@mysten-incubation/devstack 0.0.1 → 0.1.0

package/dist/orchestrators/lifecycle-prune/index.mjs

@@ -0,0 +1,350 @@
+import { logDebugAndFallback } from "../../substrate/runtime/observability/ignore-with-log.mjs";
+import { LivenessProbeScope, layerLivenessProbeScope } from "../../substrate/runtime/cross-process/liveness.mjs";
+import { readRoster } from "../../substrate/runtime/cross-process/roster.mjs";
+import "../../substrate/runtime/observability/index.mjs";
+import { DockerSpawner, layerDockerHostDefault } from "../../runtime/docker/client.mjs";
+import { LabelKey } from "../../runtime/docker/labels.mjs";
+import { listDevstackContainers, listDevstackContainersByKind, listDevstackImages, listDevstackNetworks, listDevstackVolumes } from "../../runtime/docker/inventory.mjs";
+import { removeDevstackContainers, removeDevstackContainersByKindAndName, removeDevstackImages, removeDevstackNetworksBestEffort, removeDevstackVolumes } from "../../runtime/docker/sweep.mjs";
+import "../../runtime/docker/index.mjs";
+import { ROUTER_KIND_LABEL_VALUE, ROUTER_SHARED_APP } from "../router/sentinels.mjs";
+import "../../substrate/runtime/managed-container.mjs";
+import "../../substrate/runtime/cross-process/index.mjs";
+import { removeRouterProfileStateForDockerStack } from "../router/cleanup.mjs";
+import { failPhase } from "./errors.mjs";
+import { Effect, Layer } from "effect";
+import { existsSync } from "node:fs";
+import * as NodeFileSystem from "@effect/platform-node/NodeFileSystem";
+import { join } from "node:path";
+import * as NodePath from "@effect/platform-node/NodePath";
+import * as NodeChildProcessSpawner from "@effect/platform-node/NodeChildProcessSpawner";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+//#region src/orchestrators/lifecycle-prune/index.ts
+const layerDockerSpawnerFromNode = Layer.effect(DockerSpawner, Effect.gen(function* () {
+	return yield* ChildProcessSpawner;
+}));
+const dockerLayer = Layer.merge(layerDockerHostDefault, layerDockerSpawnerFromNode.pipe(Layer.provideMerge(NodeChildProcessSpawner.layer.pipe(Layer.provideMerge(Layer.mergeAll(NodeFileSystem.layer, NodePath.layer))))));
+const emptyBucket = () => ({
+	containers: 0,
+	runningContainers: 0,
+	networks: 0,
+	volumes: 0,
+	images: 0
+});
+/** Public, parser-safe key for a `(app, stack)` group. Display-only —
+*  internal grouping uses the structural `{app, stack}` tuple via the
+*  `GroupBuckets` map below, so a slash inside `app` or `stack` cannot
+*  produce a wrong tuple. The separator is a forward slash for human-
+*  readable log/JSON output (`arena/main`); membership tests round-trip
+*  through this same constructor so callers never re-split the key —
+*  any potential `/`-in-app-or-stack ambiguity is resolved structurally
+*  by `GroupBuckets`, not by string-splitting the key. */
+const GROUP_KEY_SEPARATOR = "/";
+const lifecyclePruneGroupKey = (app, stack) => `${app}${GROUP_KEY_SEPARATOR}${stack}`;
+/** Map keyed on `(app, stack)` tuples without string encoding. Tuple
+*  equality is achieved by interning each `(app, stack)` pair through
+*  a nested `app → stack → bucket` index, so the map is collision-
+*  free even when `app` or `stack` contains a separator character. */
+var GroupBuckets = class {
+	buckets = /* @__PURE__ */ new Map();
+	get(identity) {
+		let perApp = this.buckets.get(identity.app);
+		if (perApp === void 0) {
+			perApp = /* @__PURE__ */ new Map();
+			this.buckets.set(identity.app, perApp);
+		}
+		let bucket = perApp.get(identity.stack);
+		if (bucket === void 0) {
+			bucket = emptyBucket();
+			perApp.set(identity.stack, bucket);
+		}
+		return bucket;
+	}
+	*entries() {
+		for (const [app, perApp] of this.buckets) for (const [stack, bucket] of perApp) yield {
+			app,
+			stack,
+			bucket
+		};
+	}
+};
+const readAppStack = (labels) => {
+	const app = labels[LabelKey.app];
+	const stack = labels[LabelKey.stack];
+	if (app === void 0 || app.length === 0) return null;
+	if (stack === void 0 || stack.length === 0) return null;
+	return {
+		app,
+		stack
+	};
+};
+const routerStackForContainer = (name) => ({
+	app: ROUTER_SHARED_APP,
+	stack: name
+});
+/** Read the live-PID set for a stack from its roster.
+*
+*  Path policy: `<runtimeRoot>/stacks/<stack>/roster.json`. This is the
+*  same key the entire substrate uses — see `substrate/runtime/paths.ts`
+*  (`path.join(root, 'stacks', identity.stack)`) — so the path here
+*  carries no NEW cross-attribution risk beyond the substrate-wide
+*  decision to key per-stack-disk-state on `stack` alone. (Two stacks
+*  in DIFFERENT apps that pick the SAME stack name would already share
+*  every other on-disk artifact — `state.json`, `cache/`, `snapshots/`,
+*  `stack.lock`, `container-claims.json`. The Docker-level discriminator
+*  is the container/network/volume NAME, which IS `<app>-<stack>-…`
+*  composed inside each plugin; so cross-attribution at the daemon
+*  level is prevented by name uniqueness even when disk state collides.)
+*
+*  This function deliberately omits `app` from the path so the
+*  prune sweeper agrees with every other consumer (`cli/main.ts`,
+*  `cli/wirings/identity.ts`, `cli/wirings/up.ts`, the roster module
+*  itself). Promoting `app` into the stack-state path is an
+*  architectural change that must update all of those call sites in
+*  lockstep — out of scope for this orchestrator. */
+const livePidsForStack = (runtimeRoot, stack) => {
+	const rosterFile = join(runtimeRoot, "stacks", stack, "roster.json");
+	if (!existsSync(rosterFile)) return Effect.succeed([]);
+	return Effect.gen(function* () {
+		const doc = yield* readRoster(rosterFile).pipe(logDebugAndFallback(null, "lifecycle-prune: roster read failed; treating as empty", { rosterFile }));
+		if (doc === null) return [];
+		const probe = yield* LivenessProbeScope;
+		const pids = [];
+		for (const holder of doc.holders) if ((yield* probe.probeHolderLiveness(holder).pipe(logDebugAndFallback("alive", "lifecycle-prune: liveness check failed; assuming alive", { pid: holder.pid }))) === "alive") pids.push(holder.pid);
+		return pids;
+	}).pipe(Effect.provide(layerLivenessProbeScope));
+};
+/** True when the group is one of the two shared shapes the
+*  orchestrator knows about: `_per-app_` (cross-stack-per-app shared)
+*  or the router-singleton (`ROUTER_SHARED_APP`). Surfaces consult
+*  this instead of recomputing the predicate. */
+const isSharedLifecyclePruneGroup = (app, stack) => stack === "_per-app_" || app === "devstack-router";
+const sharedKindFor = (app, stack) => {
+	if (app === "devstack-router") return "router";
+	if (stack === "_per-app_") return "per-app-shared";
+	return null;
+};
+/** True when the group represents a router-singleton resource set.
+*  Exported so L4 surfaces can call this rather than re-implement the
+*  router-stack naming predicate. */
+const isRouterLifecyclePruneGroup = (group) => group.app === "devstack-router" && group.stack.startsWith(`devstack-router-`);
+const isRouterGroup = isRouterLifecyclePruneGroup;
+const isSharedGroup = isSharedLifecyclePruneGroup;
+/** Label-tuple match for the `removeDevstack*` sweepers — router-shared
+*  resources stamp `{app: ROUTER_SHARED_APP, stack: <profile-name>}`
+*  (see `traefik-container.ts:ensureNetwork`) and the inventory pass
+*  buckets them under `routerStackForContainer(container.name)`, so for
+*  router groups the tuple is `{app: ROUTER_SHARED_APP, stack: group.stack}`.
+*  For non-router groups it's the bucket's literal `{app, stack}`. The
+*  branch is structurally identical to the container-removal branch's
+*  router-specific dispatch via `removeDevstackContainersByKindAndName`,
+*  so dry-run inventory counts and real-run removal stay in lockstep
+*  for router resources. Exported so tests can pin the dry-run ↔
+*  real-run parity without standing up a Docker daemon. */
+const lifecyclePruneRemovalMatchTuple = (group) => isRouterGroup(group) ? {
+	app: ROUTER_SHARED_APP,
+	stack: group.stack
+} : {
+	app: group.app,
+	stack: group.stack
+};
+const matchTupleForGroup = lifecyclePruneRemovalMatchTuple;
+const collectLifecyclePruneInventory = (options) => Effect.gen(function* () {
+	const [containers, routerContainers, networks, volumes, images] = yield* Effect.all([
+		listDevstackContainers(),
+		listDevstackContainersByKind(ROUTER_KIND_LABEL_VALUE),
+		listDevstackNetworks(),
+		listDevstackVolumes(),
+		listDevstackImages()
+	], { concurrency: "unbounded" }).pipe(Effect.provide(dockerLayer), Effect.mapError(failPhase("inventory")));
+	const buckets = new GroupBuckets();
+	for (const container of containers) {
+		const identity = readAppStack(container.labels);
+		if (identity === null) continue;
+		const bucket = buckets.get(identity);
+		bucket.containers += 1;
+		if (container.state === "running") bucket.runningContainers += 1;
+	}
+	for (const container of routerContainers) {
+		const bucket = buckets.get(routerStackForContainer(container.name));
+		bucket.containers += 1;
+		if (container.state === "running") bucket.runningContainers += 1;
+	}
+	for (const network of networks) {
+		const identity = readAppStack(network.labels);
+		if (identity === null) continue;
+		buckets.get(identity).networks += 1;
+	}
+	for (const volume of volumes) {
+		const identity = readAppStack(volume.labels);
+		if (identity === null) continue;
+		buckets.get(identity).volumes += 1;
+	}
+	for (const image of images) {
+		const identity = readAppStack(image.labels);
+		if (identity === null) continue;
+		buckets.get(identity).images += 1;
+	}
+	const groups = [];
+	for (const entry of buckets.entries()) {
+		const { app, stack, bucket } = entry;
+		const livePids = app === "devstack-router" ? [] : yield* livePidsForStack(options.runtimeRoot, stack);
+		const live = livePids.length > 0 || bucket.runningContainers > 0;
+		groups.push({
+			key: lifecyclePruneGroupKey(app, stack),
+			app,
+			stack,
+			live,
+			livePids,
+			shared: isSharedGroup(app, stack),
+			sharedKind: sharedKindFor(app, stack),
+			autoPrunable: isRouterGroup({
+				app,
+				stack
+			}),
+			containers: bucket.containers,
+			runningContainers: bucket.runningContainers,
+			networks: bucket.networks,
+			volumes: bucket.volumes,
+			images: bucket.images
+		});
+	}
+	groups.sort((a, b) => {
