@mysten-incubation/devstack 0.0.0

package/dist/runtime/docker/labels.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"labels.mjs","names":[],"sources":["../../../src/runtime/docker/labels.ts"],"sourcesContent":["// Docker label contract.\n//\n// Architecture § Container runtime § Label-driven inventory:\n//   Containers, images, networks, and volumes are enumerated by the\n//   four canonical engine-level dimensions and a small set of\n//   well-known role labels. Inventory NEVER greps stdout for names.\n//\n// The four canonical engine dimensions (no service names anywhere):\n//\n//   - `devstack.app`     — the app/project this resource belongs to\n//   - `devstack.stack`   — the stack name within that app\n//   - `devstack.plugin`  — the plugin key (opaque to the runtime)\n//   - `devstack.role`    — the resource's role within the plugin (also opaque)\n//\n// Plus two protocol-level labels for the lifecycle machinery:\n//\n//   - `devstack.cycle`   — the engine cycle id that last touched it\n//                          (sweep filters by this to find orphans)\n//   - `devstack.managed` — set to `'true'` on every resource we own;\n//                          a coarse \"is this ours at all?\" filter\n//\n// Network / image / volume specializations carry only the canonical\n// engine dimensions plus a kind-specific marker.\n\nimport type { ContainerLabelTuple } from '../../contracts/snapshotable.ts';\n\n/** Canonical label keys. Single source of truth. */\nexport const LabelKey = {\n\tapp: 'devstack.app',\n\tstack: 'devstack.stack',\n\tplugin: 'devstack.plugin',\n\trole: 'devstack.role',\n\tcycle: 'devstack.cycle',\n\tconfigHash: 'devstack.config-hash',\n\tmanaged: 'devstack.managed',\n\t// Resource-kind markers — coarse \"what is this?\" classification\n\t// for inventory walks.\n\tnetworkMarker: 'devstack.network',\n\tvolumeMarker: 'devstack.volume',\n\t// Reverse-proxy / routable. Router itself is built outside this\n\t// package, but if it stamps a label, this is the key it uses.\n\trouterMarker: 'devstack.router',\n\trouterProfile: 'devstack.router.profile',\n\trouterSpecVersion: 'devstack.router.spec-version',\n} as const;\n\nexport type LabelKey = (typeof LabelKey)[keyof typeof LabelKey];\n\n/** Docker Compose-compatible labels used only for Docker Desktop grouping.\n *  Cleanup and inventory remain keyed by `LabelKey` above. */\nexport const ComposeLabelKey = {\n\tproject: 'com.docker.compose.project',\n\tservice: 'com.docker.compose.service',\n\tcontainerNumber: 'com.docker.compose.container-number',\n\tversion: 'com.docker.compose.version',\n\toneoff: 'com.docker.compose.oneoff',\n\tnetwork: 'com.docker.compose.network',\n\tvolume: 'com.docker.compose.volume',\n} as const;\n\nexport type ComposeLabelKey = (typeof ComposeLabelKey)[keyof typeof ComposeLabelKey];\n\nexport const COMPOSE_UI_VERSION = '2.0.0';\n\nexport type ExpectedOwnershipLabels = Readonly<Record<string, string>>;\n\nconst normalizeComposeSegment = (value: string): string => {\n\tconst normalized = value\n\t\t.trim()\n\t\t.replace(/[^a-zA-Z0-9_-]+/g, '-')\n\t\t.replace(/^-+|-+$/g, '');\n\treturn normalized.length > 0 ? normalized : 'unnamed';\n};\n\nexport const composeProjectId = (app: string, stack: string): string =>\n\t`${normalizeComposeSegment(app)}-${normalizeComposeSegment(stack)}`;\n\nexport const composeServiceId = (tuple: ContainerLabelTuple): string =>\n\t`${normalizeComposeSegment(tuple.plugin)}.${normalizeComposeSegment(tuple.role)}`;\n\nexport const renderComposeContainerLabels = (tuple: ContainerLabelTuple): ReadonlyArray<string> => [\n\t`${ComposeLabelKey.project}=${composeProjectId(tuple.app, tuple.stack)}`,\n\t`${ComposeLabelKey.service}=${composeServiceId(tuple)}`,\n\t`${ComposeLabelKey.containerNumber}=1`,\n\t`${ComposeLabelKey.version}=${COMPOSE_UI_VERSION}`,\n\t`${ComposeLabelKey.oneoff}=False`,\n];\n\nexport const renderComposeNetworkLabels = (\n\tname: string,\n\tapp: string,\n\tstack: string,\n): ReadonlyArray<string> => [\n\t`${ComposeLabelKey.project}=${composeProjectId(app, stack)}`,\n\t`${ComposeLabelKey.network}=${name}`,\n\t`${ComposeLabelKey.version}=${COMPOSE_UI_VERSION}`,\n];\n\nexport const renderComposeVolumeLabels = (\n\tname: string,\n\ttuple: ContainerLabelTuple,\n): ReadonlyArray<string> => [\n\t`${ComposeLabelKey.project}=${composeProjectId(tuple.app, tuple.stack)}`,\n\t`${ComposeLabelKey.volume}=${name}`,\n\t`${ComposeLabelKey.version}=${COMPOSE_UI_VERSION}`,\n];\n\nexport const expectedContainerOwnershipLabels = (\n\ttuple: ContainerLabelTuple,\n): ExpectedOwnershipLabels => ({\n\t[LabelKey.managed]: 'true',\n\t[LabelKey.app]: tuple.app,\n\t[LabelKey.stack]: tuple.stack,\n\t[LabelKey.plugin]: tuple.plugin,\n\t[LabelKey.role]: tuple.role,\n});\n\nexport const expectedNetworkOwnershipLabels = (\n\tapp: string,\n\tstack: string,\n): ExpectedOwnershipLabels => ({\n\t[LabelKey.managed]: 'true',\n\t[LabelKey.networkMarker]: 'true',\n\t[LabelKey.app]: app,\n\t[LabelKey.stack]: stack,\n});\n\nexport const expectedVolumeOwnershipLabels = (\n\ttuple: ContainerLabelTuple,\n): ExpectedOwnershipLabels => ({\n\t[LabelKey.managed]: 'true',\n\t[LabelKey.volumeMarker]: 'true',\n\t[LabelKey.app]: tuple.app,\n\t[LabelKey.stack]: tuple.stack,\n\t[LabelKey.plugin]: tuple.plugin,\n\t[LabelKey.role]: tuple.role,\n});\n\nexport const ownershipMismatchDetail = (\n\texpected: ExpectedOwnershipLabels,\n\tactual: Readonly<Record<string, string>>,\n): string | null => {\n\tconst mismatches: Array<string> = [];\n\tfor (const [key, expectedValue] of Object.entries(expected)) {\n\t\tconst actualValue = actual[key];\n\t\tif (actualValue !== expectedValue) {\n\t\t\tmismatches.push(`${key}: expected ${expectedValue}, found ${actualValue ?? '<missing>'}`);\n\t\t}\n\t}\n\treturn mismatches.length === 0 ? null : mismatches.join('; ');\n};\n\n/** Render a `ContainerLabelTuple` to docker `--label key=value` pairs.\n *  The cycle/managed labels are stamped at create time by `container.ts`. */\nexport const renderContainerLabels = (\n\ttuple: ContainerLabelTuple,\n\tcycle: number,\n\textra: Readonly<Record<string, string>> = {},\n): ReadonlyArray<string> => {\n\tconst ownership = [\n\t\t...Object.entries(expectedContainerOwnershipLabels(tuple)).map(\n\t\t\t([key, value]) => `${key}=${value}`,\n\t\t),\n\t\t`${LabelKey.cycle}=${cycle}`,\n\t\t...Object.entries(extra).map(([key, value]) => `${key}=${value}`),\n\t];\n\treturn [...ownership, ...renderComposeContainerLabels(tuple)];\n};\n\n/** Render a label-tuple as `--filter label=key=value` args for `docker ps`,\n *  `docker volume ls`, etc. Partial tuples allowed (sweep / inventory). */\nexport const renderFilterArgs = (\n\tmatch: Partial<ContainerLabelTuple>,\n\textra: Readonly<Record<string, string>> = {},\n): ReadonlyArray<string> => {\n\tconst filters: Array<string> = [`label=${LabelKey.managed}=true`];\n\tif (match.app !== undefined) filters.push(`label=${LabelKey.app}=${match.app}`);\n\tif (match.stack !== undefined) filters.push(`label=${LabelKey.stack}=${match.stack}`);\n\tif (match.plugin !== undefined) filters.push(`label=${LabelKey.plugin}=${match.plugin}`);\n\tif (match.role !== undefined) filters.push(`label=${LabelKey.role}=${match.role}`);\n\tfor (const [k, v] of Object.entries(extra)) filters.push(`label=${k}=${v}`);\n\treturn filters.flatMap((f) => ['--filter', f]);\n};\n\n/** Network-specific labels (shared `devstack` network is cross-stack;\n *  per-stack networks would stamp the full tuple). */\nexport const renderNetworkLabels = (\n\tname: string,\n\tapp: string,\n\tstack: string,\n\topts: { readonly composeUi?: boolean } = {},\n): ReadonlyArray<string> => {\n\tconst ownership = Object.entries(expectedNetworkOwnershipLabels(app, stack)).map(\n\t\t([key, value]) => `${key}=${value}`,\n\t);\n\treturn opts.composeUi === false\n\t\t? ownership\n\t\t: [...ownership, ...renderComposeNetworkLabels(name, app, stack)];\n};\n\n/** Volume labels — pre-create with these before any `run -v` argv to\n *  avoid docker's lazy unlabelled-create. */\nexport const renderVolumeLabels = (\n\tname: string,\n\ttuple: ContainerLabelTuple,\n): ReadonlyArray<string> => {\n\tconst ownership = Object.entries(expectedVolumeOwnershipLabels(tuple)).map(\n\t\t([key, value]) => `${key}=${value}`,\n\t);\n\treturn [...ownership, ...renderComposeVolumeLabels(name, tuple)];\n};\n"],"mappings":";;AA2BA,MAAa,WAAW;CACvB,KAAK;CACL,OAAO;CACP,QAAQ;CACR,MAAM;CACN,OAAO;CACP,YAAY;CACZ,SAAS;CAGT,eAAe;CACf,cAAc;CAGd,cAAc;CACd,eAAe;CACf,mBAAmB;CACnB;;;AAMD,MAAa,kBAAkB;CAC9B,SAAS;CACT,SAAS;CACT,iBAAiB;CACjB,SAAS;CACT,QAAQ;CACR,SAAS;CACT,QAAQ;CACR;AAID,MAAa,qBAAqB;AAIlC,MAAM,2BAA2B,UAA0B;CAC1D,MAAM,aAAa,MACjB,MAAM,CACN,QAAQ,oBAAoB,IAAI,CAChC,QAAQ,YAAY,GAAG;AACzB,QAAO,WAAW,SAAS,IAAI,aAAa;;AAG7C,MAAa,oBAAoB,KAAa,UAC7C,GAAG,wBAAwB,IAAI,CAAC,GAAG,wBAAwB,MAAM;AAElE,MAAa,oBAAoB,UAChC,GAAG,wBAAwB,MAAM,OAAO,CAAC,GAAG,wBAAwB,MAAM,KAAK;AAEhF,MAAa,gCAAgC,UAAsD;CAClG,GAAG,gBAAgB,QAAQ,GAAG,iBAAiB,MAAM,KAAK,MAAM,MAAM;CACtE,GAAG,gBAAgB,QAAQ,GAAG,iBAAiB,MAAM;CACrD,GAAG,gBAAgB,gBAAgB;CACnC,GAAG,gBAAgB,QAAQ,GAAG;CAC9B,GAAG,gBAAgB,OAAO;CAC1B;AAED,MAAa,8BACZ,MACA,KACA,UAC2B;CAC3B,GAAG,gBAAgB,QAAQ,GAAG,iBAAiB,KAAK,MAAM;CAC1D,GAAG,gBAAgB,QAAQ,GAAG;CAC9B,GAAG,gBAAgB,QAAQ,GAAG;CAC9B;AAWD,MAAa,oCACZ,WAC8B;EAC7B,SAAS,UAAU;EACnB,SAAS,MAAM,MAAM;EACrB,SAAS,QAAQ,MAAM;EACvB,SAAS,SAAS,MAAM;EACxB,SAAS,OAAO,MAAM;CACvB;AAED,MAAa,kCACZ,KACA,WAC8B;EAC7B,SAAS,UAAU;EACnB,SAAS,gBAAgB;EACzB,SAAS,MAAM;EACf,SAAS,QAAQ;CAClB;AAaD,MAAa,2BACZ,UACA,WACmB;CACnB,MAAM,aAA4B,EAAE;AACpC,MAAK,MAAM,CAAC,KAAK,kBAAkB,OAAO,QAAQ,SAAS,EAAE;EAC5D,MAAM,cAAc,OAAO;AAC3B,MAAI,gBAAgB,cACnB,YAAW,KAAK,GAAG,IAAI,aAAa,cAAc,UAAU,eAAe,cAAc;;AAG3F,QAAO,WAAW,WAAW,IAAI,OAAO,WAAW,KAAK,KAAK;;;;AAK9D,MAAa,yBACZ,OACA,OACA,QAA0C,EAAE,KACjB;AAQ3B,QAAO,CAAC,GAAG;EANV,GAAG,OAAO,QAAQ,iCAAiC,MAAM,CAAC,CAAC,KACzD,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,QAC5B;EACD,GAAG,SAAS,MAAM,GAAG;EACrB,GAAG,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,QAAQ;EAE9C,EAAE,GAAG,6BAA6B,MAAM,CAAC;;;;AAK9D,MAAa,oBACZ,OACA,QAA0C,EAAE,KACjB;CAC3B,MAAM,UAAyB,CAAC,SAAS,SAAS,QAAQ,OAAO;AACjE,KAAI,MAAM,QAAQ,KAAA,EAAW,SAAQ,KAAK,SAAS,SAAS,IAAI,GAAG,MAAM,MAAM;AAC/E,KAAI,MAAM,UAAU,KAAA,EAAW,SAAQ,KAAK,SAAS,SAAS,MAAM,GAAG,MAAM,QAAQ;AACrF,KAAI,MAAM,WAAW,KAAA,EAAW,SAAQ,KAAK,SAAS,SAAS,OAAO,GAAG,MAAM,SAAS;AACxF,KAAI,MAAM,SAAS,KAAA,EAAW,SAAQ,KAAK,SAAS,SAAS,KAAK,GAAG,MAAM,OAAO;AAClF,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,CAAE,SAAQ,KAAK,SAAS,EAAE,GAAG,IAAI;AAC3E,QAAO,QAAQ,SAAS,MAAM,CAAC,YAAY,EAAE,CAAC;;;;AAK/C,MAAa,uBACZ,MACA,KACA,OACA,OAAyC,EAAE,KAChB;CAC3B,MAAM,YAAY,OAAO,QAAQ,+BAA+B,KAAK,MAAM,CAAC,CAAC,KAC3E,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,QAC5B;AACD,QAAO,KAAK,cAAc,QACvB,YACA,CAAC,GAAG,WAAW,GAAG,2BAA2B,MAAM,KAAK,MAAM,CAAC"}

