@mysten-incubation/devstack 0.0.1 → 0.1.0

package/dist/runtime/docker/container.mjs

@@ -1,11 +1,12 @@
 import { StackPathsService } from "../../substrate/runtime/paths.mjs";
-import { decodeJsonArrayElementSync } from "../../substrate/runtime/runtime-decode.mjs";
-import { dockerRun, dockerRunOk } from "./client.mjs";
 import { addClaim, removeClaim } from "../../substrate/runtime/cross-process/roster.mjs";
-import { ContainerCreateFailed, ContainerNameCollisionUnrecoverable, DaemonUnreachable, DockerInspectDecodeFailed, DockerInspectFailed, ForeignDockerResource, RecreateRefused } from "./errors.mjs";
-import { LabelKey, expectedContainerOwnershipLabels, ownershipMismatchDetail, renderContainerLabels } from "./labels.mjs";
+import { dockerRun, dockerRunOk } from "./client.mjs";
+import { ContainerCreateFailed, ContainerNameCollisionUnrecoverable, DaemonUnreachable, ForeignDockerResource, RecreateRefused } from "./errors.mjs";
 import { classifyExit, isDaemonUnreachableStderr, isNameCollisionStderr, isNoSuchContainerStderr, wrapCreateError, wrapGeneric } from "./wrap.mjs";
+import { dockerInspectAndDecode } from "./inspect-and-decode.mjs";
+import { LabelKey, expectedContainerOwnershipLabels, ownershipMismatchDetail, readLabels, renderContainerLabels } from "./labels.mjs";
 import { connect, readIps, waitForIp } from "./network.mjs";
+import { renderCreateArgs } from "./render-run-args.mjs";
 import { Deferred, Effect, Ref, Schema } from "effect";
 //#region src/runtime/docker/container.ts
 /** Pure decision: given the inspect facts (or null = missing), the
@@ -13,11 +14,11 @@ import { Deferred, Effect, Ref, Schema } from "effect";
 *  do we take?
 *
 *  Tested directly without the subprocess seam. */
-const decideRunAction = (facts, desiredImage, policy, desiredPortBindings = [], portBindingReconciliation = "exact", desiredConfigHash, desiredImageDigest) => {
+const decideRunAction = (facts, desiredImage, policy, desiredPortBindings = [], portBindingReconciliation = "exact", desiredConfigHash, desiredImageDigest, desiredNetworkAttachments = []) => {
 	if (facts === null) return { kind: "fresh" };
 	const imageMatches = facts.image === desiredImage || desiredImageDigest !== void 0 && (facts.image === desiredImageDigest || facts.imageDigest === desiredImageDigest);
 	const portsCompatible = sameBindings(facts.portBindings ?? [], desiredPortBindings) || portBindingReconciliation === "adopt-existing" && sameBindingContainerPorts(facts.portBindings ?? [], desiredPortBindings);
-	const configMatches = desiredConfigHash === void 0 || facts.labels?.[LabelKey.configHash] === desiredConfigHash;
+	const configMatches = desiredNetworkAttachmentsCompatible(facts.networkAttachments ?? [], desiredNetworkAttachments) && (desiredConfigHash === void 0 || facts.labels?.[LabelKey.configHash] === desiredConfigHash);
 	if (facts.lifecycle.kind === "unknown") return routeRecreate({
 		kind: "recreate",
 		id: facts.id,
@@ -89,6 +90,17 @@ const sameBindingContainerPorts = (left, right) => {
 };
 const bindingContainerKey = (binding) => binding.split("=")[0] ?? binding;
 const normalizeHostIp = (hostIp) => hostIp === void 0 || hostIp === "" ? "0.0.0.0" : hostIp;
+const desiredNetworkAttachmentsCompatible = (actual, desired) => {
+	const actualByName = new Map(actual.map((network) => [network.name, network]));
+	return desired.every((entry, index) => {
+		const normalized = normalizeNetworkAttachment(entry);
+		const actualNetwork = actualByName.get(normalized.name);
+		if (actualNetwork === void 0) return index !== 0;
+		if (normalized.aliases === void 0 || normalized.aliases.length === 0) return true;
+		const actualAliases = new Set(actualNetwork.aliases);
+		return normalized.aliases.every((alias) => actualAliases.has(alias));
+	});
+};
 const readPublishedPorts = (raw) => {
 	if (raw === null || typeof raw !== "object") return [];
 	const out = [];
@@ -137,16 +149,20 @@ const readStringArray = (raw) => {
 	if (!Array.isArray(raw)) return [];
 	return raw.filter((value) => typeof value === "string");
 };
-const readLabels = (raw) => {
-	if (raw === null || typeof raw !== "object") return {};
-	const out = {};
-	for (const [key, value] of Object.entries(raw)) if (typeof value === "string") out[key] = value;
-	return out;
-};
 const readNetworks = (raw) => {
 	if (raw === null || typeof raw !== "object") return [];
 	return Object.keys(raw).sort();
 };
+const readNetworkAttachments = (raw) => {