+		if (a.app !== b.app) return a.app < b.app ? -1 : 1;
+		return a.stack < b.stack ? -1 : a.stack > b.stack ? 1 : 0;
+	});
+	return { groups };
+}).pipe(Effect.withSpan("orchestrator.lifecycle-prune.inventory"));
+const selectedGroups = (inventory, selection) => {
+	const selected = new Set(selection.groupKeys);
+	return inventory.groups.filter((group) => selected.has(group.key));
+};
+/** Defensive enforcement of the per-app-shared pinning rule for a
+*  caller-supplied selection. Resolves `selection.groupKeys` against
+*  `inventory` and drops any `per-app-shared` group whose app still has
+*  a live sibling — reusing the SAME predicate as
+*  `defaultLifecyclePruneSelection` so a selection built outside the
+*  default path (interactive picker, scripted, programmatic) can never
+*  remove a shared group a live sibling depends on. Exported so the
+*  invariant is unit-testable without a Docker daemon. */
+const enforcePinnedLifecyclePruneSelection = (inventory, selection) => {
+	const pinned = lifecyclePruneAppsWithLiveSiblings(inventory);
+	return selectedGroups(inventory, selection).filter((group) => !(group.sharedKind === "per-app-shared" && pinned.has(group.app)));
+};
+/** Default resource scope for the lifecycle-prune orchestrator —
+*  containers + networks + volumes, never images. Surfaces consume
+*  this directly so the default never drifts between L3 and L4. */
+const DEFAULT_LIFECYCLE_PRUNE_RESOURCES = {
+	containers: true,
+	networks: true,
+	volumes: true,
+	images: false
+};
+/** Apps with at least one live non-shared group — their `_per-app_`
+*  shared resources stay pinned because something under the app is
+*  still running. Exported so L4 surfaces consume the orchestrator's
+*  pinning predicate. */
+const lifecyclePruneAppsWithLiveSiblings = (inventory) => {
+	const apps = /* @__PURE__ */ new Set();
+	for (const group of inventory.groups) if (!group.shared && group.live) apps.add(group.app);
+	return apps;
+};
+const groupHasResource = (group, resources) => resources.containers && group.containers > 0 || resources.networks && group.networks > 0 || resources.volumes && group.volumes > 0 || resources.images && group.images > 0;
+/** Default selection: every non-live group whose shared shape is
+*  prunable in non-interactive flows. Surfaces and the live-supervisor
+*  command handler share this so the orchestrator owns the policy. */
+const defaultLifecyclePruneSelection = (inventory, resources = DEFAULT_LIFECYCLE_PRUNE_RESOURCES) => {
+	const pinned = lifecyclePruneAppsWithLiveSiblings(inventory);
+	const keys = [];
+	for (const group of inventory.groups) {
+		if (group.live) continue;
+		if (!groupHasResource(group, resources)) continue;
+		if (group.sharedKind === "per-app-shared" && pinned.has(group.app)) continue;
+		if (group.shared && !group.autoPrunable && group.sharedKind !== "per-app-shared") continue;
+		keys.push(group.key);
+	}
+	return keys;
+};
+const runLifecyclePrune = (options, selection) => Effect.gen(function* () {
+	const groups = enforcePinnedLifecyclePruneSelection(yield* collectLifecyclePruneInventory(options), selection);
+	let skippedLiveGroups = 0;
+	let containersRemoved = 0;
+	let networksRemoved = 0;
+	let networksSkipped = 0;
+	let volumesRemoved = 0;
+	let imagesRemoved = 0;
+	const prunableGroups = [];
+	for (const group of groups) {
+		if (group.live) {
+			skippedLiveGroups += 1;
+			continue;
+		}
+		if (selection.dryRun) {
+			prunableGroups.push(group);
+			if (selection.resources.containers) containersRemoved += group.containers;
+			if (selection.resources.networks) networksRemoved += group.networks;
+			if (selection.resources.volumes) volumesRemoved += group.volumes;
+			if (selection.resources.images) imagesRemoved += group.images;
+			continue;
+		}
+		if (!isRouterGroup(group)) {
+			if ((yield* livePidsForStack(options.runtimeRoot, group.stack)).length > 0) {
+				skippedLiveGroups += 1;
+				continue;
+			}
+		}
+		prunableGroups.push(group);
+	}
+	const foreignNetworkHolders = [];
+	const staleNetworkEndpoints = [];
+	yield* Effect.gen(function* () {
+		if (!selection.dryRun && selection.resources.containers) for (const group of prunableGroups) if (isRouterGroup(group)) containersRemoved += yield* removeDevstackContainersByKindAndName(ROUTER_KIND_LABEL_VALUE, group.stack).pipe(Effect.mapError(failPhase("remove-containers")));
+		else {
+			const match = {
+				app: group.app,
+				stack: group.stack
+			};
+			containersRemoved += yield* removeDevstackContainers(match).pipe(Effect.mapError(failPhase("remove-containers")));
+		}
+		if (!selection.dryRun && selection.resources.networks) for (const group of prunableGroups) {
+			const result = yield* removeDevstackNetworksBestEffort(matchTupleForGroup(group)).pipe(Effect.mapError(failPhase("remove-networks")));
+			networksRemoved += result.removed;
+			networksSkipped += result.skippedInUse;
+			for (const holder of result.foreignHolders) foreignNetworkHolders.push(holder);
+			for (const ep of result.staleEndpoints) staleNetworkEndpoints.push(ep);
+		}
+		if (!selection.dryRun && selection.resources.volumes) for (const group of prunableGroups) {
+			const match = matchTupleForGroup(group);
+			volumesRemoved += yield* removeDevstackVolumes(match).pipe(Effect.mapError(failPhase("remove-volumes")));
+		}
+		if (!selection.dryRun && selection.resources.images) for (const group of prunableGroups) {
+			const match = matchTupleForGroup(group);
+			imagesRemoved += yield* removeDevstackImages(match).pipe(Effect.mapError(failPhase("remove-images")));
+		}
+	}).pipe(Effect.provide(dockerLayer));
+	if (!selection.dryRun) yield* Effect.gen(function* () {
+		for (const group of prunableGroups) {
+			if (!isRouterGroup(group)) continue;
+			yield* removeRouterProfileStateForDockerStack({
+				runtimeRoot: options.runtimeRoot,
+				routerStack: group.stack
+			});
+		}
+	}).pipe(Effect.provide(NodeFileSystem.layer), Effect.withSpan("orchestrator.lifecycle-prune.removeRouterProfileState"));
+	return {
+		inspectedGroups: groups.length,
+		selectedGroups: prunableGroups.length,
+		skippedLiveGroups,
+		containersRemoved,
+		networksRemoved,
+		networksSkipped,
+		volumesRemoved,
+		imagesRemoved,
+		foreignNetworkHolders,
+		staleNetworkEndpoints
+	};
+}).pipe(Effect.withSpan("orchestrator.lifecycle-prune.run"));
+//#endregion
+export { DEFAULT_LIFECYCLE_PRUNE_RESOURCES, collectLifecyclePruneInventory, defaultLifecyclePruneSelection, lifecyclePruneAppsWithLiveSiblings, runLifecyclePrune };
+
+//# sourceMappingURL=index.mjs.map

package/dist/orchestrators/lifecycle-prune/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["joinPath"],"sources":["../../../src/orchestrators/lifecycle-prune/index.ts"],"sourcesContent":["// Lifecycle prune orchestrator — cross-stack Docker sweep.\n//\n// Architecture § L3 orchestrators. Walks the L1 docker inventory (the\n// reference `ContainerRuntime` adapter), groups labelled resources by\n// `(app, stack)`, consults the cross-process roster + claim ledger for\n// liveness, and dispatches removal through the sibling router cleanup\n// helper for router-shared resources.\n//\n// Name-blindness: this orchestrator never names a service. It walks\n// the engine label tuple (`LabelKey.app` / `LabelKey.stack`) which is\n// L1-substrate-level vocabulary and dispatches on the\n// `ROUTER_SHARED_APP` sentinel exported by the router orchestrator.\n//\n// Consumers: `cli/prune-direct.ts` (the L4-adjacent CLI infrastructure\n// for the `devstack prune` verb) calls `runLifecyclePrune` /\n// `collectLifecyclePruneInventory`. No L4 surface module imports L1\n// runtime adapters directly; that boundary lives here.\n\nimport { existsSync } from 'node:fs';\nimport { join as joinPath } from 'node:path';\n\nimport * as NodeChildProcessSpawner from '@effect/platform-node/NodeChildProcessSpawner';\nimport * as NodeFileSystem from '@effect/platform-node/NodeFileSystem';\nimport * as NodePath from '@effect/platform-node/NodePath';\nimport { Effect, Layer } from 'effect';\nimport { ChildProcessSpawner } from 'effect/unstable/process/ChildProcessSpawner';\n\nimport {\n\tDockerHost,\n\tDockerSpawner,\n\ttype ForeignNetworkHolder,\n\tLabelKey,\n\tlayerDockerHostDefault,\n\tlistDevstackContainers,\n\tlistDevstackContainersByKind,\n\tlistDevstackImages,\n\tlistDevstackNetworks,\n\tlistDevstackVolumes,\n\tremoveDevstackContainers,\n\tremoveDevstackContainersByKindAndName,\n\tremoveDevstackImages,\n\tremoveDevstackNetworksBestEffort,\n\tremoveDevstackVolumes,\n\ttype StaleNetworkEndpoint,\n} from '../../runtime/docker/index.ts';\nimport {\n\tlayerLivenessProbeScope,\n\tLivenessProbeScope,\n\treadRoster,\n} from '../../substrate/runtime/cross-process/index.ts';\nimport { PER_APP_SHARED_STACK } from '../../substrate/runtime/managed-container.ts';\nimport { logDebugAndFallback } from '../../substrate/runtime/observability/index.ts';\nimport { ROUTER_SHARED_APP, removeRouterProfileStateForDockerStack } from '../router/cleanup.ts';\n// Import the kind sentinel from its canonical source rather than the\n// `traefik-container.ts` re-export — the router-singleton label literals\n// live in `sentinels.ts`, and lifecycle-prune only needs the constant\n// (not the container ops), so depending on the sentinel module keeps the\n// import edge minimal and the source-of-truth direct.\nimport { ROUTER_KIND_LABEL_VALUE } from '../router/sentinels.ts';\nimport { failPhase, type LifecyclePruneError } from './errors.ts';\n\nexport { LifecyclePruneError, LifecyclePrunePhase } from './errors.ts';\n\n// -----------------------------------------------------------------------------\n// Public shapes — mirror `surfaces/cli/commands/prune.ts` field-for-field so\n// the verb dispatcher can consume the orchestrator output without an adapter.\n// -----------------------------------------------------------------------------\n\nexport interface LifecyclePruneOptions {\n\treadonly runtimeRoot: string;\n}\n\nexport interface LifecyclePruneGroup {\n\treadonly key: string;\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly live: boolean;\n\treadonly livePids: ReadonlyArray<number>;\n\treadonly shared: boolean;\n\t/** Discriminator for shared-resource groups. `'per-app-shared'`\n\t *  groups (the `_per-app_` synthetic stack) stay pinned while any\n\t *  sibling stack under the same app is live; `'router'` groups are\n\t *  auto-prunable when no app pins them. `null` for normal groups. */\n\treadonly sharedKind: SharedGroupKind | null;\n\t/** True when the group represents a router-shared resource set that\n\t *  is auto-prunable in non-interactive flows (`devstack prune --all`).