@mysten-incubation/devstack 0.0.1 → 0.1.0

package/dist/plugins/postgres/snapshot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/postgres/snapshot.ts"],"sourcesContent":["// Postgres plugin — Snapshotable contribution.\n//\n// Architecture §3: the snapshot orchestrator captures and restores\n// without naming the plugin. Postgres's contribution is the\n// container's writable layer — image-commit captures PGDATA only\n// because the vendored image relocates `PGDATA` OFF the upstream\n// `VOLUME /var/lib/postgresql/data` (which docker commit excludes).\n//\n// Identity contribution (distilled doc § Postgres-specific concerns +\n// architecture identity-guard pattern): the postgres \"server\n// identifier\" doubles as a guard. On restore we compare the\n// snapshot's stored postgres identity (server name + the set of\n// requested databases) against the resolver's current answer; if\n// the user pointed at a different cluster shape mid-cycle, the\n// identity-guard refuses BEFORE any destructive mutation.\n//\n// Stop-grace (distilled doc § Postgres-specific concerns): the service\n// threads a 20s Docker stop grace into the container spec, matching the\n// sui-indexer-db sidecar for the same image. This file's `quiesce`\n// Effect is intentionally `Effect.void` (the substrate engine pauses the\n// container around `docker commit`); the plugin only contributes the\n// LABEL TUPLE that lets the engine find it.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\n/** Identity payload contributed to the substrate's identity-guard.\n *  The substrate's pre-restore hook reads this; identity mismatch\n *  refuses the restore. Server name + ordered database list is the\n *  smallest tuple that distinguishes a postgres instance for snapshot\n *  purposes — image tag / version is intentionally NOT part of\n *  identity (a minor-version bump should restore cleanly). */\nexport interface PostgresIdentityPayload {\n\treadonly kind: 'postgres-server';\n\treadonly name: string;\n\treadonly databases: ReadonlyArray<string>;\n}\n\nexport interface MakeSnapshotableOptions {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly name: string;\n\treadonly databases: ReadonlyArray<string>;\n}\n\n/** Build the Snapshotable contribution.\n *\n *  Container-bearing only; no host-side subtree. Postgres's entire\n *  state lives in the container's writable layer at the relocated\n *  `PGDATA` (see `service.ts` for the image build context). */\nexport const makeSnapshotable = (opts: MakeSnapshotableOptions): SnapshotableDecl => {\n\tconst labels: ContainerLabelTuple = {\n\t\tapp: opts.app,\n\t\tstack: opts.stack,\n\t\tplugin: 'postgres',\n\t\trole: opts.name,\n\t};\n\n\tconst identity: PostgresIdentityPayload = {\n\t\tkind: 'postgres-server',\n\t\tname: opts.name,\n\t\t// Frozen list so the identity payload is structurally stable\n\t\t// across calls — the substrate hashes it for comparison.\n\t\tdatabases: Object.freeze([...opts.databases].sort()) as ReadonlyArray<string>,\n\t};\n\n\treturn {\n\t\tkind: 'snapshotable',\n\t\t// No host-tree subtree — all state lives in the container.\n\t\tsubtrees: [],\n\t\tmanagedContainers: [labels],\n\t\t// Engine-level pause-around-commit handles quiescence; the\n\t\t// plugin's contribution is just the label tuple above.\n\t\tmissingTolerance: 'fine',\n\t\tpreRestore: Effect.succeed(identity),\n\t\tpostRestore: Effect.void,\n\t};\n};\n"],"mappings":";;;;;;;AAmDA,MAAa,oBAAoB,SAAoD;CACpF,MAAM,SAA8B;EACnC,KAAK,KAAK;EACV,OAAO,KAAK;EACZ,QAAQ;EACR,MAAM,KAAK;EACX;CAED,MAAM,WAAoC;EACzC,MAAM;EACN,MAAM,KAAK;EAGX,WAAW,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,MAAM,CAAC;EACpD;AAED,QAAO;EACN,MAAM;EAEN,UAAU,EAAE;EACZ,mBAAmB,CAAC,OAAO;EAG3B,kBAAkB;EAClB,YAAY,OAAO,QAAQ,SAAS;EACpC,aAAa,OAAO;EACpB"}
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/postgres/snapshot.ts"],"sourcesContent":["// Postgres plugin — Snapshotable contribution.\n//\n// Architecture §3: the snapshot orchestrator captures and restores\n// without naming the plugin. Postgres's contribution is the\n// container's writable layer — image-commit captures PGDATA only\n// because the vendored image relocates `PGDATA` OFF the upstream\n// `VOLUME /var/lib/postgresql/data` (which docker commit excludes).\n//\n// Identity contribution (distilled doc § Postgres-specific concerns +\n// architecture identity-guard pattern): the postgres \"server\n// identifier\" doubles as a guard. On restore we compare the\n// snapshot's stored postgres identity (server name + the set of\n// requested databases) against the resolver's current answer; if\n// the user pointed at a different cluster shape mid-cycle, the\n// identity-guard refuses BEFORE any destructive mutation.\n//\n// Stop-grace (distilled doc § Postgres-specific concerns): the service\n// threads a 20s Docker stop grace into the container spec, matching the\n// sui-indexer-db sidecar for the same image. This file's `quiesce`\n// Effect is intentionally `Effect.void` (the substrate engine pauses the\n// container around `docker commit`); the plugin only contributes the\n// LABEL TUPLE that lets the engine find it.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\n/** Identity payload contributed to the substrate's identity-guard.\n *  The substrate's pre-restore hook reads this; identity mismatch\n *  refuses the restore. Server name + ordered database list is the\n *  smallest tuple that distinguishes a postgres instance for snapshot\n *  purposes — image tag / version is intentionally NOT part of\n *  identity (a minor-version bump should restore cleanly). */\nexport type PostgresIdentityPayload = {\n\treadonly kind: 'postgres-server';\n\treadonly name: string;\n\treadonly databases: ReadonlyArray<string>;\n};\n\nexport interface MakeSnapshotableOptions {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly name: string;\n\treadonly databases: ReadonlyArray<string>;\n}\n\n/** Build the Snapshotable contribution.\n *\n *  Container-bearing only; no host-side subtree. Postgres's entire\n *  state lives in the container's writable layer at the relocated\n *  `PGDATA` (see `service.ts` for the image build context). */\nexport const makeSnapshotable = (opts: MakeSnapshotableOptions): SnapshotableDecl => {\n\tconst labels: ContainerLabelTuple = {\n\t\tapp: opts.app,\n\t\tstack: opts.stack,\n\t\tplugin: 'postgres',\n\t\trole: opts.name,\n\t};\n\n\tconst identity: PostgresIdentityPayload = {\n\t\tkind: 'postgres-server',\n\t\tname: opts.name,\n\t\t// Frozen list so the identity payload is structurally stable\n\t\t// across calls — the substrate hashes it for comparison.\n\t\tdatabases: Object.freeze([...opts.databases].sort()) as ReadonlyArray<string>,\n\t};\n\n\treturn {\n\t\tkind: 'snapshotable',\n\t\t// No host-tree subtree — all state lives in the container.\n\t\tsubtrees: [],\n\t\tmanagedContainers: [labels],\n\t\t// Engine-level pause-around-commit handles quiescence; the\n\t\t// plugin's contribution is just the label tuple above.\n\t\tmissingTolerance: 'fine',\n\t\tpreRestore: Effect.succeed(identity),\n\t\tpostRestore: Effect.void,\n\t};\n};\n"],"mappings":";;;;;;;AAmDA,MAAa,oBAAoB,SAAoD;CACpF,MAAM,SAA8B;EACnC,KAAK,KAAK;EACV,OAAO,KAAK;EACZ,QAAQ;EACR,MAAM,KAAK;EACX;CAED,MAAM,WAAoC;EACzC,MAAM;EACN,MAAM,KAAK;EAGX,WAAW,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,MAAM,CAAC;EACpD;AAED,QAAO;EACN,MAAM;EAEN,UAAU,EAAE;EACZ,mBAAmB,CAAC,OAAO;EAG3B,kBAAkB;EAClB,YAAY,OAAO,QAAQ,SAAS;EACpC,aAAa,OAAO;EACpB"}

package/dist/plugins/postgres/spans.mjs

@@ -0,0 +1,11 @@
+//#region src/plugins/postgres/spans.ts
+const PostgresSpans = {
+	database: "postgres.database",
+	name: "postgres.name",
+	timeoutMs: "postgres.timeoutMs",
+	version: "postgres.version"
+};
+//#endregion
+export { PostgresSpans };
+
+//# sourceMappingURL=spans.mjs.map

package/dist/plugins/postgres/spans.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"spans.mjs","names":[],"sources":["../../../src/plugins/postgres/spans.ts"],"sourcesContent":["// Postgres plugin span-attribute vocabulary. Plugin-local — substrate's\n// `SpanAttr` carries only engine-dimensional + http/process generic\n// keys; plugin-domain keys live next to the plugin that owns them.\n//\n// Callsite pattern: `Effect.annotateCurrentSpan({ [PostgresSpans.database]:\n// value })`. Free-form string literals are a STYLE_GUIDE §16 violation.\n\nexport const PostgresSpans = {\n\tdatabase: 'postgres.database',\n\tname: 'postgres.name',\n\ttimeoutMs: 'postgres.timeoutMs',\n\tversion: 'postgres.version',\n} as const;\n"],"mappings":";AAOA,MAAa,gBAAgB;CAC5B,UAAU;CACV,MAAM;CACN,WAAW;CACX,SAAS;CACT"}

package/dist/plugins/router-entrypoints.mjs

@@ -1,18 +1,18 @@
-import { SUI_ENTRYPOINTS } from "./sui/routable.mjs";
+import { DASHBOARD_ENTRYPOINTS } from "./dashboard/routable.mjs";
 import { HOST_SERVICE_ENTRYPOINTS } from "./host-service/routable.mjs";
-import { WALLET_ENTRYPOINTS } from "./wallet/routable.mjs";
-import { DEEPBOOK_ENTRYPOINTS } from "./deepbook/routable.mjs";
 import { POSTGRES_ENTRYPOINTS } from "./postgres/routable.mjs";
 import { SEAL_ENTRYPOINTS } from "./seal/routable.mjs";
+import { SUI_ENTRYPOINTS } from "./sui/routable.mjs";
+import { WALLET_ENTRYPOINTS } from "./wallet/routable.mjs";
 import { WALRUS_ENTRYPOINTS } from "./walrus/routable.mjs";
 //#region src/plugins/router-entrypoints.ts
 const BUILT_IN_ENTRYPOINTS = [
+	...DASHBOARD_ENTRYPOINTS,
 	...SUI_ENTRYPOINTS,
 	...HOST_SERVICE_ENTRYPOINTS,
 	...WALLET_ENTRYPOINTS,
 	...WALRUS_ENTRYPOINTS,
 	...SEAL_ENTRYPOINTS,
-	...DEEPBOOK_ENTRYPOINTS,
 	...POSTGRES_ENTRYPOINTS
 ];
 //#endregion

package/dist/plugins/router-entrypoints.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"router-entrypoints.mjs","names":[],"sources":["../../src/plugins/router-entrypoints.ts"],"sourcesContent":["// Built-in plugin router entrypoints.\n//\n// The router orchestrator owns registry validation and collision checks.\n// Built-in plugins own their public listener names and ports.\n\nimport type { EntrypointDecl } from '../contracts/routable.ts';\nimport { DEEPBOOK_ENTRYPOINTS } from './deepbook/routable.ts';\nimport { HOST_SERVICE_ENTRYPOINTS } from './host-service/routable.ts';\nimport { POSTGRES_ENTRYPOINTS } from './postgres/routable.ts';\nimport { SEAL_ENTRYPOINTS } from './seal/routable.ts';\nimport { SUI_ENTRYPOINTS } from './sui/routable.ts';\nimport { WALLET_ENTRYPOINTS } from './wallet/routable.ts';\nimport { WALRUS_ENTRYPOINTS } from './walrus/routable.ts';\n\nexport const BUILT_IN_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t...SUI_ENTRYPOINTS,\n\t...HOST_SERVICE_ENTRYPOINTS,\n\t...WALLET_ENTRYPOINTS,\n\t...WALRUS_ENTRYPOINTS,\n\t...SEAL_ENTRYPOINTS,\n\t...DEEPBOOK_ENTRYPOINTS,\n\t...POSTGRES_ENTRYPOINTS,\n];\n"],"mappings":";;;;;;;;AAcA,MAAa,uBAAsD;CAClE,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH"}
+{"version":3,"file":"router-entrypoints.mjs","names":[],"sources":["../../src/plugins/router-entrypoints.ts"],"sourcesContent":["// Built-in plugin router entrypoints.\n//\n// The router orchestrator owns registry validation and collision checks.\n// Built-in plugins own their public listener names and ports.\n\nimport type { EntrypointDecl } from '../contracts/routable.ts';\nimport { DASHBOARD_ENTRYPOINTS } from './dashboard/routable.ts';\nimport { HOST_SERVICE_ENTRYPOINTS } from './host-service/routable.ts';\nimport { POSTGRES_ENTRYPOINTS } from './postgres/routable.ts';\nimport { SEAL_ENTRYPOINTS } from './seal/routable.ts';\nimport { SUI_ENTRYPOINTS } from './sui/routable.ts';\nimport { WALLET_ENTRYPOINTS } from './wallet/routable.ts';\nimport { WALRUS_ENTRYPOINTS } from './walrus/routable.ts';\n\nexport const BUILT_IN_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t...DASHBOARD_ENTRYPOINTS,\n\t...SUI_ENTRYPOINTS,\n\t...HOST_SERVICE_ENTRYPOINTS,\n\t...WALLET_ENTRYPOINTS,\n\t...WALRUS_ENTRYPOINTS,\n\t...SEAL_ENTRYPOINTS,\n\t...POSTGRES_ENTRYPOINTS,\n];\n"],"mappings":";;;;;;;;AAcA,MAAa,uBAAsD;CAClE,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH"}