package/dist/runtime/docker/logs.d.mts

@@ -0,0 +1 @@
+import { Effect, Stream } from "effect";

package/dist/runtime/docker/logs.mjs

@@ -0,0 +1,34 @@
+import { splitUtf8Lines } from "../../substrate/runtime/observability/process-lines.mjs";
+import { DockerHost, DockerSpawner, dockerCommand } from "./client.mjs";
+import { DaemonUnreachable } from "./errors.mjs";
+import { Effect, Stream } from "effect";
+//#region src/runtime/docker/logs.ts
+/** `docker logs --follow --timestamps <id>` projected to a per-line
+*  Stream. Combined stdout+stderr (docker writes both to the same
+*  follow stream).
+*
+*  IMPORTANT: the stream completes when the container exits (docker
+*  closes the pipe). Consumers that want to re-follow after a restart
+*  must re-call this. */
+const followLogs = (containerNameOrId, opts = {}) => {
+	const args = ["--follow", "--timestamps"];
+	if (opts.since !== void 0) args.push("--since", opts.since);
+	if (opts.tail !== void 0) args.push("--tail", String(opts.tail));
+	args.push(containerNameOrId);
+	const mapSpawnError = (cause) => new DaemonUnreachable({
+		op: "docker.logs",
+		detail: "logs follow stream failed",
+		cause
+	});
+	return Stream.unwrap(Effect.gen(function* () {
+		const host = yield* DockerHost;
+		const spawner = yield* DockerSpawner;
+		const cmd = dockerCommand(host, "logs", args);
+		const handle = yield* spawner.spawn(cmd).pipe(Effect.mapError(mapSpawnError));
+		return splitUtf8Lines(Stream.merge(handle.stdout, handle.stderr)).pipe(Stream.mapError(mapSpawnError));
+	}));
+};
+//#endregion
+export { followLogs };
+
+//# sourceMappingURL=logs.mjs.map

package/dist/runtime/docker/logs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.mjs","names":[],"sources":["../../../src/runtime/docker/logs.ts"],"sourcesContent":["// `docker logs --follow` as an Effect Stream.\n//\n// Architecture invariant: per-line `Stream<string, …>` so consumers\n// can filter / promote levels / dedupe followers across hot-restart\n// cycles via the L1 per-line sink.\n//\n// We DON'T solve the process-global follower-dedupe problem here; the\n// supervisor's per-container-key registry is where dedupe lives.\n// This stream is the raw substrate.\n\nimport { Effect, Stream } from 'effect';\n\nimport { splitUtf8Lines } from '../../substrate/runtime/observability/process-lines.ts';\nimport { DockerHost, DockerSpawner } from './client.ts';\nimport { DaemonUnreachable, type DockerRuntimeError } from './errors.ts';\nimport { dockerCommand } from './client.ts';\n\nexport interface FollowLogsOptions {\n\treadonly since?: string;\n\treadonly tail?: number;\n}\n\n/** `docker logs --follow --timestamps <id>` projected to a per-line\n *  Stream. Combined stdout+stderr (docker writes both to the same\n *  follow stream).\n *\n *  IMPORTANT: the stream completes when the container exits (docker\n *  closes the pipe). Consumers that want to re-follow after a restart\n *  must re-call this. */\nexport const followLogs = (\n\tcontainerNameOrId: string,\n\topts: FollowLogsOptions = {},\n): Stream.Stream<string, DockerRuntimeError, DockerHost | DockerSpawner> => {\n\tconst args: Array<string> = ['--follow', '--timestamps'];\n\tif (opts.since !== undefined) args.push('--since', opts.since);\n\tif (opts.tail !== undefined) args.push('--tail', String(opts.tail));\n\targs.push(containerNameOrId);\n\tconst mapSpawnError = (cause: unknown): DockerRuntimeError =>\n\t\tnew DaemonUnreachable({ op: 'docker.logs', detail: 'logs follow stream failed', cause });\n\treturn Stream.unwrap(\n\t\tEffect.gen(function* () {\n\t\t\tconst host = yield* DockerHost;\n\t\t\tconst spawner = yield* DockerSpawner;\n\t\t\tconst cmd = dockerCommand(host, 'logs', args);\n\t\t\tconst handle = yield* spawner.spawn(cmd).pipe(Effect.mapError(mapSpawnError));\n\t\t\t// Merge stdout + stderr so caller sees the unified follow stream;\n\t\t\t// docker prefixes each line with its source via --timestamps.\n\t\t\tconst lineStream = splitUtf8Lines(Stream.merge(handle.stdout, handle.stderr)).pipe(\n\t\t\t\tStream.mapError(mapSpawnError),\n\t\t\t);\n\t\t\treturn lineStream;\n\t\t}),\n\t);\n};\n\n/** Best-effort log tail for error enrichment. Returns the last\n *  `tail` lines as a single string; on any failure returns empty. */\nexport const logTail = (\n\tcontainerNameOrId: string,\n\ttail: number = 50,\n): Effect.Effect<string, never, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\tconst cmd = dockerCommand(host, 'logs', ['--tail', String(tail), containerNameOrId]);\n\t\tconst res = yield* Effect.scoped(\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst handle = yield* spawner.spawn(cmd);\n\t\t\t\tconst [out, err] = yield* Effect.all(\n\t\t\t\t\t[\n\t\t\t\t\t\tStream.mkString(Stream.decodeText(handle.stdout)),\n\t\t\t\t\t\tStream.mkString(Stream.decodeText(handle.stderr)),\n\t\t\t\t\t],\n\t\t\t\t\t{ concurrency: 'unbounded' },\n\t\t\t\t);\n\t\t\t\treturn `${out}\\n${err}`.trim();\n\t\t\t}),\n\t\t).pipe(Effect.catch(() => Effect.succeed('')));\n\t\treturn res;\n\t}).pipe(Effect.withSpan('runtime.docker.logs.tail'));\n"],"mappings":";;;;;;;;;;;;AA6BA,MAAa,cACZ,mBACA,OAA0B,EAAE,KAC+C;CAC3E,MAAM,OAAsB,CAAC,YAAY,eAAe;AACxD,KAAI,KAAK,UAAU,KAAA,EAAW,MAAK,KAAK,WAAW,KAAK,MAAM;AAC9D,KAAI,KAAK,SAAS,KAAA,EAAW,MAAK,KAAK,UAAU,OAAO,KAAK,KAAK,CAAC;AACnE,MAAK,KAAK,kBAAkB;CAC5B,MAAM,iBAAiB,UACtB,IAAI,kBAAkB;EAAE,IAAI;EAAe,QAAQ;EAA6B;EAAO,CAAC;AACzF,QAAO,OAAO,OACb,OAAO,IAAI,aAAa;EACvB,MAAM,OAAO,OAAO;EACpB,MAAM,UAAU,OAAO;EACvB,MAAM,MAAM,cAAc,MAAM,QAAQ,KAAK;EAC7C,MAAM,SAAS,OAAO,QAAQ,MAAM,IAAI,CAAC,KAAK,OAAO,SAAS,cAAc,CAAC;AAM7E,SAHmB,eAAe,OAAO,MAAM,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC,KAC7E,OAAO,SAAS,cAAc,CAEd;GAChB,CACF"}

package/dist/runtime/docker/network.d.mts

@@ -0,0 +1 @@
+import { Effect } from "effect";

package/dist/runtime/docker/network.mjs

@@ -0,0 +1,168 @@
+import { decodeJsonArrayElementSync } from "../../substrate/runtime/runtime-decode.mjs";
+import { dockerRun, dockerRunOk } from "./client.mjs";
+import { DaemonUnreachable, DockerInspectDecodeFailed, DockerInspectFailed, ForeignDockerResource, NetworkIpReadbackTimeout, NetworkOperationFailed } from "./errors.mjs";
+import { expectedNetworkOwnershipLabels, ownershipMismatchDetail, renderNetworkLabels } from "./labels.mjs";
+import { ProbeTimeoutError, waitForProbe } from "../../substrate/runtime/probes.mjs";
+import { isAlreadyInNetworkStderr, isDaemonUnreachableStderr, wrapNetworkError } from "./wrap.mjs";
+import { Effect, Schema } from "effect";
+//#region src/runtime/docker/network.ts
+const readLabels = (raw) => {
+	if (raw === null || typeof raw !== "object") return {};
+	const out = {};
+	for (const [key, value] of Object.entries(raw)) if (typeof value === "string") out[key] = value;
+	return out;
+};
+const NetworkInspectSchema = Schema.Struct({
+	Id: Schema.String,
+	Labels: Schema.optional(Schema.Unknown)
+});
+const isNoSuchNetworkStderr = (stderr) => /no such network|network .* not found|not found/i.test(stderr);
+const inspectNetwork = (name) => Effect.gen(function* () {
+	const res = yield* dockerRunOk("network", ["inspect", name]).pipe(Effect.mapError(wrapNetworkError("inspect", name)));
+	if (res.exitCode !== 0) {
+		if (isNoSuchNetworkStderr(res.stderr)) return null;
+		if (isDaemonUnreachableStderr(res.stderr)) return yield* Effect.fail(new DaemonUnreachable({
+			op: "docker.network.inspect",
+			detail: "docker daemon unreachable"
+		}));
+		return yield* Effect.fail(new DockerInspectFailed({
+			resource: "network",
+			name,
+			stderr: res.stderr,
+			exitCode: res.exitCode
+		}));
+	}
+	try {
+		const decoded = decodeJsonArrayElementSync(NetworkInspectSchema, res.stdout, {
+			source: `docker network inspect ${name}`,
+			missingMessage: "inspect returned an empty result",
+			mkError: (issue) => new DockerInspectDecodeFailed({
+				resource: "network",
+				name,
+				detail: issue.message === "inspect returned an empty result" ? issue.message : "inspect returned malformed network JSON",
+				cause: issue.cause
+			})
+		});
+		return {
+			id: decoded.Id,
+			labels: readLabels(decoded.Labels)
+		};
+	} catch (cause) {
+		return yield* Effect.fail(cause);
+	}
+});
+const assertNetworkOwned = (name, facts, opts) => Effect.gen(function* () {
+	const expected = expectedNetworkOwnershipLabels(opts.app, opts.stack);
+	const mismatch = ownershipMismatchDetail(expected, facts.labels);
+	if (mismatch !== null) return yield* Effect.fail(new ForeignDockerResource({
+		resource: "network",
+		name,
+		expected,
+		actual: facts.labels,
+		detail: mismatch
+	}));
+});
+/** Idempotent `docker network create`. Returns the network's id (or
+*  the pre-existing id). Architecture: NO scope finalizer — networks
+*  outlive the supervisor. */
+const ensureNetwork = (name, opts) => Effect.gen(function* () {
+	const probe = yield* inspectNetwork(name);
+	if (probe !== null) {
+		yield* assertNetworkOwned(name, probe, opts);
+		return probe.id;
+	}
+	const labelArgs = renderNetworkLabels(name, opts.app, opts.stack, { composeUi: opts.composeUi }).flatMap((l) => ["--label", l]);
+	const driverArgs = opts.driver ? ["--driver", opts.driver] : [];
+	const subnetArgs = opts.subnet ? ["--subnet", opts.subnet] : [];
+	const gatewayArgs = opts.gateway ? ["--gateway", opts.gateway] : [];
+	return (yield* dockerRun("network", [
+		"create",
+		...driverArgs,
+		...subnetArgs,
+		...gatewayArgs,
+		...labelArgs,
+		name
+	]).pipe(Effect.mapError(wrapNetworkError("create", name)))).stdout.trim();
+}).pipe(Effect.withSpan("runtime.docker.network.ensure"));
+/** Idempotent `docker network connect`. Treats "already exists in
+*  network" stderr as success — architecture mandates idempotency on
+*  this verb. */
+const connect = (containerNameOrId, network, alias) => Effect.gen(function* () {
+	const res = yield* dockerRunOk("network", [
+		"connect",
+		...alias ? ["--alias", alias] : [],
+		network,
+		containerNameOrId
+	]).pipe(Effect.mapError(wrapNetworkError("connect", network)));
+	if (res.exitCode === 0) return;
+	if (isAlreadyInNetworkStderr(res.stderr)) return;
+	return yield* Effect.fail(new NetworkOperationFailed({
+		op: "connect",
+		network,
+		stderr: res.stderr
+	}));
+}).pipe(Effect.withSpan("runtime.docker.network.connect"));
+/** Schema of the small JSON slice of `docker inspect` we read for the
+*  network-membership / IP shape. */
+const InspectNetworkSettings = Schema.Struct({ NetworkSettings: Schema.Struct({ Networks: Schema.Record(Schema.String, Schema.Struct({
+	IPAddress: Schema.optional(Schema.String),
+	NetworkID: Schema.optional(Schema.String)
+})) }) });
+const DEFAULT_IP_POLL_BUDGET_MILLIS = 3e3;
+const DEFAULT_IP_POLL_INTERVAL_MILLIS = 100;
+/** Poll `docker inspect` until the container has a non-empty IP on
+*  `network`. Architecture §5 — async network-connect settle. */
+const waitForIp = (containerNameOrId, network, opts = {}) => {
+	const budget = opts.budgetMillis ?? DEFAULT_IP_POLL_BUDGET_MILLIS;
+	const interval = opts.intervalMillis ?? DEFAULT_IP_POLL_INTERVAL_MILLIS;
+	const start = Date.now();
+	let foundIp;
+	return waitForProbe({
+		label: `docker.network.ip:${containerNameOrId}:${network}`,
+		timeoutMs: budget,
+		intervalMs: interval,
+		isRetryableError: () => false,
+		probe: () => Effect.gen(function* () {
+			const res = yield* dockerRunOk("inspect", [containerNameOrId]).pipe(Effect.mapError(wrapNetworkError("inspect", network)));
+			if (res.exitCode === 0) try {
+				const ip = decodeJsonArrayElementSync(InspectNetworkSettings, res.stdout, {
+					source: `docker inspect ${containerNameOrId}`,
+					mkError: (issue) => issue
+				}).NetworkSettings.Networks[network]?.IPAddress;
+				if (ip && ip.length > 0) {
+					foundIp = ip;
+					return true;
+				}
+			} catch {}
+			return false;
+		})
+	}).pipe(Effect.map(() => foundIp ?? ""), Effect.mapError((cause) => {
+		if (cause instanceof ProbeTimeoutError) return new NetworkIpReadbackTimeout({
+			container: containerNameOrId,
+			network,
+			waitedMillis: Date.now() - start
+		});
+		return cause;
+	}), Effect.withSpan("runtime.docker.network.waitForIp"));
+};
+/** Read out ALL networks + IPs for a container. Used by the contract's
+*  `ContainerHandle.ips`. */
+const readIps = (containerNameOrId) => Effect.gen(function* () {
+	const res = yield* dockerRunOk("inspect", [containerNameOrId]).pipe(Effect.mapError(wrapNetworkError("inspect", containerNameOrId)));
+	if (res.exitCode !== 0) return [];
+	try {
+		const decoded = decodeJsonArrayElementSync(InspectNetworkSettings, res.stdout, {
+			source: `docker inspect ${containerNameOrId}`,
+			mkError: (issue) => issue
+		});
+		const ips = [];
+		for (const slot of Object.values(decoded.NetworkSettings.Networks)) if (slot.IPAddress && slot.IPAddress.length > 0) ips.push(slot.IPAddress);
+		return ips;
+	} catch {
+		return [];
+	}
+}).pipe(Effect.withSpan("runtime.docker.network.readIps"));
+//#endregion
+export { connect, ensureNetwork, readIps, waitForIp };
+
+//# sourceMappingURL=network.mjs.map