\n\t *  Computed by the orchestrator so surfaces never recompute the\n\t *  router-stack naming predicate. */\n\treadonly autoPrunable: boolean;\n\treadonly containers: number;\n\treadonly runningContainers: number;\n\treadonly networks: number;\n\treadonly volumes: number;\n\treadonly images: number;\n}\n\n/** Kind of a shared-resource group. `'per-app-shared'` groups belong\n *  to the `PER_APP_SHARED_STACK` synthetic stack under a real app and\n *  stay pinned while a sibling stack is live. `'router'` groups are\n *  router-singleton resources. */\nexport type SharedGroupKind = 'per-app-shared' | 'router';\n\nexport interface LifecyclePruneInventory {\n\treadonly groups: ReadonlyArray<LifecyclePruneGroup>;\n}\n\nexport interface LifecyclePruneResourceScope {\n\treadonly containers: boolean;\n\treadonly networks: boolean;\n\treadonly volumes: boolean;\n\treadonly images: boolean;\n}\n\nexport interface LifecyclePruneSelection {\n\treadonly groupKeys: ReadonlyArray<string>;\n\treadonly resources: LifecyclePruneResourceScope;\n\treadonly dryRun: boolean;\n}\n\nexport interface LifecyclePruneSummary {\n\treadonly inspectedGroups: number;\n\treadonly selectedGroups: number;\n\treadonly skippedLiveGroups: number;\n\treadonly containersRemoved: number;\n\treadonly networksRemoved: number;\n\treadonly networksSkipped: number;\n\treadonly volumesRemoved: number;\n\treadonly imagesRemoved: number;\n\t/** Non-devstack containers still holding networks that prune could\n\t *  not remove. Empty when every network came down cleanly. */\n\treadonly foreignNetworkHolders: ReadonlyArray<ForeignNetworkHolder>;\n\t/** Endpoints Docker insists exist on a network but which no CLI/API\n\t *  path can address — symptom of a Docker engine bug (the bridge\n\t *  driver leaked endpoint metadata after a container was reaped).\n\t *  Only a Docker daemon restart clears these. */\n\treadonly staleNetworkEndpoints: ReadonlyArray<StaleNetworkEndpoint>;\n}\n\n// -----------------------------------------------------------------------------\n// Internal helpers\n// -----------------------------------------------------------------------------\n\ntype ResourceBucket = {\n\tcontainers: number;\n\trunningContainers: number;\n\tnetworks: number;\n\tvolumes: number;\n\timages: number;\n};\n\nconst layerDockerSpawnerFromNode: Layer.Layer<DockerSpawner, never, ChildProcessSpawner> =\n\tLayer.effect(\n\t\tDockerSpawner,\n\t\tEffect.gen(function* () {\n\t\t\treturn yield* ChildProcessSpawner;\n\t\t}),\n\t);\n\nconst dockerLayer: Layer.Layer<DockerHost | DockerSpawner> = Layer.merge(\n\tlayerDockerHostDefault,\n\tlayerDockerSpawnerFromNode.pipe(\n\t\tLayer.provideMerge(\n\t\t\tNodeChildProcessSpawner.layer.pipe(\n\t\t\t\tLayer.provideMerge(Layer.mergeAll(NodeFileSystem.layer, NodePath.layer)),\n\t\t\t),\n\t\t),\n\t),\n);\n\nconst emptyBucket = (): ResourceBucket => ({\n\tcontainers: 0,\n\trunningContainers: 0,\n\tnetworks: 0,\n\tvolumes: 0,\n\timages: 0,\n});\n\n/** Public, parser-safe key for a `(app, stack)` group. Display-only —\n *  internal grouping uses the structural `{app, stack}` tuple via the\n *  `GroupBuckets` map below, so a slash inside `app` or `stack` cannot\n *  produce a wrong tuple. The separator is a forward slash for human-\n *  readable log/JSON output (`arena/main`); membership tests round-trip\n *  through this same constructor so callers never re-split the key —\n *  any potential `/`-in-app-or-stack ambiguity is resolved structurally\n *  by `GroupBuckets`, not by string-splitting the key. */\nconst GROUP_KEY_SEPARATOR = '/';\n\nexport const lifecyclePruneGroupKey = (app: string, stack: string): string =>\n\t`${app}${GROUP_KEY_SEPARATOR}${stack}`;\n\n/** Map keyed on `(app, stack)` tuples without string encoding. Tuple\n *  equality is achieved by interning each `(app, stack)` pair through\n *  a nested `app → stack → bucket` index, so the map is collision-\n *  free even when `app` or `stack` contains a separator character. */\nclass GroupBuckets {\n\tprivate readonly buckets = new Map<string, Map<string, ResourceBucket>>();\n\n\tget(identity: { readonly app: string; readonly stack: string }): ResourceBucket {\n\t\tlet perApp = this.buckets.get(identity.app);\n\t\tif (perApp === undefined) {\n\t\t\tperApp = new Map<string, ResourceBucket>();\n\t\t\tthis.buckets.set(identity.app, perApp);\n\t\t}\n\t\tlet bucket = perApp.get(identity.stack);\n\t\tif (bucket === undefined) {\n\t\t\tbucket = emptyBucket();\n\t\t\tperApp.set(identity.stack, bucket);\n\t\t}\n\t\treturn bucket;\n\t}\n\n\t*entries(): Iterable<{\n\t\treadonly app: string;\n\t\treadonly stack: string;\n\t\treadonly bucket: ResourceBucket;\n\t}> {\n\t\tfor (const [app, perApp] of this.buckets) {\n\t\t\tfor (const [stack, bucket] of perApp) {\n\t\t\t\tyield { app, stack, bucket };\n\t\t\t}\n\t\t}\n\t}\n}\n\nconst readAppStack = (\n\tlabels: Readonly<Record<string, string>>,\n): { readonly app: string; readonly stack: string } | null => {\n\tconst app = labels[LabelKey.app];\n\tconst stack = labels[LabelKey.stack];\n\tif (app === undefined || app.length === 0) return null;\n\tif (stack === undefined || stack.length === 0) return null;\n\treturn { app, stack };\n};\n\nconst routerStackForContainer = (\n\tname: string,\n): { readonly app: string; readonly stack: string } => ({\n\tapp: ROUTER_SHARED_APP,\n\tstack: name,\n});\n\n/** Read the live-PID set for a stack from its roster.\n *\n *  Path policy: `<runtimeRoot>/stacks/<stack>/roster.json`. This is the\n *  same key the entire substrate uses — see `substrate/runtime/paths.ts`\n *  (`path.join(root, 'stacks', identity.stack)`) — so the path here\n *  carries no NEW cross-attribution risk beyond the substrate-wide\n *  decision to key per-stack-disk-state on `stack` alone. (Two stacks\n *  in DIFFERENT apps that pick the SAME stack name would already share\n *  every other on-disk artifact — `state.json`, `cache/`, `snapshots/`,\n *  `stack.lock`, `container-claims.json`. The Docker-level discriminator\n *  is the container/network/volume NAME, which IS `<app>-<stack>-…`\n *  composed inside each plugin; so cross-attribution at the daemon\n *  level is prevented by name uniqueness even when disk state collides.)\n *\n *  This function deliberately omits `app` from the path so the\n *  prune sweeper agrees with every other consumer (`cli/main.ts`,\n *  `cli/wirings/identity.ts`, `cli/wirings/up.ts`, the roster module\n *  itself). Promoting `app` into the stack-state path is an\n *  architectural change that must update all of those call sites in\n *  lockstep — out of scope for this orchestrator. */\nconst livePidsForStack = (\n\truntimeRoot: string,\n\tstack: string,\n): Effect.Effect<ReadonlyArray<number>> => {\n\tconst rosterFile = joinPath(runtimeRoot, 'stacks', stack, 'roster.json');\n\tif (!existsSync(rosterFile)) return Effect.succeed([]);\n\t// Yield a fresh `LivenessProbeScope` so a recycled-PID corner case\n\t// (multiple holders sharing one pid in the same roster) forks the OS\n\t// liveness probe once per pid across this scan.\n\treturn Effect.gen(function* () {\n\t\tconst doc = yield* readRoster(rosterFile).pipe(\n\t\t\tlogDebugAndFallback(null, 'lifecycle-prune: roster read failed; treating as empty', {\n\t\t\t\trosterFile,\n\t\t\t}),\n\t\t);\n\t\tif (doc === null) return [];\n\t\tconst probe = yield* LivenessProbeScope;\n\t\tconst pids: Array<number> = [];\n\t\tfor (const holder of doc.holders) {\n\t\t\tconst live = yield* probe\n\t\t\t\t.probeHolderLiveness(holder)\n\t\t\t\t.pipe(\n\t\t\t\t\tlogDebugAndFallback(\n\t\t\t\t\t\t'alive' as const,\n\t\t\t\t\t\t'lifecycle-prune: liveness check failed; assuming alive',\n\t\t\t\t\t\t{ pid: holder.pid },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\tif (live === 'alive') pids.push(holder.pid);\n\t\t}\n\t\treturn pids;\n\t}).pipe(Effect.provide(layerLivenessProbeScope));\n};\n\n/** True when the group is one of the two shared shapes the\n *  orchestrator knows about: `_per-app_` (cross-stack-per-app shared)\n *  or the router-singleton (`ROUTER_SHARED_APP`). Surfaces consult\n *  this instead of recomputing the predicate. */\nexport const isSharedLifecyclePruneGroup = (app: string, stack: string): boolean =>\n\tstack === PER_APP_SHARED_STACK || app === ROUTER_SHARED_APP;\n\nconst sharedKindFor = (app: string, stack: string): SharedGroupKind | null => {\n\tif (app === ROUTER_SHARED_APP) return 'router';\n\tif (stack === PER_APP_SHARED_STACK) return 'per-app-shared';\n\treturn null;\n};\n\n/** True when the group represents a router-singleton resource set.\n *  Exported so L4 surfaces can call this rather than re-implement the\n *  router-stack naming predicate. */\nexport const isRouterLifecyclePruneGroup = (\n\tgroup: Pick<LifecyclePruneGroup, 'app' | 'stack'>,\n): boolean => group.app === ROUTER_SHARED_APP && group.stack.startsWith(`${ROUTER_SHARED_APP}-`);\n\n// Internal aliases for back-compat call sites in this file.\nconst isRouterGroup = isRouterLifecyclePruneGroup;\nconst isSharedGroup = isSharedLifecyclePruneGroup;\n\n/** Label-tuple match for the `removeDevstack*` sweepers — router-shared\n *  resources stamp `{app: ROUTER_SHARED_APP, stack: <profile-name>}`\n *  (see `traefik-container.ts:ensureNetwork`) and the inventory pass\n *  buckets them under `routerStackForContainer(container.name)`, so for\n *  router groups the tuple is `{app: ROUTER_SHARED_APP, stack: group.stack}`.