package/dist/plugins/seal/bootstrap-assets/cargo-image.mjs

@@ -1,11 +1,10 @@
+import { readEnv } from "../../../substrate/runtime/typed-env.mjs";
 import { sealError } from "../errors.mjs";
+import { SealSpans } from "../spans.mjs";
 import { DEFAULT_SEAL_REPO, DEFAULT_SEAL_VERSION } from "./source-fetch.mjs";
 import { Effect } from "effect";
+import { fileURLToPath } from "node:url";
 //#region src/plugins/seal/bootstrap-assets/cargo-image.ts
-/** Pinned rust toolchain for the upstream seal cargo build. Distilled-
-*  doc §Configuration defaults block. Pinned to match walrus's default
-*  so a shared rust:1.93 builder image can fan out builds. */
-const DEFAULT_SEAL_RUST_TOOLCHAIN = "1.93";
 /** Resolve the seal image. Two staged paths:
 *
 *   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked
@@ -23,35 +22,38 @@ const DEFAULT_SEAL_RUST_TOOLCHAIN = "1.93";
 *        package them. Build is content-addressed by docker; same
 *        Dockerfile + same SEAL_VERSION → same image hash. */
 const resolveSealCargoImage = (runtime, inputs) => Effect.gen(function* () {
-	const override = globalThis.process?.env?.SEAL_CARGO_IMAGE_OVERRIDE;
+	const override = readEnv("SEAL_CARGO_IMAGE_OVERRIDE");
 	if (override && override.length > 0) return {
 		digest: override,
 		tag: override
 	};
 	const buildCtx = {
-		contextPath: new URL("../../../../images/", import.meta.url).pathname,
+		contextPath: fileURLToPath(new URL("../../../../images/", import.meta.url)),
 		dockerfile: "seal/Dockerfile",
 		fingerprintPaths: [
 			"seal/Dockerfile",
 			"seal/entrypoint.sh",
 			"_shared/signal-forward.sh"
 		],
-		buildArgs: { SEAL_VERSION: inputs.sealRef }
+		buildArgs: { SEAL_VERSION: inputs.sealRef },
+		owner: {
+			app: inputs.owner.app,
+			stack: inputs.owner.stack,
+			plugin: "seal",
+			role: "key-server"
+		}
 	};
 	return yield* runtime.ensureImage(buildCtx).pipe(Effect.mapError((cause) => sealError("image", {
 		name: "seal",
 		message: `seal image build failed: ${cause.reason}: ${cause.detail}. SEAL_VERSION=${inputs.sealRef} (from ${inputs.sealRepo}/releases). Set SEAL_CARGO_IMAGE_OVERRIDE=<tag> to bypass the build.`,
 		cause
 	})));
-}).pipe(Effect.withSpan("devstack.plugin.seal.cargoImage.resolve", { attributes: {
-	"seal.ref": inputs.sealRef,
-	"seal.rustToolchain": inputs.rustToolchain
-} }));
+}).pipe(Effect.withSpan("devstack.plugin.seal.cargoImage.resolve", { attributes: { [SealSpans.ref]: inputs.sealRef } }));
 /** Convenience: resolve via the default inputs. */
-const resolveDefaultSealCargoImage = (runtime) => resolveSealCargoImage(runtime, {
+const resolveDefaultSealCargoImage = (runtime, owner) => resolveSealCargoImage(runtime, {
 	sealRepo: DEFAULT_SEAL_REPO,
 	sealRef: DEFAULT_SEAL_VERSION,
-	rustToolchain: DEFAULT_SEAL_RUST_TOOLCHAIN
+	owner
 });
 //#endregion
 export { resolveDefaultSealCargoImage };

package/dist/plugins/seal/bootstrap-assets/cargo-image.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cargo-image.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/cargo-image.ts"],"sourcesContent":["// Seal vendored-Dockerfile docker image.\n//\n// The upstream seal release ships pre-built `seal-cli` + `key-server`\n// binaries per platform, and our vendored Dockerfile at\n// `images/seal/Dockerfile` just fetches and packages them.\n//\n// Resolution paths (mirror walrus's two-stage dispatch — distilled-doc\n// §\"Pinned upstream version\" + §\"Optional pre-built image tag override\"):\n//\n//   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env — points at a pre-baked\n//        registry tag (or a locally-tagged image like `seal-test-stub:latest`).\n//        Skips the docker build entirely. The on-disk image is\n//        content-addressed by the registry; we just thread it through.\n//\n//   (b) Real build via `runtime.ensureImage({ contextPath,\n//        dockerfile: 'Dockerfile', buildArgs: { SEAL_VERSION } })`\n//        against the vendored Dockerfile at `images/seal/`. Mirrors\n//        the sui plugin's `resolveImage` shape.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tContainerBuildContext,\n\tContainerRuntime,\n\tImageRef,\n} from '../../../contracts/container-runtime.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { DEFAULT_SEAL_REPO, DEFAULT_SEAL_VERSION } from './source-fetch.ts';\n\n// ---------------------------------------------------------------------------\n/** Pinned rust toolchain for the upstream seal cargo build. Distilled-\n *  doc §Configuration defaults block. Pinned to match walrus's default\n *  so a shared rust:1.93 builder image can fan out builds. */\nexport const DEFAULT_SEAL_RUST_TOOLCHAIN = '1.93' as const;\n\n/** Inputs to the seal image resolver. */\nexport interface SealCargoImageInputs<Ref extends string = string, RustV extends string = string> {\n\treadonly sealRepo: typeof DEFAULT_SEAL_REPO;\n\treadonly sealRef: Ref;\n\treadonly rustToolchain: RustV;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Resolve the seal image. Two staged paths:\n *\n *   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked\n *        registry tag (or a locally-built fixture image like\n *        `seal-test-stub:latest`). Skips the docker build entirely\n *        and returns a bare `ImageRef` synthesized from the override\n *        tag. CI bakes the image once + pins the tag; the local-\n *        keygen boot just reads the env.\n *\n *   (b) Real build via `runtime.ensureImage` against the vendored\n *        Dockerfile at `packages/devstack/images/seal/`. The\n *        Dockerfile is a binary-fetch path (NOT a cargo compile) —\n *        the seal release workflow ships pre-built per-platform\n *        binaries (`seal-cli`, `key-server`) and we just fetch +\n *        package them. Build is content-addressed by docker; same\n *        Dockerfile + same SEAL_VERSION → same image hash. */\nexport const resolveSealCargoImage = (\n\truntime: ContainerRuntime,\n\tinputs: SealCargoImageInputs,\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst override = (globalThis as { process?: { env?: Record<string, string | undefined> } })\n\t\t\t.process?.env?.SEAL_CARGO_IMAGE_OVERRIDE;\n\t\tif (override && override.length > 0) {\n\t\t\t// Trust-the-tag path. Compose the resolved shape from the\n\t\t\t// pinned tag — the digest is opaque (substrate's\n\t\t\t// content-addressed cache will re-resolve via `docker\n\t\t\t// inspect` when it materializes the image).\n\t\t\treturn { digest: override, tag: override } satisfies ImageRef;\n\t\t}\n\t\t// Vendored-Dockerfile path. Same shape as sui's `resolveImage`\n\t\t// (plugins/sui/mode/local.ts:resolveImage). Context is `images/`\n\t\t// (NOT `images/seal/`) so the Dockerfile can `COPY` the shared\n\t\t// `_shared/signal-forward.sh` snippet alongside the seal-specific\n\t\t// entrypoint. The Dockerfile builds in two stages: (1) ubuntu\n\t\t// base, fetch + chmod the per-arch binaries from the seal release\n\t\t// URL; (2) debian:bookworm-slim runtime with the signal-\n\t\t// forwarding entrypoint shell wrapped around `key-server`.\n\t\tconst buildCtx: ContainerBuildContext = {\n\t\t\tcontextPath: new URL('../../../../images/', import.meta.url).pathname,\n\t\t\tdockerfile: 'seal/Dockerfile',\n\t\t\tfingerprintPaths: ['seal/Dockerfile', 'seal/entrypoint.sh', '_shared/signal-forward.sh'],\n\t\t\tbuildArgs: { SEAL_VERSION: inputs.sealRef },\n\t\t};\n\t\treturn yield* runtime.ensureImage(buildCtx).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal image build failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t`SEAL_VERSION=${inputs.sealRef} (from ${inputs.sealRepo}/releases). ` +\n\t\t\t\t\t\t`Set SEAL_CARGO_IMAGE_OVERRIDE=<tag> to bypass the build.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.cargoImage.resolve', {\n\t\t\tattributes: {\n\t\t\t\t'seal.ref': inputs.sealRef,\n\t\t\t\t'seal.rustToolchain': inputs.rustToolchain,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealCargoImage = (\n\truntime: ContainerRuntime,\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tresolveSealCargoImage(runtime, {\n\t\tsealRepo: DEFAULT_SEAL_REPO,\n\t\tsealRef: DEFAULT_SEAL_VERSION,\n\t\trustToolchain: DEFAULT_SEAL_RUST_TOOLCHAIN,\n\t});\n"],"mappings":";;;;;;;AAiCA,MAAa,8BAA8B;;;;;;;;;;;;;;;;;AA6B3C,MAAa,yBACZ,SACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAY,WAChB,SAAS,KAAK;AAChB,KAAI,YAAY,SAAS,SAAS,EAKjC,QAAO;EAAE,QAAQ;EAAU,KAAK;EAAU;CAU3C,MAAM,WAAkC;EACvC,aAAa,IAAI,IAAI,uBAAuB,OAAO,KAAK,IAAI,CAAC;EAC7D,YAAY;EACZ,kBAAkB;GAAC;GAAmB;GAAsB;GAA4B;EACxF,WAAW,EAAE,cAAc,OAAO,SAAS;EAC3C;AACD,QAAO,OAAO,QAAQ,YAAY,SAAS,CAAC,KAC3C,OAAO,UAAU,UAChB,UAAU,SAAS;EAClB,MAAM;EACN,SACC,4BAA4B,MAAM,OAAO,IAAI,MAAM,OAAO,iBAC1C,OAAO,QAAQ,SAAS,OAAO,SAAS;EAEzD;EACA,CAAC,CACF,CACD;EACA,CAAC,KACF,OAAO,SAAS,2CAA2C,EAC1D,YAAY;CACX,YAAY,OAAO;CACnB,sBAAsB,OAAO;CAC7B,EACD,CAAC,CACF;;AAGF,MAAa,gCACZ,YAEA,sBAAsB,SAAS;CAC9B,UAAU;CACV,SAAS;CACT,eAAe;CACf,CAAC"}
+{"version":3,"file":"cargo-image.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/cargo-image.ts"],"sourcesContent":["// Seal vendored-Dockerfile docker image.\n//\n// The upstream seal release ships pre-built `seal-cli` + `key-server`\n// binaries per platform, and our vendored Dockerfile at\n// `images/seal/Dockerfile` just fetches and packages them.\n//\n// Resolution paths (mirror walrus's two-stage dispatch — distilled-doc\n// §\"Pinned upstream version\" + §\"Optional pre-built image tag override\"):\n//\n//   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env — points at a pre-baked\n//        registry tag (or a locally-tagged image like `seal-test-stub:latest`).\n//        Skips the docker build entirely. The on-disk image is\n//        content-addressed by the registry; we just thread it through.\n//\n//   (b) Real build via `runtime.ensureImage({ contextPath,\n//        dockerfile: 'Dockerfile', buildArgs: { SEAL_VERSION } })`\n//        against the vendored Dockerfile at `images/seal/`. Mirrors\n//        the sui plugin's `resolveImage` shape.\n\nimport { Effect, type Scope } from 'effect';\nimport { fileURLToPath } from 'node:url';\n\nimport type {\n\tContainerBuildContext,\n\tContainerRuntime,\n\tImageRef,\n} from '../../../contracts/container-runtime.ts';\nimport { readEnv } from '../../../substrate/runtime/typed-env.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { SealSpans } from '../spans.ts';\nimport { DEFAULT_SEAL_REPO, DEFAULT_SEAL_VERSION } from './source-fetch.ts';\n\n// ---------------------------------------------------------------------------\n/** Inputs to the seal image resolver. */\nexport interface SealCargoImageInputs<Ref extends string = string> {\n\treadonly sealRepo: typeof DEFAULT_SEAL_REPO;\n\treadonly sealRef: Ref;\n\t/** Owner identity stamped on the built image so label-driven prune\n\t *  finds it. */\n\treadonly owner: {\n\t\treadonly app: string;\n\t\treadonly stack: string;\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Resolve the seal image. Two staged paths:\n *\n *   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked\n *        registry tag (or a locally-built fixture image like\n *        `seal-test-stub:latest`). Skips the docker build entirely\n *        and returns a bare `ImageRef` synthesized from the override\n *        tag. CI bakes the image once + pins the tag; the local-\n *        keygen boot just reads the env.\n *\n *   (b) Real build via `runtime.ensureImage` against the vendored\n *        Dockerfile at `packages/devstack/images/seal/`. The\n *        Dockerfile is a binary-fetch path (NOT a cargo compile) —\n *        the seal release workflow ships pre-built per-platform\n *        binaries (`seal-cli`, `key-server`) and we just fetch +\n *        package them. Build is content-addressed by docker; same\n *        Dockerfile + same SEAL_VERSION → same image hash. */\nexport const resolveSealCargoImage = (\n\truntime: ContainerRuntime,\n\tinputs: SealCargoImageInputs,\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst override = readEnv('SEAL_CARGO_IMAGE_OVERRIDE');\n\t\tif (override && override.length > 0) {\n\t\t\t// Trust-the-tag path. Compose the resolved shape from the\n\t\t\t// pinned tag — the digest is opaque (substrate's\n\t\t\t// content-addressed cache will re-resolve via `docker\n\t\t\t// inspect` when it materializes the image).\n\t\t\treturn { digest: override, tag: override } satisfies ImageRef;\n\t\t}\n\t\t// Vendored-Dockerfile path. Same shape as sui's `resolveImage`\n\t\t// (plugins/sui/mode/local.ts:resolveImage). Context is `images/`\n\t\t// (NOT `images/seal/`) so the Dockerfile can `COPY` the shared\n\t\t// `_shared/signal-forward.sh` snippet alongside the seal-specific\n\t\t// entrypoint. The Dockerfile builds in two stages: (1) ubuntu\n\t\t// base, fetch + chmod the per-arch binaries from the seal release\n\t\t// URL; (2) debian:bookworm-slim runtime with the signal-\n\t\t// forwarding entrypoint shell wrapped around `key-server`.\n\t\tconst buildCtx: ContainerBuildContext = {\n\t\t\t// `fileURLToPath` normalises across platforms (Windows\n\t\t\t// `file:///C:/...` → `C:\\...`; POSIX strips the scheme and\n\t\t\t// percent-decodes). Using `.pathname` directly leaves the\n\t\t\t// leading `/` on Windows drive paths.\n\t\t\tcontextPath: fileURLToPath(new URL('../../../../images/', import.meta.url)),\n\t\t\tdockerfile: 'seal/Dockerfile',\n\t\t\tfingerprintPaths: ['seal/Dockerfile', 'seal/entrypoint.sh', '_shared/signal-forward.sh'],\n\t\t\tbuildArgs: { SEAL_VERSION: inputs.sealRef },\n\t\t\towner: {\n\t\t\t\tapp: inputs.owner.app,\n\t\t\t\tstack: inputs.owner.stack,\n\t\t\t\tplugin: 'seal',\n\t\t\t\trole: 'key-server',\n\t\t\t},\n\t\t};\n\t\treturn yield* runtime.ensureImage(buildCtx).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal image build failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t`SEAL_VERSION=${inputs.sealRef} (from ${inputs.sealRepo}/releases). ` +\n\t\t\t\t\t\t`Set SEAL_CARGO_IMAGE_OVERRIDE=<tag> to bypass the build.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.cargoImage.resolve', {\n\t\t\tattributes: {\n\t\t\t\t[SealSpans.ref]: inputs.sealRef,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealCargoImage = (\n\truntime: ContainerRuntime,\n\towner: SealCargoImageInputs['owner'],\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tresolveSealCargoImage(runtime, {\n\t\tsealRepo: DEFAULT_SEAL_REPO,\n\t\tsealRef: DEFAULT_SEAL_VERSION,\n\t\towner,\n\t});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiEA,MAAa,yBACZ,SACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,QAAQ,4BAA4B;AACrD,KAAI,YAAY,SAAS,SAAS,EAKjC,QAAO;EAAE,QAAQ;EAAU,KAAK;EAAU;CAU3C,MAAM,WAAkC;EAKvC,aAAa,cAAc,IAAI,IAAI,uBAAuB,OAAO,KAAK,IAAI,CAAC;EAC3E,YAAY;EACZ,kBAAkB;GAAC;GAAmB;GAAsB;GAA4B;EACxF,WAAW,EAAE,cAAc,OAAO,SAAS;EAC3C,OAAO;GACN,KAAK,OAAO,MAAM;GAClB,OAAO,OAAO,MAAM;GACpB,QAAQ;GACR,MAAM;GACN;EACD;AACD,QAAO,OAAO,QAAQ,YAAY,SAAS,CAAC,KAC3C,OAAO,UAAU,UAChB,UAAU,SAAS;EAClB,MAAM;EACN,SACC,4BAA4B,MAAM,OAAO,IAAI,MAAM,OAAO,iBAC1C,OAAO,QAAQ,SAAS,OAAO,SAAS;EAEzD;EACA,CAAC,CACF,CACD;EACA,CAAC,KACF,OAAO,SAAS,2CAA2C,EAC1D,YAAY,GACV,UAAU,MAAM,OAAO,SACxB,EACD,CAAC,CACF;;AAGF,MAAa,gCACZ,SACA,UAEA,sBAAsB,SAAS;CAC9B,UAAU;CACV,SAAS;CACT;CACA,CAAC"}

