IAAI,IAAI;EACX,MAAM,QAAQ,OAAO,iBAAiB,KAAK;AAC3C,MAAI,UAAU,KACb,QAAO,OAAO,OAAO,KACpB,IAAI,oCAAoC;GACvC;GACA,QAAQ;GACR,CAAC,CACF;AAEF,SAAO,iBAAiB,MAAM,OAAO,OAAO;AAC5C,MAAI,MAAM,UAAU,SAAS,UAC5B,QAAO,OAAO,8BAA8B,MAAM,cAAc;AAEjE,SAAO,MAAM;;AAEd,KAAI,wBAAwB,IAAI,OAAO,CAGtC,QAAO,OAAO,OAAO,KACpB,IAAI,oCAAoC;EACvC;EACA,QAAQ;EACR,CAAC,CACF;AAEF,QAAO,OAAO,OAAO,KACpB,IAAI,oCAAoC;EACvC;EACA,QAAQ,2BAA2B,IAAI;EACvC,CAAC,CACF;EACA;AAEH,MAAM,eACL,MACA,UAEA,OAAO,IAAI,aAAa;AAGvB,SAAO,OADgB,UAAU,OADpB,WAAW,MAAM,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM,OACtB,CAAC,CAAC,KAAK,OAAO,SAAS,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAChF,OAAO,MAAM;EAC3B;AAEH,MAAM,eACL,SAMA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAM,OAAO,YAAY,SAAS,CAAC,KAAK,CAAC,CAAC,KAC/C,OAAO,SAAS,YAAY,eAAe,CAAC,CAC5C;AACD,KAAI,IAAI,aAAa,EAAG,QAAO,EAAE,IAAI,MAAe;AACpD,KAAI,0BAA0B,IAAI,OAAO,CACxC,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,IAAI;EACJ,QAAQ;EACR,CAAC,CACF;AAEF,QAAO;EAAE,IAAI;EAAgB,QAAQ,IAAI;EAAQ;EAChD;AAEH,MAAM,8BACL,IACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,cAAc;EAAE,MAAM;EAAY;EAAI,QAAQ;EAAiB,EAAE,KAAK,SAAS;AAC9F,KAAI,OAAO,SAAS,SACnB,QAAO,OAAO,OAAO,KAAK,IAAI,gBAAgB;EAAE,MAAM,KAAK;EAAM,QAAQ,OAAO;EAAQ,CAAC,CAAC;AAE3F,QAAO,iBAAiB,KAAK,MAAM,IAAI,KAAK,OAAO;AACnD,QAAO,OAAO,4BAA4B,MAAM,KAAK;EACpD;AAEH,MAAM,4BAA4B,OAAqB,SAAuC;CAC7F,MAAM,UAAU,sBAAsB,KAAK,MAAM;AACjD,KAAI,QAAQ,WAAW,EAAG,QAAO;CACjC,MAAM,SAAS,MAAM,yBAAyB,EAAE;AAChD,KAAI,aAAa,QAAQ,QAAQ,CAAE,QAAO;AAC1C,SACE,KAAK,6BAA6B,aAAa,oBAChD,0BAA0B,QAAQ,QAAQ;;AAI5C,MAAM,iCACL,IACA,MACA,SAEA,OAAO,IAAI,aAAa;AACvB,MAAK,KAAK,SAAS,EAAE,EAAE,WAAW,EAAG,QAAO;CAC5C,MAAM,QAAQ,OAAO,iBAAiB,KAAK,KAAK;AAChD,KAAI,UAAU,QAAQ,MAAM,OAAO,MAAM,MAAM,UAAU,SAAS,UAAW,QAAO;AACpF,QAAO,iBAAiB,KAAK,MAAM,OAAO,KAAK,OAAO;AACtD,KAAI,yBAAyB,OAAO,KAAK,CAAE,QAAO;CAClD,MAAM,aAAa,OAAO,2BAA2B,IAAI,MAAM,KAAK;CACpE,MAAM,gBAAgB,OAAO,iBAAiB,KAAK,KAAK;AACxD,KACC,kBAAkB,QAClB,cAAc,OAAO,cACrB,cAAc,UAAU,SAAS,aACjC,yBAAyB,eAAe,KAAK,CAE7C,QAAO;AAER,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,MAAM,KAAK;EACX,QAAQ,4EAA4E,KAAK,UACxF,sBAAsB,KAAK,MAAM,CACjC,CAAC,UAAU,KAAK,UAAU,eAAe,yBAAyB,EAAE,CAAC;EACtE,UAAU;EACV,CAAC,CACF;EACA;AAEH,MAAM,iBACL,MACA,cACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAsB,EAAE;AAC9B,KAAI,WAAW,KAAA,EAAW,MAAK,KAAK,YAAY,OAAO;AACvD,MAAK,KAAK,UAAU,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC;AAClE,MAAK,KAAK,KAAK;AACf,QAAO,YAAY,QAAQ,KAAK,CAAC,KAChC,OAAO,YAAY,OAAO,KAAK,EAC/B,OAAO,OACP;EACA;;;;;;;;;;;;;;;;;AAoCH,MAAa,sBACZ,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,SAAS,MAAY;AAa3C,KAAI,OAZmB,IAAI,OAAO,OAAO,MAAM;EAC9C,MAAM,QAAQ,EAAE,IAAI,KAAK;EACzB,MAAM,OAAO,IAAI,IAAI,EAAE;AACvB,MAAI,UAAU,KAAA,GAAW;AAExB,QAAK,IAAI,MAAM,EAAE,CAAC;AAClB,UAAO,CAAC,MAAM,KAAyB;;AAGxC,OAAK,IAAI,MAAM,CAAC,GAAG,OAAO,OAAO,CAAC;AAClC,SAAO,CAAC,OAAO,KAAyB;GACvC,CACW;AAKb,QAAO,SAAS,MAAM,OAAO,CAAC,KAC7B,OAAO,kBACN,IAAI,OAAO,OAAO,MAAM;EACvB,MAAM,QAAQ,EAAE,IAAI,KAAK;AACzB,MAAI,UAAU,KAAA,EAAW,QAAO;EAChC,MAAM,WAAW,MAAM,QAAQ,MAAM,MAAM,OAAO;AAClD,MAAI,SAAS,WAAW,MAAM,OAAQ,QAAO;EAC7C,MAAM,OAAO,IAAI,IAAI,EAAE;AACvB,OAAK,IAAI,MAAM,SAAS;AACxB,SAAO;GACN,CACF,CACD;EACA;AAEH,MAAa,sBACZ,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO,IAAI,OAAO,OAAO,MAAM;EAC3C,MAAM,QAAQ,EAAE,IAAI,KAAK;AACzB,MAAI,UAAU,KAAA,EAAW,QAAO,CAAC,KAAA,GAAW,EAAE;EAC9C,MAAM,OAAO,IAAI,IAAI,EAAE;AACvB,MAAI,MAAM,WAAW,GAAG;AACvB,QAAK,OAAO,KAAK;AACjB,UAAO,CAAC,KAAA,GAAW,KAAyB;;EAE7C,MAAM,CAAC,OAAO,GAAG,QAAQ;AACzB,OAAK,IAAI,MAAM,KAAK;AACpB,SAAO,CAAC,OAAO,KAAyB;GACvC;AACF,KAAI,SAAS,KAAA,EACZ,QAAO,SAAS,QAAQ,MAAM,KAAA,EAAU;EAExC;;;;;;AAOH,MAAa,mBACZ,MACA,SAMA,OAAO,IAAI,aAAa;CAOvB,MAAM,kBAAkB,KAAK,MAAM,OAAO,KAAK,MAAM;CACrD,MAAM,KAAK,OAAO,OAAO,kBACxB,mBAAmB,KAAK,aAAa,KAAK,KAAK,QAE9C,OAAO,IAAI,aAAa;EACvB,MAAM,QAAQ,OAAO,iBAAiB,KAAK,KAAK;AAChD,MAAI,UAAU,KACb,QAAO,iBAAiB,KAAK,MAAM,OAAO,KAAK,OAAO;AAYvD,SAAO,OAAO,8BAA8B,OAD1B,YATH,gBACd,OACA,iBACA,KAAK,UACL,sBAAsB,KAAK,MAAM,EACjC,KAAK,6BAA6B,SAClC,KAAK,YACL,KAAK,MAAM,OAEwB,EAAE,MAAM,KAAK,EACD,MAAM,KAAK;GAC1D,QACG,mBAAmB,KAAK,aAAa,KAAK,KAAK,CACrD;AACD,QAAO,2BAA2B;EACjC;EACA,MAAM,KAAK;EACX,QAAQ,KAAK;EACb,WAAW,KAAK,MAAM,OAAO,KAAK,MAAM;EACxC,QAAQ;EACR,KAAK,EAAE;EACP,CAAC;CAKF,MAAM,eAAe,KAAK,iBAAiB,EAAE,EAAE,MAAM,EAAE;AACvD,MAAK,MAAM,OAAO,aAAa;AAC9B,SAAO,QAAQ,KAAK,MAAM,IAAI;AAC9B,SAAO,UAAU,KAAK,MAAM,IAAI;;CAGjC,MAAM,MAAM,OAAO,QAAQ,KAAK,KAAK;CACrC,MAAM,iBAAiB,OAAO,iBAAiB,KAAK,KAAK;CACzD,MAAM,QAAQ,gBAAgB,kBAAkB,gBAAgB,SAAS,KAAK;CAQ9E,MAAM,QAAQ,OAAO;CACrB,MAAM,qBAAqB,UAC1B,IAAI,kBAAkB;EACrB,IAAI;EACJ,QAAQ,wCAAwC,OAAO,MAAM;EAC7D;EACA,CAAC;AACH,QAAO,SACN;EAAE,eAAe,MAAM;EAAe,YAAY,MAAM;EAAY,EACpE,KAAK,KACL,CAAC,KAAK,OAAO,SAAS,kBAAkB,CAAC;AAE1C,QAAO,OAAO,mBACb,OAAO,IAAI,aAAa;AAIvB,OAAI,OAHmB,iBAAiB,KAAK,KAAK,CAAC,KAClD,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CACxC,GACY,OAAO,GACnB,QAAO,cAAc,KAAK,MAAM,KAAK,oBAAoB,GAAG;AAE7D,SAAO,YACN;GAAE,eAAe,MAAM;GAAe,YAAY,MAAM;GAAY,EACpE,KAAK,KACL,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,EAAE,mBAAmB,OAAO,CAAC,CAAC,CAAC;GACvE,CAAC,KAAK,OAAO,gBAAgB,CAC/B;AAED,QAAO,SACN,IACA,KAAK,MACL,KAAK,MAAM,OAAO,KAAK,MAAM,QAC7B,WACA,KACA,OACA,KAAK,OACL;EACA,CAAC,KAAK,OAAO,SAAS,kCAAkC,CAAC;;;AAI5D,MAAM,eACL,QACA,MACA,SAEA,OAAO,IAAI,aAAa;AACvB,SAAQ,OAAO,MAAf;EACC,KAAK,QACJ,QAAO,OAAO;EACf,KAAK;AACJ,UAAO,2BAA2B;IACjC,IAAI,OAAO;IACX,MAAM,KAAK;IACX,QAAQ,KAAK;IACb,WAAW,KAAK,MAAM,OAAO,KAAK,MAAM;IACxC,QAAQ;IACR,KAAK,EAAE;IACP,CAAC;AACF,UAAO,QAAQ,KAAK,KAAK;AACzB,UAAO,OAAO;EACf,KAAK;AACJ,UAAO,2BAA2B;IACjC,IAAI,OAAO;IACX,MAAM,KAAK;IACX,QAAQ,KAAK;IACb