\n *  For non-router groups it's the bucket's literal `{app, stack}`. The\n *  branch is structurally identical to the container-removal branch's\n *  router-specific dispatch via `removeDevstackContainersByKindAndName`,\n *  so dry-run inventory counts and real-run removal stay in lockstep\n *  for router resources. Exported so tests can pin the dry-run ↔\n *  real-run parity without standing up a Docker daemon. */\nexport const lifecyclePruneRemovalMatchTuple = (\n\tgroup: Pick<LifecyclePruneGroup, 'app' | 'stack'>,\n): { readonly app: string; readonly stack: string } =>\n\tisRouterGroup(group)\n\t\t? { app: ROUTER_SHARED_APP, stack: group.stack }\n\t\t: { app: group.app, stack: group.stack };\n\nconst matchTupleForGroup = lifecyclePruneRemovalMatchTuple;\n\n// -----------------------------------------------------------------------------\n// Orchestrator entry points\n// -----------------------------------------------------------------------------\n\nexport const collectLifecyclePruneInventory = (\n\toptions: LifecyclePruneOptions,\n): Effect.Effect<LifecyclePruneInventory, LifecyclePruneError> =>\n\tEffect.gen(function* () {\n\t\tconst [containers, routerContainers, networks, volumes, images] = yield* Effect.all(\n\t\t\t[\n\t\t\t\tlistDevstackContainers(),\n\t\t\t\tlistDevstackContainersByKind(ROUTER_KIND_LABEL_VALUE),\n\t\t\t\tlistDevstackNetworks(),\n\t\t\t\tlistDevstackVolumes(),\n\t\t\t\tlistDevstackImages(),\n\t\t\t],\n\t\t\t{ concurrency: 'unbounded' },\n\t\t).pipe(Effect.provide(dockerLayer), Effect.mapError(failPhase('inventory')));\n\n\t\tconst buckets = new GroupBuckets();\n\n\t\tfor (const container of containers) {\n\t\t\tconst identity = readAppStack(container.labels);\n\t\t\tif (identity === null) continue;\n\t\t\tconst bucket = buckets.get(identity);\n\t\t\tbucket.containers += 1;\n\t\t\tif (container.state === 'running') bucket.runningContainers += 1;\n\t\t}\n\t\tfor (const container of routerContainers) {\n\t\t\tconst bucket = buckets.get(routerStackForContainer(container.name));\n\t\t\tbucket.containers += 1;\n\t\t\tif (container.state === 'running') bucket.runningContainers += 1;\n\t\t}\n\t\tfor (const network of networks) {\n\t\t\tconst identity = readAppStack(network.labels);\n\t\t\tif (identity === null) continue;\n\t\t\tbuckets.get(identity).networks += 1;\n\t\t}\n\t\tfor (const volume of volumes) {\n\t\t\tconst identity = readAppStack(volume.labels);\n\t\t\tif (identity === null) continue;\n\t\t\tbuckets.get(identity).volumes += 1;\n\t\t}\n\t\tfor (const image of images) {\n\t\t\tconst identity = readAppStack(image.labels);\n\t\t\tif (identity === null) continue;\n\t\t\tbuckets.get(identity).images += 1;\n\t\t}\n\n\t\tconst groups: Array<LifecyclePruneGroup> = [];\n\t\tfor (const entry of buckets.entries()) {\n\t\t\tconst { app, stack, bucket } = entry;\n\t\t\tconst routerGroup = app === ROUTER_SHARED_APP;\n\t\t\tconst livePids = routerGroup ? [] : yield* livePidsForStack(options.runtimeRoot, stack);\n\t\t\t// Liveness is the OR of two independent signals so a live stack\n\t\t\t// is never mis-reported `live:false` (and so never swept by\n\t\t\t// `devstack prune --all`):\n\t\t\t//\n\t\t\t//   1. The per-stack roster carries a live holder (`livePids`\n\t\t\t//      — the SAME `<root>/stacks/<stack>/roster.json` probe\n\t\t\t//      `ensureNoLiveSupervisor` / `probeSupervisorPresence` use;\n\t\t\t//      see `livePidsForStack`). Authoritative supervisor-presence\n\t\t\t//      signal; also yields the PID detail.\n\t\t\t//   2. The Docker daemon reports a RUNNING container for the\n\t\t\t//      group. A `devstack up` supervisor always has running\n\t\t\t//      containers, so this catches a live stack even when the\n\t\t\t//      roster probe transiently comes back empty — a missing/\n\t\t\t//      stale roster file, a holder reaped by a peer sweep, or a\n\t\t\t//      `ps -o lstart` start-time hiccup that harvests a live\n\t\t\t//      holder as dead. Running containers are a daemon-\n\t\t\t//      authoritative \"not idle\" signal, so this only ever ADDS\n\t\t\t//      protection; it never reclassifies as idle a stack the\n\t\t\t//      roster probe alone would have protected.\n\t\t\t//\n\t\t\t// The router branch already keyed liveness on\n\t\t\t// `runningContainers > 0` (router singletons carry no per-stack\n\t\t\t// roster); folding the same signal into normal groups makes the\n\t\t\t// classification uniform and closes the under-report.\n\t\t\tconst live = livePids.length > 0 || bucket.runningContainers > 0;\n\t\t\tgroups.push({\n\t\t\t\tkey: lifecyclePruneGroupKey(app, stack),\n\t\t\t\tapp,\n\t\t\t\tstack,\n\t\t\t\tlive,\n\t\t\t\tlivePids,\n\t\t\t\tshared: isSharedGroup(app, stack),\n\t\t\t\tsharedKind: sharedKindFor(app, stack),\n\t\t\t\tautoPrunable: isRouterGroup({ app, stack }),\n\t\t\t\tcontainers: bucket.containers,\n\t\t\t\trunningContainers: bucket.runningContainers,\n\t\t\t\tnetworks: bucket.networks,\n\t\t\t\tvolumes: bucket.volumes,\n\t\t\t\timages: bucket.images,\n\t\t\t});\n\t\t}\n\n\t\tgroups.sort((a, b) => {\n\t\t\tif (a.app !== b.app) return a.app < b.app ? -1 : 1;\n\t\t\treturn a.stack < b.stack ? -1 : a.stack > b.stack ? 1 : 0;\n\t\t});\n\n\t\treturn { groups };\n\t}).pipe(Effect.withSpan('orchestrator.lifecycle-prune.inventory'));\n\nconst selectedGroups = (\n\tinventory: LifecyclePruneInventory,\n\tselection: LifecyclePruneSelection,\n): ReadonlyArray<LifecyclePruneGroup> => {\n\tconst selected = new Set(selection.groupKeys);\n\treturn inventory.groups.filter((group) => selected.has(group.key));\n};\n\n/** Defensive enforcement of the per-app-shared pinning rule for a\n *  caller-supplied selection. Resolves `selection.groupKeys` against\n *  `inventory` and drops any `per-app-shared` group whose app still has\n *  a live sibling — reusing the SAME predicate as\n *  `defaultLifecyclePruneSelection` so a selection built outside the\n *  default path (interactive picker, scripted, programmatic) can never\n *  remove a shared group a live sibling depends on. Exported so the\n *  invariant is unit-testable without a Docker daemon. */\nexport const enforcePinnedLifecyclePruneSelection = (\n\tinventory: LifecyclePruneInventory,\n\tselection: LifecyclePruneSelection,\n): ReadonlyArray<LifecyclePruneGroup> => {\n\tconst pinned = lifecyclePruneAppsWithLiveSiblings(inventory);\n\treturn selectedGroups(inventory, selection).filter(\n\t\t(group) => !(group.sharedKind === 'per-app-shared' && pinned.has(group.app)),\n\t);\n};\n\n/** Default resource scope for the lifecycle-prune orchestrator —\n *  containers + networks + volumes, never images. Surfaces consume\n *  this directly so the default never drifts between L3 and L4. */\nexport const DEFAULT_LIFECYCLE_PRUNE_RESOURCES: LifecyclePruneResourceScope = {\n\tcontainers: true,\n\tnetworks: true,\n\tvolumes: true,\n\timages: false,\n};\n\n/** Apps with at least one live non-shared group — their `_per-app_`\n *  shared resources stay pinned because something under the app is\n *  still running. Exported so L4 surfaces consume the orchestrator's\n *  pinning predicate. */\nexport const lifecyclePruneAppsWithLiveSiblings = (\n\tinventory: LifecyclePruneInventory,\n): ReadonlySet<string> => {\n\tconst apps = new Set<string>();\n\tfor (const group of inventory.groups) {\n\t\tif (!group.shared && group.live) apps.add(group.app);\n\t}\n\treturn apps;\n};\n\nconst groupHasResource = (\n\tgroup: LifecyclePruneGroup,\n\tresources: LifecyclePruneResourceScope,\n): boolean =>\n\t(resources.containers && group.containers > 0) ||\n\t(resources.networks && group.networks > 0) ||\n\t(resources.volumes && group.volumes > 0) ||\n\t(resources.images && group.images > 0);\n\n/** Default selection: every non-live group whose shared shape is\n *  prunable in non-interactive flows. Surfaces and the live-supervisor\n *  command handler share this so the orchestrator owns the policy. */\nexport const defaultLifecyclePruneSelection = (\n\tinventory: LifecyclePruneInventory,\n\tresources: LifecyclePruneResourceScope = DEFAULT_LIFECYCLE_PRUNE_RESOURCES,\n): ReadonlyArray<string> => {\n\tconst pinned = lifecyclePruneAppsWithLiveSiblings(inventory);\n\tconst keys: string[] = [];\n\tfor (const group of inventory.groups) {\n\t\tif (group.live) continue;\n\t\tif (!groupHasResource(group, resources)) continue;\n\t\tif (group.sharedKind === 'per-app-shared' && pinned.has(group.app)) continue;\n\t\tif (group.shared && !group.autoPrunable && group.sharedKind !== 'per-app-shared') continue;\n\t\tkeys.push(group.key);\n\t}\n\treturn keys;\n};\n\nexport const runLifecyclePrune = (\n\toptions: LifecyclePruneOptions,\n\tselection: LifecyclePruneSelection,\n): Effect.Effect<LifecyclePruneSummary, LifecyclePruneError> =>\n\tEffect.gen(function* () {\n\t\tconst inventory = yield* collectLifecyclePruneInventory(options);\n\t\t// Defensive enforcement: a caller-supplied selection (interactive\n\t\t// picker, scripted `--all`, or a programmatic caller) must never\n\t\t// remove a `per-app-shared` group pinned by a live sibling. The\n\t\t// default selection already drops these (see\n\t\t// `defaultLifecyclePruneSelection`); re-applying the SAME predicate\n\t\t// here guarantees the rule holds even when the selection was built\n\t\t// elsewhere.\n\t\tconst groups = enforcePinnedLifecyclePruneSelection(inventory, selection);\n\t\tlet skippedLiveGroups = 0;\n\t\tlet containersRemoved = 0;\n\t\tlet networksRemoved = 0;\n\t\tlet networksSkipped = 0;\n\t\tlet volumesRemoved = 0;\n\t\tlet imagesRemoved = 0;\n\n\t\tconst prunableGroups: Array<LifecyclePruneGroup> = [];\n\t\tfor (const group of groups) {\n\t\t\tif (group.live) {\n\t\t\t\tskippedLiveGroups += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (selection.dryRun) {\n\t\t\t\tprunableGroups.push(group);\n\t\t\t\tif (selection.resources.containers) containersRemoved += group.containers;\n\t\t\t\tif (selection.resources.networks) networksRemoved += group.networks;\n\t\t\t\tif (selection.resources.volumes) volumesRemoved += group.volumes;\n\t\t\t\tif (selection.resources.images) imagesRemoved += group.images;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t// TOCTOU close: `collectLifecyclePruneInventory` probed liveness\n\t\t\t// ONCE at the top of this run. A stack that booted in the window\n\t\t\t// between that snapshot and here (a concurrent `devstack up` of a\n\t\t\t// previously-dead stack) would have its containers/networks/volumes\n\t\t\t// removed out from under the freshly-started supervisor. Re-probe\n\t\t\t// each non-router victim's roster via the SAME helper the inventory\n\t\t\t// pass used (`livePidsForStack`) immediately before committing it to\n\t\t\t// removal, and skip any group that came alive since. Router groups\n\t\t\t// carry no per-stack roster (their inventory liveness is\n\t\t\t// `runningContainers`), so they keep the snapshot classification —\n\t\t\t// mirroring the `routerGroup` branch in the inventory pass.