package/dist/plugins/seal/bootstrap-assets/source-fetch.mjs

@@ -1,5 +1,11 @@
+import { tailOutput } from "../../../substrate/runtime/observability/output-truncate.mjs";
+import "../../../substrate/runtime/observability/index.mjs";
+import { mintRandomSuffix } from "../../../substrate/runtime/random-suffix.mjs";
 import { stageAndSwap } from "../../../substrate/runtime/stage-and-swap/index.mjs";
+import { hostBindMountOwner } from "../../../substrate/runtime/host-bind-mount-owner.mjs";
+import { readEnv } from "../../../substrate/runtime/typed-env.mjs";
 import { sealError } from "../errors.mjs";
+import { SealSpans } from "../spans.mjs";
 import { Effect, FileSystem, Path } from "effect";
 //#region src/plugins/seal/bootstrap-assets/source-fetch.ts
 /** Default upstream repo URL — distilled doc §"External" reference. */
@@ -15,33 +21,23 @@ const DEFAULT_SEAL_MOVE_SUBDIR = "move/seal";
 *  `clone`. */
 const SEAL_SOURCE_FETCH_IMAGE = "alpine/git:2.52.0";
 const SEAL_SOURCE_FETCH_TIMEOUT_MS = 5 * 6e4;
-const env = () => globalThis.process?.env ?? {};
-const processId = () => String(globalThis.process?.pid ?? "unknown");
-let scratchCounter = 0;
 const nextScratchPaths = (cacheDir) => {
-	scratchCounter = scratchCounter + 1;
-	const suffix = `${processId()}.${scratchCounter}`;
+	const suffix = mintRandomSuffix(16);
 	return {
 		stagingPath: `${cacheDir}.staging.${suffix}`,
 		backupPath: `${cacheDir}.backup.${suffix}`
 	};
 };
 const sealSourceCacheDir = (ref) => {
-	return `${env().HOME ?? "/tmp"}/.cache/devstack-rewrite/seal-src/${encodeURIComponent(ref)}`;
+	return `${readEnv("HOME") ?? "/tmp"}/.cache/devstack/seal-src/${encodeURIComponent(ref)}`;
 };
 const sealSourcePublishLockPath = (ref) => `${sealSourceCacheDir(ref)}.publish.lock`;
 const sourceImageRef = {
 	digest: SEAL_SOURCE_FETCH_IMAGE,
 	tag: SEAL_SOURCE_FETCH_IMAGE
 };
-const outputTail = (value) => value.slice(-1e3);
-const hostCloneUser = () => {
-	const process = globalThis.process;
-	if (typeof process?.getuid !== "function" || typeof process.getgid !== "function") return;
-	return `${process.getuid()}:${process.getgid()}`;
-};
 const resolveSealSource = (runtime, inputs) => Effect.gen(function* () {
-	const override = env().SEAL_MOVE_SOURCE_OVERRIDE;
+	const override = readEnv("SEAL_MOVE_SOURCE_OVERRIDE");
 	if (override && override.length > 0) return {
 		repo: inputs.repo,
 		ref: inputs.ref,
@@ -67,7 +63,7 @@ const resolveSealSource = (runtime, inputs) => Effect.gen(function* () {
 			const result = yield* Effect.scoped(runtime.runOneShot({
 				image: sourceImageRef,
 				entrypoint: "git",
-				user: hostCloneUser(),
+				user: hostBindMountOwner(),
 				argv: [
 					"clone",
 					"--depth",
@@ -91,8 +87,8 @@ const resolveSealSource = (runtime, inputs) => Effect.gen(function* () {
 				name: "seal",
 				message: `seal move-source: git clone exited ${result.exitCode}. Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,
 				exitCode: result.exitCode,
-				stdout: outputTail(result.stdout),
-				stderr: outputTail(result.stderr)
+				stdout: tailOutput(result.stdout),
+				stderr: tailOutput(result.stderr)
 			}));
 			const stagedSubdir = path.join(stagingPath, inputs.subdir);
 			if (!(yield* fs.exists(stagedSubdir).pipe(Effect.catch(() => Effect.succeed(false))))) return yield* Effect.fail(sealError("image", {
@@ -116,9 +112,9 @@ const resolveSealSource = (runtime, inputs) => Effect.gen(function* () {
 		path: subdirPath
 	};
 }).pipe(Effect.withSpan("devstack.plugin.seal.moveSource.resolve", { attributes: {
-	"seal.repo": inputs.repo,
-	"seal.ref": inputs.ref,
-	"seal.subdir": inputs.subdir
+	[SealSpans.repo]: inputs.repo,
+	[SealSpans.ref]: inputs.ref,
+	[SealSpans.subdir]: inputs.subdir
 } }));
 /** Convenience: resolve via the default inputs. */
 const resolveDefaultSealSource = (runtime) => resolveSealSource(runtime, {