,WAAW,KAAK,MAAM,OAAO,KAAK,MAAM;IACxC,QAAQ;IACR,KAAK,EAAE;IACP,CAAC;AAEF,OAAI,EAAC,OADkB,YAAY,KAAK,KAAK,EAChC,GACZ,QAAO,OAAO,2BAA2B,OAAO,IAAI,MAAM,KAAK;AAEhE,UAAO,OAAO;EAEf,KAAK;AACJ,UAAO,iBAAiB,KAAK,MAAM,OAAO,IAAI,KAAK,OAAO;AAC1D,UAAO,OAAO,4BAA4B,MAAM,KAAK;EAEtD,KAAK,QACJ,QAAO,OAAO,4BAA4B,MAAM,KAAK;EACtD,KAAK,SACJ,QAAO,OAAO,OAAO,KAAK,IAAI,gBAAgB;GAAE,MAAM,KAAK;GAAM,QAAQ,OAAO;GAAQ,CAAC,CAAC;;EAE3F;;;AAIH,MAAM,+BACL,MACA,SAEA,YAAY,MAAM,KAAK,MAAM,CAAC,KAC7B,OAAO,SAAS,6CACf,cAAc,KAAK,MAAM,KAAK,OAAO,CACrC,EAID,OAAO,SAAS,0BAA0B,QACzC,sBAAsB,IAAI,OAAO,GAAG,cAAc,KAAK,MAAM,KAAK,OAAO,GAAG,OAAO,KAAK,IAAI,CAC5F,CACD;AAMF,MAAa,QACZ,MACA,cACA,WAEA,cAAc,MAAM,cAAc,OAAO,CAAC,KAAK,OAAO,OAAO;AAE9D,MAAa,SACZ,SAEA,OAAO,IAAI,aAAa;AACvB,QAAO,UAAU,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,eAAe,CAAC,CAAC;EACnF,CAAC,KAAK,OAAO,SAAS,iCAAiC,CAAC;AAE3D,MAAa,WACZ,SAEA,OAAO,IAAI,aAAa;AACvB,QAAO,UAAU,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,iBAAiB,CAAC,CAAC;EACvF,CAAC,KAAK,OAAO,SAAS,mCAAmC,CAAC;;;AAI7D,MAAa,UACZ,MACA,QAEA,OAAO,IAAI,aAAa;CAIvB,MAAM,UAAS,OAHI,UAAU,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,KACnD,OAAO,SAAS,YAAY,gBAAgB,CAAC,CAC7C,EACkB,OAAO,MAAM;AAChC,KAAI,OAAO,WAAW,EACrB,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB;EACA,QAAQ;EACR,UAAU;EACV,CAAC,CACF;AAEF,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,kCAAkC,CAAC"}

package/dist/runtime/docker/errors.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/runtime/docker/errors.mjs

@@ -0,0 +1,187 @@
+import { Data } from "effect";
+//#region src/runtime/docker/errors.ts
+/** Daemon connection failure. The CLI returned the "Cannot connect to
+*  the Docker daemon" pattern, or the binary is missing. */
+var DaemonUnreachable = class extends Data.TaggedError("DaemonUnreachable") {};
+/** Image pull / inspect could not locate the requested image. */
+var ImageNotFound = class extends Data.TaggedError("ImageNotFound") {};
+/** `docker pull` non-zero exit (network / auth / unknown ref). */
+var ImagePullFailed = class extends Data.TaggedError("ImagePullFailed") {};
+/** `docker build` non-zero exit. `parsedStep` is best-effort —
+*  populated by `wrap.ts` when the build log surfaces a clear failing
+*  step line. */
+var BuildFailed = class extends Data.TaggedError("BuildFailed") {};
+/** `docker create` / `docker run -d` rejected; not a name collision. */
+var ContainerCreateFailed = class extends Data.TaggedError("ContainerCreateFailed") {};
+/** `docker run -d -p ...` lost the probe-to-publish race. */
+var ContainerPortPublishConflict = class extends Data.TaggedError("ContainerPortPublishConflict") {};
+/** Name-collision recovery exhausted: peer beat us and the
+*  start-and-adopt fallback ALSO failed. Architecture forbids the
+*  infinite-loop retry; one shot at adopt then surface this. */
+var ContainerNameCollisionUnrecoverable = class extends Data.TaggedError("ContainerNameCollisionUnrecoverable") {};
+Data.TaggedError("ContainerExited");
+/** `docker rm -f` failed while deliberately replacing a managed
+*  container set. Unlike orphan sweep, restore cannot silently leave
+*  the old writable layer in place. */
+var ContainerRemoveFailed = class extends Data.TaggedError("ContainerRemoveFailed") {};
+/** Docker inspect failed for a reason other than "not found". */
+var DockerInspectFailed = class extends Data.TaggedError("DockerInspectFailed") {};
+/** Docker inspect returned malformed JSON or a shape outside the
+*  runtime's expected schema. */
+var DockerInspectDecodeFailed = class extends Data.TaggedError("DockerInspectDecodeFailed") {};
+/** A same-name Docker resource exists but is not owned by the expected
+*  devstack label tuple, so mutating it would cross stack/plugin
+*  boundaries. */
+var ForeignDockerResource = class extends Data.TaggedError("ForeignDockerResource") {};
+/** `docker network connect` / `network create` failure that isn't the
+*  idempotent "already exists in network" case. */
+var NetworkOperationFailed = class extends Data.TaggedError("NetworkOperationFailed") {};
+/** `docker network create` exhausted Docker's default bridge IPAM
+*  pools. This is not a daemon reachability failure; stale long-lived
+*  networks or missing explicit subnet/gateway policy are the usual
+*  causes. */
+var NetworkAddressPoolExhausted = class extends Data.TaggedError("NetworkAddressPoolExhausted") {};
+/** Container's IP on a secondary network was not allocated within the
+*  bounded poll budget. Architecture § Async network-connect. */
+var NetworkIpReadbackTimeout = class extends Data.TaggedError("NetworkIpReadbackTimeout") {};
+/** Volume create / inspect failed. */
+var VolumeOperationFailed = class extends Data.TaggedError("VolumeOperationFailed") {};
+/** Recreate was refused — the caller's `RecreatePolicy` was `never`
+*  but the lifecycle state machine concluded recreate was required
+*  (image/config mismatch, unclean exit, unknown state). Caller must explicitly opt
+*  in to a recreate to proceed (architecture G1 — Move-build-
+*  container's no-auto-recreate case). */
+var RecreateRefused = class extends Data.TaggedError("RecreateRefused") {};
+/** Generic exec / one-shot failure when the caller asked us to
+*  promote a non-zero exit. */
+var ExecFailed = class extends Data.TaggedError("ExecFailed") {};
+/** `docker save` failed — daemon error, missing image, or pipe failure
+*  draining stdout. */
+var ImageSaveFailed = class extends Data.TaggedError("ImageSaveFailed") {};