\n\t\t\tif (!isRouterGroup(group)) {\n\t\t\t\tconst livePids = yield* livePidsForStack(options.runtimeRoot, group.stack);\n\t\t\t\tif (livePids.length > 0) {\n\t\t\t\t\tskippedLiveGroups += 1;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t}\n\t\t\tprunableGroups.push(group);\n\t\t}\n\n\t\tconst foreignNetworkHolders: Array<ForeignNetworkHolder> = [];\n\t\tconst staleNetworkEndpoints: Array<StaleNetworkEndpoint> = [];\n\t\t// Provide `dockerLayer` ONCE around the whole removal section rather\n\t\t// than re-providing it per group per resource. The inventory pass\n\t\t// already provides it once for its parallel scan; the removal loops\n\t\t// mirror that so the layer's docker-host resolution is built a single\n\t\t// time, not rebuilt for every container/network/volume/image removal.\n\t\t// The per-call `Effect.mapError(failPhase(...))` stays inside each\n\t\t// loop so each removal still carries its phase-specific tag.\n\t\tyield* Effect.gen(function* () {\n\t\t\tif (!selection.dryRun && selection.resources.containers) {\n\t\t\t\tfor (const group of prunableGroups) {\n\t\t\t\t\tif (isRouterGroup(group)) {\n\t\t\t\t\t\tcontainersRemoved += yield* removeDevstackContainersByKindAndName(\n\t\t\t\t\t\t\tROUTER_KIND_LABEL_VALUE,\n\t\t\t\t\t\t\tgroup.stack,\n\t\t\t\t\t\t).pipe(Effect.mapError(failPhase('remove-containers')));\n\t\t\t\t\t} else {\n\t\t\t\t\t\tconst match = { app: group.app, stack: group.stack };\n\t\t\t\t\t\tcontainersRemoved += yield* removeDevstackContainers(match).pipe(\n\t\t\t\t\t\t\tEffect.mapError(failPhase('remove-containers')),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!selection.dryRun && selection.resources.networks) {\n\t\t\t\tfor (const group of prunableGroups) {\n\t\t\t\t\tconst match = matchTupleForGroup(group);\n\t\t\t\t\tconst result = yield* removeDevstackNetworksBestEffort(match).pipe(\n\t\t\t\t\t\tEffect.mapError(failPhase('remove-networks')),\n\t\t\t\t\t);\n\t\t\t\t\tnetworksRemoved += result.removed;\n\t\t\t\t\tnetworksSkipped += result.skippedInUse;\n\t\t\t\t\tfor (const holder of result.foreignHolders) foreignNetworkHolders.push(holder);\n\t\t\t\t\tfor (const ep of result.staleEndpoints) staleNetworkEndpoints.push(ep);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!selection.dryRun && selection.resources.volumes) {\n\t\t\t\tfor (const group of prunableGroups) {\n\t\t\t\t\tconst match = matchTupleForGroup(group);\n\t\t\t\t\tvolumesRemoved += yield* removeDevstackVolumes(match).pipe(\n\t\t\t\t\t\tEffect.mapError(failPhase('remove-volumes')),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!selection.dryRun && selection.resources.images) {\n\t\t\t\tfor (const group of prunableGroups) {\n\t\t\t\t\tconst match = matchTupleForGroup(group);\n\t\t\t\t\timagesRemoved += yield* removeDevstackImages(match).pipe(\n\t\t\t\t\t\tEffect.mapError(failPhase('remove-images')),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}).pipe(Effect.provide(dockerLayer));\n\n\t\tif (!selection.dryRun) {\n\t\t\tyield* Effect.gen(function* () {\n\t\t\t\tfor (const group of prunableGroups) {\n\t\t\t\t\tif (!isRouterGroup(group)) continue;\n\t\t\t\t\tyield* removeRouterProfileStateForDockerStack({\n\t\t\t\t\t\truntimeRoot: options.runtimeRoot,\n\t\t\t\t\t\trouterStack: group.stack,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}).pipe(\n\t\t\t\tEffect.provide(NodeFileSystem.layer),\n\t\t\t\tEffect.withSpan('orchestrator.lifecycle-prune.removeRouterProfileState'),\n\t\t\t);\n\t\t}\n\n\t\treturn {\n\t\t\tinspectedGroups: groups.length,\n\t\t\t// Groups actually selected for pruning — `groups.length` minus\n\t\t\t// the live ones skipped above, NOT the inspected total.\n\t\t\tselectedGroups: prunableGroups.length,\n\t\t\tskippedLiveGroups,\n\t\t\tcontainersRemoved,\n\t\t\tnetworksRemoved,\n\t\t\tnetworksSkipped,\n\t\t\tvolumesRemoved,\n\t\t\timagesRemoved,\n\t\t\tforeignNetworkHolders,\n\t\t\tstaleNetworkEndpoints,\n\t\t};\n\t}).pipe(Effect.withSpan('orchestrator.lifecycle-prune.run'));\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAsJA,MAAM,6BACL,MAAM,OACL,eACA,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO;EACb,CACF;AAEF,MAAM,cAAuD,MAAM,MAClE,wBACA,2BAA2B,KAC1B,MAAM,aACL,wBAAwB,MAAM,KAC7B,MAAM,aAAa,MAAM,SAAS,eAAe,OAAO,SAAS,MAAM,CAAC,CACxE,CACD,CACD,CACD;AAED,MAAM,qBAAqC;CAC1C,YAAY;CACZ,mBAAmB;CACnB,UAAU;CACV,SAAS;CACT,QAAQ;CACR;;;;;;;;;AAUD,MAAM,sBAAsB;AAE5B,MAAa,0BAA0B,KAAa,UACnD,GAAG,MAAM,sBAAsB;;;;;AAMhC,IAAM,eAAN,MAAmB;CAClB,0BAA2B,IAAI,KAA0C;CAEzE,IAAI,UAA4E;EAC/E,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI;AAC3C,MAAI,WAAW,KAAA,GAAW;AACzB,4BAAS,IAAI,KAA6B;AAC1C,QAAK,QAAQ,IAAI,SAAS,KAAK,OAAO;;EAEvC,IAAI,SAAS,OAAO,IAAI,SAAS,MAAM;AACvC,MAAI,WAAW,KAAA,GAAW;AACzB,YAAS,aAAa;AACtB,UAAO,IAAI,SAAS,OAAO,OAAO;;AAEnC,SAAO;;CAGR,CAAC,UAIE;AACF,OAAK,MAAM,CAAC,KAAK,WAAW,KAAK,QAChC,MAAK,MAAM,CAAC,OAAO,WAAW,OAC7B,OAAM;GAAE;GAAK;GAAO;GAAQ;;;AAMhC,MAAM,gBACL,WAC6D;CAC7D,MAAM,MAAM,OAAO,SAAS;CAC5B,MAAM,QAAQ,OAAO,SAAS;AAC9B,KAAI,QAAQ,KAAA,KAAa,IAAI,WAAW,EAAG,QAAO;AAClD,KAAI,UAAU,KAAA,KAAa,MAAM,WAAW,EAAG,QAAO;AACtD,QAAO;EAAE;EAAK;EAAO;;AAGtB,MAAM,2BACL,UACuD;CACvD,KAAK;CACL,OAAO;CACP;;;;;;;;;;;;;;;;;;;;;AAsBD,MAAM,oBACL,aACA,UAC0C;CAC1C,MAAM,aAAaA,KAAS,aAAa,UAAU,OAAO,cAAc;AACxE,KAAI,CAAC,WAAW,WAAW,CAAE,QAAO,OAAO,QAAQ,EAAE,CAAC;AAItD,QAAO,OAAO,IAAI,aAAa;EAC9B,MAAM,MAAM,OAAO,WAAW,WAAW,CAAC,KACzC,oBAAoB,MAAM,0DAA0D,EACnF,YACA,CAAC,CACF;AACD,MAAI,QAAQ,KAAM,QAAO,EAAE;EAC3B,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAsB,EAAE;AAC9B,OAAK,MAAM,UAAU,IAAI,QAUxB,MAAI,OATgB,MAClB,oBAAoB,OAAO,CAC3B,KACA,oBACC,SACA,0DACA,EAAE,KAAK,OAAO,KAAK,CACnB,CACD,MACW,QAAS,MAAK,KAAK,OAAO,IAAI;AAE5C,SAAO;GACN,CAAC,KAAK,OAAO,QAAQ,wBAAwB,CAAC;;;;;;AAOjD,MAAa,+BAA+B,KAAa,UACxD,UAAA,eAAkC,QAAA;AAEnC,MAAM,iBAAiB,KAAa,UAA0C;AAC7E,KAAI,QAAA,kBAA2B,QAAO;AACtC,KAAI,UAAA,YAAgC,QAAO;AAC3C,QAAO;;;;;AAMR,MAAa,+BACZ,UACa,MAAM,QAAA,qBAA6B,MAAM,MAAM,WAAW,mBAAwB;AAGhG,MAAM,gBAAgB;AACtB,MAAM,gBAAgB;;;;;;;;;;;;AAatB,MAAa,mCACZ,UAEA,cAAc,MAAM,GACjB;CAAE,KAAK;CAAmB,OAAO,MAAM;CAAO,GAC9C;CAAE,KAAK,MAAM;CAAK,OAAO,MAAM;CAAO;AAE1C,MAAM,qBAAqB;AAM3B,MAAa,kCACZ,YAEA,OAAO,IAAI,aAAa;CACvB,MAAM,CAAC,YAAY,kBAAkB,UAAU,SAAS,UAAU,OAAO,OAAO,IAC/E;EACC,wBAAwB;EACxB,6BAA6B,wBAAwB;EACrD,sBAAsB;EACtB,qBAAqB;EACrB,oBAAoB;EACpB,EACD,EAAE,aAAa,aAAa,CAC5B,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,SAAS,UAAU,YAAY,CAAC,CAAC;CAE5E,MAAM,UAAU,IAAI,cAAc;AAElC,MAAK,MAAM,aAAa,YAAY;EACnC,MAAM,WAAW,aAAa,UAAU,OAAO;AAC/C,MAAI,aAAa,KAAM;EACvB,MAAM,SAAS,QAAQ,IAAI,SAAS;AACpC,SAAO,cAAc;AACrB,MAAI,UAAU,UAAU,UAAW,QAAO,qBAAqB;;AAEhE,MAAK,MAAM,aAAa,kBAAkB;EACzC,MAAM,SAAS,QAAQ,IAAI,wBAAwB,UAAU,KAAK,CAAC;AACnE,SAAO,cAAc;AACrB,MAAI,UAAU,UAAU,UAAW,QAAO,qBAAqB;;AAEhE,MAAK,MAAM,WAAW,UAAU;EAC/B,MAAM,WAAW,aAAa,QAAQ,OAAO;AAC7C,MAAI,aAAa,KAAM;AACvB,UAAQ,IAAI,SAAS,CAAC,YAAY;;AAEnC,MAAK,MAAM,UAAU,SAAS;EAC7B,MAAM,WAAW,aAAa,OAAO,OAAO;AAC5C,MAAI,aAAa,KAAM;AACvB,UAAQ,IAAI,SAAS,CAAC,WAAW;;AAElC,MAAK,MAAM,SAAS,QAAQ;EAC3B,MAAM,WAAW,aAAa,MAAM,OAAO;AAC3C,MAAI,aAAa,KAAM;AACvB,UAAQ,IAAI,SAAS,CAAC,UAAU;;CAGjC,MAAM,SAAqC,EAAE;AAC7C,MAAK,MAAM,SAAS,QAAQ,SAAS,EAAE;EACtC,MAAM,EAAE,KAAK,OAAO,WAAW;EAE/B,MAAM,WADc,QAAA,oBACW,EAAE,GAAG,OAAO,iBAAiB,QAAQ,aAAa,MAAM;EAyBvF,MAAM,OAAO,SAAS,SAAS,KAAK,OAAO,oBAAoB;AAC/D,SAAO,KAAK;GACX,KAAK,uBAAuB,KAAK,MAAM;GACvC;GACA;GACA;GACA;GACA,QAAQ,cAAc,KAAK,MAAM;GACjC,YAAY,cAAc,KAAK,MAAM;GACrC,cAAc,cAAc;IAAE;IAAK;IAAO,CAAC;GAC3C,YAAY,OAAO;GACnB,mBAAmB,OAAO;GAC1B,UAAU,OAAO;GACjB,SAAS,OAAO;GAChB,QAAQ,OAAO;GACf,CAAC;;AAGH,QAAO,MAAM,GAAG,MAAM;AACrB,MAAI,EAAE,QAAQ,EAAE,IAAK,QAAO,EAAE,MAAM,EAAE,MAAM,KAAK;AACjD,SAAO,EAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI;GACvD;AAEF,QAAO,EAAE,QAAQ;EAChB,CAAC,KAAK,OAAO,SAAS,yCAAyC,CAAC;AAEnE,MAAM,kBACL,WACA,cACwC;CACxC,MAAM,WAAW,IAAI,IAAI,UAAU,UAAU;AAC7C,QAAO,UAAU,OAAO,QAAQ,UAAU,SAAS,IAAI,MAAM,IAAI,CAAC;;;;;;;;;;AAWnE,MAAa,wCACZ,WACA,cACwC;CACxC,MAAM,SAAS,mCAAmC,UAAU;AAC5D,QAAO,eAAe,WAAW,UAAU,CAAC,QAC1C,UAAU,EAAE,MAAM,eAAe,oBAAoB,OAAO,IAAI,MAAM,IAAI,EAC3E;;;;;AAMF,MAAa,oCAAiE;CAC7E,YAAY;CACZ,UAAU;CACV,SAAS;CACT,QAAQ;CACR;;;;;AAMD,MAAa,sCACZ,cACyB;CACzB,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,SAAS,UAAU,OAC7B,KAAI,CAAC,MAAM,UAAU,MAAM,KAAM,MAAK,IAAI,MAAM,IAAI;AAErD,QAAO;;AAGR,MAAM,oBACL,OACA,cAEC,UAAU,cAAc,MAAM,aAAa,KAC3C,UAAU,YAAY,MAAM,WAAW,KACvC,UAAU,WAAW,MAAM,UAAU,KACrC,UAAU,UAAU,MAAM,SAAS;;;;AAKrC,MAAa,kCACZ,WACA,YAAyC,sCACd;CAC3B,MAAM,SAAS,mCAAmC,UAAU;CAC5D,MAAM,OAAiB,EAAE;AACzB,MAAK,MAAM,SAAS,UAAU,QAAQ;AACrC,MAAI,MAAM,KAAM;AAChB,MAAI,CAAC,iBAAiB,OAAO,UAAU,CAAE;AACzC,MAAI,MAAM,eAAe,oBAAoB,OAAO,IAAI,MAAM,IAAI,CAAE;AACpE,MAAI,MAAM,UAAU,CAAC,MAAM,gBAAgB,MAAM,eAAe,iBAAkB;AAClF,OAAK,KAAK,MAAM,IAAI;;AAErB,QAAO;;AAGR,MAAa,qBACZ,SACA,cAEA,OAAO,IAAI,aAAa;CASvB,MAAM,SAAS,qCAAqC,OAR3B,+BAA+B,QAAQ,EAQD,UAAU;CACzE,IAAI,oBAAoB;CACxB,IAAI,oBAAoB;CACxB,IAAI,kBAAkB;CACtB,IAAI,kBAAkB;CACtB,IAAI,iBAAiB;CACrB,IAAI,gBAAgB;CAEpB,MAAM,iBAA6C,EAAE;AACrD,MAAK,MAAM,SAAS,QAAQ;AAC3B,MAAI,MAAM,MAAM;AACf,wBAAqB;AACrB;;AAED,MAAI,UAAU,QAAQ;AACrB,kBAAe,KAAK,MAAM;AAC1B,OAAI,UAAU,UAAU,WAAY,sBAAqB,MAAM;AAC/D,OAAI,UAAU,UAAU,SAAU,oBAAmB,MAAM;AAC3D,OAAI,UAAU,UAAU,QAAS,mBAAkB,MAAM;AACzD,OAAI,UAAU,UAAU,OAAQ,kBAAiB,MAAM;AACvD;;AAaD,MAAI,CAAC,cAAc,MAAM;QAEpB,OADoB,iBAAiB,QAAQ,aAAa,MAAM,MAAM,EAC7D,SAAS,GAAG;AACxB,yBAAqB;AACrB;;;AAGF,iBAAe,KAAK,MAAM;;CAG3B,MAAM,wBAAqD,EAAE;CAC7D,MAAM,wBAAqD,EAAE;AAQ7D,QAAO,OAAO,IAAI,aAAa;AAC9B,MAAI,CAAC,UAAU,UAAU,UAAU,UAAU,WAC5C,MAAK,MAAM,SAAS,eACnB,KAAI,cAAc,MAAM,CACvB,sBAAqB,OAAO,sCAC3B,yBACA,MAAM,MACN,CAAC,KAAK,OAAO,SAAS,UAAU,oBAAoB,CAAC,CAAC;OACjD;GACN,MAAM,QAAQ;IAAE,KAAK,MAAM;IAAK,OAAO,MAAM;IAAO;AACpD,wBAAqB,OAAO,yBAAyB,MAAM,CAAC,KAC3D,OAAO,SAAS,UAAU,oBAAoB,CAAC,CAC/C;;AAKJ,MAAI,CAAC,UAAU,UAAU,UAAU,UAAU,SAC5C,MAAK,MAAM,SAAS,gBAAgB;GAEnC,MAAM,SAAS,OAAO,iCADR,mBAAmB,MAC2B,CAAC,CAAC,KAC7D,OAAO,SAAS,UAAU,kBAAkB,CAAC,CAC7C;AACD,sBAAmB,OAAO;AAC1B,sBAAmB,OAAO;AAC1B,QAAK,MAAM,UAAU,OAAO,eAAgB,uBAAsB,KAAK,OAAO;AAC9E,QAAK,MAAM,MAAM,OAAO,eAAgB,uBAAsB,KAAK,GAAG;;AAIxE,MAAI,CAAC,UAAU,UAAU,UAAU,UAAU,QAC5C,MAAK,MAAM,SAAS,gBAAgB;GACnC,MAAM,QAAQ,mBAAmB,MAAM;AACvC,qBAAkB,OAAO,sBAAsB,MAAM,CAAC,KACrD,OAAO,SAAS,UAAU,iBAAiB,CAAC,CAC5C;;AAIH,MAAI,CAAC,UAAU,UAAU,UAAU,UAAU,OAC5C,MAAK,MAAM,SAAS,gBAAgB;GACnC,MAAM,QAAQ,mBAAmB,MAAM;AACvC,oBAAiB,OAAO,qBAAqB,MAAM,CAAC,KACnD,OAAO,SAAS,UAAU,gBAAgB,CAAC,CAC3C;;GAGF,CAAC,KAAK,OAAO,QAAQ,YAAY,CAAC;AAEpC,KAAI,CAAC,UAAU,OACd,QAAO,OAAO,IAAI,aAAa;AAC9B,OAAK,MAAM,SAAS,gBAAgB;AACnC,OAAI,CAAC,cAAc,MAAM,CAAE;AAC3B,UAAO,uCAAuC;IAC7C,aAAa,QAAQ;IACrB,aAAa,MAAM;IACnB,CAAC;;GAEF,CAAC,KACF,OAAO,QAAQ,eAAe,MAAM,EACpC,OAAO,SAAS,wDAAwD,CACxE;AAGF,QAAO;EACN,iBAAiB,OAAO;EAGxB,gBAAgB,eAAe;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC,KAAK,OAAO,SAAS,mCAAmC,CAAC"}