package/dist/plugins/seal/bootstrap-assets/source-fetch.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"source-fetch.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/source-fetch.ts"],"sourcesContent":["// Seal git-fetched source tree.\n//\n// Resolution paths (mirror walrus's three-stage dispatch):\n//\n//   (a) Caller-pinned `movePackagePath` opt — local-keygen mode\n//        short-circuits before calling this resolver.\n//\n//   (b) `SEAL_MOVE_SOURCE_OVERRIDE` env var — points at a pre-fetched\n//        on-disk path. Trust-the-path; no I/O. Useful in CI where the\n//        repo is checked out once and reused.\n//\n//   (c) Real git fetch via `runtime.runOneShot({ image: 'alpine/git:2.52.0',\n//        mounts: [stagingDir→/out], argv: ['clone',...] })`, staged\n//        into the per-host source cache before returning the host\n//        `move/seal` subdir.\n\nimport { Effect, FileSystem, Path, type Scope } from 'effect';\n\nimport type { ContainerRuntime } from '../../../contracts/container-runtime.ts';\nimport { stageAndSwap } from '../../../substrate/runtime/stage-and-swap/index.ts';\nimport { sealError, type SealError } from '../errors.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — distilled-doc §\"External / upstream sources\"\n// ---------------------------------------------------------------------------\n\n/** Default upstream repo URL — distilled doc §\"External\" reference. */\nexport const DEFAULT_SEAL_REPO = 'https://github.com/MystenLabs/seal' as const;\n\n/** Pinned default ref. Distilled-doc invariant #11: this MUST match\n *  the cargo binary's version (the Dockerfile's `SEAL_VERSION` build\n *  arg). They move in lockstep. */\nexport const DEFAULT_SEAL_VERSION = 'seal-v0.6.6' as const;\n\n/** Subdirectory containing the Move package. */\nexport const DEFAULT_SEAL_MOVE_SUBDIR = 'move/seal' as const;\n\n/** Pinned helper image for the git clone one-shot. `alpine/git`\n *  uses `git` as its entrypoint, so the clone argv starts at\n *  `clone`. */\nexport const SEAL_SOURCE_FETCH_IMAGE = 'alpine/git:2.52.0' as const;\n\nconst SEAL_SOURCE_FETCH_TIMEOUT_MS = 5 * 60_000;\n\n// ---------------------------------------------------------------------------\n// Resolved value\n// ---------------------------------------------------------------------------\n\n/** Resolved value for the cloned `move/seal` subdir. The local-keygen\n *  mode's acquire body threads this into `publishSealPackage(...)`. */\nexport interface SealSourceFetchResolved {\n\treadonly repo: string;\n\treadonly ref: string;\n\treadonly subdir: string;\n\treadonly path: string;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Inputs to the source resolver. */\nexport interface SealSourceFetchInputs<Ref extends string = string> {\n\treadonly repo: typeof DEFAULT_SEAL_REPO;\n\treadonly ref: Ref;\n\treadonly subdir: typeof DEFAULT_SEAL_MOVE_SUBDIR;\n}\n\nconst env = (): Record<string, string | undefined> =>\n\t(globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ?? {};\n\nconst processId = (): string =>\n\tString((globalThis as { process?: { pid?: number } }).process?.pid ?? 'unknown');\n\nlet scratchCounter = 0;\n\nconst nextScratchPaths = (\n\tcacheDir: string,\n): { readonly stagingPath: string; readonly backupPath: string } => {\n\tscratchCounter = scratchCounter + 1;\n\tconst suffix = `${processId()}.${scratchCounter}`;\n\treturn {\n\t\tstagingPath: `${cacheDir}.staging.${suffix}`,\n\t\tbackupPath: `${cacheDir}.backup.${suffix}`,\n\t};\n};\n\nexport const sealSourceCacheDir = (ref: string): string => {\n\tconst home = env().HOME ?? '/tmp';\n\treturn `${home}/.cache/devstack-rewrite/seal-src/${encodeURIComponent(ref)}`;\n};\n\nexport const sealSourcePublishLockPath = (ref: string): string =>\n\t`${sealSourceCacheDir(ref)}.publish.lock`;\n\nconst sourceImageRef = { digest: SEAL_SOURCE_FETCH_IMAGE, tag: SEAL_SOURCE_FETCH_IMAGE } as const;\n\nconst outputTail = (value: string): string => value.slice(-1000);\n\nconst hostCloneUser = (): string | undefined => {\n\tconst process = (\n\t\tglobalThis as {\n\t\t\tprocess?: { getuid?: () => number; getgid?: () => number };\n\t\t}\n\t).process;\n\tif (typeof process?.getuid !== 'function' || typeof process.getgid !== 'function') {\n\t\treturn undefined;\n\t}\n\treturn `${process.getuid()}:${process.getgid()}`;\n};\n\nexport const resolveSealSource = (\n\truntime: ContainerRuntime,\n\tinputs: SealSourceFetchInputs,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\tconst override = env().SEAL_MOVE_SOURCE_OVERRIDE;\n\t\tif (override && override.length > 0) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: override,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = yield* Path.Path;\n\t\tconst cacheDir = sealSourceCacheDir(inputs.ref);\n\t\tconst subdirPath = path.join(cacheDir, inputs.subdir);\n\t\tconst cached = yield* fs.exists(subdirPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (cached) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: subdirPath,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst { stagingPath, backupPath } = nextScratchPaths(cacheDir);\n\t\tyield* stageAndSwap({\n\t\t\ttargetPath: cacheDir,\n\t\t\tstagingPath,\n\t\t\tbackupPath,\n\t\t\tbuild: Effect.gen(function* () {\n\t\t\t\tconst result = yield* Effect.scoped(\n\t\t\t\t\truntime\n\t\t\t\t\t\t.runOneShot({\n\t\t\t\t\t\t\timage: sourceImageRef,\n\t\t\t\t\t\t\tentrypoint: 'git',\n\t\t\t\t\t\t\tuser: hostCloneUser(),\n\t\t\t\t\t\t\targv: ['clone', '--depth', '1', '--branch', inputs.ref, inputs.repo, '/out'],\n\t\t\t\t\t\t\tmounts: [{ source: stagingPath, target: '/out' }],\n\t\t\t\t\t\t\ttimeoutMillis: SEAL_SOURCE_FETCH_TIMEOUT_MS,\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\t`seal move-source: git clone one-shot failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tif (result.exitCode !== 0) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t`seal move-source: git clone exited ${result.exitCode}. ` +\n\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\t\t\tstdout: outputTail(result.stdout),\n\t\t\t\t\t\t\tstderr: outputTail(result.stderr),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst stagedSubdir = path.join(stagingPath, inputs.subdir);\n\t\t\t\tconst stagedSubdirExists = yield* fs\n\t\t\t\t\t.exists(stagedSubdir)\n\t\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\tif (!stagedSubdirExists) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage: `seal move-source: clone completed but ${inputs.subdir} was missing from ${inputs.repo}@${inputs.ref}.`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}),\n\t\t\tpublishLockPath: sealSourcePublishLockPath(inputs.ref),\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause): SealError => {\n\t\t\t\tif (cause._tag === 'SealError') return cause;\n\t\t\t\treturn sealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage: `seal move-source: cache publish failed at ${cause.stage}`,\n\t\t\t\t\tcause,\n\t\t\t\t});\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\trepo: inputs.repo,\n\t\t\tref: inputs.ref,\n\t\t\tsubdir: inputs.subdir,\n\t\t\tpath: subdirPath,\n\t\t} satisfies SealSourceFetchResolved;\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.moveSource.resolve', {\n\t\t\tattributes: {\n\t\t\t\t'seal.repo': inputs.repo,\n\t\t\t\t'seal.ref': inputs.ref,\n\t\t\t\t'seal.subdir': inputs.subdir,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealSource = (\n\truntime: ContainerRuntime,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tresolveSealSource(runtime, {\n\t\trepo: DEFAULT_SEAL_REPO,\n\t\tref: DEFAULT_SEAL_VERSION,\n\t\tsubdir: DEFAULT_SEAL_MOVE_SUBDIR,\n\t});\n"],"mappings":";;;;;AA2BA,MAAa,oBAAoB;;;;AAKjC,MAAa,uBAAuB;;AAGpC,MAAa,2BAA2B;;;;AAKxC,MAAa,0BAA0B;AAEvC,MAAM,+BAA+B,IAAI;AA0BzC,MAAM,YACJ,WAA0E,SAAS,OAAO,EAAE;AAE9F,MAAM,kBACL,OAAQ,WAA8C,SAAS,OAAO,UAAU;AAEjF,IAAI,iBAAiB;AAErB,MAAM,oBACL,aACmE;AACnE,kBAAiB,iBAAiB;CAClC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG;AACjC,QAAO;EACN,aAAa,GAAG,SAAS,WAAW;EACpC,YAAY,GAAG,SAAS,UAAU;EAClC;;AAGF,MAAa,sBAAsB,QAAwB;AAE1D,QAAO,GADM,KAAK,CAAC,QAAQ,OACZ,oCAAoC,mBAAmB,IAAI;;AAG3E,MAAa,6BAA6B,QACzC,GAAG,mBAAmB,IAAI,CAAC;AAE5B,MAAM,iBAAiB;CAAE,QAAQ;CAAyB,KAAK;CAAyB;AAExF,MAAM,cAAc,UAA0B,MAAM,MAAM,KAAM;AAEhE,MAAM,sBAA0C;CAC/C,MAAM,UACL,WAGC;AACF,KAAI,OAAO,SAAS,WAAW,cAAc,OAAO,QAAQ,WAAW,WACtE;AAED,QAAO,GAAG,QAAQ,QAAQ,CAAC,GAAG,QAAQ,QAAQ;;AAG/C,MAAa,qBACZ,SACA,WAMA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,KAAK,CAAC;AACvB,KAAI,YAAY,SAAS,SAAS,EACjC,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;CAGF,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,WAAW,mBAAmB,OAAO,IAAI;CAC/C,MAAM,aAAa,KAAK,KAAK,UAAU,OAAO,OAAO;AAErD,KAAI,OADkB,GAAG,OAAO,WAAW,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,CAE1F,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;CAGF,MAAM,EAAE,aAAa,eAAe,iBAAiB,SAAS;AAC9D,QAAO,aAAa;EACnB,YAAY;EACZ;EACA;EACA,OAAO,OAAO,IAAI,aAAa;GAC9B,MAAM,SAAS,OAAO,OAAO,OAC5B,QACE,WAAW;IACX,OAAO;IACP,YAAY;IACZ,MAAM,eAAe;IACrB,MAAM;KAAC;KAAS;KAAW;KAAK;KAAY,OAAO;KAAK,OAAO;KAAM;KAAO;IAC5E,QAAQ,CAAC;KAAE,QAAQ;KAAa,QAAQ;KAAQ,CAAC;IACjD,eAAe;IACf,CAAC,CACD,KACA,OAAO,UAAU,UAChB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,gDAAgD,MAAM,OAAO,IAAI,MAAM,OAAO;IAE/E;IACA,CAAC,CACF,CACD,CACF;AAED,OAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,sCAAsC,OAAO,SAAS;IAEvD,UAAU,OAAO;IACjB,QAAQ,WAAW,OAAO,OAAO;IACjC,QAAQ,WAAW,OAAO,OAAO;IACjC,CAAC,CACF;GAGF,MAAM,eAAe,KAAK,KAAK,aAAa,OAAO,OAAO;AAI1D,OAAI,EAAC,OAH6B,GAChC,OAAO,aAAa,CACpB,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEhD,QAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SAAS,yCAAyC,OAAO,OAAO,oBAAoB,OAAO,KAAK,GAAG,OAAO,IAAI;IAC9G,CAAC,CACF;IAED;EACF,iBAAiB,0BAA0B,OAAO,IAAI;EACtD,CAAC,CAAC,KACF,OAAO,UAAU,UAAqB;AACrC,MAAI,MAAM,SAAS,YAAa,QAAO;AACvC,SAAO,UAAU,SAAS;GACzB,MAAM;GACN,SAAS,6CAA6C,MAAM;GAC5D;GACA,CAAC;GACD,CACF;AAED,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;EACA,CAAC,KACF,OAAO,SAAS,2CAA2C,EAC1D,YAAY;CACX,aAAa,OAAO;CACpB,YAAY,OAAO;CACnB,eAAe,OAAO;CACtB,EACD,CAAC,CACF;;AAGF,MAAa,4BACZ,YAMA,kBAAkB,SAAS;CAC1B,MAAM;CACN,KAAK;CACL,QAAQ;CACR,CAAC"}
+{"version":3,"file":"source-fetch.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/source-fetch.ts"],"sourcesContent":["// Seal git-fetched source tree.\n//\n// Resolution paths (mirror walrus's three-stage dispatch):\n//\n//   (a) Caller-pinned `movePackagePath` opt — local-keygen mode\n//        short-circuits before calling this resolver.\n//\n//   (b) `SEAL_MOVE_SOURCE_OVERRIDE` env var — points at a pre-fetched\n//        on-disk path. Trust-the-path; no I/O. Useful in CI where the\n//        repo is checked out once and reused.\n//\n//   (c) Real git fetch via `runtime.runOneShot({ image: 'alpine/git:2.52.0',\n//        mounts: [stagingDir→/out], argv: ['clone',...] })`, staged\n//        into the per-host source cache before returning the host\n//        `move/seal` subdir.\n\nimport { Effect, FileSystem, Path, type Scope } from 'effect';\n\nimport type { ContainerRuntime } from '../../../contracts/container-runtime.ts';\nimport { hostBindMountOwner } from '../../../substrate/runtime/host-bind-mount-owner.ts';\nimport { mintRandomSuffix } from '../../../substrate/runtime/random-suffix.ts';\nimport { tailOutput } from '../../../substrate/runtime/observability/index.ts';\nimport { stageAndSwap } from '../../../substrate/runtime/stage-and-swap/index.ts';\nimport { readEnv } from '../../../substrate/runtime/typed-env.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { SealSpans } from '../spans.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — distilled-doc §\"External / upstream sources\"\n// ---------------------------------------------------------------------------\n\n/** Default upstream repo URL — distilled doc §\"External\" reference. */\nexport const DEFAULT_SEAL_REPO = 'https://github.com/MystenLabs/seal' as const;\n\n/** Pinned default ref. Distilled-doc invariant #11: this MUST match\n *  the cargo binary's version (the Dockerfile's `SEAL_VERSION` build\n *  arg). They move in lockstep. */\nexport const DEFAULT_SEAL_VERSION = 'seal-v0.6.6' as const;\n\n/** Subdirectory containing the Move package. */\nexport const DEFAULT_SEAL_MOVE_SUBDIR = 'move/seal' as const;\n\n/** Pinned helper image for the git clone one-shot. `alpine/git`\n *  uses `git` as its entrypoint, so the clone argv starts at\n *  `clone`. */\nexport const SEAL_SOURCE_FETCH_IMAGE = 'alpine/git:2.52.0' as const;\n\nconst SEAL_SOURCE_FETCH_TIMEOUT_MS = 5 * 60_000;\n\n// ---------------------------------------------------------------------------\n// Resolved value\n// ---------------------------------------------------------------------------\n\n/** Resolved value for the cloned `move/seal` subdir. The local-keygen\n *  mode's acquire body threads this into `publishSealPackage(...)`. */\nexport interface SealSourceFetchResolved {\n\treadonly repo: string;\n\treadonly ref: string;\n\treadonly subdir: string;\n\treadonly path: string;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Inputs to the source resolver. */\nexport interface SealSourceFetchInputs<Ref extends string = string> {\n\treadonly repo: typeof DEFAULT_SEAL_REPO;\n\treadonly ref: Ref;\n\treadonly subdir: typeof DEFAULT_SEAL_MOVE_SUBDIR;\n}\n\nconst nextScratchPaths = (\n\tcacheDir: string,\n): { readonly stagingPath: string; readonly backupPath: string } => {\n\t// 16-char crypto suffix (STYLE_GUIDE §17) — the old\n\t// `pid.counter` scheme collided across two concurrent PROCESSES\n\t// fetching the same ref (counters reset per-process, so pid A's\n\t// `.staging.1` and pid B's `.staging.1` differ only by pid, and\n\t// the staging tree corrupts if a pid is reused). A random suffix\n\t// makes overlap cryptographically negligible regardless of pid.\n\tconst suffix = mintRandomSuffix(16);\n\treturn {\n\t\tstagingPath: `${cacheDir}.staging.${suffix}`,\n\t\tbackupPath: `${cacheDir}.backup.${suffix}`,\n\t};\n};\n\nexport const sealSourceCacheDir = (ref: string): string => {\n\tconst home = readEnv('HOME') ?? '/tmp';\n\treturn `${home}/.cache/devstack/seal-src/${encodeURIComponent(ref)}`;\n};\n\nexport const sealSourcePublishLockPath = (ref: string): string =>\n\t`${sealSourceCacheDir(ref)}.publish.lock`;\n\nconst sourceImageRef = { digest: SEAL_SOURCE_FETCH_IMAGE, tag: SEAL_SOURCE_FETCH_IMAGE } as const;\n\nexport const resolveSealSource = (\n\truntime: ContainerRuntime,\n\tinputs: SealSourceFetchInputs,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\tconst override = readEnv('SEAL_MOVE_SOURCE_OVERRIDE');\n\t\tif (override && override.length > 0) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: override,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = yield* Path.Path;\n\t\tconst cacheDir = sealSourceCacheDir(inputs.ref);\n\t\tconst subdirPath = path.join(cacheDir, inputs.subdir);\n\t\tconst cached = yield* fs.exists(subdirPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (cached) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: subdirPath,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst { stagingPath, backupPath } = nextScratchPaths(cacheDir);\n\t\tyield* stageAndSwap({\n\t\t\ttargetPath: cacheDir,\n\t\t\tstagingPath,\n\t\t\tbackupPath,\n\t\t\tbuild: Effect.gen(function* () {\n\t\t\t\tconst result = yield* Effect.scoped(\n\t\t\t\t\truntime\n\t\t\t\t\t\t.runOneShot({\n\t\t\t\t\t\t\timage: sourceImageRef,\n\t\t\t\t\t\t\tentrypoint: 'git',\n\t\t\t\t\t\t\tuser: hostBindMountOwner(),\n\t\t\t\t\t\t\targv: ['clone', '--depth', '1', '--branch', inputs.ref, inputs.repo, '/out'],\n\t\t\t\t\t\t\tmounts: [{ source: stagingPath, target: '/out' }],\n\t\t\t\t\t\t\ttimeoutMillis: SEAL_SOURCE_FETCH_TIMEOUT_MS,\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\t`seal move-source: git clone one-shot failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tif (result.exitCode !== 0) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t`seal move-source: git clone exited ${result.exitCode}. ` +\n\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\t\t\tstdout: tailOutput(result.stdout),\n\t\t\t\t\t\t\tstderr: tailOutput(result.stderr),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst stagedSubdir = path.join(stagingPath, inputs.subdir);\n\t\t\t\tconst stagedSubdirExists = yield* fs\n\t\t\t\t\t.exists(stagedSubdir)\n\t\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\tif (!stagedSubdirExists) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage: `seal move-source: clone completed but ${inputs.subdir} was missing from ${inputs.repo}@${inputs.ref}.`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}),\n\t\t\tpublishLockPath: sealSourcePublishLockPath(inputs.ref),\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause): SealError => {\n\t\t\t\tif (cause._tag === 'SealError') return cause;\n\t\t\t\treturn sealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage: `seal move-source: cache publish failed at ${cause.stage}`,\n\t\t\t\t\tcause,\n\t\t\t\t});\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\trepo: inputs.repo,\n\t\t\tref: inputs.ref,\n\t\t\tsubdir: inputs.subdir,\n\t\t\tpath: subdirPath,\n\t\t} satisfies SealSourceFetchResolved;\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.moveSource.resolve', {\n\t\t\tattributes: {\n\t\t\t\t[SealSpans.repo]: inputs.repo,\n\t\t\t\t[SealSpans.ref]: inputs.ref,\n\t\t\t\t[SealSpans.subdir]: inputs.subdir,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealSource = (\n\truntime: ContainerRuntime,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tresolveSealSource(runtime, {\n\t\trepo: DEFAULT_SEAL_REPO,\n\t\tref: DEFAULT_SEAL_VERSION,\n\t\tsubdir: DEFAULT_SEAL_MOVE_SUBDIR,\n\t});\n"],"mappings":";;;;;;;;;;;AAgCA,MAAa,oBAAoB;;;;AAKjC,MAAa,uBAAuB;;AAGpC,MAAa,2BAA2B;;;;AAKxC,MAAa,0BAA0B;AAEvC,MAAM,+BAA+B,IAAI;AA0BzC,MAAM,oBACL,aACmE;CAOnE,MAAM,SAAS,iBAAiB,GAAG;AACnC,QAAO;EACN,aAAa,GAAG,SAAS,WAAW;EACpC,YAAY,GAAG,SAAS,UAAU;EAClC;;AAGF,MAAa,sBAAsB,QAAwB;AAE1D,QAAO,GADM,QAAQ,OAAO,IAAI,OACjB,4BAA4B,mBAAmB,IAAI;;AAGnE,MAAa,6BAA6B,QACzC,GAAG,mBAAmB,IAAI,CAAC;AAE5B,MAAM,iBAAiB;CAAE,QAAQ;CAAyB,KAAK;CAAyB;AAExF,MAAa,qBACZ,SACA,WAMA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,QAAQ,4BAA4B;AACrD,KAAI,YAAY,SAAS,SAAS,EACjC,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;CAGF,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,WAAW,mBAAmB,OAAO,IAAI;CAC/C,MAAM,aAAa,KAAK,KAAK,UAAU,OAAO,OAAO;AAErD,KAAI,OADkB,GAAG,OAAO,WAAW,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,CAE1F,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;CAGF,MAAM,EAAE,aAAa,eAAe,iBAAiB,SAAS;AAC9D,QAAO,aAAa;EACnB,YAAY;EACZ;EACA;EACA,OAAO,OAAO,IAAI,aAAa;GAC9B,MAAM,SAAS,OAAO,OAAO,OAC5B,QACE,WAAW;IACX,OAAO;IACP,YAAY;IACZ,MAAM,oBAAoB;IAC1B,MAAM;KAAC;KAAS;KAAW;KAAK;KAAY,OAAO;KAAK,OAAO;KAAM;KAAO;IAC5E,QAAQ,CAAC;KAAE,QAAQ;KAAa,QAAQ;KAAQ,CAAC;IACjD,eAAe;IACf,CAAC,CACD,KACA,OAAO,UAAU,UAChB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,gDAAgD,MAAM,OAAO,IAAI,MAAM,OAAO;IAE/E;IACA,CAAC,CACF,CACD,CACF;AAED,OAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,sCAAsC,OAAO,SAAS;IAEvD,UAAU,OAAO;IACjB,QAAQ,WAAW,OAAO,OAAO;IACjC,QAAQ,WAAW,OAAO,OAAO;IACjC,CAAC,CACF;GAGF,MAAM,eAAe,KAAK,KAAK,aAAa,OAAO,OAAO;AAI1D,OAAI,EAAC,OAH6B,GAChC,OAAO,aAAa,CACpB,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEhD,QAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SAAS,yCAAyC,OAAO,OAAO,oBAAoB,OAAO,KAAK,GAAG,OAAO,IAAI;IAC9G,CAAC,CACF;IAED;EACF,iBAAiB,0BAA0B,OAAO,IAAI;EACtD,CAAC,CAAC,KACF,OAAO,UAAU,UAAqB;AACrC,MAAI,MAAM,SAAS,YAAa,QAAO;AACvC,SAAO,UAAU,SAAS;GACzB,MAAM;GACN,SAAS,6CAA6C,MAAM;GAC5D;GACA,CAAC;GACD,CACF;AAED,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;EACA,CAAC,KACF,OAAO,SAAS,2CAA2C,EAC1D,YAAY;EACV,UAAU,OAAO,OAAO;EACxB,UAAU,MAAM,OAAO;EACvB,UAAU,SAAS,OAAO;CAC3B,EACD,CAAC,CACF;;AAGF,MAAa,4BACZ,YAMA,kBAAkB,SAAS;CAC1B,MAAM;CACN,KAAK;CACL,QAAQ;CACR,CAAC"}