+/** `docker load` failed — corrupt tar, daemon error, or no `Loaded
+*  image:` line parsed from stdout. */
+var ImageLoadFailed = class extends Data.TaggedError("ImageLoadFailed") {};
+/** `docker tag` failed — source image missing or invalid tag string. */
+var ImageTagFailed = class extends Data.TaggedError("ImageTagFailed") {};
+/** `docker image rm` failed while removing managed snapshot/build
+*  byproducts. */
+var ImageRemoveFailed = class extends Data.TaggedError("ImageRemoveFailed") {};
+/** Project a typed `DockerRuntimeError` into the contract-shaped
+*  `ContainerRuntimeError`. The contract is intentionally narrow
+*  (`reason` is a closed enum); plugins that want the precise tag
+*  can `Effect.catchTag` against the typed errors BEFORE the contract
+*  projection runs. */
+const toContractError = (err) => {
+	switch (err._tag) {
+		case "DaemonUnreachable": return {
+			_tag: "ContainerRuntimeError",
+			reason: "daemon-unreachable",
+			detail: err.detail
+		};
+		case "ImageNotFound": return {
+			_tag: "ContainerRuntimeError",
+			reason: "image-build-failed",
+			detail: `${err.ref}: ${err.detail}`
+		};
+		case "ImagePullFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "image-build-failed",
+			detail: `pull ${err.ref} failed: ${err.stderr}`
+		};
+		case "BuildFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "image-build-failed",
+			detail: err.parsedStep ?? err.stderr
+		};
+		case "ContainerCreateFailed":
+		case "ContainerNameCollisionUnrecoverable": return {
+			_tag: "ContainerRuntimeError",
+			reason: "name-collision",
+			detail: "detail" in err ? err.detail : err.stderr
+		};
+		case "ContainerPortPublishConflict": return {
+			_tag: "ContainerRuntimeError",
+			reason: "publish-port-conflict",
+			detail: `${err.name}: ${err.stderr}`
+		};
+		case "ContainerExited": return {
+			_tag: "ContainerRuntimeError",
+			reason: "ready-probe-failed",
+			detail: `${err.name} exited ${err.exitCode}: ${err.logTail}`
+		};
+		case "ContainerRemoveFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "container-replace-failed",
+			detail: `${err.name}: ${err.stderr}`
+		};
+		case "DockerInspectFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "docker-inspect-failed",
+			detail: `${err.resource} ${err.name}: ${err.stderr}`
+		};
+		case "DockerInspectDecodeFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "docker-inspect-failed",
+			detail: `${err.resource} ${err.name}: ${err.detail}`
+		};
+		case "ForeignDockerResource": return {
+			_tag: "ContainerRuntimeError",
+			reason: "foreign-resource",
+			detail: `${err.resource} ${err.name}: ${err.detail}`
+		};
+		case "NetworkOperationFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "daemon-unreachable",
+			detail: `network ${err.op} ${err.network}: ${err.stderr}`
+		};
+		case "NetworkAddressPoolExhausted": return {
+			_tag: "ContainerRuntimeError",
+			reason: "network-address-pool-exhausted",
+			detail: `network create ${err.network}: ${err.hint} stderr=${err.stderr}`
+		};
+		case "NetworkIpReadbackTimeout": return {
+			_tag: "ContainerRuntimeError",
+			reason: "ip-readback-timeout",
+			detail: `${err.container} on ${err.network} after ${err.waitedMillis}ms`
+		};
+		case "VolumeOperationFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "daemon-unreachable",
+			detail: `volume ${err.op} ${err.volume}: ${err.stderr}`
+		};
+		case "RecreateRefused": return {
+			_tag: "ContainerRuntimeError",
+			reason: "recreate-refused",
+			detail: `${err.name}: ${err.reason}`
+		};
+		case "ExecFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "ready-probe-failed",
+			detail: `exec ${err.name} exit ${err.exitCode}: ${err.stderr}`
+		};
+		case "ImageSaveFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "image-save-failed",
+			detail: `${err.ref}: ${err.detail}`
+		};
+		case "ImageLoadFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "image-load-failed",
+			detail: err.stderr !== void 0 ? `${err.detail}: ${err.stderr}` : err.detail
+		};
+		case "ImageTagFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "image-tag-failed",
+			detail: `${err.src} → ${err.dst}: ${err.stderr}`
+		};
+		case "ImageRemoveFailed": return {
+			_tag: "ContainerRuntimeError",
+			reason: "image-remove-failed",
+			detail: `${err.ref}: ${err.stderr}`
+		};
+	}
+};
+//#endregion
+export { BuildFailed, ContainerCreateFailed, ContainerNameCollisionUnrecoverable, ContainerPortPublishConflict, ContainerRemoveFailed, DaemonUnreachable, DockerInspectDecodeFailed, DockerInspectFailed, ExecFailed, ForeignDockerResource, ImageLoadFailed, ImageNotFound, ImagePullFailed, ImageRemoveFailed, ImageSaveFailed, ImageTagFailed, NetworkAddressPoolExhausted, NetworkIpReadbackTimeout, NetworkOperationFailed, RecreateRefused, VolumeOperationFailed, toContractError };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/runtime/docker/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../../src/runtime/docker/errors.ts"],"sourcesContent":["// Docker runtime — typed error envelopes.\n//\n// Architecture inverts the legacy \"stderr-pattern wording\" coupling:\n// the public surface speaks in typed errors (`ImageNotFound`,\n// `BuildFailed`, …); raw `CaptureError`s from the subprocess seam\n// are translated by `wrap.ts` into these envelopes.\n//\n// Every error is `Data.TaggedError` so callers can `Effect.catchTag`\n// the precise failure mode.