package/dist/orchestrators/router/cleanup.mjs

@@ -1,58 +1,57 @@
+import { ROUTER_CONTAINER_NAME_PREFIX } from "./sentinels.mjs";
 import { dispatchFileIdFromFilename, parseDispatchRouteFile } from "./file-provider.mjs";
-import { Effect } from "effect";
-import { existsSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
+import { Effect, FileSystem } from "effect";
 import { join } from "node:path";
 //#region src/orchestrators/router/cleanup.ts
-const ROUTER_SHARED_APP = "devstack-router";
-const ROUTER_CONTAINER_NAME_PREFIX = "devstack-router-";
 const routerStateRoot = (runtimeRoot) => join(runtimeRoot, "router");
-const safeDirectories = (dir) => {
-	try {
-		return readdirSync(dir).filter((entry) => statSync(join(dir, entry)).isDirectory());
-	} catch {
-		return [];
+const safeDirectories = (fs, dir) => Effect.gen(function* () {
+	const entries = yield* fs.readDirectory(dir).pipe(Effect.catch(() => Effect.succeed([])));
+	const directories = [];
+	for (const entry of entries) {
+		const stat = yield* fs.stat(join(dir, entry)).pipe(Effect.catch(() => Effect.succeed(null)));
+		if (stat !== null && stat.type === "Directory") directories.push(entry);
 	}
-};
-const removeRouterDispatchFilesForStack = (inputs) => Effect.sync(() => {
+	return directories;
+});
+const removeRouterDispatchFilesForStack = (inputs) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
 	let removed = 0;
-	for (const profileDir of safeDirectories(routerStateRoot(inputs.runtimeRoot))) {
+	for (const profileDir of yield* safeDirectories(fs, routerStateRoot(inputs.runtimeRoot))) {
 		const dispatchDir = join(routerStateRoot(inputs.runtimeRoot), profileDir, "dispatch");
-		if (!existsSync(dispatchDir)) continue;
-		for (const filename of readdirSync(dispatchDir)) {
+		if (!(yield* fs.exists(dispatchDir).pipe(Effect.catch(() => Effect.succeed(false))))) continue;
+		const filenames = yield* fs.readDirectory(dispatchDir).pipe(Effect.catch(() => Effect.succeed([])));
+		for (const filename of filenames) {
 			const dispatchFileId = dispatchFileIdFromFilename(filename);
 			if (dispatchFileId === null) continue;
 			const file = join(dispatchDir, filename);
-			let body;
-			try {
-				body = readFileSync(file, "utf8");
-			} catch {
-				continue;
-			}
+			const body = yield* fs.readFileString(file).pipe(Effect.catch(() => Effect.succeed(null)));
+			if (body === null) continue;
 			const parsed = parseDispatchRouteFile(body, dispatchFileId);
 			if (parsed._tag === "valid" && parsed.route.lease?.app === inputs.app && parsed.route.lease.stack === inputs.stack) {
-				rmSync(file, { force: true });
+				yield* fs.remove(file, { force: true }).pipe(Effect.ignore);
 				removed += 1;
 			}
 		}
 	}
 	return removed;
 });
-const removeRouterProfileStateForDockerStack = (inputs) => Effect.sync(() => {
+const removeRouterProfileStateForDockerStack = (inputs) => Effect.gen(function* () {
 	if (!inputs.routerStack.startsWith("devstack-router-")) return 0;
-	const fingerprint = inputs.routerStack.slice(16);
+	const fingerprint = inputs.routerStack.slice(ROUTER_CONTAINER_NAME_PREFIX.length);
 	if (fingerprint.length === 0) return 0;
+	const fs = yield* FileSystem.FileSystem;
 	let removed = 0;
-	for (const profileDir of safeDirectories(routerStateRoot(inputs.runtimeRoot))) {
+	for (const profileDir of yield* safeDirectories(fs, routerStateRoot(inputs.runtimeRoot))) {
 		if (!profileDir.endsWith(`-${fingerprint}`)) continue;
-		rmSync(join(routerStateRoot(inputs.runtimeRoot), profileDir), {
+		yield* fs.remove(join(routerStateRoot(inputs.runtimeRoot), profileDir), {
 			recursive: true,
 			force: true
-		});
+		}).pipe(Effect.ignore);
 		removed += 1;
 	}
 	return removed;
 });
 //#endregion
-export { ROUTER_CONTAINER_NAME_PREFIX, ROUTER_SHARED_APP, removeRouterDispatchFilesForStack, removeRouterProfileStateForDockerStack };
+export { removeRouterDispatchFilesForStack, removeRouterProfileStateForDockerStack };
 
 //# sourceMappingURL=cleanup.mjs.map

package/dist/orchestrators/router/cleanup.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cleanup.mjs","names":[],"sources":["../../../src/orchestrators/router/cleanup.ts"],"sourcesContent":["import { existsSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';\nimport { join } from 'node:path';\n\nimport { Effect } from 'effect';\n\nimport { dispatchFileIdFromFilename, parseDispatchRouteFile } from './file-provider.ts';\n\nexport const ROUTER_SHARED_APP = 'devstack-router';\nexport const ROUTER_CONTAINER_NAME_PREFIX = 'devstack-router-';\n\nconst routerStateRoot = (runtimeRoot: string): string => join(runtimeRoot, 'router');\n\nconst safeDirectories = (dir: string): ReadonlyArray<string> => {\n\ttry {\n\t\treturn readdirSync(dir).filter((entry) => statSync(join(dir, entry)).isDirectory());\n\t} catch {\n\t\treturn [];\n\t}\n};\n\nexport const removeRouterDispatchFilesForStack = (inputs: {\n\treadonly runtimeRoot: string;\n\treadonly app: string;\n\treadonly stack: string;\n}): Effect.Effect<number> =>\n\tEffect.sync(() => {\n\t\tlet removed = 0;\n\t\tfor (const profileDir of safeDirectories(routerStateRoot(inputs.runtimeRoot))) {\n\t\t\tconst dispatchDir = join(routerStateRoot(inputs.runtimeRoot), profileDir, 'dispatch');\n\t\t\tif (!existsSync(dispatchDir)) continue;\n\t\t\tfor (const filename of readdirSync(dispatchDir)) {\n\t\t\t\tconst dispatchFileId = dispatchFileIdFromFilename(filename);\n\t\t\t\tif (dispatchFileId === null) continue;\n\t\t\t\tconst file = join(dispatchDir, filename);\n\t\t\t\tlet body: string;\n\t\t\t\ttry {\n\t\t\t\t\tbody = readFileSync(file, 'utf8');\n\t\t\t\t} catch {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst parsed = parseDispatchRouteFile(body, dispatchFileId);\n\t\t\t\tif (\n\t\t\t\t\tparsed._tag === 'valid' &&\n\t\t\t\t\tparsed.route.lease?.app === inputs.app &&\n\t\t\t\t\tparsed.route.lease.stack === inputs.stack\n\t\t\t\t) {\n\t\t\t\t\trmSync(file, { force: true });\n\t\t\t\t\tremoved += 1;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn removed;\n\t});\n\nexport const removeRouterProfileStateForDockerStack = (inputs: {\n\treadonly runtimeRoot: string;\n\treadonly routerStack: string;\n}): Effect.Effect<number> =>\n\tEffect.sync(() => {\n\t\tif (!inputs.routerStack.startsWith(ROUTER_CONTAINER_NAME_PREFIX)) return 0;\n\t\tconst fingerprint = inputs.routerStack.slice(ROUTER_CONTAINER_NAME_PREFIX.length);\n\t\tif (fingerprint.length === 0) return 0;\n\n\t\tlet removed = 0;\n\t\tfor (const profileDir of safeDirectories(routerStateRoot(inputs.runtimeRoot))) {\n\t\t\tif (!profileDir.endsWith(`-${fingerprint}`)) continue;\n\t\t\trmSync(join(routerStateRoot(inputs.runtimeRoot), profileDir), {\n\t\t\t\trecursive: true,\n\t\t\t\tforce: true,\n\t\t\t});\n\t\t\tremoved += 1;\n\t\t}\n\t\treturn removed;\n\t});\n"],"mappings":";;;;;AAOA,MAAa,oBAAoB;AACjC,MAAa,+BAA+B;AAE5C,MAAM,mBAAmB,gBAAgC,KAAK,aAAa,SAAS;AAEpF,MAAM,mBAAmB,QAAuC;AAC/D,KAAI;AACH,SAAO,YAAY,IAAI,CAAC,QAAQ,UAAU,SAAS,KAAK,KAAK,MAAM,CAAC,CAAC,aAAa,CAAC;SAC5E;AACP,SAAO,EAAE;;;AAIX,MAAa,qCAAqC,WAKjD,OAAO,WAAW;CACjB,IAAI,UAAU;AACd,MAAK,MAAM,cAAc,gBAAgB,gBAAgB,OAAO,YAAY,CAAC,EAAE;EAC9E,MAAM,cAAc,KAAK,gBAAgB,OAAO,YAAY,EAAE,YAAY,WAAW;AACrF,MAAI,CAAC,WAAW,YAAY,CAAE;AAC9B,OAAK,MAAM,YAAY,YAAY,YAAY,EAAE;GAChD,MAAM,iBAAiB,2BAA2B,SAAS;AAC3D,OAAI,mBAAmB,KAAM;GAC7B,MAAM,OAAO,KAAK,aAAa,SAAS;GACxC,IAAI;AACJ,OAAI;AACH,WAAO,aAAa,MAAM,OAAO;WAC1B;AACP;;GAED,MAAM,SAAS,uBAAuB,MAAM,eAAe;AAC3D,OACC,OAAO,SAAS,WAChB,OAAO,MAAM,OAAO,QAAQ,OAAO,OACnC,OAAO,MAAM,MAAM,UAAU,OAAO,OACnC;AACD,WAAO,MAAM,EAAE,OAAO,MAAM,CAAC;AAC7B,eAAW;;;;AAId,QAAO;EACN;AAEH,MAAa,0CAA0C,WAItD,OAAO,WAAW;AACjB,KAAI,CAAC,OAAO,YAAY,WAAA,mBAAwC,CAAE,QAAO;CACzE,MAAM,cAAc,OAAO,YAAY,MAAM,GAAoC;AACjF,KAAI,YAAY,WAAW,EAAG,QAAO;CAErC,IAAI,UAAU;AACd,MAAK,MAAM,cAAc,gBAAgB,gBAAgB,OAAO,YAAY,CAAC,EAAE;AAC9E,MAAI,CAAC,WAAW,SAAS,IAAI,cAAc,CAAE;AAC7C,SAAO,KAAK,gBAAgB,OAAO,YAAY,EAAE,WAAW,EAAE;GAC7D,WAAW;GACX,OAAO;GACP,CAAC;AACF,aAAW;;AAEZ,QAAO;EACN"}
+{"version":3,"file":"cleanup.mjs","names":[],"sources":["../../../src/orchestrators/router/cleanup.ts"],"sourcesContent":["import { join } from 'node:path';\n\nimport { Effect, FileSystem } from 'effect';\n\nimport { dispatchFileIdFromFilename, parseDispatchRouteFile } from './file-provider.ts';\nimport { ROUTER_CONTAINER_NAME_PREFIX } from './sentinels.ts';\n\nexport { ROUTER_CONTAINER_NAME_PREFIX, ROUTER_SHARED_APP } from './sentinels.ts';\n\nconst routerStateRoot = (runtimeRoot: string): string => join(runtimeRoot, 'router');\n\nconst safeDirectories = (\n\tfs: FileSystem.FileSystem,\n\tdir: string,\n): Effect.Effect<ReadonlyArray<string>> =>\n\tEffect.gen(function* () {\n\t\tconst entries = yield* fs\n\t\t\t.readDirectory(dir)\n\t\t\t.pipe(Effect.catch(() => Effect.succeed<ReadonlyArray<string>>([])));\n\t\tconst directories: Array<string> = [];\n\t\tfor (const entry of entries) {\n\t\t\tconst stat = yield* fs.stat(join(dir, entry)).pipe(Effect.catch(() => Effect.succeed(null)));\n\t\t\tif (stat !== null && stat.type === 'Directory') {\n\t\t\t\tdirectories.push(entry);\n\t\t\t}\n\t\t}\n\t\treturn directories;\n\t});\n\nexport const removeRouterDispatchFilesForStack = (inputs: {\n\treadonly runtimeRoot: string;\n\treadonly app: string;\n\treadonly stack: string;\n}): Effect.Effect<number, never, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tlet removed = 0;\n\t\tfor (const profileDir of yield* safeDirectories(fs, routerStateRoot(inputs.runtimeRoot))) {\n\t\t\tconst dispatchDir = join(routerStateRoot(inputs.runtimeRoot), profileDir, 'dispatch');\n\t\t\tconst exists = yield* fs.exists(dispatchDir).