package/dist/plugins/seal/codegen.d.mts

@@ -9,9 +9,8 @@ interface SealBindings {
   readonly objectId: string;
   readonly keyServerUrl: string;
   readonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;
-  /** Mode marker so the bindings file knows whether to surface the
-   *  admin rotate Effect-construction shim (distilled-doc invariant
-   *  #15 — only local-keygen mode produces a manager). */
+  /** Mode marker for consumers that branch between local-keygen and
+   *  known-deployment surfaces. */
   readonly mode: 'local-keygen' | 'live' | 'fork-known';
 }
 //#endregion

package/dist/plugins/seal/codegen.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/seal/codegen.ts"],"sourcesContent":["// Seal plugin — Codegenable contribution.\n//\n// Distilled-doc §\"Outputs\": the seal plugin contributes ONE codegen\n// emit shape — the `seal-key-server` config the user-facing\n// bindings consume to construct a `SealClient`. The orchestrator\n// reads this contribution + every other plugin's; the heavy\n// codegen substrate (file writing, type-export grouping) lives in\n// the codegen orchestrator (architecture §6).\n//\n// Tag id discipline:\n//\n//   - The emitter name `'seal-key-server'` is pinned here so the\n//     generated output and orchestrator attribution stay stable.\n\nimport { Effect } from 'effect';\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\nimport type { SealKeyServerEntry } from './registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Bindings shape\n// ---------------------------------------------------------------------------\n\n/** Codegen-emitted shape for seal. Mirrors the read-side resolved\n *  value (sans the per-instance defaults like `weight`). The\n *  bindings emitter writes a TypeScript file exporting these. */\nexport interface SealBindings {\n\treadonly name: string;\n\treadonly objectId: string;\n\treadonly keyServerUrl: string;\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\t/** Mode marker so the bindings file knows whether to surface the\n\t *  admin rotate Effect-construction shim (distilled-doc invariant\n\t *  #15 — only local-keygen mode produces a manager). */\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n}\n\n// ---------------------------------------------------------------------------\n// Decl builder\n// ---------------------------------------------------------------------------\n\n/** Build the Codegenable contribution for a seal instance. */\nexport const makeSealCodegenable = (\n\tbindings: SealBindings,\n): CodegenableDecl<'seal-key-server'> => ({\n\tkind: 'codegenable',\n\temitterName: 'seal-key-server',\n\toutputPath: `seal/${bindings.name}.ts`,\n\temit: (ctx) =>\n\t\tEffect.sync(() => {\n\t\t\tctx.exportConst('sealBindings', bindings satisfies SealBindings);\n\t\t\treturn ctx.done();\n\t\t}),\n});\n"],"mappings":";;;AA0CA,MAAa,uBACZ,cACyC;CACzC,MAAM;CACN,aAAa;CACb,YAAY,QAAQ,SAAS,KAAK;CAClC,OAAO,QACN,OAAO,WAAW;AACjB,MAAI,YAAY,gBAAgB,SAAgC;AAChE,SAAO,IAAI,MAAM;GAChB;CACH"}
+{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/seal/codegen.ts"],"sourcesContent":["// Seal plugin — Codegenable contribution.\n//\n// Distilled-doc §\"Outputs\": the seal plugin contributes ONE codegen\n// emit shape — the `seal-key-server` config the user-facing\n// bindings consume to construct a `SealClient`. The orchestrator\n// reads this contribution + every other plugin's; the heavy\n// codegen substrate (file writing, type-export grouping) lives in\n// the codegen orchestrator (architecture §6).\n//\n// Tag id discipline:\n//\n//   - The emitter name `'seal-key-server'` is pinned here so the\n//     generated output and orchestrator attribution stay stable.\n\nimport { Effect } from 'effect';\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\nimport type { SealKeyServerEntry } from './registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Bindings shape\n// ---------------------------------------------------------------------------\n\n/** Codegen-emitted shape for seal. Mirrors the read-side resolved\n *  value (sans the per-instance defaults like `weight`). The\n *  bindings emitter writes a TypeScript file exporting these. */\nexport interface SealBindings {\n\treadonly name: string;\n\treadonly objectId: string;\n\treadonly keyServerUrl: string;\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\t/** Mode marker for consumers that branch between local-keygen and\n\t *  known-deployment surfaces. */\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n}\n\n// ---------------------------------------------------------------------------\n// Decl builder\n// ---------------------------------------------------------------------------\n\n/** Build the Codegenable contribution for a seal instance. */\nexport const makeSealCodegenable = (\n\tbindings: SealBindings,\n): CodegenableDecl<'seal-key-server'> => ({\n\tkind: 'codegenable',\n\temitterName: 'seal-key-server',\n\toutputPath: `seal/${bindings.name}.ts`,\n\temit: (ctx) =>\n\t\tEffect.sync(() => {\n\t\t\tctx.exportConst('sealBindings', bindings satisfies SealBindings);\n\t\t\treturn ctx.done();\n\t\t}),\n});\n"],"mappings":";;;AAyCA,MAAa,uBACZ,cACyC;CACzC,MAAM;CACN,aAAa;CACb,YAAY,QAAQ,SAAS,KAAK;CAClC,OAAO,QACN,OAAO,WAAW;AACjB,MAAI,YAAY,gBAAgB,SAAgC;AAChE,SAAO,IAAI,MAAM;GAChB;CACH"}