\n\nimport { Data } from 'effect';\n\nimport type { ContainerRuntimeError } from '../../contracts/container-runtime.ts';\n\n/** Daemon connection failure. The CLI returned the \"Cannot connect to\n *  the Docker daemon\" pattern, or the binary is missing. */\nexport class DaemonUnreachable extends Data.TaggedError('DaemonUnreachable')<{\n\treadonly op: string;\n\treadonly detail: string;\n\treadonly cause?: unknown;\n}> {}\n\n/** Image pull / inspect could not locate the requested image. */\nexport class ImageNotFound extends Data.TaggedError('ImageNotFound')<{\n\treadonly ref: string;\n\treadonly detail: string;\n}> {}\n\n/** `docker pull` non-zero exit (network / auth / unknown ref). */\nexport class ImagePullFailed extends Data.TaggedError('ImagePullFailed')<{\n\treadonly ref: string;\n\treadonly stderr: string;\n\treadonly exitCode: number | undefined;\n}> {}\n\n/** `docker build` non-zero exit. `parsedStep` is best-effort —\n *  populated by `wrap.ts` when the build log surfaces a clear failing\n *  step line. */\nexport class BuildFailed extends Data.TaggedError('BuildFailed')<{\n\treadonly contextPath: string;\n\treadonly dockerfile: string | undefined;\n\treadonly stderr: string;\n\treadonly parsedStep?: string;\n\treadonly exitCode: number | undefined;\n}> {}\n\n/** `docker create` / `docker run -d` rejected; not a name collision. */\nexport class ContainerCreateFailed extends Data.TaggedError('ContainerCreateFailed')<{\n\treadonly name: string;\n\treadonly stderr: string;\n\treadonly exitCode: number | undefined;\n}> {}\n\n/** `docker run -d -p ...` lost the probe-to-publish race. */\nexport class ContainerPortPublishConflict extends Data.TaggedError('ContainerPortPublishConflict')<{\n\treadonly name: string;\n\treadonly stderr: string;\n\treadonly exitCode: number | undefined;\n}> {}\n\n/** Name-collision recovery exhausted: peer beat us and the\n *  start-and-adopt fallback ALSO failed. Architecture forbids the\n *  infinite-loop retry; one shot at adopt then surface this. */\nexport class ContainerNameCollisionUnrecoverable extends Data.TaggedError(\n\t'ContainerNameCollisionUnrecoverable',\n)<{\n\treadonly name: string;\n\treadonly detail: string;\n}> {}\n\n/** Container exited (non-zero or unexpected) during the run. */\nexport class ContainerExited extends Data.TaggedError('ContainerExited')<{\n\treadonly name: string;\n\treadonly exitCode: number;\n\treadonly logTail: string;\n}> {}\n\n/** `docker rm -f` failed while deliberately replacing a managed\n *  container set. Unlike orphan sweep, restore cannot silently leave\n *  the old writable layer in place. */\nexport class ContainerRemoveFailed extends Data.TaggedError('ContainerRemoveFailed')<{\n\treadonly name: string;\n\treadonly stderr: string;\n\treadonly exitCode: number | undefined;\n}> {}\n\nexport type DockerResourceKind = 'container' | 'network' | 'volume';\n\n/** Docker inspect failed for a reason other than \"not found\". */\nexport class DockerInspectFailed extends Data.TaggedError('DockerInspectFailed')<{\n\treadonly resource: DockerResourceKind;\n\treadonly name: string;\n\treadonly stderr: string;\n\treadonly exitCode: number | undefined;\n}> {}\n\n/** Docker inspect returned malformed JSON or a shape outside the\n *  runtime's expected schema. */\nexport class DockerInspectDecodeFailed extends Data.TaggedError('DockerInspectDecodeFailed')<{\n\treadonly resource: DockerResourceKind;\n\treadonly name: string;\n\treadonly detail: string;\n\treadonly cause?: unknown;\n}> {}\n\n/** A same-name Docker resource exists but is not owned by the expected\n *  devstack label tuple, so mutating it would cross stack/plugin\n *  boundaries. */\nexport class ForeignDockerResource extends Data.TaggedError('ForeignDockerResource')<{\n\treadonly resource: DockerResourceKind;\n\treadonly name: string;\n\treadonly expected: Readonly<Record<string, string>>;\n\treadonly actual: Readonly<Record<string, string>>;\n\treadonly detail: string;\n}> {}\n\n/** `docker network connect` / `network create` failure that isn't the\n *  idempotent \"already exists in network\" case. */\nexport class NetworkOperationFailed extends Data.TaggedError('NetworkOperationFailed')<{\n\treadonly op: 'create' | 'connect' | 'disconnect' | 'inspect' | 'remove';\n\treadonly network: string;\n\treadonly stderr: string;\n}> {}\n\n/** `docker network create` exhausted Docker's default bridge IPAM\n *  pools. This is not a daemon reachability failure; stale long-lived\n *  networks or missing explicit subnet/gateway policy are the usual\n *  causes. */\nexport class NetworkAddressPoolExhausted extends Data.TaggedError('NetworkAddressPoolExhausted')<{\n\treadonly network: string;\n\treadonly stderr: string;\n\treadonly hint: string;\n}> {}\n\n/** Container's IP on a secondary network was not allocated within the\n *  bounded poll budget. Architecture § Async network-connect. */\nexport class NetworkIpReadbackTimeout extends Data.TaggedError('NetworkIpReadbackTimeout')<{\n\treadonly container: string;\n\treadonly network: string;\n\treadonly waitedMillis: number;\n}> {}\n\n/** Volume create / inspect failed. */\nexport class VolumeOperationFailed extends Data.TaggedError('VolumeOperationFailed')<{\n\treadonly op: 'create' | 'inspect' | 'remove';\n\treadonly volume: string;\n\treadonly stderr: string;\n}> {}\n\n/** Recreate was refused — the caller's `RecreatePolicy` was `never`\n *  but the lifecycle state machine concluded recreate was required\n *  (image/config mismatch, unclean exit, unknown state). Caller must explicitly opt\n *  in to a recreate to proceed (architecture G1 — Move-build-\n *  container's no-auto-recreate case). */\nexport class RecreateRefused extends Data.TaggedError('RecreateRefused')<{\n\treadonly name: string;\n\treadonly reason:\n\t\t| 'image-mismatch'\n\t\t| 'config-mismatch'\n\t\t| 'unclean-shutdown'\n\t\t| 'resume-failed'\n\t\t| 'unknown-state';\n}> {}\n\n/** Generic exec / one-shot failure when the caller asked us to\n *  promote a non-zero exit. */\nexport class ExecFailed extends Data.TaggedError('ExecFailed')<{\n\treadonly name: string;\n\treadonly argv: ReadonlyArray<string>;\n\treadonly exitCode: number;\n\treadonly stderr: string;\n}> {}\n\n/** `docker save` failed — daemon error, missing image, or pipe failure\n *  draining stdout. */\nexport class ImageSaveFailed extends Data.TaggedError('ImageSaveFailed')<{\n\treadonly ref: string;\n\treadonly detail: string;\n\treadonly cause?: unknown;\n}> {}\n\n/** `docker load` failed — corrupt tar, daemon error, or no `Loaded\n *  image:` line parsed from stdout. */\nexport class ImageLoadFailed extends Data.TaggedError('ImageLoadFailed')<{\n\treadonly detail: string;\n\treadonly stderr?: string;\n\treadonly cause?: unknown;\n}> {}\n\n/** `docker tag` failed — source image missing or invalid tag string. */\nexport class ImageTagFailed extends Data.TaggedError('ImageTagFailed')<{\n\treadonly src: string;\n\treadonly dst: string;\n\treadonly stderr: string;\n}> {}\n\n/** `docker image rm` failed while removing managed snapshot/build\n *  byproducts. */\nexport class ImageRemoveFailed extends Data.TaggedError('ImageRemoveFailed')<{\n\treadonly ref: string;\n\treadonly stderr: string;\n\treadonly exitCode: number | undefined;\n}> {}\n\n/** Union of every docker-runtime typed error. */\nexport type DockerRuntimeError =\n\t| DaemonUnreachable\n\t| ImageNotFound\n\t| ImagePullFailed\n\t| BuildFailed\n\t| ContainerCreateFailed\n\t| ContainerPortPublishConflict\n\t| ContainerNameCollisionUnrecoverable\n\t| ContainerExited\n\t| ContainerRemoveFailed\n\t| DockerInspectFailed\n\t| DockerInspectDecodeFailed\n\t| ForeignDockerResource\n\t| NetworkOperationFailed\n\t| NetworkAddressPoolExhausted\n\t| NetworkIpReadbackTimeout\n\t| VolumeOperationFailed\n\t| RecreateRefused\n\t| ExecFailed\n\t| ImageSaveFailed\n\t| ImageLoadFailed\n\t| ImageTagFailed\n\t| ImageRemoveFailed;\n\n/** Project a typed `DockerRuntimeError` into the contract-shaped\n *  `ContainerRuntimeError`. The contract is intentionally narrow\n *  (`reason` is a closed enum); plugins that want the precise tag\n *  can `Effect.catchTag` against the typed errors BEFORE the contract\n *  projection runs. */\nexport const toContractError = (err: DockerRuntimeError): ContainerRuntimeError => {\n\tswitch (err._tag) {\n\t\tcase 'DaemonUnreachable':\n\t\t\treturn { _tag: 'ContainerRuntimeError', reason: 'daemon-unreachable', detail: err.detail };\n\t\tcase 'ImageNotFound':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'image-build-failed',\n\t\t\t\tdetail: `${err.ref}: ${err.detail}`,\n\t\t\t};\n\t\tcase 'ImagePullFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'image-build-failed',\n\t\t\t\tdetail: `pull ${err.ref} failed: ${err.stderr}`,\n\t\t\t};\n\t\tcase 'BuildFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'image-build-failed',\n\t\t\t\tdetail: err.parsedStep ?? err.stderr,\n\t\t\t};\n\t\tcase 'ContainerCreateFailed':\n\t\tcase 'ContainerNameCollisionUnrecoverable':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'name-collision',\n\t\t\t\tdetail: 'detail' in err ? err.detail : err.stderr,\n\t\t\t};\n\t\tcase 'ContainerPortPublishConflict':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'publish-port-conflict',\n\t\t\t\tdetail: `${err.name}: ${err.stderr}`,\n\t\t\t};\n\t\tcase 'ContainerExited':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'ready-probe-failed',\n\t\t\t\tdetail: `${err.name} exited ${err.exitCode}: ${err.logTail}`,\n\t\t\t};\n\t\tcase 'ContainerRemoveFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'container-replace-failed',\n\t\t\t\tdetail: `${err.name}: ${err.stderr}`,\n\t\t\t};\n\t\tcase 'DockerInspectFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'docker-inspect-failed',\n\t\t\t\tdetail: `${err.resource} ${err.name}: ${err.stderr}`,\n\t\t\t};\n\t\tcase 'DockerInspectDecodeFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'docker-inspect-failed',\n\t\t\t\tdetail: `${err.resource} ${err.name}: ${err.detail}`,\n\t\t\t};\n\t\tcase 'ForeignDockerResource':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'foreign-resource',\n\t\t\t\tdetail: `${err.resource} ${err.name}: ${err.detail}`,\n\t\t\t};\n\t\tcase 'NetworkOperationFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'daemon-unreachable',\n\t\t\t\tdetail: `network ${err.op} ${err.network}: ${err.stderr}`,\n\t\t\t};\n\t\tcase 'NetworkAddressPoolExhausted':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'network-address-pool-exhausted',\n\t\t\t\tdetail: `network create ${err.network}: ${err.hint} stderr=${err.stderr}`,\n\t\t\t};\n\t\tcase 'NetworkIpReadbackTimeout':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'ip-readback-timeout',\n\t\t\t\tdetail: `${err.container} on ${err.network} after ${err.waitedMillis}ms`,\n\t\t\t};\n\t\tcase 'VolumeOperationFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'daemon-unreachable',\n\t\t\t\tdetail: `volume ${err.op} ${err.volume}: ${err.stderr}`,\n\t\t\t};\n\t\tcase 'RecreateRefused':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'recreate-refused',\n\t\t\t\tdetail: `${err.name}: ${err.reason}`,\n\t\t\t};\n\t\tcase 'ExecFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'ready-probe-failed',\n\t\t\t\tdetail: `exec ${err.name} exit ${err.exitCode}: ${err.stderr}`,\n\t\t\t};\n\t\tcase 'ImageSaveFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'image-save-failed',\n\t\t\t\tdetail: `${err.ref}: ${err.detail}`,\n\t\t\t};\n\t\tcase 'ImageLoadFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'image-load-failed',\n\t\t\t\tdetail: err.stderr !