+	if (raw === null || typeof raw !== "object") return [];
+	return Object.entries(raw).map(([name, value]) => {
+		const aliases = value !== null && typeof value === "object" ? value.Aliases ?? [] : [];
+		return {
+			name,
+			aliases: Array.isArray(aliases) ? aliases.filter((alias) => typeof alias === "string").sort() : []
+		};
+	}).sort((a, b) => a.name.localeCompare(b.name));
+};
 const readLifecycleState = (state) => {
 	if (state === void 0) return { kind: "unknown" };
 	if (state.Paused) return {
@@ -183,82 +199,62 @@ const InspectSchema = Schema.Struct({
 	})
 });
 const inspectContainer = (name) => Effect.gen(function* () {
-	const res = yield* dockerRunOk("container", ["inspect", name]).pipe(Effect.mapError(wrapGeneric("docker.container.inspect")));
-	if (res.exitCode !== 0) {
-		if (isNoSuchContainerStderr(res.stderr)) return null;
-		if (isDaemonUnreachableStderr(res.stderr)) return yield* Effect.fail(new DaemonUnreachable({
-			op: "docker.container.inspect",
-			detail: "docker daemon unreachable"
-		}));
-		return yield* Effect.fail(new DockerInspectFailed({
-			resource: "container",
-			name,
-			stderr: res.stderr,
-			exitCode: res.exitCode
-		}));
-	}
-	try {
-		const decoded = decodeJsonArrayElementSync(InspectSchema, res.stdout, {
-			source: `docker container inspect ${name}`,
-			missingMessage: "inspect returned an empty result",
-			mkError: (issue) => new DockerInspectDecodeFailed({
-				resource: "container",
-				name,
-				detail: issue.message === "inspect returned an empty result" ? issue.message : "inspect returned malformed container JSON",
-				cause: issue.cause
-			})
-		});
-		const lifecycle = readLifecycleState(decoded.State);
-		const effectivePorts = readPublishedPorts(decoded.NetworkSettings.Ports);
-		const ports = decoded.HostConfig === void 0 ? effectivePorts : readPublishedPorts(decoded.HostConfig.PortBindings);
-		const mounts = readMounts(decoded.Mounts);
-		const command = readStringArray(decoded.Config.Cmd);
-		const labels = readLabels(decoded.Config.Labels);
-		const networks = readNetworks(decoded.NetworkSettings.Networks);
-		return {
-			id: decoded.Id,
-			lifecycle,
-			running: lifecycle.kind === "running" || lifecycle.kind === "paused",
-			paused: lifecycle.kind === "paused",
-			exitCode: lifecycle.kind === "unknown" ? null : lifecycle.exitCode,
-			image: decoded.Config.Image,
-			...decoded.Image !== void 0 ? { imageDigest: decoded.Image } : {},
-			mounts,
-			portBindings: canonicalPortBindings(ports),
-			ports,
-			effectivePortBindings: canonicalPortBindings(effectivePorts),
-			effectivePorts,
-			command,
-			labels,
-			networks
-		};
-	} catch (cause) {
-		return yield* Effect.fail(cause);
-	}
+	const decoded = yield* dockerInspectAndDecode({
+		resourceKind: "container",
+		name,
+		op: "docker.container.inspect",
+		inspectCommand: dockerRunOk("container", ["inspect", name]).pipe(Effect.mapError(wrapGeneric("docker.container.inspect"))),
+		schema: InspectSchema,
+		isMissingStderr: isNoSuchContainerStderr
+	});
+	if (decoded === null) return null;
+	const lifecycle = readLifecycleState(decoded.State);
+	const effectivePorts = readPublishedPorts(decoded.NetworkSettings.Ports);
+	const ports = decoded.HostConfig === void 0 ? effectivePorts : readPublishedPorts(decoded.HostConfig.PortBindings);
+	const mounts = readMounts(decoded.Mounts);
+	const command = readStringArray(decoded.Config.Cmd);
+	const labels = readLabels(decoded.Config.Labels);
+	const networks = readNetworks(decoded.NetworkSettings.Networks);
+	const networkAttachments = readNetworkAttachments(decoded.NetworkSettings.Networks);
+	return {
+		id: decoded.Id,
+		lifecycle,
+		running: lifecycle.kind === "running" || lifecycle.kind === "paused",
+		paused: lifecycle.kind === "paused",
+		exitCode: lifecycle.kind === "unknown" ? null : lifecycle.exitCode,
+		image: decoded.Config.Image,
+		...decoded.Image !== void 0 ? { imageDigest: decoded.Image } : {},
+		mounts,
+		portBindings: canonicalPortBindings(ports),
+		ports,
+		effectivePortBindings: canonicalPortBindings(effectivePorts),
+		effectivePorts,
+		command,
+		labels,
+		networks,
+		networkAttachments
+	};
 }).pipe(Effect.withSpan("runtime.docker.container.inspect"));
+const normalizeNetworkAttachment = (entry) => typeof entry === "string" ? { name: entry } : entry.aliases === void 0 || entry.aliases.length === 0 ? { name: entry.name } : {