package/dist/plugins/seal/config-render.mjs

@@ -1,22 +1,49 @@
 import { atomicWriteFile } from "../../substrate/runtime/atomic-write.mjs";
-import { sealError } from "./errors.mjs";
+import { sealConfigError, sealError } from "./errors.mjs";
+import { SealSpans } from "./spans.mjs";
 import { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from "./keygen.mjs";
 import { Effect } from "effect";
 //#region src/plugins/seal/config-render.ts
 const DEFAULT_TS_SDK_REQUIREMENT = ">=0.4.5";
+/** Allowed character set for raw interpolation into a YAML double-quoted
+*  string. A `"` would close the quote and let downstream characters
+*  inject YAML syntax; a backslash would start an escape sequence the
+*  parser then chokes on. Sui/Seal object ids + node URLs only need
+*  alphanumerics, `:/_.-`, and `0x` — so the conservative whitelist is
+*  safe. The `ts_sdk_version_requirement` allows the SemVer comparator
+*  characters as well. */
+const YAML_INTERP_FIELD_RE = /^[0-9a-zA-Z:/_.\-]+$/;
+const YAML_INTERP_SEMVER_RE = /^[0-9a-zA-Z:/_.\-<>=^~* |!]+$/;
+const assertYamlSafe = (field, value, pattern) => {
+	if (pattern.test(value)) return value;
+	throw sealConfigError({
+		field,
+		message: `seal.config-render: ${field} contains characters that would break YAML quoting`,
+		hint: `allowed characters: ${pattern.source}`
+	});
+};
 /** Render the key-server config yaml.
 *
 *  Distilled-doc invariant #19: `network: !Devnet` is hardcoded.
 *  This is the "custom chain via node_url" discriminator the
-*  upstream binary expects when devstack supplies its own RPC. */
+*  upstream binary expects when devstack supplies its own RPC.
+*
+*  Each interpolated value is whitelist-asserted BEFORE rendering — a
+*  `"` in any field would close the YAML quoted string and let
+*  downstream characters inject syntax. The assertion raises a
+*  `SealConfigError({phase: 'config-render'})` naming the offending
+*  field so callers see a typed refusal, not silently-broken YAML. */
 const renderSealKeyServerConfig = (inputs) => {
-	const tsReq = inputs.tsSdkVersionRequirement ?? DEFAULT_TS_SDK_REQUIREMENT;
+	const sealPackageId = assertYamlSafe("sealPackageId", inputs.sealPackageId, YAML_INTERP_FIELD_RE);
+	const nodeUrl = assertYamlSafe("nodeUrl", inputs.nodeUrl, YAML_INTERP_FIELD_RE);
+	const keyServerObjectId = assertYamlSafe("keyServerObjectId", inputs.keyServerObjectId, YAML_INTERP_FIELD_RE);
+	const tsReq = assertYamlSafe("tsSdkVersionRequirement", inputs.tsSdkVersionRequirement ?? DEFAULT_TS_SDK_REQUIREMENT, YAML_INTERP_SEMVER_RE);
 	return [
 		"network: !Devnet",
-		`  seal_package: "${inputs.sealPackageId}"`,
-		`node_url: "${inputs.nodeUrl}"`,
+		`  seal_package: "${sealPackageId}"`,
+		`node_url: "${nodeUrl}"`,
 		"server_mode: !Open",
-		`  key_server_object_id: "${inputs.keyServerObjectId}"`,
+		`  key_server_object_id: "${keyServerObjectId}"`,
 		`ts_sdk_version_requirement: "${tsReq}"`,
 		""
 	].join("\n");
@@ -73,8 +100,8 @@ const stageSealConfig = (yamlBody, masterKeyHex, servicePath, name) => Effect.ge
 		masterKeyEnvFile
 	};
 }).pipe(Effect.withSpan("devstack.plugin.seal.config-render.stage", { attributes: {
-	"seal.name": name,
-	"seal.servicePath": servicePath
+	[SealSpans.name]: name,
+	[SealSpans.servicePath]: servicePath
 } }));
 //#endregion
 export { parseMasterKeyEnvFile, renderSealKeyServerConfig, stageSealConfig };