== undefined ? `${err.detail}: ${err.stderr}` : err.detail,\n\t\t\t};\n\t\tcase 'ImageTagFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'image-tag-failed',\n\t\t\t\tdetail: `${err.src} → ${err.dst}: ${err.stderr}`,\n\t\t\t};\n\t\tcase 'ImageRemoveFailed':\n\t\t\treturn {\n\t\t\t\t_tag: 'ContainerRuntimeError',\n\t\t\t\treason: 'image-remove-failed',\n\t\t\t\tdetail: `${err.ref}: ${err.stderr}`,\n\t\t\t};\n\t}\n};\n"],"mappings":";;;;AAgBA,IAAa,oBAAb,cAAuC,KAAK,YAAY,oBAAoB,CAIzE;;AAGH,IAAa,gBAAb,cAAmC,KAAK,YAAY,gBAAgB,CAGjE;;AAGH,IAAa,kBAAb,cAAqC,KAAK,YAAY,kBAAkB,CAIrE;;;;AAKH,IAAa,cAAb,cAAiC,KAAK,YAAY,cAAc,CAM7D;;AAGH,IAAa,wBAAb,cAA2C,KAAK,YAAY,wBAAwB,CAIjF;;AAGH,IAAa,+BAAb,cAAkD,KAAK,YAAY,+BAA+B,CAI/F;;;;AAKH,IAAa,sCAAb,cAAyD,KAAK,YAC7D,sCACA,CAGE;AAGkC,KAAK,YAAY,kBAAkB;;;;AASxE,IAAa,wBAAb,cAA2C,KAAK,YAAY,wBAAwB,CAIjF;;AAKH,IAAa,sBAAb,cAAyC,KAAK,YAAY,sBAAsB,CAK7E;;;AAIH,IAAa,4BAAb,cAA+C,KAAK,YAAY,4BAA4B,CAKzF;;;;AAKH,IAAa,wBAAb,cAA2C,KAAK,YAAY,wBAAwB,CAMjF;;;AAIH,IAAa,yBAAb,cAA4C,KAAK,YAAY,yBAAyB,CAInF;;;;;AAMH,IAAa,8BAAb,cAAiD,KAAK,YAAY,8BAA8B,CAI7F;;;AAIH,IAAa,2BAAb,cAA8C,KAAK,YAAY,2BAA2B,CAIvF;;AAGH,IAAa,wBAAb,cAA2C,KAAK,YAAY,wBAAwB,CAIjF;;;;;;AAOH,IAAa,kBAAb,cAAqC,KAAK,YAAY,kBAAkB,CAQrE;;;AAIH,IAAa,aAAb,cAAgC,KAAK,YAAY,aAAa,CAK3D;;;AAIH,IAAa,kBAAb,cAAqC,KAAK,YAAY,kBAAkB,CAIrE;;;AAIH,IAAa,kBAAb,cAAqC,KAAK,YAAY,kBAAkB,CAIrE;;AAGH,IAAa,iBAAb,cAAoC,KAAK,YAAY,iBAAiB,CAInE;;;AAIH,IAAa,oBAAb,cAAuC,KAAK,YAAY,oBAAoB,CAIzE;;;;;;AAgCH,MAAa,mBAAmB,QAAmD;AAClF,SAAQ,IAAI,MAAZ;EACC,KAAK,oBACJ,QAAO;GAAE,MAAM;GAAyB,QAAQ;GAAsB,QAAQ,IAAI;GAAQ;EAC3F,KAAK,gBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,IAAI,IAAI,IAAI;GAC3B;EACF,KAAK,kBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,QAAQ,IAAI,IAAI,WAAW,IAAI;GACvC;EACF,KAAK,cACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,IAAI,cAAc,IAAI;GAC9B;EACF,KAAK;EACL,KAAK,sCACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,YAAY,MAAM,IAAI,SAAS,IAAI;GAC3C;EACF,KAAK,+BACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,KAAK,IAAI,IAAI;GAC5B;EACF,KAAK,kBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,KAAK,UAAU,IAAI,SAAS,IAAI,IAAI;GACnD;EACF,KAAK,wBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,KAAK,IAAI,IAAI;GAC5B;EACF,KAAK,sBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,SAAS,GAAG,IAAI,KAAK,IAAI,IAAI;GAC5C;EACF,KAAK,4BACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,SAAS,GAAG,IAAI,KAAK,IAAI,IAAI;GAC5C;EACF,KAAK,wBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,SAAS,GAAG,IAAI,KAAK,IAAI,IAAI;GAC5C;EACF,KAAK,yBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,WAAW,IAAI,GAAG,GAAG,IAAI,QAAQ,IAAI,IAAI;GACjD;EACF,KAAK,8BACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,kBAAkB,IAAI,QAAQ,IAAI,IAAI,KAAK,UAAU,IAAI;GACjE;EACF,KAAK,2BACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,UAAU,MAAM,IAAI,QAAQ,SAAS,IAAI,aAAa;GACrE;EACF,KAAK,wBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,UAAU,IAAI,GAAG,GAAG,IAAI,OAAO,IAAI,IAAI;GAC/C;EACF,KAAK,kBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,KAAK,IAAI,IAAI;GAC5B;EACF,KAAK,aACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,QAAQ,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI;GACtD;EACF,KAAK,kBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,IAAI,IAAI,IAAI;GAC3B;EACF,KAAK,kBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,IAAI,WAAW,KAAA,IAAY,GAAG,IAAI,OAAO,IAAI,IAAI,WAAW,IAAI;GACxE;EACF,KAAK,iBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI;GACxC;EACF,KAAK,oBACJ,QAAO;GACN,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,IAAI,IAAI,IAAI,IAAI;GAC3B"}

package/dist/runtime/docker/exec.d.mts

@@ -0,0 +1 @@
+import { Effect, Scope } from "effect";

package/dist/runtime/docker/exec.mjs

@@ -0,0 +1,63 @@
+import { dockerRunOk } from "./client.mjs";
+import { DaemonUnreachable, ExecFailed } from "./errors.mjs";
+import { wrapGeneric } from "./wrap.mjs";
+import { Effect } from "effect";
+import { randomUUID } from "node:crypto";
+//#region src/runtime/docker/exec.ts
+/** `docker exec [-u user] [-w workdir] [-e k=v]... <name> <argv...>`. */
+const dockerExec = (containerNameOrId, argv, opts = {}) => Effect.gen(function* () {
+	const args = [];
+	if (opts.user) args.push("--user", opts.user);
+	if (opts.workdir) args.push("--workdir", opts.workdir);
+	if (opts.env) for (const [k, v] of Object.entries(opts.env)) args.push("--env", `${k}=${v}`);
+	args.push(containerNameOrId, ...argv);
+	const res = yield* dockerRunOk("exec", args, {
+		onStdoutLine: opts.onStdoutLine,
+		onStderrLine: opts.onStderrLine
+	}).pipe(Effect.mapError(wrapGeneric("docker.exec")));
+	if (opts.failOnNonZero && res.exitCode !== 0) return yield* Effect.fail(new ExecFailed({
+		name: containerNameOrId,
+		argv,
+		exitCode: res.exitCode,
+		stderr: res.stderr
+	}));
+	return res;
+}).pipe(Effect.withSpan("runtime.docker.exec"));
+/** `docker run --rm [-name <n>] [-e ...] [--mount ...] [--network n]
+*  [--entrypoint e] [--label ...] <image> <argv...>`.