+	name: entry.name,
+	aliases: entry.aliases
+};
 const createArgv = (spec, cycle, imageRef) => {
-	const args = [
-		"-d",
-		"--name",
-		spec.name
-	];
 	const configLabels = spec.configHash === void 0 ? void 0 : { [LabelKey.configHash]: spec.configHash };
-	for (const label of renderContainerLabels(spec.labels, cycle, configLabels)) args.push("--label", label);
-	if (spec.env) for (const [k, v] of Object.entries(spec.env)) args.push("--env", `${k}=${v}`);
-	if (spec.ports) for (const p of spec.ports) {
-		const hostPrefix = p.hostIp === void 0 ? "" : `${p.hostIp}:`;
-		args.push("-p", `${hostPrefix}${p.hostPort}:${p.containerPort}`);
-	}
-	if (spec.mounts) for (const m of spec.mounts) {
-		const ro = m.readonly ? ",readonly" : "";
-		args.push("--mount", `type=bind,source=${m.source},target=${m.target}${ro}`);
-	}
-	if (spec.networkAttach && spec.networkAttach.length > 0) args.push("--network", spec.networkAttach[0]);
-	if (spec.extraHosts) for (const [host, ip] of Object.entries(spec.extraHosts)) args.push("--add-host", `${host}:${ip}`);
-	if (spec.entrypoint) args.push("--entrypoint", spec.entrypoint);
-	args.push(imageRef);
-	if (spec.command) args.push(...spec.command);
-	return args;
+	const labels = renderContainerLabels(spec.labels, cycle, configLabels);
+	const firstNetwork = spec.networkAttach && spec.networkAttach.length > 0 ? normalizeNetworkAttachment(spec.networkAttach[0]) : void 0;
+	return renderCreateArgs({
+		name: spec.name,
+		image: imageRef,
+		labels,
+		env: spec.env,
+		ports: spec.ports,
+		mounts: spec.mounts,
+		network: firstNetwork,
+		addHosts: spec.extraHosts,
+		entrypoint: spec.entrypoint,
+		command: spec.command
+	});
 };
 const handleOf = (id, name, imageName, status, ips, ports, labels) => ({
 	id,
@@ -396,7 +392,10 @@ const stopWithGrace = (name, graceSeconds, signal) => Effect.gen(function* () {
 	if (signal !== void 0) args.push("--signal", signal);
 	args.push("--time", String(Math.max(0, Math.floor(graceSeconds))));
 	args.push(name);
-	yield* dockerRunOk("stop", args).pipe(Effect.catch(() => Effect.void), Effect.asVoid);
+	yield* dockerRunOk("stop", args).pipe(Effect.tapCause((cause) => Effect.logDebug("docker stop failed; container may already be gone", {
+		name,
+		cause
+	})), Effect.catch(() => Effect.void), Effect.asVoid);
 });
 /** Per-name lock acquire/release. The in-process serialization is the
 *  inspect→action window's invariant: two concurrent ensureContainer
@@ -426,15 +425,19 @@ const acquirePerNameLock = (lock, name) => Effect.gen(function* () {
 		next.set(name, [...queue, waiter]);
 		return [false, next];
 	})) return;
-	yield* Deferred.await(waiter).pipe(Effect.onInterrupt(() => Ref.update(lock, (m) => {
-		const queue = m.get(name);
-		if (queue === void 0) return m;
-		const filtered = queue.filter((d) => d !== waiter);
-		if (filtered.length === queue.length) return m;
-		const next = new Map(m);
-		next.set(name, filtered);
-		return next;
-	})));
+	yield* Deferred.await(waiter).pipe(Effect.onInterrupt(() => Effect.gen(function* () {
+		if (yield* Ref.modify(lock, (m) => {
+			const queue = m.get(name);
+			if (queue === void 0) return [false, m];
+			const filtered = queue.filter((d) => d !== waiter);
+			if (filtered.length !== queue.length) {
+				const next = new Map(m);
+				next.set(name, filtered);
+				return [false, next];
+			}
+			return [true, m];
+		})) yield* releasePerNameLock(lock, name);
+	}).pipe(Effect.uninterruptible)));
 });
 const releasePerNameLock = (lock, name) => Effect.gen(function* () {
 	const head = yield* Ref.modify(lock, (m) => {
@@ -451,6 +454,13 @@ const releasePerNameLock = (lock, name) => Effect.gen(function* () {
 	});
 	if (head !== void 0) yield* Deferred.succeed(head, void 0);
 });
+/** Run `body` while holding the per-name lock for `name`. Wraps the
+*  `acquireUseRelease(acquire, use, release)` triple so every caller
+*  cannot accidentally forget the release on interrupt. The body is
+*  responsible for running uninterruptibly over the inspect→action
+*  window AND arming any stop-on-scope-close finalizer before this
+*  helper releases the lock. */
+const withSerializedContainerOp = (name, lock, body) => Effect.acquireUseRelease(acquirePerNameLock(lock, name), () => body, () => releasePerNameLock(lock, name));
 /** Idempotent ensure: apply the state machine, register a scope
 *  finalizer that stops the container + releases the cross-process
 *  claim.