package/dist/plugins/seal/config-render.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config-render.mjs","names":[],"sources":["../../../src/plugins/seal/config-render.ts"],"sourcesContent":["// Seal plugin — key-server-config.yaml renderer.\n//\n// Distilled-doc invariant #19: the `network: !Devnet` discriminator\n// is LOAD-BEARING. Env-only mode silently routes at the public\n// testnet fullnode regardless of `NODE_URL`; going through the\n// config file with the `!Devnet` discriminator binds the daemon to\n// the in-stack sui RPC.\n//\n// Distilled-doc invariant #20: the rendered file MUST land under\n// `runtime/seal/`, NOT a scoped temp dir. The substrate's\n// service-path resolver (`servicePath('seal')`) produces the host\n// path; we land both the yaml and the master-key env-file there.\n//\n// This file declares the renderer + the staging procedure. The\n// renderer is a pure string builder; the staging procedure uses the\n// substrate's atomic-write primitive (FileSystem-backed).\n\nimport { Effect, FileSystem } from 'effect';\n\nimport { atomicWriteFile } from '../../substrate/runtime/atomic-write.ts';\nimport { sealError, type SealError } from './errors.ts';\nimport { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from './keygen.ts';\n\n// ---------------------------------------------------------------------------\n// Render inputs\n// ---------------------------------------------------------------------------\n\n/** Inputs the renderer consumes. The substrate provides the\n *  sui node URL (in-container DNS form, e.g. `http://sui-localnet:9000`)\n *  + the seal package id + the on-chain key-server object id. */\nexport interface SealKeyServerConfigInputs {\n\t/** Seal Move package id (from publish). */\n\treadonly sealPackageId: string;\n\t/** Sui RPC node URL as seen from inside the container's network. */\n\treadonly nodeUrl: string;\n\t/** On-chain `KeyServer` object id (from register). */\n\treadonly keyServerObjectId: string;\n\t/** Optional ts-sdk version requirement override. Default is the\n\t *  pin distilled from v3 (`'>=0.4.5'`); v2 plans expose this so\n\t *  consumers running older `@mysten/seal` aren't silently\n\t *  rejected. Distilled-doc opportunity #8. */\n\treadonly tsSdkVersionRequirement?: string;\n}\n\nexport interface ParsedSealKeyServerConfig {\n\treadonly sealPackageId: string;\n\treadonly nodeUrl: string;\n\treadonly keyServerObjectId: string;\n}\n\nconst DEFAULT_TS_SDK_REQUIREMENT = '>=0.4.5';\n\n// ---------------------------------------------------------------------------\n// Render — pure string builder\n// ---------------------------------------------------------------------------\n\n/** Render the key-server config yaml.\n *\n *  Distilled-doc invariant #19: `network: !Devnet` is hardcoded.\n *  This is the \"custom chain via node_url\" discriminator the\n *  upstream binary expects when devstack supplies its own RPC. */\nexport const renderSealKeyServerConfig = (inputs: SealKeyServerConfigInputs): string => {\n\tconst tsReq = inputs.tsSdkVersionRequirement ?? DEFAULT_TS_SDK_REQUIREMENT;\n\treturn [\n\t\t'network: !Devnet',\n\t\t`  seal_package: \"${inputs.sealPackageId}\"`,\n\t\t`node_url: \"${inputs.nodeUrl}\"`,\n\t\t'server_mode: !Open',\n\t\t`  key_server_object_id: \"${inputs.keyServerObjectId}\"`,\n\t\t`ts_sdk_version_requirement: \"${tsReq}\"`,\n\t\t'',\n\t].join('\\n');\n};\n\n// ---------------------------------------------------------------------------\n// Master-key env-file body\n// ---------------------------------------------------------------------------\n\n/** Render the docker `--env-file` body. Single `KEY=value` line.\n *  Distilled-doc invariant #3 — this is the ONLY path the master key\n *  reaches the container; inline `-e MASTER_KEY=…` would surface\n *  the secret in `docker inspect` and host process env. */\nexport const renderMasterKeyEnvFile = (masterKeyHex: string): string =>\n\t`MASTER_KEY=${masterKeyHex}\\n`;\n\nconst readQuotedYamlField = (body: string, field: string): string | null => {\n\tconst escaped = field.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\tconst match = new RegExp(`(?:^|\\\\n)\\\\s*${escaped}:\\\\s*\"([^\"]+)\"\\\\s*(?:\\\\n|$)`).exec(body);\n\treturn match?.[1] ?? null;\n};\n\nexport const parseSealKeyServerConfig = (body: string): ParsedSealKeyServerConfig | null => {\n\tconst sealPackageId = readQuotedYamlField(body, 'seal_package');\n\tconst nodeUrl = readQuotedYamlField(body, 'node_url');\n\tconst keyServerObjectId = readQuotedYamlField(body, 'key_server_object_id');\n\tif (sealPackageId === null || nodeUrl === null || keyServerObjectId === null) {\n\t\treturn null;\n\t}\n\treturn { sealPackageId, nodeUrl, keyServerObjectId };\n};\n\nexport const parseMasterKeyEnvFile = (body: string): string | null => {\n\tconst match = /^MASTER_KEY=(0x)?([0-9a-fA-F]+)\\s*$/m.exec(body);\n\treturn match?.[2] ?? null;\n};\n\n// ---------------------------------------------------------------------------\n// Staging procedure — write yaml + env-file with proper mode bits\n// ---------------------------------------------------------------------------\n\n/** Compose the two writes the local-keygen mode needs.\n *\n *  Writes:\n *\n *    - `${servicePath}/key-server-config.yaml` (mode 0o644 — public)\n *    - `${servicePath}/master-key.env`          (mode 0o600 — secret)\n *\n *  Parent dir is created with 0o700 (distilled-doc invariant #2).\n *  Both writes flow through the substrate's `atomicWriteFile`\n *  (tempfile + fsync + rename, never partial-write visible).\n *\n *  Distilled-doc invariant #4: `master-key.env` MUST NOT be unlinked\n *  on scope close (snapshot → restore round-trip retains the key).\n *  We do NOT register a finalizer here.\n *\n *  Error surface: `SealError({phase: 'config-render'})` wraps any\n *  underlying `AtomicWriteFailed`. The substrate's atomic write owns\n *  fsync + rename + cleanup semantics. */\nexport const stageSealConfig = (\n\tyamlBody: string,\n\tmasterKeyHex: string,\n\tservicePath: string,\n\tname: string,\n): Effect.Effect<\n\t{\n\t\treadonly configPath: string;\n\t\treadonly masterKeyEnvFile: string;\n\t},\n\tSealError,\n\tFileSystem.FileSystem\n> =>\n\tEffect.gen(function* () {\n\t\tconst configPath = `${servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;\n\t\tconst masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\t\tconst yamlBytes = new TextEncoder().encode(yamlBody);\n\t\tconst envBytes = new TextEncoder().encode(renderMasterKeyEnvFile(masterKeyHex));\n\n\t\t// World-readable yaml (no secrets) inside 0o700 parent — the\n\t\t// daemon process inside the container reads via the bind-mount\n\t\t// so host-side mode bits don't fully matter, but 0o644 is the\n\t\t// least-surprising default for a non-secret config.\n\t\tyield* atomicWriteFile(configPath, yamlBytes, {\n\t\t\tmode: 0o644,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${KEY_SERVER_CONFIG_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\t// SECRET — 0o600 inside the same 0o700 parent. Distilled-doc\n\t\t// §Hard requirements #2.\n\t\tyield* atomicWriteFile(masterKeyEnvFile, envBytes, {\n\t\t\tmode: 0o600,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${MASTER_KEY_ENVFILE_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\treturn { configPath, masterKeyEnvFile };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.config-render.stage', {\n\t\t\tattributes: { 'seal.name': name, 'seal.servicePath': servicePath },\n\t\t}),\n\t);\n"],"mappings":";;;;;AAkDA,MAAM,6BAA6B;;;;;;AAWnC,MAAa,6BAA6B,WAA8C;CACvF,MAAM,QAAQ,OAAO,2BAA2B;AAChD,QAAO;EACN;EACA,oBAAoB,OAAO,cAAc;EACzC,cAAc,OAAO,QAAQ;EAC7B;EACA,4BAA4B,OAAO,kBAAkB;EACrD,gCAAgC,MAAM;EACtC;EACA,CAAC,KAAK,KAAK;;;;;;AAWb,MAAa,0BAA0B,iBACtC,cAAc,aAAa;AAkB5B,MAAa,yBAAyB,SAAgC;AAErE,QADc,uCAAuC,KAAK,KAC9C,GAAG,MAAM;;;;;;;;;;;;;;;;;;;;AAyBtB,MAAa,mBACZ,UACA,cACA,aACA,SASA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,GAAG,YAAY,GAAG;CACrC,MAAM,mBAAmB,GAAG,YAAY,GAAG;CAC3C,MAAM,YAAY,IAAI,aAAa,CAAC,OAAO,SAAS;CACpD,MAAM,WAAW,IAAI,aAAa,CAAC,OAAO,uBAAuB,aAAa,CAAC;AAM/E,QAAO,gBAAgB,YAAY,WAAW;EAC7C,MAAM;EACN,YAAY;EACZ,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,2BAA2B,IAAI,MAAM,MAAM;EAC3F;EACA,CAAC,CACF,CACD,CACD;AAID,QAAO,gBAAgB,kBAAkB,UAAU;EAClD,MAAM;EACN,YAAY;EACZ,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,4BAA4B,IAAI,MAAM,MAAM;EAC5F;EACA,CAAC,CACF,CACD,CACD;AAED,QAAO;EAAE;EAAY;EAAkB;EACtC,CAAC,KACF,OAAO,SAAS,4CAA4C,EAC3D,YAAY;CAAE,aAAa;CAAM,oBAAoB;CAAa,EAClE,CAAC,CACF"}
+{"version":3,"file":"config-render.mjs","names":[],"sources":["../../../src/plugins/seal/config-render.ts"],"sourcesContent":["// Seal plugin — key-server-config.yaml renderer.\n//\n// Distilled-doc invariant #19: the `network: !Devnet` discriminator\n// is LOAD-BEARING. Env-only mode silently routes at the public\n// testnet fullnode regardless of `NODE_URL`; going through the\n// config file with the `!Devnet` discriminator binds the daemon to\n// the in-stack sui RPC.\n//\n// Distilled-doc invariant #20: the rendered file MUST land under\n// `runtime/seal/`, NOT a scoped temp dir. The substrate's\n// service-path resolver (`servicePath('seal')`) produces the host\n// path; we land both the yaml and the master-key env-file there.\n//\n// This file declares the renderer + the staging procedure. The\n// renderer is a pure string builder; the staging procedure uses the\n// substrate's atomic-write primitive (FileSystem-backed).\n\nimport { Effect, FileSystem } from 'effect';\n\nimport { atomicWriteFile } from '../../substrate/runtime/atomic-write.ts';\nimport { sealConfigError, sealError, type SealError } from './errors.ts';\nimport { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from './keygen.ts';\nimport { SealSpans } from './spans.ts';\n\n// ---------------------------------------------------------------------------\n// Render inputs\n// ---------------------------------------------------------------------------\n\n/** Inputs the renderer consumes. The substrate provides the\n *  sui node URL (in-container DNS form, e.g. `http://sui-localnet:9000`)\n *  + the seal package id + the on-chain key-server object id. */\nexport interface SealKeyServerConfigInputs {\n\t/** Seal Move package id (from publish). */\n\treadonly sealPackageId: string;\n\t/** Sui RPC node URL as seen from inside the container's network. */\n\treadonly nodeUrl: string;\n\t/** On-chain `KeyServer` object id (from register). */\n\treadonly keyServerObjectId: string;\n\t/** Optional ts-sdk version requirement override. Default is the\n\t *  pin distilled from v3 (`'>=0.4.5'`); v2 plans expose this so\n\t *  consumers running older `@mysten/seal` aren't silently\n\t *  rejected. Distilled-doc opportunity #8. */\n\treadonly tsSdkVersionRequirement?: string;\n}\n\nexport interface ParsedSealKeyServerConfig {\n\treadonly sealPackageId: string;\n\treadonly nodeUrl: string;\n\treadonly keyServerObjectId: string;\n}\n\nconst DEFAULT_TS_SDK_REQUIREMENT = '>=0.4.5';\n\n// ---------------------------------------------------------------------------\n// Render — pure string builder\n// ---------------------------------------------------------------------------\n\n/** Allowed character set for raw interpolation into a YAML double-quoted\n *  string. A `\"` would close the quote and let downstream characters\n *  inject YAML syntax; a backslash would start an escape sequence the\n *  parser then chokes on. Sui/Seal object ids + node URLs only need\n *  alphanumerics, `:/_.-`, and `0x` — so the conservative whitelist is\n *  safe. The `ts_sdk_version_requirement` allows the SemVer comparator\n *  characters as well. */\nconst YAML_INTERP_FIELD_RE = /^[0-9a-zA-Z:/_.\\-]+$/;\nconst YAML_INTERP_SEMVER_RE = /^[0-9a-zA-Z:/_.\\-<>=^~* |!]+$/;\n\nconst assertYamlSafe = (field: string, value: string, pattern: RegExp): string => {\n\tif (pattern.test(value)) return value;\n\tthrow sealConfigError({\n\t\tfield,\n\t\tmessage: `seal.config-render: ${field} contains characters that would break YAML quoting`,\n\t\thint: `allowed characters: ${pattern.source}`,\n\t});\n};\n\n/** Render the key-server config yaml.\n *\n *  Distilled-doc invariant #19: `network: !Devnet` is hardcoded.\n *  This is the \"custom chain via node_url\" discriminator the\n *  upstream binary expects when devstack supplies its own RPC.\n *\n *  Each interpolated value is whitelist-asserted BEFORE rendering — a\n *  `\"` in any field would close the YAML quoted string and let\n *  downstream characters inject syntax. The assertion raises a\n *  `SealConfigError({phase: 'config-render'})` naming the offending\n *  field so callers see a typed refusal, not silently-broken YAML. */\nexport const renderSealKeyServerConfig = (inputs: SealKeyServerConfigInputs): string => {\n\tconst sealPackageId = assertYamlSafe('sealPackageId', inputs.sealPackageId, YAML_INTERP_FIELD_RE);\n\tconst nodeUrl = assertYamlSafe('nodeUrl', inputs.nodeUrl, YAML_INTERP_FIELD_RE);\n\tconst keyServerObjectId = assertYamlSafe(\n\t\t'keyServerObjectId',\n\t\tinputs.keyServerObjectId,\n\t\tYAML_INTERP_FIELD_RE,\n\t);\n\tconst tsReq = assertYamlSafe(\n\t\t'tsSdkVersionRequirement',\n\t\tinputs.tsSdkVersionRequirement ?? DEFAULT_TS_SDK_REQUIREMENT,\n\t\tYAML_INTERP_SEMVER_RE,\n\t);\n\treturn [\n\t\t'network: !Devnet',\n\t\t`  seal_package: \"${sealPackageId}\"`,\n\t\t`node_url: \"${nodeUrl}\"`,\n\t\t'server_mode: !Open',\n\t\t`  key_server_object_id: \"${keyServerObjectId}\"`,\n\t\t`ts_sdk_version_requirement: \"${tsReq}\"`,\n\t\t'',\n\t].join('\\n');\n};\n\n// ---------------------------------------------------------------------------\n// Master-key env-file body\n// ---------------------------------------------------------------------------\n\n/** Render the docker `--env-file` body. Single `KEY=value` line.\n *  Distilled-doc invariant #3 — this is the ONLY path the master key\n *  reaches the container; inline `-e MASTER_KEY=…` would surface\n *  the secret in `docker inspect` and host process env. */\nexport const renderMasterKeyEnvFile = (masterKeyHex: string): string =>\n\t`MASTER_KEY=${masterKeyHex}\\n`;\n\nconst readQuotedYamlField = (body: string, field: string): string | null => {\n\tconst escaped = field.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\t// Anchor to start-of-line: `(?:^|\\n)` plus a whitespace-only run\n\t// (`[ \\t]*` — explicitly excludes `#`) so a commented field\n\t// (`# node_url: \"fake\"`) can never accidentally match. The renderer\n\t// does not emit comments today, but the parser is also used on\n\t// snapshot-restore bodies that may grow comments in future. The\n\t// previous `\\s*` admitted no `#`, but `\\s` includes `\\n` which let\n\t// the regex engine skip past the start-of-line anchor; restricting\n\t// to inline-whitespace makes the line-anchoring strict.\n\tconst match = new RegExp(`(?:^|\\\\n)[ \\\\t]*${escaped}:[ \\\\t]*\"([^\"]+)\"[ \\\\t]*(?:\\\\n|$)`).exec(\n\t\tbody,\n\t);\n\treturn match?.[1] ?? null;\n};\n\nexport const parseSealKeyServerConfig = (body: string): ParsedSealKeyServerConfig | null => {\n\tconst sealPackageId = readQuotedYamlField(body, 'seal_package');\n\tconst nodeUrl = readQuotedYamlField(body, 'node_url');\n\tconst keyServerObjectId = readQuotedYamlField(body, 'key_server_object_id');\n\tif (sealPackageId === null || nodeUrl === null || keyServerObjectId === null) {\n\t\treturn null;\n\t}\n\treturn { sealPackageId, nodeUrl, keyServerObjectId };\n};\n\nexport const parseMasterKeyEnvFile = (body: string): string | null => {\n\tconst match = /^MASTER_KEY=(0x)?([0-9a-fA-F]+)\\s*$/m.exec(body);\n\treturn match?.[2] ?? null;\n};\n\n// ---------------------------------------------------------------------------\n// Staging procedure — write yaml + env-file with proper mode bits\n// ---------------------------------------------------------------------------\n\n/** Compose the two writes the local-keygen mode needs.\n *\n *  Writes:\n *\n *    - `${servicePath}/key-server-config.yaml` (mode 0o644 — public)\n *    - `${servicePath}/master-key.env`          (mode 0o600 — secret)\n *\n *  Parent dir is created with 0o700 (distilled-doc invariant #2).\n *  Both writes flow through the substrate's `atomicWriteFile`\n *  (tempfile + fsync + rename, never partial-write visible).\n *\n *  Distilled-doc invariant #4: `master-key.env` MUST NOT be unlinked\n *  on scope close (snapshot → restore round-trip retains the key).\n *  We do NOT register a finalizer here.\n *\n *  Error surface: `SealError({phase: 'config-render'})` wraps any\n *  underlying `AtomicWriteFailed`. The substrate's atomic write owns\n *  fsync + rename + cleanup semantics. */\nexport const stageSealConfig = (\n\tyamlBody: string,\n\tmasterKeyHex: string,\n\tservicePath: string,\n\tname: string,\n): Effect.Effect<\n\t{\n\t\treadonly configPath: string;\n\t\treadonly masterKeyEnvFile: string;\n\t},\n\tSealError,\n\tFileSystem.FileSystem\n> =>\n\tEffect.gen(function* () {\n\t\tconst configPath = `${servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;\n\t\tconst masterKeyEnvFile = `${servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\t\tconst yamlBytes = new TextEncoder().encode(yamlBody);\n\t\tconst envBytes = new TextEncoder().encode(renderMasterKeyEnvFile(masterKeyHex));\n\n\t\t// World-readable yaml (no secrets) inside 0o700 parent — the\n\t\t// daemon process inside the container reads via the bind-mount\n\t\t// so host-side mode bits don't fully matter, but 0o644 is the\n\t\t// least-surprising default for a non-secret config.\n\t\tyield* atomicWriteFile(configPath, yamlBytes, {\n\t\t\tmode: 0o644,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${KEY_SERVER_CONFIG_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\t// SECRET — 0o600 inside the same 0o700 parent. Distilled-doc\n\t\t// §Hard requirements #2.\n\t\tyield* atomicWriteFile(masterKeyEnvFile, envBytes, {\n\t\t\tmode: 0o600,\n\t\t\tparentMode: 0o700,\n\t\t}).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('config-render', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.config-render: failed to write ${MASTER_KEY_ENVFILE_BASENAME} (${cause.stage})`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\n\t\treturn { configPath, masterKeyEnvFile };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.config-render.stage', {\n\t\t\tattributes: { [SealSpans.name]: name, [SealSpans.servicePath]: servicePath },\n\t\t}),\n\t);\n"],"mappings":";;;;;;AAmDA,MAAM,6BAA6B;;;;;;;;AAanC,MAAM,uBAAuB;AAC7B,MAAM,wBAAwB;AAE9B,MAAM,kBAAkB,OAAe,OAAe,YAA4B;AACjF,KAAI,QAAQ,KAAK,MAAM,CAAE,QAAO;AAChC,OAAM,gBAAgB;EACrB;EACA,SAAS,uBAAuB,MAAM;EACtC,MAAM,uBAAuB,QAAQ;EACrC,CAAC;;;;;;;;;;;;;AAcH,MAAa,6BAA6B,WAA8C;CACvF,MAAM,gBAAgB,eAAe,iBAAiB,OAAO,eAAe,qBAAqB;CACjG,MAAM,UAAU,eAAe,WAAW,OAAO,SAAS,qBAAqB;CAC/E,MAAM,oBAAoB,eACzB,qBACA,OAAO,mBACP,qBACA;CACD,MAAM,QAAQ,eACb,2BACA,OAAO,2BAA2B,4BAClC,sBACA;AACD,QAAO;EACN;EACA,oBAAoB,cAAc;EAClC,cAAc,QAAQ;EACtB;EACA,4BAA4B,kBAAkB;EAC9C,gCAAgC,MAAM;EACtC;EACA,CAAC,KAAK,KAAK;;;;;;AAWb,MAAa,0BAA0B,iBACtC,cAAc,aAAa;AA4B5B,MAAa,yBAAyB,SAAgC;AAErE,QADc,uCAAuC,KAAK,KAC9C,GAAG,MAAM;;;;;;;;;;;;;;;;;;;;AAyBtB,MAAa,mBACZ,UACA,cACA,aACA,SASA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,GAAG,YAAY,GAAG;CACrC,MAAM,mBAAmB,GAAG,YAAY,GAAG;CAC3C,MAAM,YAAY,IAAI,aAAa,CAAC,OAAO,SAAS;CACpD,MAAM,WAAW,IAAI,aAAa,CAAC,OAAO,uBAAuB,aAAa,CAAC;AAM/E,QAAO,gBAAgB,YAAY,WAAW;EAC7C,MAAM;EACN,YAAY;EACZ,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,2BAA2B,IAAI,MAAM,MAAM;EAC3F;EACA,CAAC,CACF,CACD,CACD;AAID,QAAO,gBAAgB,kBAAkB,UAAU;EAClD,MAAM;EACN,YAAY;EACZ,CAAC,CAAC,KACF,OAAO,OAAO,UACb,OAAO,KACN,UAAU,iBAAiB;EAC1B;EACA,SAAS,uCAAuC,4BAA4B,IAAI,MAAM,MAAM;EAC5F;EACA,CAAC,CACF,CACD,CACD;AAED,QAAO;EAAE;EAAY;EAAkB;EACtC,CAAC,KACF,OAAO,SAAS,4CAA4C,EAC3D,YAAY;EAAG,UAAU,OAAO;EAAO,UAAU,cAAc;CAAa,EAC5E,CAAC,CACF"}