package/dist/runtime/docker/network.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.mjs","names":[],"sources":["../../../src/runtime/docker/network.ts"],"sourcesContent":["// Docker network lifecycle.\n//\n// Architecture § Docker backend § Networking:\n//   - ONE shared `devstack` network per host (cross-stack). Other\n//     per-stack secondary networks are allowed by callers, but the\n//     default surface assumes the shared bridge.\n//   - `network connect` is idempotent — \"already exists in network\"\n//     stderr is success (see `wrap.ts` classifier).\n//   - `network connect` settle is ASYNCHRONOUS in docker — the\n//     endpoint is registered before the IP is allocated. Callers must\n//     wait for IP readback (see §5 and `waitForIp`).\n//   - `network create` registers NO finalizer; the network outlives\n//     individual stacks so resume into a stopped container reattaches\n//     to the same bridge id. Cleanup is via `wipe` / `prune`.\n//\n// Surface:\n//   - `ensureNetwork(name, opts)` — idempotent create\n//   - `connect(container, network, alias?)` — idempotent attach\n//   - `disconnect(container, network)` — idempotent detach\n//   - `waitForIp(container, network, opts)` — bounded poll for IP\n\nimport { Effect, Schema } from 'effect';\n\nimport { DockerHost, DockerSpawner, dockerRun, dockerRunOk } from './client.ts';\nimport { ProbeTimeoutError, waitForProbe } from '../../substrate/runtime/probes.ts';\nimport { decodeJsonArrayElementSync } from '../../substrate/runtime/runtime-decode.ts';\nimport {\n\tDockerInspectDecodeFailed,\n\tDockerInspectFailed,\n\tDaemonUnreachable,\n\ttype DockerRuntimeError,\n\tForeignDockerResource,\n\tNetworkIpReadbackTimeout,\n\tNetworkOperationFailed,\n} from './errors.ts';\nimport {\n\texpectedNetworkOwnershipLabels,\n\townershipMismatchDetail,\n\trenderNetworkLabels,\n} from './labels.ts';\nimport { isAlreadyInNetworkStderr, isDaemonUnreachableStderr, wrapNetworkError } from './wrap.ts';\n\n/** The cross-host shared network name. Architecture-mandated single\n *  bridge per host. Callers can target other networks (per-stack) but\n *  this is the constant for the shared one. */\nexport const SHARED_NETWORK_NAME = 'devstack';\n\nexport interface EnsureNetworkOptions {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly subnet?: string;\n\treadonly gateway?: string;\n\treadonly driver?: 'bridge' | 'host' | 'overlay';\n\treadonly composeUi?: boolean;\n}\n\ninterface NetworkInspectFacts {\n\treadonly id: string;\n\treadonly labels: Readonly<Record<string, string>>;\n}\n\nconst readLabels = (raw: unknown): Readonly<Record<string, string>> => {\n\tif (raw === null || typeof raw !== 'object') return {};\n\tconst out: Record<string, string> = {};\n\tfor (const [key, value] of Object.entries(raw)) {\n\t\tif (typeof value === 'string') out[key] = value;\n\t}\n\treturn out;\n};\n\nconst NetworkInspectSchema = Schema.Struct({\n\tId: Schema.String,\n\tLabels: Schema.optional(Schema.Unknown),\n});\n\nconst isNoSuchNetworkStderr = (stderr: string): boolean =>\n\t/no such network|network .* not found|not found/i.test(stderr);\n\nconst inspectNetwork = (\n\tname: string,\n): Effect.Effect<NetworkInspectFacts | null, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst res = yield* dockerRunOk('network', ['inspect', name]).pipe(\n\t\t\tEffect.mapError(wrapNetworkError('inspect', name)),\n\t\t);\n\t\tif (res.exitCode !== 0) {\n\t\t\tif (isNoSuchNetworkStderr(res.stderr)) return null;\n\t\t\tif (isDaemonUnreachableStderr(res.stderr)) {\n\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\tnew DaemonUnreachable({\n\t\t\t\t\t\top: 'docker.network.inspect',\n\t\t\t\t\t\tdetail: 'docker daemon unreachable',\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew DockerInspectFailed({\n\t\t\t\t\tresource: 'network',\n\t\t\t\t\tname,\n\t\t\t\t\tstderr: res.stderr,\n\t\t\t\t\texitCode: res.exitCode,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\ttry {\n\t\t\tconst decoded = decodeJsonArrayElementSync(NetworkInspectSchema, res.stdout, {\n\t\t\t\tsource: `docker network inspect ${name}`,\n\t\t\t\tmissingMessage: 'inspect returned an empty result',\n\t\t\t\tmkError: (issue) =>\n\t\t\t\t\tnew DockerInspectDecodeFailed({\n\t\t\t\t\t\tresource: 'network',\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tdetail:\n\t\t\t\t\t\t\tissue.message === 'inspect returned an empty result'\n\t\t\t\t\t\t\t\t? issue.message\n\t\t\t\t\t\t\t\t: 'inspect returned malformed network JSON',\n\t\t\t\t\t\tcause: issue.cause,\n\t\t\t\t\t}),\n\t\t\t});\n\t\t\treturn { id: decoded.Id, labels: readLabels(decoded.Labels) };\n\t\t} catch (cause) {\n\t\t\treturn yield* Effect.fail(cause as DockerRuntimeError);\n\t\t}\n\t});\n\nconst assertNetworkOwned = (\n\tname: string,\n\tfacts: NetworkInspectFacts,\n\topts: EnsureNetworkOptions,\n): Effect.Effect<void, DockerRuntimeError> =>\n\tEffect.gen(function* () {\n\t\tconst expected = expectedNetworkOwnershipLabels(opts.app, opts.stack);\n\t\tconst mismatch = ownershipMismatchDetail(expected, facts.labels);\n\t\tif (mismatch !== null) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew ForeignDockerResource({\n\t\t\t\t\tresource: 'network',\n\t\t\t\t\tname,\n\t\t\t\t\texpected,\n\t\t\t\t\tactual: facts.labels,\n\t\t\t\t\tdetail: mismatch,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t});\n\n// -----------------------------------------------------------------------------\n// Create / inspect\n// -----------------------------------------------------------------------------\n\n/** Idempotent `docker network create`. Returns the network's id (or\n *  the pre-existing id). Architecture: NO scope finalizer — networks\n *  outlive the supervisor. */\nexport const ensureNetwork = (\n\tname: string,\n\topts: EnsureNetworkOptions,\n): Effect.Effect<string, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst probe = yield* inspectNetwork(name);\n\t\tif (probe !== null) {\n\t\t\tyield* assertNetworkOwned(name, probe, opts);\n\t\t\treturn probe.id;\n\t\t}\n\t\t// Create with full label stamp.\n\t\tconst labelArgs = renderNetworkLabels(name, opts.app, opts.stack, {\n\t\t\tcomposeUi: opts.composeUi,\n\t\t}).flatMap((l) => ['--label', l]);\n\t\tconst driverArgs = opts.driver ? ['--driver', opts.driver] : [];\n\t\tconst subnetArgs = opts.subnet ? ['--subnet', opts.subnet] : [];\n\t\tconst gatewayArgs = opts.gateway ? ['--gateway', opts.gateway] : [];\n\t\tconst created = yield* dockerRun('network', [\n\t\t\t'create',\n\t\t\t...driverArgs,\n\t\t\t...subnetArgs,\n\t\t\t...gatewayArgs,\n\t\t\t...labelArgs,\n\t\t\tname,\n\t\t]).pipe(Effect.mapError(wrapNetworkError('create', name)));\n\t\treturn created.stdout.trim();\n\t}).pipe(Effect.withSpan('runtime.docker.network.ensure'));\n\n// -----------------------------------------------------------------------------\n// Connect / disconnect\n// -----------------------------------------------------------------------------\n\n/** Idempotent `docker network connect`. Treats \"already exists in\n *  network\" stderr as success — architecture mandates idempotency on\n *  this verb. */\nexport const connect = (\n\tcontainerNameOrId: string,\n\tnetwork: string,\n\talias?: string,\n): Effect.Effect<void, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst aliasArgs = alias ? ['--alias', alias] : [];\n\t\tconst res = yield* dockerRunOk('network', [\n\t\t\t'connect',\n\t\t\t...aliasArgs,\n\t\t\tnetwork,\n\t\t\tcontainerNameOrId,\n\t\t]).pipe(Effect.mapError(wrapNetworkError('connect', network)));\n\t\tif (res.exitCode === 0) return;\n\t\tif (isAlreadyInNetworkStderr(res.stderr)) return;\n\t\t// Non-idempotent failure path.\n\t\treturn yield* Effect.fail(\n\t\t\tnew NetworkOperationFailed({ op: 'connect', network, stderr: res.stderr }),\n\t\t);\n\t}).pipe(Effect.withSpan('runtime.docker.network.connect'));\n\nexport const disconnect = (\n\tcontainerNameOrId: string,\n\tnetwork: string,\n): Effect.Effect<void, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst res = yield* dockerRunOk('network', ['disconnect', network, containerNameOrId]).pipe(\n\t\t\tEffect.mapError(wrapNetworkError('disconnect', network)),\n\t\t);\n\t\t// \"is not connected\" is also idempotent success on the\n\t\t// disconnect side; we treat any non-fatal stderr as success here\n\t\t// since the postcondition (not connected) holds.