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\tif (!exists) continue;\n\t\t\tconst filenames = yield* fs\n\t\t\t\t.readDirectory(dispatchDir)\n\t\t\t\t.pipe(Effect.catch(() => Effect.succeed<ReadonlyArray<string>>([])));\n\t\t\tfor (const filename of filenames) {\n\t\t\t\tconst dispatchFileId = dispatchFileIdFromFilename(filename);\n\t\t\t\tif (dispatchFileId === null) continue;\n\t\t\t\tconst file = join(dispatchDir, filename);\n\t\t\t\tconst body = yield* fs.readFileString(file).pipe(Effect.catch(() => Effect.succeed(null)));\n\t\t\t\tif (body === null) continue;\n\t\t\t\tconst parsed = parseDispatchRouteFile(body, dispatchFileId);\n\t\t\t\tif (\n\t\t\t\t\tparsed._tag === 'valid' &&\n\t\t\t\t\tparsed.route.lease?.app === inputs.app &&\n\t\t\t\t\tparsed.route.lease.stack === inputs.stack\n\t\t\t\t) {\n\t\t\t\t\tyield* fs.remove(file, { force: true }).pipe(Effect.ignore);\n\t\t\t\t\tremoved += 1;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn removed;\n\t});\n\nexport const removeRouterProfileStateForDockerStack = (inputs: {\n\treadonly runtimeRoot: string;\n\treadonly routerStack: string;\n}): Effect.Effect<number, never, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tif (!inputs.routerStack.startsWith(ROUTER_CONTAINER_NAME_PREFIX)) return 0;\n\t\tconst fingerprint = inputs.routerStack.slice(ROUTER_CONTAINER_NAME_PREFIX.length);\n\t\tif (fingerprint.length === 0) return 0;\n\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tlet removed = 0;\n\t\tfor (const profileDir of yield* safeDirectories(fs, routerStateRoot(inputs.runtimeRoot))) {\n\t\t\tif (!profileDir.endsWith(`-${fingerprint}`)) continue;\n\t\t\tyield* fs\n\t\t\t\t.remove(join(routerStateRoot(inputs.runtimeRoot), profileDir), {\n\t\t\t\t\trecursive: true,\n\t\t\t\t\tforce: true,\n\t\t\t\t})\n\t\t\t\t.pipe(Effect.ignore);\n\t\t\tremoved += 1;\n\t\t}\n\t\treturn removed;\n\t});\n"],"mappings":";;;;;AASA,MAAM,mBAAmB,gBAAgC,KAAK,aAAa,SAAS;AAEpF,MAAM,mBACL,IACA,QAEA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO,GACrB,cAAc,IAAI,CAClB,KAAK,OAAO,YAAY,OAAO,QAA+B,EAAE,CAAC,CAAC,CAAC;CACrE,MAAM,cAA6B,EAAE;AACrC,MAAK,MAAM,SAAS,SAAS;EAC5B,MAAM,OAAO,OAAO,GAAG,KAAK,KAAK,KAAK,MAAM,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AAC5F,MAAI,SAAS,QAAQ,KAAK,SAAS,YAClC,aAAY,KAAK,MAAM;;AAGzB,QAAO;EACN;AAEH,MAAa,qCAAqC,WAKjD,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,IAAI,UAAU;AACd,MAAK,MAAM,cAAc,OAAO,gBAAgB,IAAI,gBAAgB,OAAO,YAAY,CAAC,EAAE;EACzF,MAAM,cAAc,KAAK,gBAAgB,OAAO,YAAY,EAAE,YAAY,WAAW;AAErF,MAAI,EAAC,OADiB,GAAG,OAAO,YAAY,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAC/E;EACb,MAAM,YAAY,OAAO,GACvB,cAAc,YAAY,CAC1B,KAAK,OAAO,YAAY,OAAO,QAA+B,EAAE,CAAC,CAAC,CAAC;AACrE,OAAK,MAAM,YAAY,WAAW;GACjC,MAAM,iBAAiB,2BAA2B,SAAS;AAC3D,OAAI,mBAAmB,KAAM;GAC7B,MAAM,OAAO,KAAK,aAAa,SAAS;GACxC,MAAM,OAAO,OAAO,GAAG,eAAe,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AAC1F,OAAI,SAAS,KAAM;GACnB,MAAM,SAAS,uBAAuB,MAAM,eAAe;AAC3D,OACC,OAAO,SAAS,WAChB,OAAO,MAAM,OAAO,QAAQ,OAAO,OACnC,OAAO,MAAM,MAAM,UAAU,OAAO,OACnC;AACD,WAAO,GAAG,OAAO,MAAM,EAAE,OAAO,MAAM,CAAC,CAAC,KAAK,OAAO,OAAO;AAC3D,eAAW;;;;AAId,QAAO;EACN;AAEH,MAAa,0CAA0C,WAItD,OAAO,IAAI,aAAa;AACvB,KAAI,CAAC,OAAO,YAAY,WAAA,mBAAwC,CAAE,QAAO;CACzE,MAAM,cAAc,OAAO,YAAY,MAAM,6BAA6B,OAAO;AACjF,KAAI,YAAY,WAAW,EAAG,QAAO;CAErC,MAAM,KAAK,OAAO,WAAW;CAC7B,IAAI,UAAU;AACd,MAAK,MAAM,cAAc,OAAO,gBAAgB,IAAI,gBAAgB,OAAO,YAAY,CAAC,EAAE;AACzF,MAAI,CAAC,WAAW,SAAS,IAAI,cAAc,CAAE;AAC7C,SAAO,GACL,OAAO,KAAK,gBAAgB,OAAO,YAAY,EAAE,WAAW,EAAE;GAC9D,WAAW;GACX,OAAO;GACP,CAAC,CACD,KAAK,OAAO,OAAO;AACrB,aAAW;;AAEZ,QAAO;EACN"}

package/dist/orchestrators/router/entrypoints.mjs

@@ -1,7 +1,7 @@
 import { EntrypointConflict, UnknownEntrypoint } from "./errors.mjs";
 import { Context, Effect, Layer } from "effect";
 //#region src/orchestrators/router/entrypoints.ts
-var EntrypointRegistry = class extends Context.Service()("@devstack-rewrite/orchestrators/router/EntrypointRegistry") {};
+var EntrypointRegistry = class extends Context.Service()("@devstack/orchestrators/router/EntrypointRegistry") {};
 const entrypointFamily = (protocol) => protocol === "tcp" ? "tcp" : "http";
 /** Build a registry from a literal seed. Idempotent on identical
 *  `(name, port, protocol)` triples; throws synchronously on conflict
@@ -75,6 +75,6 @@ const makeEntrypointRegistry = (seed) => {
 *  registry — they pick names from it via their Routable contributions. */
 const layerEntrypointRegistry = (seed) => Layer.succeed(EntrypointRegistry)(makeEntrypointRegistry(seed));
 //#endregion
-export { EntrypointRegistry, layerEntrypointRegistry };
+export { EntrypointRegistry, layerEntrypointRegistry, makeEntrypointRegistry };
 
 //# sourceMappingURL=entrypoints.mjs.map

package/dist/orchestrators/router/entrypoints.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.mjs","names":[],"sources":["../../../src/orchestrators/router/entrypoints.ts"],"sourcesContent":["// Entrypoint registry — a process-global allowlist of named host\n// ports the Traefik container will listen on.\n//\n// Architecture invariants:\n//   #6  — Routables select an entrypoint by *name* from a closed set\n//          populated at module-load time. The set is read ONCE at\n//          router launch.\n//   #12 — Every entrypoint is plain HTTP / h2c / TCP; no TLS surface.\n//          TCP entrypoints bind a host port and dispatch raw bytes to a\n//          single backend (postgres, redis, …); they cannot share the\n//          port across parallel stacks because TCP has no virtual-host\n//          concept. HTTP/h2c entrypoints DO share ports via Host-header\n//          dispatch.\n//\n// The registry is intentionally a typed Context service (Effect v4\n// idiom) rather than a module-mutable map: that lets tests build a\n// fresh registry per scenario, lets the orchestrator carry the\n// registration set forward immutably, and removes the\n// `ATTACHED_FOLLOWERS`-style hidden globals the architecture's\n// \"What's NOT in it\" section forbids.\n//\n// Construction surface:\n//   `makeEntrypointRegistry(...)` — pure constructor; throws synchronously\n//   on conflict registration (architecture invariant #6 is \"throw at\n//   registration time\", not at acquire time).\n//\n// Lookup surface:\n//   `EntrypointRegistry.byName(name)` — typed yieldable that fails\n//   `UnknownEntrypoint` if the caller spliced an unregistered name.\n\nimport { Context, Effect, Layer } from 'effect';\n\nimport type { EntrypointDecl } from '../../contracts/routable.ts';\nimport { EntrypointConflict, UnknownEntrypoint } from './errors.ts';\n\n/** A named entrypoint — a host port the Traefik container binds and\n *  listens on. `http`/`h2c` entrypoints support Host-header dispatch\n *  (one port → many backends). `tcp` entrypoints are point-to-point\n *  (one port → one backend) — siblings dial them directly. */\nexport type Entrypoint = EntrypointDecl;\n\n/** Registry shape. Closed map from declared name → canonical listener.\n *  HTTP-family declarations may share a port; Traefik still needs one\n *  listener name for that port, so aliases resolve to the first\n *  registered listener. */\nexport interface EntrypointRegistryShape {\n\treadonly byName: (name: string) => Effect.Effect<Entrypoint, UnknownEntrypoint>;\n\treadonly all: () => ReadonlyArray<Entrypoint>;\n}\n\nexport class EntrypointRegistry extends Context.Service<\n\tEntrypointRegistry,\n\tEntrypointRegistryShape\n>()('@devstack-rewrite/orchestrators/router/EntrypointRegistry') {}\n\nconst entrypointFamily = (protocol: Entrypoint['protocol']): 'http' | 'tcp' =>\n\tprotocol === 'tcp' ? 'tcp' : 'http';\n\n/** Build a registry from a literal seed. Idempotent on identical\n *  `(name, port, protocol)` triples; throws synchronously on conflict\n *  per architecture invariant #6. The reason this is synchronous\n *  rather than yielded: registration is module-load wiring, not a\n *  runtime effect — the failure mode is \"two callers wired the same\n *  name to different ports\", which is a build-time bug.\n *\n *  Traefik cannot bind multiple entrypoints to the same container port.\n *  For HTTP-family aliases on one port, keep every declared name\n *  lookupable but resolve those aliases to the first listener registered\n *  for the port. */\nexport const makeEntrypointRegistry = (\n\tseed: ReadonlyArray<Entrypoint>,\n): EntrypointRegistryShape => {\n\tconst declaredByName = new Map<string, Entrypoint>();\n\tconst lookupByName = new Map<string, Entrypoint>();\n\tconst listenerByPort = new Map<number, Entrypoint>();\n\tfor (const e of seed) {\n\t\tconst existing = declaredByName.get(e.name);\n\t\tif (existing) {\n\t\t\tif (existing.port === e.port && existing.protocol === e.protocol) continue;\n\t\t\tthrow new EntrypointConflict({\n\t\t\t\tname: e.name,\n\t\t\t\texisting: { port: existing.port, protocol: existing.protocol },\n\t\t\t\tattempted: { port: e.port, protocol: e.protocol },\n\t\t\t});\n\t\t}\n\t\tdeclaredByName.set(e.name, e);\n\n\t\tconst listener = listenerByPort.get(e.port);\n\t\tif (listener) {\n\t\t\tconst listenerFamily = entrypointFamily(listener.protocol);\n\t\t\tconst attemptedFamily = entrypointFamily(e.protocol);\n\t\t\tif (listenerFamily === 'tcp' || listenerFamily !== attemptedFamily) {\n\t\t\t\tthrow new EntrypointConflict({\n\t\t\t\t\tname: e.name,\n\t\t\t\t\texisting: { port: listener.port, protocol: listener.protocol },\n\t\t\t\t\tattempted: { port: e.port, protocol: e.protocol },\n\t\t\t\t});\n\t\t\t}\n\t\t\tlookupByName.set(e.name, listener);\n\t\t\tcontinue;\n\t\t}\n\n\t\tlistenerByPort.set(e.port, e);\n\t\tlookupByName.set(e.name, e);\n\t}\n\tconst frozenListeners: ReadonlyArray<Entrypoint> = Array.from(listenerByPort.values());\n\tconst knownNames = Array.from(declaredByName.keys());\n\treturn {\n\t\tbyName: (name) => {\n\t\t\tconst hit = lookupByName.get(name);\n\t\t\tif (hit) return Effect.succeed(hit);\n\t\t\treturn Effect.fail(\n\t\t\t\tnew UnknownEntrypoint({\n\t\t\t\t\tname,\n\t\t\t\t\tknown: knownNames,\n\t\t\t\t}),\n\t\t\t);\n\t\t},\n\t\tall: () => frozenListeners,\n\t};\n};\n\n/** Layer that pins the registry from a literal seed. The orchestrator\n *  takes this as a substrate dependency; plugins do NOT mutate the\n *  registry — they pick names from it via their Routable contributions. */\nexport const layerEntrypointRegistry = (\n\tseed: ReadonlyArray<Entrypoint>,\n): Layer.Layer<EntrypointRegistry> =>\n\tLayer.succeed(EntrypointRegistry)(makeEntrypointRegistry(seed));\n"],"mappings":";;;AAkDA,IAAa,qBAAb,cAAwC,QAAQ,SAG7C,CAAC,4DAA4D,CAAC;AAEjE,MAAM,oBAAoB,aACzB,aAAa,QAAQ,QAAQ;;;;;;;;;;;;AAa9B,MAAa,0BACZ,SAC6B;CAC7B,MAAM,iCAAiB,IAAI,KAAyB;CACpD,MAAM,+BAAe,IAAI,KAAyB;CAClD,MAAM,iCAAiB,IAAI,KAAyB;AACpD,MAAK,MAAM,KAAK,MAAM;EACrB,MAAM,WAAW,eAAe,IAAI,EAAE,KAAK;AAC3C,MAAI,UAAU;AACb,OAAI,SAAS,SAAS,EAAE,QAAQ,SAAS,aAAa,EAAE,SAAU;AAClE,SAAM,IAAI,mBAAmB;IAC5B,MAAM,EAAE;IACR,UAAU;KAAE,MAAM,SAAS;KAAM,UAAU,SAAS;KAAU;IAC9D,WAAW;KAAE,MAAM,EAAE;KAAM,UAAU,EAAE;KAAU;IACjD,CAAC;;AAEH,iBAAe,IAAI,EAAE,MAAM,EAAE;EAE7B,MAAM,WAAW,eAAe,IAAI,EAAE,KAAK;AAC3C,MAAI,UAAU;GACb,MAAM,iBAAiB,iBAAiB,SAAS,SAAS;GAC1D,MAAM,kBAAkB,iBAAiB,EAAE,SAAS;AACpD,OAAI,mBAAmB,SAAS,mBAAmB,gBAClD,OAAM,IAAI,mBAAmB;IAC5B,MAAM,EAAE;IACR,UAAU;KAAE,MAAM,SAAS;KAAM,UAAU,SAAS;KAAU;IAC9D,WAAW;KAAE,MAAM,EAAE;KAAM,UAAU,EAAE;KAAU;IACjD,CAAC;AAEH,gBAAa,IAAI,EAAE,MAAM,SAAS;AAClC;;AAGD,iBAAe,IAAI,EAAE,MAAM,EAAE;AAC7B,eAAa,IAAI,EAAE,MAAM,EAAE;;CAE5B,MAAM,kBAA6C,MAAM,KAAK,eAAe,QAAQ,CAAC;CACtF,MAAM,aAAa,MAAM,KAAK,eAAe,MAAM,CAAC;AACpD,QAAO;EACN,SAAS,SAAS;GACjB,MAAM,MAAM,aAAa,IAAI,KAAK;AAClC,OAAI,IAAK,QAAO,OAAO,QAAQ,IAAI;AACnC,UAAO,OAAO,KACb,IAAI,kBAAkB;IACrB;IACA,OAAO;IACP,CAAC,CACF;;EAEF,WAAW;EACX;;;;;AAMF,MAAa,2BACZ,SAEA,MAAM,QAAQ,mBAAmB,CAAC,uBAAuB,KAAK,CAAC"}