+*
+*  Belt-and-suspenders: when `keep` is false, a Scope finalizer fires
+*  `docker rm -f <name>` to catch containers that outlived the
+*  foreground subprocess on the timeout path. */
+const dockerRunOneShot = (opts) => Effect.gen(function* () {
+	const args = [];
+	if (!opts.keep) args.push("--rm");
+	const name = opts.name ?? `devstack-oneshot-${Date.now()}-${randomUUID().replace(/-/g, "").slice(0, 8)}`;
+	args.push("--name", name);
+	if (opts.network) args.push("--network", opts.network);
+	if (opts.entrypoint) args.push("--entrypoint", opts.entrypoint);
+	if (opts.user) args.push("--user", opts.user);
+	if (opts.env) for (const [k, v] of Object.entries(opts.env)) args.push("--env", `${k}=${v}`);
+	if (opts.mounts) for (const m of opts.mounts) {
+		const ro = m.readonly ? ",readonly" : "";
+		args.push("--mount", `type=bind,source=${m.source},target=${m.target}${ro}`);
+	}
+	if (opts.labels) for (const l of opts.labels) args.push("--label", l);
+	if (opts.extraHosts) for (const [host, ip] of Object.entries(opts.extraHosts)) args.push("--add-host", `${host}:${ip}`);
+	args.push(opts.image);
+	if (opts.argv) args.push(...opts.argv);
+	if (!opts.keep) yield* Effect.addFinalizer(() => dockerRunOk("rm", ["-f", name]).pipe(Effect.catch(() => Effect.void), Effect.asVoid));
+	const baseInvocation = dockerRunOk("run", args, {
+		onStdoutLine: opts.onStdoutLine,
+		onStderrLine: opts.onStderrLine
+	}).pipe(Effect.mapError(wrapGeneric("docker.run-oneshot")));
+	if (opts.timeoutMillis !== void 0) return yield* baseInvocation.pipe(Effect.timeout(`${opts.timeoutMillis} millis`), Effect.catchTag("TimeoutError", () => Effect.fail(new DaemonUnreachable({
+		op: "docker.run-oneshot",
+		detail: `one-shot timed out after ${opts.timeoutMillis}ms`
+	}))));
+	return yield* baseInvocation;
+}).pipe(Effect.withSpan("runtime.docker.oneShot"));
+//#endregion
+export { dockerExec, dockerRunOneShot };
+
+//# sourceMappingURL=exec.mjs.map

package/dist/runtime/docker/exec.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.mjs","names":[],"sources":["../../../src/runtime/docker/exec.ts"],"sourcesContent":["// One-shot `docker exec` and `docker run --rm`.\n//\n// Architecture:\n//   - `dockerExec` invokes inside an already-running long-lived\n//     container; captures stdout/stderr/exitCode.\n//   - `dockerRunOneShot` is for `docker run --rm` style invocation —\n//     a transient container that runs to completion.\n//   - Wall-clock timeout with SIGTERM-then-SIGKILL escalation is\n//     scoped at the L0 capture level via `Effect.timeout`; the\n//     belt-and-suspenders `rm -f` is registered as a finalizer so a\n//     timed-out container that outlived its foreground subprocess is\n//     still reaped.\n\nimport { randomUUID } from 'node:crypto';\n\nimport { Effect, Scope } from 'effect';\n\nimport type {\n\tCaptureOptions,\n\tCaptureResult,\n} from '../../substrate/runtime/observability/subprocess-capture.ts';\nimport { DockerHost, DockerSpawner, dockerRunOk } from './client.ts';\nimport { DaemonUnreachable, type DockerRuntimeError, ExecFailed } from './errors.ts';\nimport { wrapGeneric } from './wrap.ts';\n\n// -----------------------------------------------------------------------------\n// Exec — into a running container\n// -----------------------------------------------------------------------------\n\nexport interface DockerExecOptions {\n\treadonly user?: string;\n\treadonly env?: Readonly<Record<string, string>>;\n\treadonly workdir?: string;\n\treadonly onStdoutLine?: (line: string) => Effect.Effect<void>;\n\treadonly onStderrLine?: (line: string) => Effect.Effect<void>;\n\t/** Promote non-zero exit to `ExecFailed`. Default false; the caller\n\t *  gets the full result and decides. */\n\treadonly failOnNonZero?: boolean;\n}\n\nexport interface DockerExecResult {\n\treadonly exitCode: number;\n\treadonly stdout: string;\n\treadonly stderr: string;\n}\n\n/** `docker exec [-u user] [-w workdir] [-e k=v]... <name> <argv...>`. */\nexport const dockerExec = (\n\tcontainerNameOrId: string,\n\targv: ReadonlyArray<string>,\n\topts: DockerExecOptions = {},\n): Effect.Effect<DockerExecResult, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst args: Array<string> = [];\n\t\tif (opts.user) args.push('--user', opts.user);\n\t\tif (opts.workdir) args.push('--workdir', opts.workdir);\n\t\tif (opts.env) {\n\t\t\tfor (const [k, v] of Object.entries(opts.env)) {\n\t\t\t\targs.push('--env', `${k}=${v}`);\n\t\t\t}\n\t\t}\n\t\targs.push(containerNameOrId, ...argv);\n\t\tconst captureOpts: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'> = {\n\t\t\tonStdoutLine: opts.onStdoutLine,\n\t\t\tonStderrLine: opts.onStderrLine,\n\t\t};\n\t\tconst res = yield* dockerRunOk('exec', args, captureOpts).pipe(\n\t\t\tEffect.mapError(wrapGeneric('docker.exec')),\n\t\t);\n\t\tif (opts.failOnNonZero && res.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew ExecFailed({\n\t\t\t\t\tname: containerNameOrId,\n\t\t\t\t\targv,\n\t\t\t\t\texitCode: res.exitCode,\n\t\t\t\t\tstderr: res.stderr,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\treturn res;\n\t}).pipe(Effect.withSpan('runtime.docker.exec'));\n\n// -----------------------------------------------------------------------------\n// One-shot — `docker run --rm`\n// -----------------------------------------------------------------------------\n\nexport interface DockerOneShotOptions {\n\treadonly name?: string;\n\treadonly image: string;\n\treadonly argv?: ReadonlyArray<string>;\n\treadonly env?: Readonly<Record<string, string>>;\n\treadonly mounts?: ReadonlyArray<{\n\t\treadonly source: string;\n\t\treadonly target: string;\n\t\treadonly readonly?: boolean;\n\t}>;\n\treadonly network?: string;\n\treadonly entrypoint?: string;\n\treadonly user?: string;\n\treadonly labels?: ReadonlyArray<string>;\n\t/** `--add-host <host>:<ip>` entries. See contract docs. */\n\treadonly extraHosts?: Readonly<Record<string, string>>;\n\treadonly onStdoutLine?: (line: string) => Effect.Effect<void>;\n\treadonly onStderrLine?: (line: string) => Effect.Effect<void>;\n\t/** Wall-clock timeout. After this the subprocess is killed; the\n\t *  outer `rm -f` belt-and-suspenders finalizer catches any\n\t *  container that survived the kill. */\n\treadonly timeoutMillis?: number;\n\t/** Keep the container after exit (forensic retention escape hatch).