\n\t\tif (res.exitCode !== 0 && !/is not connected/i.test(res.stderr)) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew NetworkOperationFailed({ op: 'disconnect', network, stderr: res.stderr }),\n\t\t\t);\n\t\t}\n\t}).pipe(Effect.withSpan('runtime.docker.network.disconnect'));\n\n// -----------------------------------------------------------------------------\n// IP readback\n// -----------------------------------------------------------------------------\n\n/** Schema of the small JSON slice of `docker inspect` we read for the\n *  network-membership / IP shape. */\nconst InspectNetworkSettings = Schema.Struct({\n\tNetworkSettings: Schema.Struct({\n\t\tNetworks: Schema.Record(\n\t\t\tSchema.String,\n\t\t\tSchema.Struct({\n\t\t\t\tIPAddress: Schema.optional(Schema.String),\n\t\t\t\tNetworkID: Schema.optional(Schema.String),\n\t\t\t}),\n\t\t),\n\t}),\n});\n\nconst DEFAULT_IP_POLL_BUDGET_MILLIS = 3_000;\nconst DEFAULT_IP_POLL_INTERVAL_MILLIS = 100;\n\nexport interface WaitForIpOptions {\n\treadonly budgetMillis?: number;\n\treadonly intervalMillis?: number;\n}\n\n/** Poll `docker inspect` until the container has a non-empty IP on\n *  `network`. Architecture §5 — async network-connect settle. */\nexport const waitForIp = (\n\tcontainerNameOrId: string,\n\tnetwork: string,\n\topts: WaitForIpOptions = {},\n): Effect.Effect<string, DockerRuntimeError, DockerHost | DockerSpawner> => {\n\tconst budget = opts.budgetMillis ?? DEFAULT_IP_POLL_BUDGET_MILLIS;\n\tconst interval = opts.intervalMillis ?? DEFAULT_IP_POLL_INTERVAL_MILLIS;\n\tconst start = Date.now();\n\tlet foundIp: string | undefined;\n\treturn waitForProbe({\n\t\tlabel: `docker.network.ip:${containerNameOrId}:${network}`,\n\t\ttimeoutMs: budget,\n\t\tintervalMs: interval,\n\t\tisRetryableError: () => false,\n\t\tprobe: () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst res = yield* dockerRunOk('inspect', [containerNameOrId]).pipe(\n\t\t\t\t\tEffect.mapError(wrapNetworkError('inspect', network)),\n\t\t\t\t);\n\t\t\t\tif (res.exitCode === 0) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst decoded = decodeJsonArrayElementSync(InspectNetworkSettings, res.stdout, {\n\t\t\t\t\t\t\tsource: `docker inspect ${containerNameOrId}`,\n\t\t\t\t\t\t\tmkError: (issue) => issue,\n\t\t\t\t\t\t});\n\t\t\t\t\t\tconst slot = decoded.NetworkSettings.Networks[network];\n\t\t\t\t\t\tconst ip = slot?.IPAddress;\n\t\t\t\t\t\tif (ip && ip.length > 0) {\n\t\t\t\t\t\t\tfoundIp = ip;\n\t\t\t\t\t\t\treturn true;\n\t\t\t\t\t\t}\n\t\t\t\t\t} catch {\n\t\t\t\t\t\t// Malformed — fall through to retry.\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn false;\n\t\t\t}),\n\t}).pipe(\n\t\tEffect.map(() => foundIp ?? ''),\n\t\tEffect.mapError((cause) => {\n\t\t\tif (cause instanceof ProbeTimeoutError) {\n\t\t\t\treturn new NetworkIpReadbackTimeout({\n\t\t\t\t\tcontainer: containerNameOrId,\n\t\t\t\t\tnetwork,\n\t\t\t\t\twaitedMillis: Date.now() - start,\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn cause;\n\t\t}),\n\t\tEffect.withSpan('runtime.docker.network.waitForIp'),\n\t);\n};\n\n/** Read out ALL networks + IPs for a container. Used by the contract's\n *  `ContainerHandle.ips`. */\nexport const readIps = (\n\tcontainerNameOrId: string,\n): Effect.Effect<ReadonlyArray<string>, DockerRuntimeError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst res = yield* dockerRunOk('inspect', [containerNameOrId]).pipe(\n\t\t\tEffect.mapError(wrapNetworkError('inspect', containerNameOrId)),\n\t\t);\n\t\tif (res.exitCode !== 0) return [];\n\t\ttry {\n\t\t\tconst decoded = decodeJsonArrayElementSync(InspectNetworkSettings, res.stdout, {\n\t\t\t\tsource: `docker inspect ${containerNameOrId}`,\n\t\t\t\tmkError: (issue) => issue,\n\t\t\t});\n\t\t\tconst ips: Array<string> = [];\n\t\t\tfor (const slot of Object.values(decoded.NetworkSettings.Networks)) {\n\t\t\t\tif (slot.IPAddress && slot.IPAddress.length > 0) ips.push(slot.IPAddress);\n\t\t\t}\n\t\t\treturn ips;\n\t\t} catch {\n\t\t\treturn [];\n\t\t}\n\t}).pipe(Effect.withSpan('runtime.docker.network.readIps'));\n"],"mappings":";;;;;;;;AA6DA,MAAM,cAAc,QAAmD;AACtE,KAAI,QAAQ,QAAQ,OAAO,QAAQ,SAAU,QAAO,EAAE;CACtD,MAAM,MAA8B,EAAE;AACtC,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,CAC7C,KAAI,OAAO,UAAU,SAAU,KAAI,OAAO;AAE3C,QAAO;;AAGR,MAAM,uBAAuB,OAAO,OAAO;CAC1C,IAAI,OAAO;CACX,QAAQ,OAAO,SAAS,OAAO,QAAQ;CACvC,CAAC;AAEF,MAAM,yBAAyB,WAC9B,kDAAkD,KAAK,OAAO;AAE/D,MAAM,kBACL,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAM,OAAO,YAAY,WAAW,CAAC,WAAW,KAAK,CAAC,CAAC,KAC5D,OAAO,SAAS,iBAAiB,WAAW,KAAK,CAAC,CAClD;AACD,KAAI,IAAI,aAAa,GAAG;AACvB,MAAI,sBAAsB,IAAI,OAAO,CAAE,QAAO;AAC9C,MAAI,0BAA0B,IAAI,OAAO,CACxC,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;GACrB,IAAI;GACJ,QAAQ;GACR,CAAC,CACF;AAEF,SAAO,OAAO,OAAO,KACpB,IAAI,oBAAoB;GACvB,UAAU;GACV;GACA,QAAQ,IAAI;GACZ,UAAU,IAAI;GACd,CAAC,CACF;;AAEF,KAAI;EACH,MAAM,UAAU,2BAA2B,sBAAsB,IAAI,QAAQ;GAC5E,QAAQ,0BAA0B;GAClC,gBAAgB;GAChB,UAAU,UACT,IAAI,0BAA0B;IAC7B,UAAU;IACV;IACA,QACC,MAAM,YAAY,qCACf,MAAM,UACN;IACJ,OAAO,MAAM;IACb,CAAC;GACH,CAAC;AACF,SAAO;GAAE,IAAI,QAAQ;GAAI,QAAQ,WAAW,QAAQ,OAAO;GAAE;UACrD,OAAO;AACf,SAAO,OAAO,OAAO,KAAK,MAA4B;;EAEtD;AAEH,MAAM,sBACL,MACA,OACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,+BAA+B,KAAK,KAAK,KAAK,MAAM;CACrE,MAAM,WAAW,wBAAwB,UAAU,MAAM,OAAO;AAChE,KAAI,aAAa,KAChB,QAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,UAAU;EACV;EACA;EACA,QAAQ,MAAM;EACd,QAAQ;EACR,CAAC,CACF;EAED;;;;AASH,MAAa,iBACZ,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,KAAI,UAAU,MAAM;AACnB,SAAO,mBAAmB,MAAM,OAAO,KAAK;AAC5C,SAAO,MAAM;;CAGd,MAAM,YAAY,oBAAoB,MAAM,KAAK,KAAK,KAAK,OAAO,EACjE,WAAW,KAAK,WAChB,CAAC,CAAC,SAAS,MAAM,CAAC,WAAW,EAAE,CAAC;CACjC,MAAM,aAAa,KAAK,SAAS,CAAC,YAAY,KAAK,OAAO,GAAG,EAAE;CAC/D,MAAM,aAAa,KAAK,SAAS,CAAC,YAAY,KAAK,OAAO,GAAG,EAAE;CAC/D,MAAM,cAAc,KAAK,UAAU,CAAC,aAAa,KAAK,QAAQ,GAAG,EAAE;AASnE,SAAO,OARgB,UAAU,WAAW;EAC3C;EACA,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH;EACA,CAAC,CAAC,KAAK,OAAO,SAAS,iBAAiB,UAAU,KAAK,CAAC,CAAC,EAC3C,OAAO,MAAM;EAC3B,CAAC,KAAK,OAAO,SAAS,gCAAgC,CAAC;;;;AAS1D,MAAa,WACZ,mBACA,SACA,UAEA,OAAO,IAAI,aAAa;CAEvB,MAAM,MAAM,OAAO,YAAY,WAAW;EACzC;EACA,GAHiB,QAAQ,CAAC,WAAW,MAAM,GAAG,EAAE;EAIhD;EACA;EACA,CAAC,CAAC,KAAK,OAAO,SAAS,iBAAiB,WAAW,QAAQ,CAAC,CAAC;AAC9D,KAAI,IAAI,aAAa,EAAG;AACxB,KAAI,yBAAyB,IAAI,OAAO,CAAE;AAE1C,QAAO,OAAO,OAAO,KACpB,IAAI,uBAAuB;EAAE,IAAI;EAAW;EAAS,QAAQ,IAAI;EAAQ,CAAC,CAC1E;EACA,CAAC,KAAK,OAAO,SAAS,iCAAiC,CAAC;;;AA0B3D,MAAM,yBAAyB,OAAO,OAAO,EAC5C,iBAAiB,OAAO,OAAO,EAC9B,UAAU,OAAO,OAChB,OAAO,QACP,OAAO,OAAO;CACb,WAAW,OAAO,SAAS,OAAO,OAAO;CACzC,WAAW,OAAO,SAAS,OAAO,OAAO;CACzC,CAAC,CACF,EACD,CAAC,EACF,CAAC;AAEF,MAAM,gCAAgC;AACtC,MAAM,kCAAkC;;;AASxC,MAAa,aACZ,mBACA,SACA,OAAyB,EAAE,KACgD;CAC3E,MAAM,SAAS,KAAK,gBAAgB;CACpC,MAAM,WAAW,KAAK,kBAAkB;CACxC,MAAM,QAAQ,KAAK,KAAK;CACxB,IAAI;AACJ,QAAO,aAAa;EACnB,OAAO,qBAAqB,kBAAkB,GAAG;EACjD,WAAW;EACX,YAAY;EACZ,wBAAwB;EACxB,aACC,OAAO,IAAI,aAAa;GACvB,MAAM,MAAM,OAAO,YAAY,WAAW,CAAC,kBAAkB,CAAC,CAAC,KAC9D,OAAO,SAAS,iBAAiB,WAAW,QAAQ,CAAC,CACrD;AACD,OAAI,IAAI,aAAa,EACpB,KAAI;IAMH,MAAM,KALU,2BAA2B,wBAAwB,IAAI,QAAQ;KAC9E,QAAQ,kBAAkB;KAC1B,UAAU,UAAU;KACpB,CACmB,CAAC,gBAAgB,SAAS,UAC7B;AACjB,QAAI,MAAM,GAAG,SAAS,GAAG;AACxB,eAAU;AACV,YAAO;;WAED;AAIT,UAAO;IACN;EACH,CAAC,CAAC,KACF,OAAO,UAAU,WAAW,GAAG,EAC/B,OAAO,UAAU,UAAU;AAC1B,MAAI,iBAAiB,kBACpB,QAAO,IAAI,yBAAyB;GACnC,WAAW;GACX;GACA,cAAc,KAAK,KAAK,GAAG;GAC3B,CAAC;AAEH,SAAO;GACN,EACF,OAAO,SAAS,mCAAmC,CACnD;;;;AAKF,MAAa,WACZ,sBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,MAAM,OAAO,YAAY,WAAW,CAAC,kBAAkB,CAAC,CAAC,KAC9D,OAAO,SAAS,iBAAiB,WAAW,kBAAkB,CAAC,CAC/D;AACD,KAAI,IAAI,aAAa,EAAG,QAAO,EAAE;AACjC,KAAI;EACH,MAAM,UAAU,2BAA2B,wBAAwB,IAAI,QAAQ;GAC9E,QAAQ,kBAAkB;GAC1B,UAAU,UAAU;GACpB,CAAC;EACF,MAAM,MAAqB,EAAE;AAC7B,OAAK,MAAM,QAAQ,OAAO,OAAO,QAAQ,gBAAgB,SAAS,CACjE,KAAI,KAAK,aAAa,KAAK,UAAU,SAAS,EAAG,KAAI,KAAK,KAAK,UAAU;AAE1E,SAAO;SACA;AACP,SAAO,EAAE;;EAET,CAAC,KAAK,OAAO,SAAS,iCAAiC,CAAC"}