package/dist/plugins/seal/deploy.mjs

@@ -1,18 +1,16 @@
 import { contentHash } from "../../substrate/brand.mjs";
 import { hashMoveSources, runMoveBuild, scrubLocksHost } from "../../substrate/runtime/sui-move-build/index.mjs";
+import { executeSuiTx, formatExecutedFailure } from "../../substrate/runtime/sui-execute/index.mjs";
+import { artifactPublishError } from "../../primitives/artifact-publisher.mjs";
 import { sealError } from "./errors.mjs";
-import { decodeHex } from "./keygen.mjs";
-import { executeSuiTx } from "../../substrate/runtime/sui-execute/index.mjs";
+import { SealSpans } from "./spans.mjs";
 import { Effect, Schema } from "effect";
 import { createHash } from "node:crypto";
+import { fromHex } from "@mysten/sui/utils";
 import { Transaction } from "@mysten/sui/transactions";
 //#region src/plugins/seal/deploy.ts
 const KEY_TYPE_BONEH_FRANKLIN_BLS12381 = 0;
-const sealProduceFailed = (op, err) => ({
-	_tag: "ArtifactPublishError",
-	reason: "produce-failed",
-	detail: `seal.${op} ${err.phase}: ${err.message}`
-});
+const sealProduceFailed = (op, err) => artifactPublishError("produce-failed", `seal.${op} ${err.phase}: ${err.message}`);
 const moveBuildToSealError = (name, err) => sealError("publish", {
 	name,
 	message: `seal publish ${err.phase} failed for source '${err.sourcePath}': ${err.message}`,
@@ -59,7 +57,7 @@ const projectSealPublishReceipt = (name, receipt) => {
 	});
 };
 const runSealPublishTransaction = (inputs) => Effect.gen(function* () {
-	yield* scrubLocksHost(inputs.movePackagePath, "~/.move", { packageLockFailures: inputs.buildImage !== void 0 ? "best-effort" : "fatal" }).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));
+	yield* scrubLocksHost(inputs.movePackagePath, "~/.move").pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));
 	const buildOutput = yield* runMoveBuild({
 		sourcePath: inputs.movePackagePath,
 		packageName: inputs.name,
@@ -67,7 +65,7 @@ const runSealPublishTransaction = (inputs) => Effect.gen(function* () {
 		runtime: inputs.runtime,
 		...inputs.buildImage !== void 0 ? { buildImage: inputs.buildImage } : {}
 	}).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err)));
-	const receipt = yield* executeSuiTx({
+	const result = yield* executeSuiTx({
 		client: inputs.sdk.client,
 		signer: inputs.signer,
 		build: async () => {
@@ -80,31 +78,28 @@ const runSealPublishTransaction = (inputs) => Effect.gen(function* () {
 		message: `seal publish tx failed for signer '${inputs.signer.name}' (address=${inputs.signer.address}) during ${cause.phase}: ${cause.message}`,
 		cause
 	})));
-	return yield* projectSealPublishReceipt(inputs.name, receipt);
+	if (result.$kind === "FailedTransaction") return yield* Effect.fail(sealError("publish", {
+		name: inputs.name,
+		message: `seal publish tx executed but on-chain execution failed for signer '${inputs.signer.name}' (address=${inputs.signer.address}) ` + formatExecutedFailure(result.FailedTransaction)
+	}));
+	return yield* projectSealPublishReceipt(inputs.name, result.Transaction);
 }).pipe(Effect.withSpan("devstack.plugin.seal.publish.suiTx", { attributes: {
-	"seal.name": inputs.name,
-	"seal.signer": inputs.signer.address
+	[SealSpans.name]: inputs.name,
+	[SealSpans.signer]: inputs.signer.address
 } }));
 const publishSealPackage = (publisher, inputs) => Effect.gen(function* () {
 	const inputsHash = sealPackageInputsHash(yield* hashMoveSources(inputs.movePackagePath).pipe(Effect.mapError((err) => moveBuildToSealError(inputs.name, err))), inputs.signer.address);
-	const result = yield* publisher.publish({
+	return { packageId: (yield* publisher.publish({
 		namespace: SEAL_PACKAGE_NAMESPACE,
 		chain: inputs.chain,
 		contentHash: inputsHash,
-		verifySchema: SealPackageVerifyShape,
 		verify: (cached) => verifyObjectLenient(inputs.chainProbe, cached.packageId, SealPackageVerifyShape),
 		produce: runSealPublishTransaction(inputs).pipe(Effect.mapError((err) => sealProduceFailed("publish", err))),
 		register: () => Effect.void
-	});
-	const packageId = "packageId" in result ? result.packageId : result.objectId;
-	if (!packageId) return yield* Effect.fail(sealError("publish", {
-		name: inputs.name,
-		message: "seal.deploy.publishSealPackage: publisher returned no package id"
-	}));
-	return { packageId };
+	})).packageId };
 }).pipe(Effect.withSpan("devstack.plugin.seal.publish", { attributes: {
-	"seal.name": inputs.name,
-	"seal.chain": inputs.chain
+	[SealSpans.name]: inputs.name,
+	[SealSpans.chain]: inputs.chain
 } }));
 const SEAL_KEY_SERVER_NAMESPACE = "seal/key-server-id";
 const SealKeyServerVerifyShape = Schema.Struct({
@@ -131,7 +126,7 @@ const registerTransactionBuilder = (tx) => ({
 	})
 });
 const buildRegisterKeyServerMoveCall = (tx, inputs, signerAddress) => {
-	const pkBytes = decodeHex(inputs.publicKeyHex);
+	const pkBytes = fromHex(inputs.publicKeyHex);
 	tx.setSender(signerAddress);
 	tx.moveCall({
 		target: `${inputs.sealPackageId}::key_server::create_and_transfer_v2_independent_server`,
@@ -153,7 +148,7 @@ const projectRegisterKeyServerReceipt = (name, receipt) => {
 	return Effect.succeed({ objectId });
 };
 const runRegisterKeyServerTransaction = (sdk, signer, inputs) => Effect.gen(function* () {
-	const receipt = yield* executeSuiTx({
+	const result = yield* executeSuiTx({
 		client: sdk.client,
 		signer,
 		build: async () => {
@@ -166,31 +161,28 @@ const runRegisterKeyServerTransaction = (sdk, signer, inputs) => Effect.gen(func
 		message: `seal register tx failed for signer '${signer.name}' (address=${signer.address}) during ${cause.phase}: ${cause.message}`,
 		cause
 	})));
-	return yield* projectRegisterKeyServerReceipt(inputs.name, receipt);
+	if (result.$kind === "FailedTransaction") return yield* Effect.fail(sealError("register", {
+		name: inputs.name,
+		message: `seal register tx executed but on-chain execution failed for signer '${signer.name}' (address=${signer.address}) ` + formatExecutedFailure(result.FailedTransaction)
+	}));
+	return yield* projectRegisterKeyServerReceipt(inputs.name, result.Transaction);
 }).pipe(Effect.withSpan("devstack.plugin.seal.register.suiTx", { attributes: {
-	"seal.name": inputs.name,
-	"seal.url": inputs.keyServerUrl
+	[SealSpans.name]: inputs.name,
+	[SealSpans.url]: inputs.keyServerUrl
 } }));
 const registerKeyServer = (publisher, inputs) => Effect.gen(function* () {
 	const inputsHash = sealRegisterInputsHash(inputs, inputs.signer.address);
-	const result = yield* publisher.publish({
+	return { objectId: (yield* publisher.publish({
 		namespace: SEAL_KEY_SERVER_NAMESPACE,
 		chain: inputs.chain,
 		contentHash: inputsHash,
-		verifySchema: SealKeyServerVerifyShape,
 		verify: (cached) => verifyObjectLenient(inputs.chainProbe, cached.objectId, SealKeyServerVerifyShape),
 		produce: runRegisterKeyServerTransaction(inputs.sdk, inputs.signer, inputs).pipe(Effect.mapError((err) => sealProduceFailed("register", err))),
 		register: () => Effect.void
-	});
-	const objectId = "objectId" in result ? result.objectId : void 0;
-	if (!objectId) return yield* Effect.fail(sealError("register", {
-		name: inputs.name,
-		message: "seal.deploy.registerKeyServer: publisher returned no objectId"
-	}));
-	return { objectId };
+	})).objectId };
 }).pipe(Effect.withSpan("devstack.plugin.seal.register", { attributes: {
-	"seal.name": inputs.name,
-	"seal.url": inputs.keyServerUrl
+	[SealSpans.name]: inputs.name,
+	[SealSpans.url]: inputs.keyServerUrl
 } }));
 //#endregion
 export { publishSealPackage, registerKeyServer };