\n\t *  When true, drops `--rm` AND the finalizer rm. */\n\treadonly keep?: boolean;\n}\n\n/** `docker run --rm [-name <n>] [-e ...] [--mount ...] [--network n]\n *  [--entrypoint e] [--label ...] <image> <argv...>`.\n *\n *  Belt-and-suspenders: when `keep` is false, a Scope finalizer fires\n *  `docker rm -f <name>` to catch containers that outlived the\n *  foreground subprocess on the timeout path. */\nexport const dockerRunOneShot = (\n\topts: DockerOneShotOptions,\n): Effect.Effect<CaptureResult, DockerRuntimeError, DockerHost | DockerSpawner | Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst args: Array<string> = [];\n\t\tif (!opts.keep) args.push('--rm');\n\t\tconst name =\n\t\t\topts.name ?? `devstack-oneshot-${Date.now()}-${randomUUID().replace(/-/g, '').slice(0, 8)}`;\n\t\targs.push('--name', name);\n\t\tif (opts.network) args.push('--network', opts.network);\n\t\tif (opts.entrypoint) args.push('--entrypoint', opts.entrypoint);\n\t\tif (opts.user) args.push('--user', opts.user);\n\t\tif (opts.env) {\n\t\t\tfor (const [k, v] of Object.entries(opts.env)) {\n\t\t\t\targs.push('--env', `${k}=${v}`);\n\t\t\t}\n\t\t}\n\t\tif (opts.mounts) {\n\t\t\tfor (const m of opts.mounts) {\n\t\t\t\tconst ro = m.readonly ? ',readonly' : '';\n\t\t\t\targs.push('--mount', `type=bind,source=${m.source},target=${m.target}${ro}`);\n\t\t\t}\n\t\t}\n\t\tif (opts.labels) {\n\t\t\tfor (const l of opts.labels) args.push('--label', l);\n\t\t}\n\t\tif (opts.extraHosts) {\n\t\t\tfor (const [host, ip] of Object.entries(opts.extraHosts)) {\n\t\t\t\targs.push('--add-host', `${host}:${ip}`);\n\t\t\t}\n\t\t}\n\t\targs.push(opts.image);\n\t\tif (opts.argv) args.push(...opts.argv);\n\n\t\t// Register the belt-and-suspenders rm finalizer BEFORE we\n\t\t// invoke. Even if the spawner blows up mid-flight, the\n\t\t// finalizer fires on scope close.\n\t\tif (!opts.keep) {\n\t\t\tyield* Effect.addFinalizer(() =>\n\t\t\t\tdockerRunOk('rm', ['-f', name]).pipe(\n\t\t\t\t\tEffect.catch(() => Effect.void),\n\t\t\t\t\tEffect.asVoid,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\n\t\tconst captureOpts: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'> = {\n\t\t\tonStdoutLine: opts.onStdoutLine,\n\t\t\tonStderrLine: opts.onStderrLine,\n\t\t};\n\t\tconst baseInvocation = dockerRunOk('run', args, captureOpts).pipe(\n\t\t\tEffect.mapError(wrapGeneric('docker.run-oneshot')),\n\t\t);\n\t\tif (opts.timeoutMillis !== undefined) {\n\t\t\t// Effect.timeout fails with a TimeoutError (Effect v4\n\t\t\t// renamed it from TimeoutException); collapse into our\n\t\t\t// daemon-unreachable envelope so the caller sees the same\n\t\t\t// shape they handle for any docker subprocess.\n\t\t\treturn yield* baseInvocation.pipe(\n\t\t\t\tEffect.timeout(`${opts.timeoutMillis} millis`),\n\t\t\t\tEffect.catchTag('TimeoutError', () =>\n\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\tnew DaemonUnreachable({\n\t\t\t\t\t\t\top: 'docker.run-oneshot',\n\t\t\t\t\t\t\tdetail: `one-shot timed out after ${opts.timeoutMillis}ms`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn yield* baseInvocation;\n\t}).pipe(Effect.withSpan('runtime.docker.oneShot'));\n"],"mappings":";;;;;;;AA+CA,MAAa,cACZ,mBACA,MACA,OAA0B,EAAE,KAE5B,OAAO,IAAI,aAAa;CACvB,MAAM,OAAsB,EAAE;AAC9B,KAAI,KAAK,KAAM,MAAK,KAAK,UAAU,KAAK,KAAK;AAC7C,KAAI,KAAK,QAAS,MAAK,KAAK,aAAa,KAAK,QAAQ;AACtD,KAAI,KAAK,IACR,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,IAAI,CAC5C,MAAK,KAAK,SAAS,GAAG,EAAE,GAAG,IAAI;AAGjC,MAAK,KAAK,mBAAmB,GAAG,KAAK;CAKrC,MAAM,MAAM,OAAO,YAAY,QAAQ,MAAM;EAH5C,cAAc,KAAK;EACnB,cAAc,KAAK;EAEoC,CAAC,CAAC,KACzD,OAAO,SAAS,YAAY,cAAc,CAAC,CAC3C;AACD,KAAI,KAAK,iBAAiB,IAAI,aAAa,EAC1C,QAAO,OAAO,OAAO,KACpB,IAAI,WAAW;EACd,MAAM;EACN;EACA,UAAU,IAAI;EACd,QAAQ,IAAI;EACZ,CAAC,CACF;AAEF,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,sBAAsB,CAAC;;;;;;;AAuChD,MAAa,oBACZ,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAsB,EAAE;AAC9B,KAAI,CAAC,KAAK,KAAM,MAAK,KAAK,OAAO;CACjC,MAAM,OACL,KAAK,QAAQ,oBAAoB,KAAK,KAAK,CAAC,GAAG,YAAY,CAAC,QAAQ,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE;AAC1F,MAAK,KAAK,UAAU,KAAK;AACzB,KAAI,KAAK,QAAS,MAAK,KAAK,aAAa,KAAK,QAAQ;AACtD,KAAI,KAAK,WAAY,MAAK,KAAK,gBAAgB,KAAK,WAAW;AAC/D,KAAI,KAAK,KAAM,MAAK,KAAK,UAAU,KAAK,KAAK;AAC7C,KAAI,KAAK,IACR,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,IAAI,CAC5C,MAAK,KAAK,SAAS,GAAG,EAAE,GAAG,IAAI;AAGjC,KAAI,KAAK,OACR,MAAK,MAAM,KAAK,KAAK,QAAQ;EAC5B,MAAM,KAAK,EAAE,WAAW,cAAc;AACtC,OAAK,KAAK,WAAW,oBAAoB,EAAE,OAAO,UAAU,EAAE,SAAS,KAAK;;AAG9E,KAAI,KAAK,OACR,MAAK,MAAM,KAAK,KAAK,OAAQ,MAAK,KAAK,WAAW,EAAE;AAErD,KAAI,KAAK,WACR,MAAK,MAAM,CAAC,MAAM,OAAO,OAAO,QAAQ,KAAK,WAAW,CACvD,MAAK,KAAK,cAAc,GAAG,KAAK,GAAG,KAAK;AAG1C,MAAK,KAAK,KAAK,MAAM;AACrB,KAAI,KAAK,KAAM,MAAK,KAAK,GAAG,KAAK,KAAK;AAKtC,KAAI,CAAC,KAAK,KACT,QAAO,OAAO,mBACb,YAAY,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,KAC/B,OAAO,YAAY,OAAO,KAAK,EAC/B,OAAO,OACP,CACD;CAOF,MAAM,iBAAiB,YAAY,OAAO,MAAM;EAH/C,cAAc,KAAK;EACnB,cAAc,KAAK;EAEuC,CAAC,CAAC,KAC5D,OAAO,SAAS,YAAY,qBAAqB,CAAC,CAClD;AACD,KAAI,KAAK,kBAAkB,KAAA,EAK1B,QAAO,OAAO,eAAe,KAC5B,OAAO,QAAQ,GAAG,KAAK,cAAc,SAAS,EAC9C,OAAO,SAAS,sBACf,OAAO,KACN,IAAI,kBAAkB;EACrB,IAAI;EACJ,QAAQ,4BAA4B,KAAK,cAAc;EACvD,CAAC,CACF,CACD,CACD;AAEF,QAAO,OAAO;EACb,CAAC,KAAK,OAAO,SAAS,yBAAyB,CAAC"}

package/dist/runtime/docker/image.d.mts

@@ -0,0 +1 @@
+import { Effect, Stream } from "effect";