package/dist/runtime/docker/service.d.mts

@@ -0,0 +1,9 @@
+import { ContainerRuntime } from "../../contracts/container-runtime.mjs";
+import { Context, Layer, Ref } from "effect";
+
+//#region src/runtime/docker/service.d.ts
+declare const ContainerRuntimeService_base: Context.ServiceClass<ContainerRuntimeService, "@devstack-rewrite/runtime-docker/ContainerRuntime", ContainerRuntime>;
+declare class ContainerRuntimeService extends ContainerRuntimeService_base {}
+//#endregion
+export { ContainerRuntimeService };
+//# sourceMappingURL=service.d.mts.map

package/dist/runtime/docker/service.mjs

@@ -0,0 +1,266 @@
+import { StackPathsService } from "../../substrate/runtime/paths.mjs";
+import { chainId, contentHash } from "../../substrate/brand.mjs";
+import { CacheService } from "../../substrate/runtime/cache/service.mjs";
+import { DockerHost, DockerSpawner, dockerRunOk } from "./client.mjs";
+import { toContractError } from "./errors.mjs";
+import { ensureNetwork } from "./network.mjs";
+import { assertContainerHandleOwned, commit, ensureContainer, inspectContainer, pause, stop, unpause } from "./container.mjs";
+import { dockerExec, dockerRunOneShot } from "./exec.mjs";
+import { ensureImageCached, loadImage, pull, refOf, removeImage, saveImage, saveImages, tagImage } from "./image.mjs";
+import { listContainers } from "./inventory.mjs";
+import { followLogs } from "./logs.mjs";
+import { removeManagedContainers, removeManagedImages, removeManagedNetworks, removeManagedVolumes, sweepOrphans } from "./sweep.mjs";
+import { Context, Duration, Effect, Layer, Ref, Stream } from "effect";
+import { createHash, randomUUID } from "node:crypto";
+import { lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+//#region src/runtime/docker/service.ts
+var ContainerRuntimeService = class extends Context.Service()("@devstack-rewrite/runtime-docker/ContainerRuntime") {};
+var DockerCycle = class extends Context.Service()("@devstack-rewrite/runtime-docker/Cycle") {};
+const layerDockerCycleInitial = Layer.effect(DockerCycle, Effect.gen(function* () {
+	return yield* Ref.make(0);
+}));
+const mapToContractError = (eff) => eff.pipe(Effect.mapError(toContractError));
+const snapshotTempTag = (containerName) => {
+	return `devstack-snapshot:${containerName.replace(/[^A-Za-z0-9_.-]/g, "-")}-${randomUUID().replace(/-/g, "").slice(0, 12)}`;
+};
+const stableRelativePath = (root, path) => {
+	const rel = relative(root, path);
+	return rel.length === 0 ? "." : rel.split(sep).join("/");
+};
+const updateContextEntryHash = (hash, root, path) => {
+	const stat = lstatSync(path);
+	const rel = stableRelativePath(root, path);
+	if (stat.isDirectory()) {
+		hash.update("dir\0");
+		hash.update(rel);
+		hash.update("\0");
+		for (const child of readdirSync(path).sort((a, b) => a.localeCompare(b))) updateContextEntryHash(hash, root, join(path, child));
+		return;
+	}
+	if (stat.isFile()) {
+		hash.update("file\0");
+		hash.update(rel);
+		hash.update("\0");
+		hash.update(String(stat.mode));
+		hash.update("\0");
+		hash.update(readFileSync(path));
+		hash.update("\0");
+		return;
+	}
+	if (stat.isSymbolicLink()) {
+		hash.update("symlink\0");
+		hash.update(rel);
+		hash.update("\0");
+		hash.update(readlinkSync(path));
+		hash.update("\0");
+		return;
+	}
+	hash.update("other\0");
+	hash.update(rel);
+	hash.update("\0");
+	hash.update(String(stat.mode));
+	hash.update("\0");
+};
+const normalizeFingerprintPath = (path) => path.split(/[\\/]+/g).filter((part) => part.length > 0).join("/");
+const normalizeFingerprintPaths = (paths) => [...new Set((paths ?? []).map(normalizeFingerprintPath).filter((path) => path.length > 0))].sort((a, b) => a.localeCompare(b));
+const buildContextFingerprint = (contextPath, fingerprintPaths) => {
+	const hash = createHash("sha256");
+	const requestedPaths = normalizeFingerprintPaths(fingerprintPaths);
+	const paths = requestedPaths.length === 0 ? null : requestedPaths;
+	try {
+		if (paths === null) updateContextEntryHash(hash, contextPath, contextPath);
+		else for (const relPath of paths) {
+			hash.update("fingerprint-path\0");
+			hash.update(relPath);
+			hash.update("\0");
+			updateContextEntryHash(hash, contextPath, join(contextPath, relPath));
+		}
+	} catch (err) {
+		hash.update("unreadable\0");
+		hash.update(String(err));
+		hash.update("\0");
+	}
+	return hash.digest("hex");
+};
+/** Stable content hash for the build context. Sorts build args so two
+*  equivalent specs whose key insertion order differs produce the same
+*  hash. The Docker build context's files are part of the key: changing
+*  a vendored entrypoint script must force a new managed image tag. */
+const buildContentHash = (ctx) => {
+	const dockerfile = ctx.dockerfile ?? "Dockerfile";
+	const argsKey = Object.entries(ctx.buildArgs ?? {}).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}=${v}`).join("\0");
+	const platform = ctx.platform ?? "";
+	const fingerprintPathsKey = normalizeFingerprintPaths(ctx.fingerprintPaths).join("\0");
+	return createHash("sha256").update(ctx.contextPath).update("\0").update(dockerfile).update("\0").update(platform).update("\0").update(argsKey).update("\0").update(fingerprintPathsKey).update("\0").update(buildContextFingerprint(ctx.contextPath, ctx.fingerprintPaths)).digest("hex");
+};
+const DOCKER_ARCH_ALIASES = {
+	aarch64: "arm64",
+	arm64: "arm64",
+	x86_64: "amd64",
+	amd64: "amd64"
+};
+const normalizeDockerInfoPlatform = (raw) => {
+	const trimmed = raw.trim();
+	const slash = trimmed.indexOf("/");
+	if (slash <= 0 || slash === trimmed.length - 1) return null;
+	const os = trimmed.slice(0, slash);
+	const arch = trimmed.slice(slash + 1);
+	return `${os}/${DOCKER_ARCH_ALIASES[arch] ?? arch}`;
+};
+const inferDockerBuildPlatform = () => dockerRunOk("info", ["--format", "{{.OSType}}/{{.Architecture}}"]).pipe(Effect.map((result) => result.exitCode === 0 ? normalizeDockerInfoPlatform(result.stdout) : null), Effect.catch(() => Effect.succeed(null)));
+const layerContainerRuntimeDocker = Layer.effect(ContainerRuntimeService, Effect.gen(function* () {
+	const cycleRef = yield* DockerCycle;
+	const dockerHost = yield* DockerHost;
+	const dockerSpawner = yield* DockerSpawner;
+	const stackPaths = yield* StackPathsService;
+	const cache = yield* CacheService;
+	const baseCtx = Context.empty().pipe(Context.add(DockerHost, dockerHost), Context.add(DockerSpawner, dockerSpawner), Context.add(StackPathsService, stackPaths), Context.add(CacheService, cache));
+	const perNameLock = yield* Ref.make(/* @__PURE__ */ new Map());
+	const ensureImage = (ctx, expected) => Effect.gen(function* () {
+		const inferredPlatform = ctx.platform === void 0 ? yield* inferDockerBuildPlatform().pipe(Effect.provide(baseCtx)) : null;
+		const effectiveCtx = ctx.platform === void 0 && inferredPlatform !== null ? {
+			...ctx,
+			platform: inferredPlatform
+		} : ctx;
+		const hash = buildContentHash(effectiveCtx);
+		const tag = expected?.tag ?? `devstack-build:${hash.slice(0, 16)}`;
+		return yield* ensureImageCached({
+			contextPath: effectiveCtx.contextPath,
+			dockerfile: effectiveCtx.dockerfile,
+			platform: effectiveCtx.platform,
+			buildArgs: effectiveCtx.buildArgs,
+			tag
+		}, {
+			namespace: "runtime-docker-build",
+			chain: chainId("n/a"),
+			contentHash: contentHash(hash)
+		}).pipe(Effect.map((digest) => refOf(digest, tag)), mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.ensureImage"));
+	});
+	const ensureNetworkContractImpl = (spec) => ensureNetwork(spec.name, {
+		app: spec.app,
+		stack: spec.stack,
+		...spec.subnet === void 0 ? {} : { subnet: spec.subnet },
+		...spec.gateway === void 0 ? {} : { gateway: spec.gateway }
+	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.ensureNetwork"));
+	const pullImageContractImpl = (ref) => pull(ref).pipe(Effect.map((digest) => refOf(digest, ref)), mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.pullImage"));
+	const ensureContainerImpl = (spec) => Effect.gen(function* () {
+		return yield* ensureContainer(spec, {
+			cycle: yield* Ref.get(cycleRef),
+			perNameLock
+		});
+	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.ensureContainer"));
+	const inspectByLabels = (labels) => Effect.gen(function* () {
+		const summaries = yield* listContainers(labels);
+		return yield* Effect.forEach(summaries, (s) => inspectContainer(s.name).pipe(Effect.map((facts) => ({
+			id: facts?.id ?? s.id,
+			name: s.name,
+			labels,
+			imageName: facts?.image ?? s.image,
+			status: facts?.paused ? "paused" : facts?.running ?? s.state === "running" ? "running" : s.state === "paused" ? "paused" : s.state === "created" ? "created" : "exited",
+			ips: [],
+			...facts?.ports !== void 0 ? { ports: facts.ports } : {}
+		}))), { concurrency: "unbounded" });
+	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.inspectByLabels"));
+	const followLogsImpl = (handle) => followLogs(handle.name).pipe(Stream.mapError(toContractError), Stream.provideContext(baseCtx));
+	const pauseAndCommitImpl = (handle) => Effect.gen(function* () {
+		yield* assertContainerHandleOwned(handle);
+		if (handle.status === "running") {
+			yield* pause(handle.name);
+			yield* assertContainerHandleOwned(handle);
+		}
+		const tag = snapshotTempTag(handle.name);
+		return {
+			digest: yield* commit(handle.name, tag),
+			tag
+		};
+	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.pauseAndCommit"));
+	const pauseImpl = (handle) => Effect.gen(function* () {
+		yield* assertContainerHandleOwned(handle);
+		yield* pause(handle.name);
+	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.pause"));
+	const unpauseImpl = (handle) => Effect.gen(function* () {
+		yield* assertContainerHandleOwned(handle);
+		yield* unpause(handle.name);
+	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.unpause"));
+	const stopImpl = (handle, grace) => {
+		const seconds = Math.max(0, Math.ceil(Duration.toMillis(grace) / 1e3));
+		return Effect.gen(function* () {
+			yield* assertContainerHandleOwned(handle);
+			yield* stop(handle.name, seconds);
+		}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.stop"));
+	};
+	const sweepOrphansImpl = (labelMatch) => sweepOrphans(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.sweepOrphans"));
+	const removeManagedContainersImpl = (labelMatch) => removeManagedContainers(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeManagedContainers"));
+	const removeManagedImagesImpl = (labelMatch) => removeManagedImages(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeManagedImages"));
+	const removeManagedNetworksImpl = (labelMatch) => removeManagedNetworks(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeManagedNetworks"));
+	const removeManagedVolumesImpl = (labelMatch) => removeManagedVolumes(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeManagedVolumes"));
+	const execImpl = (handle, argv, opts) => Effect.gen(function* () {
+		yield* assertContainerHandleOwned(handle);
+		return yield* dockerExec(handle.name, argv, {
+			user: opts?.user,
+			env: opts?.env,
+			workdir: opts?.workdir
+		});
+	}).pipe(Effect.map((r) => ({
+		exitCode: r.exitCode,
+		stdout: r.stdout,
+		stderr: r.stderr
+	})), mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.exec"));
+	const saveImageImpl = (ref, opts) => {
+		return saveImage(ref.tag ?? ref.digest, opts).pipe(Stream.mapError(toContractError), Stream.provideContext(baseCtx));
+	};
+	const saveImagesImpl = (refs, opts) => {
+		return saveImages(refs.map((ref) => ref.tag ?? ref.digest), opts).pipe(Stream.mapError(toContractError), Stream.provideContext(baseCtx));
+	};
+	const loadImageContractImpl = (tar) => loadImage(tar).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.loadImage"));
+	const tagImageContractImpl = (src, newTag, opts) => {
+		return tagImage(src.tag ?? src.digest, newTag, opts).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.tagImage"));
+	};
+	const removeImageContractImpl = (ref) => {
+		return removeImage(ref.tag ?? ref.digest).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeImage"));
+	};
+	const runOneShotImpl = (spec) => dockerRunOneShot({
+		image: spec.image.tag ?? spec.image.digest,
+		argv: spec.argv,
+		env: spec.env,
+		mounts: spec.mounts,
+		network: spec.network,
+		entrypoint: spec.entrypoint,
+		user: spec.user,
+		timeoutMillis: spec.timeoutMillis,
+		extraHosts: spec.extraHosts
+	}).pipe(Effect.map((r) => ({
+		exitCode: r.exitCode,
+		stdout: r.stdout,
+		stderr: r.stderr
+	})), mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.runOneShot"));
+	return ContainerRuntimeService.of({
+		ensureImage,
+		pullImage: pullImageContractImpl,
+		ensureNetwork: ensureNetworkContractImpl,
+		ensureContainer: ensureContainerImpl,
+		exec: execImpl,
+		runOneShot: runOneShotImpl,
+		inspectByLabels,
+		followLogs: followLogsImpl,
+		pause: pauseImpl,
+		pauseAndCommit: pauseAndCommitImpl,
+		saveImage: saveImageImpl,
+		saveImages: saveImagesImpl,
+		loadImage: loadImageContractImpl,
+		tagImage: tagImageContractImpl,
+		removeImage: removeImageContractImpl,
+		unpause: unpauseImpl,
+		stop: stopImpl,
+		sweepOrphans: sweepOrphansImpl,
+		removeManagedContainers: removeManagedContainersImpl,
+		removeManagedImages: removeManagedImagesImpl,
+		removeManagedNetworks: removeManagedNetworksImpl,
+		removeManagedVolumes: removeManagedVolumesImpl
+	});
+}));
+//#endregion
+export { ContainerRuntimeService, layerContainerRuntimeDocker, layerDockerCycleInitial };
+
+//# sourceMappingURL=service.mjs.map