+{"version":3,"file":"entrypoints.mjs","names":[],"sources":["../../../src/orchestrators/router/entrypoints.ts"],"sourcesContent":["// Entrypoint registry — a process-global allowlist of named host\n// ports the Traefik container will listen on.\n//\n// Architecture invariants:\n//   #6  — Routables select an entrypoint by *name* from a closed set\n//          populated at module-load time. The set is read ONCE at\n//          router launch.\n//   #12 — Every entrypoint is plain HTTP / h2c / TCP; no TLS surface.\n//          TCP entrypoints bind a host port and dispatch raw bytes to a\n//          single backend (postgres, redis, …); they cannot share the\n//          port across parallel stacks because TCP has no virtual-host\n//          concept. HTTP/h2c entrypoints DO share ports via Host-header\n//          dispatch.\n//\n// The registry is intentionally a typed Context service (Effect v4\n// idiom) rather than a module-mutable map: that lets tests build a\n// fresh registry per scenario, lets the orchestrator carry the\n// registration set forward immutably, and removes the\n// `ATTACHED_FOLLOWERS`-style hidden globals the architecture's\n// \"What's NOT in it\" section forbids.\n//\n// Construction surface:\n//   `makeEntrypointRegistry(...)` — pure constructor; throws synchronously\n//   on conflict registration (architecture invariant #6 is \"throw at\n//   registration time\", not at acquire time).\n//\n// Lookup surface:\n//   `EntrypointRegistry.byName(name)` — typed yieldable that fails\n//   `UnknownEntrypoint` if the caller spliced an unregistered name.\n\nimport { Context, Effect, Layer } from 'effect';\n\nimport type { EntrypointDecl } from '../../contracts/routable.ts';\nimport { EntrypointConflict, UnknownEntrypoint } from './errors.ts';\n\n/** A named entrypoint — a host port the Traefik container binds and\n *  listens on. `http`/`h2c` entrypoints support Host-header dispatch\n *  (one port → many backends). `tcp` entrypoints are point-to-point\n *  (one port → one backend) — siblings dial them directly. */\nexport type Entrypoint = EntrypointDecl;\n\n/** Registry shape. Closed map from declared name → canonical listener.\n *  HTTP-family declarations may share a port; Traefik still needs one\n *  listener name for that port, so aliases resolve to the first\n *  registered listener. */\nexport interface EntrypointRegistryShape {\n\treadonly byName: (name: string) => Effect.Effect<Entrypoint, UnknownEntrypoint>;\n\treadonly all: () => ReadonlyArray<Entrypoint>;\n}\n\nexport class EntrypointRegistry extends Context.Service<\n\tEntrypointRegistry,\n\tEntrypointRegistryShape\n>()('@devstack/orchestrators/router/EntrypointRegistry') {}\n\nconst entrypointFamily = (protocol: Entrypoint['protocol']): 'http' | 'tcp' =>\n\tprotocol === 'tcp' ? 'tcp' : 'http';\n\n/** Build a registry from a literal seed. Idempotent on identical\n *  `(name, port, protocol)` triples; throws synchronously on conflict\n *  per architecture invariant #6. The reason this is synchronous\n *  rather than yielded: registration is module-load wiring, not a\n *  runtime effect — the failure mode is \"two callers wired the same\n *  name to different ports\", which is a build-time bug.\n *\n *  Traefik cannot bind multiple entrypoints to the same container port.\n *  For HTTP-family aliases on one port, keep every declared name\n *  lookupable but resolve those aliases to the first listener registered\n *  for the port. */\nexport const makeEntrypointRegistry = (\n\tseed: ReadonlyArray<Entrypoint>,\n): EntrypointRegistryShape => {\n\tconst declaredByName = new Map<string, Entrypoint>();\n\tconst lookupByName = new Map<string, Entrypoint>();\n\tconst listenerByPort = new Map<number, Entrypoint>();\n\tfor (const e of seed) {\n\t\tconst existing = declaredByName.get(e.name);\n\t\tif (existing) {\n\t\t\tif (existing.port === e.port && existing.protocol === e.protocol) continue;\n\t\t\tthrow new EntrypointConflict({\n\t\t\t\tname: e.name,\n\t\t\t\texisting: { port: existing.port, protocol: existing.protocol },\n\t\t\t\tattempted: { port: e.port, protocol: e.protocol },\n\t\t\t});\n\t\t}\n\t\tdeclaredByName.set(e.name, e);\n\n\t\tconst listener = listenerByPort.get(e.port);\n\t\tif (listener) {\n\t\t\tconst listenerFamily = entrypointFamily(listener.protocol);\n\t\t\tconst attemptedFamily = entrypointFamily(e.protocol);\n\t\t\tif (listenerFamily === 'tcp' || listenerFamily !== attemptedFamily) {\n\t\t\t\tthrow new EntrypointConflict({\n\t\t\t\t\tname: e.name,\n\t\t\t\t\texisting: { port: listener.port, protocol: listener.protocol },\n\t\t\t\t\tattempted: { port: e.port, protocol: e.protocol },\n\t\t\t\t});\n\t\t\t}\n\t\t\tlookupByName.set(e.name, listener);\n\t\t\tcontinue;\n\t\t}\n\n\t\tlistenerByPort.set(e.port, e);\n\t\tlookupByName.set(e.name, e);\n\t}\n\tconst frozenListeners: ReadonlyArray<Entrypoint> = Array.from(listenerByPort.values());\n\tconst knownNames = Array.from(declaredByName.keys());\n\treturn {\n\t\tbyName: (name) => {\n\t\t\tconst hit = lookupByName.get(name);\n\t\t\tif (hit) return Effect.succeed(hit);\n\t\t\treturn Effect.fail(\n\t\t\t\tnew UnknownEntrypoint({\n\t\t\t\t\tname,\n\t\t\t\t\tknown: knownNames,\n\t\t\t\t}),\n\t\t\t);\n\t\t},\n\t\tall: () => frozenListeners,\n\t};\n};\n\n/** Layer that pins the registry from a literal seed. The orchestrator\n *  takes this as a substrate dependency; plugins do NOT mutate the\n *  registry — they pick names from it via their Routable contributions. */\nexport const layerEntrypointRegistry = (\n\tseed: ReadonlyArray<Entrypoint>,\n): Layer.Layer<EntrypointRegistry> =>\n\tLayer.succeed(EntrypointRegistry)(makeEntrypointRegistry(seed));\n"],"mappings":";;;AAkDA,IAAa,qBAAb,cAAwC,QAAQ,SAG7C,CAAC,oDAAoD,CAAC;AAEzD,MAAM,oBAAoB,aACzB,aAAa,QAAQ,QAAQ;;;;;;;;;;;;AAa9B,MAAa,0BACZ,SAC6B;CAC7B,MAAM,iCAAiB,IAAI,KAAyB;CACpD,MAAM,+BAAe,IAAI,KAAyB;CAClD,MAAM,iCAAiB,IAAI,KAAyB;AACpD,MAAK,MAAM,KAAK,MAAM;EACrB,MAAM,WAAW,eAAe,IAAI,EAAE,KAAK;AAC3C,MAAI,UAAU;AACb,OAAI,SAAS,SAAS,EAAE,QAAQ,SAAS,aAAa,EAAE,SAAU;AAClE,SAAM,IAAI,mBAAmB;IAC5B,MAAM,EAAE;IACR,UAAU;KAAE,MAAM,SAAS;KAAM,UAAU,SAAS;KAAU;IAC9D,WAAW;KAAE,MAAM,EAAE;KAAM,UAAU,EAAE;KAAU;IACjD,CAAC;;AAEH,iBAAe,IAAI,EAAE,MAAM,EAAE;EAE7B,MAAM,WAAW,eAAe,IAAI,EAAE,KAAK;AAC3C,MAAI,UAAU;GACb,MAAM,iBAAiB,iBAAiB,SAAS,SAAS;GAC1D,MAAM,kBAAkB,iBAAiB,EAAE,SAAS;AACpD,OAAI,mBAAmB,SAAS,mBAAmB,gBAClD,OAAM,IAAI,mBAAmB;IAC5B,MAAM,EAAE;IACR,UAAU;KAAE,MAAM,SAAS;KAAM,UAAU,SAAS;KAAU;IAC9D,WAAW;KAAE,MAAM,EAAE;KAAM,UAAU,EAAE;KAAU;IACjD,CAAC;AAEH,gBAAa,IAAI,EAAE,MAAM,SAAS;AAClC;;AAGD,iBAAe,IAAI,EAAE,MAAM,EAAE;AAC7B,eAAa,IAAI,EAAE,MAAM,EAAE;;CAE5B,MAAM,kBAA6C,MAAM,KAAK,eAAe,QAAQ,CAAC;CACtF,MAAM,aAAa,MAAM,KAAK,eAAe,MAAM,CAAC;AACpD,QAAO;EACN,SAAS,SAAS;GACjB,MAAM,MAAM,aAAa,IAAI,KAAK;AAClC,OAAI,IAAK,QAAO,OAAO,QAAQ,IAAI;AACnC,UAAO,OAAO,KACb,IAAI,kBAAkB;IACrB;IACA,OAAO;IACP,CAAC,CACF;;EAEF,WAAW;EACX;;;;;AAMF,MAAa,2BACZ,SAEA,MAAM,QAAQ,mBAAmB,CAAC,uBAAuB,KAAK,CAAC"}

package/dist/orchestrators/router/file-provider.mjs

@@ -1,13 +1,21 @@
 import { RouteCollision, RouterValidationError } from "./errors.mjs";
-import { dispatchFileId, renderUrl, routerHostname } from "./hostname.mjs";
 import { CORS_MIDDLEWARE_NAME } from "./cors.mjs";
+import { renderUrl } from "../../substrate/runtime/routed-url.mjs";
+import { dispatchFileId, routerHostname } from "./hostname.mjs";
 import { Effect } from "effect";
 //#region src/orchestrators/router/file-provider.ts
 const ROUTE_READINESS_HEADER = "X-Devstack-Route-Id";
+/** Dispatch-file filename prefix. `10-` sorts behind the shared CORS
+*  middleware (`00-`) so Traefik's file-provider loads the middleware
+*  before any router that references it. Single source of truth for
+*  the file-write side (`dispatchFilename`) and the file-read side
+*  (`dispatchFileIdFromFilename`) — keep them in lockstep here. */
+const DISPATCH_FILENAME_PREFIX = "10-";
 /** Filename within the dispatch directory for a given file-id. The
-*  `10-` prefix sorts behind the shared CORS middleware (`00-`) so
-*  Traefik picks up the middleware before any router referencing it. */
-const dispatchFilename = (fileId) => `10-${fileId}.yml`;
+*  prefix (`DISPATCH_FILENAME_PREFIX`) sorts behind the shared CORS
+*  middleware (`00-`) so Traefik picks up the middleware before any
+*  router referencing it. */
+const dispatchFilename = (fileId) => `${DISPATCH_FILENAME_PREFIX}${fileId}.yml`;
 /** Resolve a single Routable into a ResolvedRoute. Pure-ish: the only
 *  effectful bit is the upstream resolver (which talks to docker /
 *  the port broker) and the entrypoint lookup.
@@ -143,7 +151,8 @@ const renderTcpRouteYaml = (route, lease) => {
 	].join("\n");
 };
 const dispatchFileIdFromFilename = (filename) => {
-	return /^10-(.+)\.yml$/.exec(filename)?.[1] ?? null;
+	const escapedPrefix = DISPATCH_FILENAME_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return new RegExp(`^${escapedPrefix}(.+)\\.yml$`).exec(filename)?.[1] ?? null;
 };
 const commentValue = (body, key) => {
 	const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");