package/dist/runtime/docker/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["ensureNetworkImpl","pullImageImpl","followLogsStream","stopContainer","saveImageStream","saveImagesStream","loadImageImpl","tagImageImpl","removeImageImpl"],"sources":["../../../src/runtime/docker/service.ts"],"sourcesContent":["// `ContainerRuntime` capability — Docker reference implementation.\n//\n// Composes the subsystems in this directory into the contract surface\n// declared in `contracts/container-runtime.ts`. Plugins consume the\n// `ContainerRuntime` interface through this service; the typed\n// docker-specific error variants are accessible to advanced consumers\n// via the underlying subsystems but the public surface projects to\n// the contract's narrow `ContainerRuntimeError`.\n\nimport { createHash, randomUUID } from 'node:crypto';\nimport { lstatSync, readdirSync, readFileSync, readlinkSync } from 'node:fs';\nimport { join, relative, sep } from 'node:path';\n\nimport { Context, Duration, Effect, Layer, Ref, Stream } from 'effect';\n\nimport type {\n\tContainerBuildContext,\n\tContainerHandle,\n\tContainerRuntime,\n\tContainerRuntimeError,\n\tEnsureContainerSpec,\n\tEnsureNetworkSpec,\n\tExecOptions,\n\tExecResult,\n\tImageRef,\n\tLoadedImageBundle,\n\tOneShotSpec,\n\tSaveImageOptions,\n\tTagImageOptions,\n\tTaggedImageRef,\n} from '../../contracts/container-runtime.ts';\nimport type { ContainerLabelTuple } from '../../contracts/snapshotable.ts';\nimport { chainId, contentHash } from '../../substrate/brand.ts';\nimport { CacheService } from '../../substrate/runtime/cache/index.ts';\nimport { StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { DockerHost, DockerSpawner, dockerRunOk } from './client.ts';\nimport {\n\tassertContainerHandleOwned,\n\tcommit,\n\tensureContainer,\n\tinspectContainer,\n\tpause,\n\ttype PerNameLockState,\n\tstop as stopContainer,\n\tunpause,\n} from './container.ts';\nimport { toContractError } from './errors.ts';\nimport { dockerExec, dockerRunOneShot } from './exec.ts';\nimport {\n\tensureImageCached,\n\tloadImage as loadImageImpl,\n\tpull as pullImageImpl,\n\trefOf,\n\tremoveImage as removeImageImpl,\n\tsaveImage as saveImageStream,\n\tsaveImages as saveImagesStream,\n\ttagImage as tagImageImpl,\n} from './image.ts';\nimport { listContainers } from './inventory.ts';\nimport { followLogs as followLogsStream } from './logs.ts';\nimport { ensureNetwork as ensureNetworkImpl } from './network.ts';\nimport {\n\tremoveManagedContainers,\n\tremoveManagedImages,\n\tremoveManagedNetworks,\n\tremoveManagedVolumes,\n\tsweepOrphans,\n} from './sweep.ts';\n\n// -----------------------------------------------------------------------------\n// Service tag — `Context.Service` per Effect-v4 idioms\n// -----------------------------------------------------------------------------\n\nexport class ContainerRuntimeService extends Context.Service<\n\tContainerRuntimeService,\n\tContainerRuntime\n>()('@devstack-rewrite/runtime-docker/ContainerRuntime') {}\n\n// -----------------------------------------------------------------------------\n// Cycle counter — stamped on container labels at create time\n// -----------------------------------------------------------------------------\n\nexport class DockerCycle extends Context.Service<DockerCycle, Ref.Ref<number>>()(\n\t'@devstack-rewrite/runtime-docker/Cycle',\n) {}\n\nexport const layerDockerCycleInitial: Layer.Layer<DockerCycle> = Layer.effect(\n\tDockerCycle,\n\tEffect.gen(function* () {\n\t\tconst ref = yield* Ref.make(0);\n\t\treturn ref;\n\t}),\n);\n\n// -----------------------------------------------------------------------------\n// Layer — wire the subsystems into the contract interface\n// -----------------------------------------------------------------------------\n\nconst mapToContractError = <R, A>(\n\teff: Effect.Effect<A, import('./errors.ts').DockerRuntimeError, R>,\n): Effect.Effect<A, ContainerRuntimeError, R> => eff.pipe(Effect.mapError(toContractError));\n\nconst snapshotTempTag = (containerName: string): string => {\n\tconst safeName = containerName.replace(/[^A-Za-z0-9_.-]/g, '-');\n\tconst suffix = randomUUID().replace(/-/g, '').slice(0, 12);\n\treturn `devstack-snapshot:${safeName}-${suffix}`;\n};\n\nconst stableRelativePath = (root: string, path: string): string => {\n\tconst rel = relative(root, path);\n\treturn rel.length === 0 ? '.' : rel.split(sep).join('/');\n};\n\nconst updateContextEntryHash = (\n\thash: ReturnType<typeof createHash>,\n\troot: string,\n\tpath: string,\n): void => {\n\tconst stat = lstatSync(path);\n\tconst rel = stableRelativePath(root, path);\n\n\tif (stat.isDirectory()) {\n\t\thash.update('dir\\0');\n\t\thash.update(rel);\n\t\thash.update('\\0');\n\t\tfor (const child of readdirSync(path).sort((a, b) => a.localeCompare(b))) {\n\t\t\tupdateContextEntryHash(hash, root, join(path, child));\n\t\t}\n\t\treturn;\n\t}\n\n\tif (stat.isFile()) {\n\t\thash.update('file\\0');\n\t\thash.update(rel);\n\t\thash.update('\\0');\n\t\thash.update(String(stat.mode));\n\t\thash.update('\\0');\n\t\thash.update(readFileSync(path));\n\t\thash.update('\\0');\n\t\treturn;\n\t}\n\n\tif (stat.isSymbolicLink()) {\n\t\thash.update('symlink\\0');\n\t\thash.update(rel);\n\t\thash.update('\\0');\n\t\thash.update(readlinkSync(path));\n\t\thash.update('\\0');\n\t\treturn;\n\t}\n\n\thash.update('other\\0');\n\thash.update(rel);\n\thash.update('\\0');\n\thash.update(String(stat.mode));\n\thash.update('\\0');\n};\n\nconst normalizeFingerprintPath = (path: string): string =>\n\tpath\n\t\t.split(/[\\\\/]+/g)\n\t\t.filter((part) => part.length > 0)\n\t\t.join('/');\n\nconst normalizeFingerprintPaths = (\n\tpaths: ReadonlyArray<string> | undefined,\n): ReadonlyArray<string> =>\n\t[...new Set((paths ?? []).map(normalizeFingerprintPath).filter((path) => path.length > 0))].sort(\n\t\t(a, b) => a.localeCompare(b),\n\t);\n\nconst buildContextFingerprint = (\n\tcontextPath: string,\n\tfingerprintPaths?: ReadonlyArray<string>,\n): string => {\n\tconst hash = createHash('sha256');\n\tconst requestedPaths = normalizeFingerprintPaths(fingerprintPaths);\n\tconst paths = requestedPaths.length === 0 ? null : requestedPaths;\n\ttry {\n\t\tif (paths === null) {\n\t\t\tupdateContextEntryHash(hash, contextPath, contextPath);\n\t\t} else {\n\t\t\tfor (const relPath of paths) {\n\t\t\t\thash.update('fingerprint-path\\0');\n\t\t\t\thash.update(relPath);\n\t\t\t\thash.update('\\0');\n\t\t\t\tupdateContextEntryHash(hash, contextPath, join(contextPath, relPath));\n\t\t\t}\n\t\t}\n\t} catch (err) {\n\t\thash.update('unreadable\\0');\n\t\thash.update(String(err));\n\t\thash.update('\\0');\n\t}\n\treturn hash.digest('hex');\n};\n\n/** Stable content hash for the build context. Sorts build args so two\n *  equivalent specs whose key insertion order differs produce the same\n *  hash. The Docker build context's files are part of the key: changing\n *  a vendored entrypoint script must force a new managed image tag. */\nexport const buildContentHash = (ctx: ContainerBuildContext): string => {\n\tconst dockerfile = ctx.dockerfile ?? 'Dockerfile';\n\tconst sortedArgs = Object.entries(ctx.buildArgs ?? {}).sort(([a], [b]) => a.localeCompare(b));\n\tconst argsKey = sortedArgs.map(([k, v]) => `${k}=${v}`).join('\\x00');\n\tconst platform = ctx.platform ?? '';\n\tconst fingerprintPathsKey = normalizeFingerprintPaths(ctx.fingerprintPaths).join('\\x00');\n\treturn createHash('sha256')\n\t\t.update(ctx.contextPath)\n\t\t.update('\\x00')\n\t\t.update(dockerfile)\n\t\t.update('\\x00')\n\t\t.update(platform)\n\t\t.update('\\x00')\n\t\t.update(argsKey)\n\t\t.update('\\x00')\n\t\t.update(fingerprintPathsKey)\n\t\t.update('\\x00')\n\t\t.update(buildContextFingerprint(ctx.contextPath, ctx.fingerprintPaths))\n\t\t.digest('hex');\n};\n\nconst DOCKER_ARCH_ALIASES: Readonly<Record<string, string>> = {\n\taarch64: 'arm64',\n\tarm64: 'arm64',\n\tx86_64: 'amd64',\n\tamd64: 'amd64',\n};\n\nexport const normalizeDockerInfoPlatform = (raw: string): string | null => {\n\tconst trimmed = raw.trim();\n\tconst slash = trimmed.indexOf('/');\n\tif (slash <= 0 || slash === trimmed.length - 1) return null;\n\tconst os = trimmed.slice(0, slash);\n\tconst arch = trimmed.slice(slash + 1);\n\tconst normalizedArch = DOCKER_ARCH_ALIASES[arch] ?? arch;\n\treturn `${os}/${normalizedArch}`;\n};\n\nconst inferDockerBuildPlatform = (): Effect.Effect<\n\tstring | null,\n\tnever,\n\tDockerHost | DockerSpawner\n> =>\n\tdockerRunOk('info', ['--format', '{{.OSType}}/{{.Architecture}}']).pipe(\n\t\tEffect.map((result) =>\n\t\t\tresult.exitCode === 0 ? normalizeDockerInfoPlatform(result.stdout) : null,\n\t\t),\n\t\tEffect.catch(() => Effect.succeed(null)),\n\t);\n\nexport const layerContainerRuntimeDocker: Layer.Layer<\n\tContainerRuntimeService,\n\tnever,\n\tCacheService | DockerHost | DockerSpawner | DockerCycle | StackPathsService\n> = Layer.effect(\n\tContainerRuntimeService,\n\tEffect.gen(function* () {\n\t\tconst cycleRef = yield* DockerCycle;\n\t\t// Snapshot the substrate services so we can provide them to the\n\t\t// closures that implement the contract's R=never surface.\n\t\tconst dockerHost = yield* DockerHost;\n\t\tconst dockerSpawner = yield* DockerSpawner;\n\t\tconst stackPaths = yield* StackPathsService;\n\t\tconst cache = yield* CacheService;\n\t\tconst baseCtx = Context.empty().pipe(\n\t\t\tContext.add(DockerHost, dockerHost),\n\t\t\tContext.add(DockerSpawner, dockerSpawner),\n\t\t\tContext.add(StackPathsService, stackPaths),\n\t\t\tContext.add(CacheService, cache),\n\t\t);\n\t\t// Per-name in-process serialization. Architecture invariant:\n\t\t// two concurrent ensureContainer calls for the same name must\n\t\t// not interleave docker inspect/create/start. The cross-process\n\t\t// safety is the daemon's `--name` atomicity (see container.ts\n\t\t// collision recovery). The in-process side is this ref.\n\t\tconst perNameLock = yield* Ref.make<PerNameLockState>(new Map());\n\n\t\tconst ensureImage = (\n\t\t\tctx: ContainerBuildContext,\n\t\t\texpected?: ImageRef,\n\t\t): Effect.Effect<ImageRef, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst inferredPlatform =\n\t\t\t\t\tctx.platform === undefined\n\t\t\t\t\t\t? yield* inferDockerBuildPlatform().pipe(Effect.provide(baseCtx))\n\t\t\t\t\t\t: null;\n\t\t\t\tconst effectiveCtx =\n\t\t\t\t\tctx.platform === undefined && inferredPlatform !== null\n\t\t\t\t\t\t? { ...ctx, platform: inferredPlatform }\n\t\t\t\t\t\t: ctx;\n\t\t\t\t// Architecture §8: bring-your-own-image vs build is a closed sum.\n\t\t\t\t// The contract accepts `ContainerBuildContext` (build path);\n\t\t\t\t// pull is exposed via `image.ts::pull` directly to plugins\n\t\t\t\t// that need it (not through this contract entry point).\n\t\t\t\t//\n\t\t\t\t// Content-addressed cache: namespace is the constant\n\t\t\t\t// `runtime-docker-build` (one substrate-owned namespace);\n\t\t\t\t// chain is `n/a` (build artifacts are chain-independent);\n\t\t\t\t// contentHash is a hash of the build context's identifying\n\t\t\t\t// fields. The caller-supplied `expected.tag`, when present,\n\t\t\t\t// is honoured as the on-host tag; absent, we derive a tag\n\t\t\t\t// from the content hash so two unrelated contexts cannot\n\t\t\t\t// collide on the sanitized contextPath form.\n\t\t\t\tconst hash = buildContentHash(effectiveCtx);\n\t\t\t\tconst tag = expected?.tag ?? `devstack-build:${hash.slice(0, 16)}`;\n\t\t\t\treturn yield* ensureImageCached(\n\t\t\t\t\t{\n\t\t\t\t\t\tcontextPath: effectiveCtx.contextPath,\n\t\t\t\t\t\tdockerfile: effectiveCtx.dockerfile,\n\t\t\t\t\t\tplatform: effectiveCtx.platform,\n\t\t\t\t\t\tbuildArgs: effectiveCtx.buildArgs,\n\t\t\t\t\t\ttag,\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tnamespace: 'runtime-docker-build',\n\t\t\t\t\t\tchain: chainId('n/a'),\n\t\t\t\t\t\tcontentHash: contentHash(hash),\n\t\t\t\t\t},\n\t\t\t\t).pipe(\n\t\t\t\t\tEffect.map((digest) => refOf(digest, tag)),\n\t\t\t\t\tmapToContractError,\n\t\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\t\tEffect.withSpan('runtime.docker.contract.ensureImage'),\n\t\t\t\t);\n\t\t\t});\n\n\t\tconst ensureNetworkContractImpl = (\n\t\t\tspec: EnsureNetworkSpec,\n\t\t): Effect.Effect<string, ContainerRuntimeError> =>\n\t\t\tensureNetworkImpl(spec.name, {\n\t\t\t\tapp: spec.app,\n\t\t\t\tstack: spec.stack,\n\t\t\t\t...(spec.subnet === undefined ? {} : { subnet: spec.subnet }),\n\t\t\t\t...(spec.gateway === undefined ? {} : { gateway: spec.gateway }),\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.ensureNetwork'),\n\t\t\t);\n\n\t\tconst pullImageContractImpl = (ref: string): Effect.Effect<ImageRef, ContainerRuntimeError> =>\n\t\t\tpullImageImpl(ref).pipe(\n\t\t\t\tEffect.map((digest) => refOf(digest, ref)),\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.pullImage'),\n\t\t\t);\n\n\t\tconst ensureContainerImpl = (\n\t\t\tspec: EnsureContainerSpec,\n\t\t): Effect.Effect<ContainerHandle, ContainerRuntimeError, import('effect').Scope.Scope> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst cycle = yield* Ref.get(cycleRef);\n\t\t\t\treturn yield* ensureContainer(spec, { cycle, perNameLock });\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.ensureContainer'),\n\t\t\t);\n\n\t\tconst inspectByLabels = (\n\t\t\tlabels: ContainerLabelTuple,\n\t\t): Effect.Effect<ReadonlyArray<ContainerHandle>, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst summaries = yield* listContainers(labels);\n\t\t\t\treturn yield* Effect.forEach(\n\t\t\t\t\tsummaries,\n\t\t\t\t\t(s) =>\n\t\t\t\t\t\tinspectContainer(s.name).pipe(\n\t\t\t\t\t\t\tEffect.map(\n\t\t\t\t\t\t\t\t(facts): ContainerHandle => ({\n\t\t\t\t\t\t\t\t\tid: facts?.id ?? s.id,\n\t\t\t\t\t\t\t\t\tname: s.name,\n\t\t\t\t\t\t\t\t\tlabels,\n\t\t\t\t\t\t\t\t\timageName: facts?.image ?? s.image,\n\t\t\t\t\t\t\t\t\tstatus: (facts?.paused\n\t\t\t\t\t\t\t\t\t\t? 'paused'\n\t\t\t\t\t\t\t\t\t\t: (facts?.running ?? s.state === 'running')\n\t\t\t\t\t\t\t\t\t\t\t? 'running'\n\t\t\t\t\t\t\t\t\t\t\t: s.state === 'paused'\n\t\t\t\t\t\t\t\t\t\t\t\t? 'paused'\n\t\t\t\t\t\t\t\t\t\t\t\t: s.state === 'created'\n\t\t\t\t\t\t\t\t\t\t\t\t\t? 'created'\n\t\t\t\t\t\t\t\t\t\t\t\t\t: 'exited') as ContainerHandle['status'],\n\t\t\t\t\t\t\t\t\tips: [],\n\t\t\t\t\t\t\t\t\t...(facts?.ports !== undefined ? { ports: facts.ports } : {}),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t{ concurrency: 'unbounded' },\n\t\t\t\t);\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.inspectByLabels'),\n\t\t\t);\n\n\t\tconst followLogsImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t): Stream.Stream<string, ContainerRuntimeError> =>\n\t\t\tfollowLogsStream(handle.name).pipe(\n\t\t\t\tStream.mapError(toContractError),\n\t\t\t\t// R-channel: the underlying stream needs DockerHost +\n\t\t\t\t// DockerSpawner from the spawn step. Provide the\n\t\t\t\t// snapshotted base context so the contract surface is\n\t\t\t\t// `R = never`. `Stream.mapError` does NOT drop R; the\n\t\t\t\t// `as`-cast in the previous shape was a release-blocker\n\t\t\t\t// per runtime-docker review issue #3.\n\t\t\t\tStream.provideContext(baseCtx),\n\t\t\t);\n\n\t\tconst pauseAndCommitImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t): Effect.Effect<TaggedImageRef, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tif (handle.status === 'running') {\n\t\t\t\t\tyield* pause(handle.name);\n\t\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\t}\n\t\t\t\tconst tag = snapshotTempTag(handle.name);\n\t\t\t\tconst digest = yield* commit(handle.name, tag);\n\t\t\t\treturn { digest, tag };\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.pauseAndCommit'),\n\t\t\t);\n\n\t\tconst pauseImpl = (handle: ContainerHandle): Effect.Effect<void, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tyield* pause(handle.name);\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.pause'),\n\t\t\t);\n\n\t\tconst unpauseImpl = (handle: ContainerHandle): Effect.Effect<void, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tyield* unpause(handle.name);\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.unpause'),\n\t\t\t);\n\n\t\tconst stopImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t\tgrace: Duration.Duration,\n\t\t): Effect.Effect<void, ContainerRuntimeError> => {\n\t\t\tconst seconds = Math.max(0, Math.ceil(Duration.toMillis(grace) / 1000));\n\t\t\treturn Effect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tyield* stopContainer(handle.name, seconds);\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.stop'),\n\t\t\t);\n\t\t};\n\n\t\tconst sweepOrphansImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tsweepOrphans(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.sweepOrphans'),\n\t\t\t);\n\n\t\tconst removeManagedContainersImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedContainers(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeManagedContainers'),\n\t\t\t);\n\n\t\tconst removeManagedImagesImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedImages(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeManagedImages'),\n\t\t\t);\n\n\t\tconst removeManagedNetworksImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedNetworks(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeManagedNetworks'),\n\t\t\t);\n\n\t\tconst removeManagedVolumesImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedVolumes(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeManagedVolumes'),\n\t\t\t);\n\n\t\tconst execImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t\targv: ReadonlyArray<string>,\n\t\t\topts?: ExecOptions,\n\t\t): Effect.Effect<ExecResult, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\treturn yield* dockerExec(handle.name, argv, {\n\t\t\t\t\tuser: opts?.user,\n\t\t\t\t\tenv: opts?.env,\n\t\t\t\t\tworkdir: opts?.workdir,\n\t\t\t\t});\n\t\t\t}).pipe(\n\t\t\t\t// Contract surface: NEVER promote non-zero exit to failure\n\t\t\t\t// here. The caller is the policy holder.\n\t\t\t\tEffect.map(\n\t\t\t\t\t(r): ExecResult => ({\n\t\t\t\t\t\texitCode: r.exitCode,\n\t\t\t\t\t\tstdout: r.stdout,\n\t\t\t\t\t\tstderr: r.stderr,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.exec'),\n\t\t\t);\n\n\t\tconst saveImageImpl = (\n\t\t\tref: ImageRef,\n\t\t\topts?: SaveImageOptions,\n\t\t): Stream.Stream<Uint8Array, ContainerRuntimeError> => {\n\t\t\tconst resolved = ref.tag ?? ref.digest;\n\t\t\treturn saveImageStream(resolved, opts).pipe(\n\t\t\t\tStream.mapError(toContractError),\n\t\t\t\tStream.provideContext(baseCtx),\n\t\t\t);\n\t\t};\n\t\tconst saveImagesImpl = (\n\t\t\trefs: ReadonlyArray<ImageRef>,\n\t\t\topts?: SaveImageOptions,\n\t\t): Stream.Stream<Uint8Array, ContainerRuntimeError> => {\n\t\t\tconst resolved = refs.map((ref) => ref.tag ?? ref.digest);\n\t\t\treturn saveImagesStream(resolved, opts).pipe(\n\t\t\t\tStream.mapError(toContractError),\n\t\t\t\tStream.provideContext(baseCtx),\n\t\t\t);\n\t\t};\n\n\t\tconst loadImageContractImpl = (\n\t\t\ttar: Stream.Stream<Uint8Array, unknown>,\n\t\t): Effect.Effect<LoadedImageBundle, ContainerRuntimeError> =>\n\t\t\tloadImageImpl(tar).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.loadImage'),\n\t\t\t);\n\n\t\tconst tagImageContractImpl = (\n\t\t\tsrc: ImageRef,\n\t\t\tnewTag: string,\n\t\t\topts?: TagImageOptions,\n\t\t): Effect.Effect<void, ContainerRuntimeError> => {\n\t\t\tconst resolved = src.tag ?? src.digest;\n\t\t\treturn tagImageImpl(resolved, newTag, opts).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.tagImage'),\n\t\t\t);\n\t\t};\n\n\t\tconst removeImageContractImpl = (ref: ImageRef): Effect.Effect<void, ContainerRuntimeError> => {\n\t\t\tconst resolved = ref.tag ?? ref.digest;\n\t\t\treturn removeImageImpl(resolved).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeImage'),\n\t\t\t);\n\t\t};\n\n\t\tconst runOneShotImpl = (\n\t\t\tspec: OneShotSpec,\n\t\t): Effect.Effect<ExecResult, ContainerRuntimeError, import('effect').Scope.Scope> =>\n\t\t\tdockerRunOneShot({\n\t\t\t\timage: spec.image.tag ?? spec.image.digest,\n\t\t\t\targv: spec.argv,\n\t\t\t\tenv: spec.env,\n\t\t\t\tmounts: spec.mounts,\n\t\t\t\tnetwork: spec.network,\n\t\t\t\tentrypoint: spec.entrypoint,\n\t\t\t\tuser: spec.user,\n\t\t\t\ttimeoutMillis: spec.timeoutMillis,\n\t\t\t\textraHosts: spec.extraHosts,\n\t\t\t}).pipe(\n\t\t\t\t// Same contract: never promote non-zero exit to failure.\n\t\t\t\tEffect.map(\n\t\t\t\t\t(r): ExecResult => ({\n\t\t\t\t\t\texitCode: r.exitCode,\n\t\t\t\t\t\tstdout: r.stdout,\n\t\t\t\t\t\tstderr: r.stderr,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.runOneShot'),\n\t\t\t);\n\n\t\treturn ContainerRuntimeService.of({\n\t\t\tensureImage,\n\t\t\tpullImage: pullImageContractImpl,\n\t\t\tensureNetwork: ensureNetworkContractImpl,\n\t\t\tensureContainer: ensureContainerImpl,\n\t\t\texec: execImpl,\n\t\t\trunOneShot: runOneShotImpl,\n\t\t\tinspectByLabels,\n\t\t\tfollowLogs: followLogsImpl,\n\t\t\tpause: pauseImpl,\n\t\t\tpauseAndCommit: pauseAndCommitImpl,\n\t\t\tsaveImage: saveImageImpl,\n\t\t\tsaveImages: saveImagesImpl,\n\t\t\tloadImage: loadImageContractImpl,\n\t\t\ttagImage: tagImageContractImpl,\n\t\t\tremoveImage: removeImageContractImpl,\n\t\t\tunpause: unpauseImpl,\n\t\t\tstop: stopImpl,\n\t\t\tsweepOrphans: sweepOrphansImpl,\n\t\t\tremoveManagedContainers: removeManagedContainersImpl,\n\t\t\tremoveManagedImages: removeManagedImagesImpl,\n\t\t\tremoveManagedNetworks: removeManagedNetworksImpl,\n\t\t\tremoveManagedVolumes: removeManagedVolumesImpl,\n\t\t});\n\t}),\n);\n"],"mappings":";;;;;;;;;;;;;;;;;AAyEA,IAAa,0BAAb,cAA6C,QAAQ,SAGlD,CAAC,oDAAoD,CAAC;AAMzD,IAAa,cAAb,cAAiC,QAAQ,SAAuC,CAC/E,yCACA,CAAC;AAEF,MAAa,0BAAoD,MAAM,OACtE,aACA,OAAO,IAAI,aAAa;AAEvB,QAAO,OADY,IAAI,KAAK,EAAE;EAE7B,CACF;AAMD,MAAM,sBACL,QACgD,IAAI,KAAK,OAAO,SAAS,gBAAgB,CAAC;AAE3F,MAAM,mBAAmB,kBAAkC;AAG1D,QAAO,qBAFU,cAAc,QAAQ,oBAAoB,IAEvB,CAAC,GADtB,YAAY,CAAC,QAAQ,MAAM,GAAG,CAAC,MAAM,GAAG,GACT;;AAG/C,MAAM,sBAAsB,MAAc,SAAyB;CAClE,MAAM,MAAM,SAAS,MAAM,KAAK;AAChC,QAAO,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI;;AAGzD,MAAM,0BACL,MACA,MACA,SACU;CACV,MAAM,OAAO,UAAU,KAAK;CAC5B,MAAM,MAAM,mBAAmB,MAAM,KAAK;AAE1C,KAAI,KAAK,aAAa,EAAE;AACvB,OAAK,OAAO,QAAQ;AACpB,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,KAAK;AACjB,OAAK,MAAM,SAAS,YAAY,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,CACvE,wBAAuB,MAAM,MAAM,KAAK,MAAM,MAAM,CAAC;AAEtD;;AAGD,KAAI,KAAK,QAAQ,EAAE;AAClB,OAAK,OAAO,SAAS;AACrB,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,OAAO,KAAK,KAAK,CAAC;AAC9B,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,aAAa,KAAK,CAAC;AAC/B,OAAK,OAAO,KAAK;AACjB;;AAGD,KAAI,KAAK,gBAAgB,EAAE;AAC1B,OAAK,OAAO,YAAY;AACxB,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,aAAa,KAAK,CAAC;AAC/B,OAAK,OAAO,KAAK;AACjB;;AAGD,MAAK,OAAO,UAAU;AACtB,MAAK,OAAO,IAAI;AAChB,MAAK,OAAO,KAAK;AACjB,MAAK,OAAO,OAAO,KAAK,KAAK,CAAC;AAC9B,MAAK,OAAO,KAAK;;AAGlB,MAAM,4BAA4B,SACjC,KACE,MAAM,UAAU,CAChB,QAAQ,SAAS,KAAK,SAAS,EAAE,CACjC,KAAK,IAAI;AAEZ,MAAM,6BACL,UAEA,CAAC,GAAG,IAAI,KAAK,SAAS,EAAE,EAAE,IAAI,yBAAyB,CAAC,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,MAC1F,GAAG,MAAM,EAAE,cAAc,EAAE,CAC5B;AAEF,MAAM,2BACL,aACA,qBACY;CACZ,MAAM,OAAO,WAAW,SAAS;CACjC,MAAM,iBAAiB,0BAA0B,iBAAiB;CAClE,MAAM,QAAQ,eAAe,WAAW,IAAI,OAAO;AACnD,KAAI;AACH,MAAI,UAAU,KACb,wBAAuB,MAAM,aAAa,YAAY;MAEtD,MAAK,MAAM,WAAW,OAAO;AAC5B,QAAK,OAAO,qBAAqB;AACjC,QAAK,OAAO,QAAQ;AACpB,QAAK,OAAO,KAAK;AACjB,0BAAuB,MAAM,aAAa,KAAK,aAAa,QAAQ,CAAC;;UAG/D,KAAK;AACb,OAAK,OAAO,eAAe;AAC3B,OAAK,OAAO,OAAO,IAAI,CAAC;AACxB,OAAK,OAAO,KAAK;;AAElB,QAAO,KAAK,OAAO,MAAM;;;;;;AAO1B,MAAa,oBAAoB,QAAuC;CACvE,MAAM,aAAa,IAAI,cAAc;CAErC,MAAM,UADa,OAAO,QAAQ,IAAI,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,CAClE,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,KAAO;CACpE,MAAM,WAAW,IAAI,YAAY;CACjC,MAAM,sBAAsB,0BAA0B,IAAI,iBAAiB,CAAC,KAAK,KAAO;AACxF,QAAO,WAAW,SAAS,CACzB,OAAO,IAAI,YAAY,CACvB,OAAO,KAAO,CACd,OAAO,WAAW,CAClB,OAAO,KAAO,CACd,OAAO,SAAS,CAChB,OAAO,KAAO,CACd,OAAO,QAAQ,CACf,OAAO,KAAO,CACd,OAAO,oBAAoB,CAC3B,OAAO,KAAO,CACd,OAAO,wBAAwB,IAAI,aAAa,IAAI,iBAAiB,CAAC,CACtE,OAAO,MAAM;;AAGhB,MAAM,sBAAwD;CAC7D,SAAS;CACT,OAAO;CACP,QAAQ;CACR,OAAO;CACP;AAED,MAAa,+BAA+B,QAA+B;CAC1E,MAAM,UAAU,IAAI,MAAM;CAC1B,MAAM,QAAQ,QAAQ,QAAQ,IAAI;AAClC,KAAI,SAAS,KAAK,UAAU,QAAQ,SAAS,EAAG,QAAO;CACvD,MAAM,KAAK,QAAQ,MAAM,GAAG,MAAM;CAClC,MAAM,OAAO,QAAQ,MAAM,QAAQ,EAAE;AAErC,QAAO,GAAG,GAAG,GADU,oBAAoB,SAAS;;AAIrD,MAAM,iCAKL,YAAY,QAAQ,CAAC,YAAY,gCAAgC,CAAC,CAAC,KAClE,OAAO,KAAK,WACX,OAAO,aAAa,IAAI,4BAA4B,OAAO,OAAO,GAAG,KACrE,EACD,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CACxC;AAEF,MAAa,8BAIT,MAAM,OACT,yBACA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,OAAO;CAGxB,MAAM,aAAa,OAAO;CAC1B,MAAM,gBAAgB,OAAO;CAC7B,MAAM,aAAa,OAAO;CAC1B,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,QAAQ,OAAO,CAAC,KAC/B,QAAQ,IAAI,YAAY,WAAW,EACnC,QAAQ,IAAI,eAAe,cAAc,EACzC,QAAQ,IAAI,mBAAmB,WAAW,EAC1C,QAAQ,IAAI,cAAc,MAAM,CAChC;CAMD,MAAM,cAAc,OAAO,IAAI,qBAAuB,IAAI,KAAK,CAAC;CAEhE,MAAM,eACL,KACA,aAEA,OAAO,IAAI,aAAa;EACvB,MAAM,mBACL,IAAI,aAAa,KAAA,IACd,OAAO,0BAA0B,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC,GAC/D;EACJ,MAAM,eACL,IAAI,aAAa,KAAA,KAAa,qBAAqB,OAChD;GAAE,GAAG;GAAK,UAAU;GAAkB,GACtC;EAcJ,MAAM,OAAO,iBAAiB,aAAa;EAC3C,MAAM,MAAM,UAAU,OAAO,kBAAkB,KAAK,MAAM,GAAG,GAAG;AAChE,SAAO,OAAO,kBACb;GACC,aAAa,aAAa;GAC1B,YAAY,aAAa;GACzB,UAAU,aAAa;GACvB,WAAW,aAAa;GACxB;GACA,EACD;GACC,WAAW;GACX,OAAO,QAAQ,MAAM;GACrB,aAAa,YAAY,KAAK;GAC9B,CACD,CAAC,KACD,OAAO,KAAK,WAAW,MAAM,QAAQ,IAAI,CAAC,EAC1C,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,sCAAsC,CACtD;GACA;CAEH,MAAM,6BACL,SAEAA,cAAkB,KAAK,MAAM;EAC5B,KAAK,KAAK;EACV,OAAO,KAAK;EACZ,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,QAAQ;EAC5D,GAAI,KAAK,YAAY,KAAA,IAAY,EAAE,GAAG,EAAE,SAAS,KAAK,SAAS;EAC/D,CAAC,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,wCAAwC,CACxD;CAEF,MAAM,yBAAyB,QAC9BC,KAAc,IAAI,CAAC,KAClB,OAAO,KAAK,WAAW,MAAM,QAAQ,IAAI,CAAC,EAC1C,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,oCAAoC,CACpD;CAEF,MAAM,uBACL,SAEA,OAAO,IAAI,aAAa;AAEvB,SAAO,OAAO,gBAAgB,MAAM;GAAE,OAAA,OADjB,IAAI,IAAI,SAAS;GACO;GAAa,CAAC;GAC1D,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,0CAA0C,CAC1D;CAEF,MAAM,mBACL,WAEA,OAAO,IAAI,aAAa;EACvB,MAAM,YAAY,OAAO,eAAe,OAAO;AAC/C,SAAO,OAAO,OAAO,QACpB,YACC,MACA,iBAAiB,EAAE,KAAK,CAAC,KACxB,OAAO,KACL,WAA4B;GAC5B,IAAI,OAAO,MAAM,EAAE;GACnB,MAAM,EAAE;GACR;GACA,WAAW,OAAO,SAAS,EAAE;GAC7B,QAAS,OAAO,SACb,WACC,OAAO,WAAW,EAAE,UAAU,YAC9B,YACA,EAAE,UAAU,WACX,WACA,EAAE,UAAU,YACX,YACA;GACN,KAAK,EAAE;GACP,GAAI,OAAO,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,OAAO,GAAG,EAAE;GAC5D,EACD,CACD,EACF,EAAE,aAAa,aAAa,CAC5B;GACA,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,0CAA0C,CAC1D;CAEF,MAAM,kBACL,WAEAC,WAAiB,OAAO,KAAK,CAAC,KAC7B,OAAO,SAAS,gBAAgB,EAOhC,OAAO,eAAe,QAAQ,CAC9B;CAEF,MAAM,sBACL,WAEA,OAAO,IAAI,aAAa;AACvB,SAAO,2BAA2B,OAAO;AACzC,MAAI,OAAO,WAAW,WAAW;AAChC,UAAO,MAAM,OAAO,KAAK;AACzB,UAAO,2BAA2B,OAAO;;EAE1C,MAAM,MAAM,gBAAgB,OAAO,KAAK;AAExC,SAAO;GAAE,QAAA,OADa,OAAO,OAAO,MAAM,IAAI;GAC7B;GAAK;GACrB,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,yCAAyC,CACzD;CAEF,MAAM,aAAa,WAClB,OAAO,IAAI,aAAa;AACvB,SAAO,2BAA2B,OAAO;AACzC,SAAO,MAAM,OAAO,KAAK;GACxB,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,gCAAgC,CAChD;CAEF,MAAM,eAAe,WACpB,OAAO,IAAI,aAAa;AACvB,SAAO,2BAA2B,OAAO;AACzC,SAAO,QAAQ,OAAO,KAAK;GAC1B,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,kCAAkC,CAClD;CAEF,MAAM,YACL,QACA,UACgD;EAChD,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,SAAS,MAAM,GAAG,IAAK,CAAC;AACvE,SAAO,OAAO,IAAI,aAAa;AAC9B,UAAO,2BAA2B,OAAO;AACzC,UAAOC,KAAc,OAAO,MAAM,QAAQ;IACzC,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,+BAA+B,CAC/C;;CAGF,MAAM,oBACL,eAEA,aAAa,WAAW,CAAC,KACxB,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,uCAAuC,CACvD;CAEF,MAAM,+BACL,eAEA,wBAAwB,WAAW,CAAC,KACnC,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,kDAAkD,CAClE;CAEF,MAAM,2BACL,eAEA,oBAAoB,WAAW,CAAC,KAC/B,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,8CAA8C,CAC9D;CAEF,MAAM,6BACL,eAEA,sBAAsB,WAAW,CAAC,KACjC,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,gDAAgD,CAChE;CAEF,MAAM,4BACL,eAEA,qBAAqB,WAAW,CAAC,KAChC,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,+CAA+C,CAC/D;CAEF,MAAM,YACL,QACA,MACA,SAEA,OAAO,IAAI,aAAa;AACvB,SAAO,2BAA2B,OAAO;AACzC,SAAO,OAAO,WAAW,OAAO,MAAM,MAAM;GAC3C,MAAM,MAAM;GACZ,KAAK,MAAM;GACX,SAAS,MAAM;GACf,CAAC;GACD,CAAC,KAGF,OAAO,KACL,OAAmB;EACnB,UAAU,EAAE;EACZ,QAAQ,EAAE;EACV,QAAQ,EAAE;EACV,EACD,EACD,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,+BAA+B,CAC/C;CAEF,MAAM,iBACL,KACA,SACsD;AAEtD,SAAOC,UADU,IAAI,OAAO,IAAI,QACC,KAAK,CAAC,KACtC,OAAO,SAAS,gBAAgB,EAChC,OAAO,eAAe,QAAQ,CAC9B;;CAEF,MAAM,kBACL,MACA,SACsD;AAEtD,SAAOC,WADU,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,OAClB,EAAE,KAAK,CAAC,KACvC,OAAO,SAAS,gBAAgB,EAChC,OAAO,eAAe,QAAQ,CAC9B;;CAGF,MAAM,yBACL,QAEAC,UAAc,IAAI,CAAC,KAClB,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,oCAAoC,CACpD;CAEF,MAAM,wBACL,KACA,QACA,SACgD;AAEhD,SAAOC,SADU,IAAI,OAAO,IAAI,QACF,QAAQ,KAAK,CAAC,KAC3C,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,mCAAmC,CACnD;;CAGF,MAAM,2BAA2B,QAA8D;AAE9F,SAAOC,YADU,IAAI,OAAO,IAAI,OACA,CAAC,KAChC,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,sCAAsC,CACtD;;CAGF,MAAM,kBACL,SAEA,iBAAiB;EAChB,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM;EACpC,MAAM,KAAK;EACX,KAAK,KAAK;EACV,QAAQ,KAAK;EACb,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,MAAM,KAAK;EACX,eAAe,KAAK;EACpB,YAAY,KAAK;EACjB,CAAC,CAAC,KAEF,OAAO,KACL,OAAmB;EACnB,UAAU,EAAE;EACZ,QAAQ,EAAE;EACV,QAAQ,EAAE;EACV,EACD,EACD,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,qCAAqC,CACrD;AAEF,QAAO,wBAAwB,GAAG;EACjC;EACA,WAAW;EACX,eAAe;EACf,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ;EACA,YAAY;EACZ,OAAO;EACP,gBAAgB;EAChB,WAAW;EACX,YAAY;EACZ,WAAW;EACX,UAAU;EACV,aAAa;EACb,SAAS;EACT,MAAM;EACN,cAAc;EACd,yBAAyB;EACzB,qBAAqB;EACrB,uBAAuB;EACvB,sBAAsB;EACtB,CAAC;EACD,CACF"}