@@ -458,44 +468,81 @@ const releasePerNameLock = (lock, name) => Effect.gen(function* () {
 *  Returns the running container handle (id + name + status + ips). */
 const ensureContainer = (spec, deps) => Effect.gen(function* () {
 	const desiredImageRef = spec.image.tag ?? spec.image.digest;
-	const id = yield* Effect.acquireUseRelease(acquirePerNameLock(deps.perNameLock, spec.name), () => Effect.gen(function* () {
-		const facts = yield* inspectContainer(spec.name);
-		if (facts !== null) yield* assertOwnedFacts(spec.name, facts, spec.labels);
-		return yield* ensureEffectivePublishedPorts(yield* applyAction(decideRunAction(facts, desiredImageRef, spec.recreate, canonicalPortBindings(spec.ports), spec.portBindingReconciliation ?? "exact", spec.configHash, spec.image.digest), spec, deps), spec, deps);
-	}), () => releasePerNameLock(deps.perNameLock, spec.name));
-	yield* assertContainerHandleOwned({
-		id,
-		name: spec.name,
-		labels: spec.labels,
-		imageName: spec.image.tag ?? spec.image.digest,
-		status: "running",
-		ips: []
-	});
-	const secondaries = (spec.networkAttach ?? []).slice(1);
-	for (const net of secondaries) {
-		yield* connect(spec.name, net);
-		yield* waitForIp(spec.name, net);
-	}
-	const ips = yield* readIps(spec.name);
-	const refreshedFacts = yield* inspectContainer(spec.name);
-	const ports = refreshedFacts?.effectivePorts ?? refreshedFacts?.ports ?? spec.ports;
 	const paths = yield* StackPathsService;
-	const mapSubstrateError = (cause) => new DaemonUnreachable({
-		op: "cross-process.claim",
-		detail: `cross-process claim mutation failed: ${String(cause)}`,
-		cause
-	});
-	yield* addClaim({
-		stackLockFile: paths.stackLockFile,
-		rosterFile: paths.rosterFile
-	}, spec.name).pipe(Effect.mapError(mapSubstrateError));
-	yield* Effect.addFinalizer(() => Effect.gen(function* () {
-		if ((yield* inspectContainer(spec.name).pipe(Effect.catch(() => Effect.succeed(null))))?.id === id) yield* stopWithGrace(spec.name, spec.stopGraceSeconds ?? 10);
+	const mapSubstrateClaimError = (eff) => eff.pipe(Effect.catchTags({
+		RosterIoError: (cause) => Effect.fail(new DaemonUnreachable({
+			op: "cross-process.claim.roster-io",
+			detail: `roster IO failed at ${cause.path}`,
+			cause
+		})),
+		RosterCorruptError: (cause) => Effect.fail(new DaemonUnreachable({
+			op: "cross-process.claim.roster-corrupt",
+			detail: `roster ledger corrupt at ${cause.path}`,
+			cause
+		})),
+		StackLockTimeoutError: (cause) => Effect.fail(new DaemonUnreachable({
+			op: "cross-process.claim.stack-lock-timeout",
+			detail: `stack-lock acquire timed out after ${cause.waitedMillis}ms at ${cause.path}`,
+			cause
+		})),
+		StackLockIoError: (cause) => Effect.fail(new DaemonUnreachable({
+			op: "cross-process.claim.stack-lock-io",
+			detail: `stack-lock IO failed at ${cause.path}`,
+			cause
+		}))
+	}));
+	const registerStopFinalizer = (id) => Effect.addFinalizer(() => Effect.gen(function* () {
+		if ((yield* inspectContainer(spec.name).pipe(Effect.tapCause((cause) => Effect.logDebug("container inspect during scope-close failed", {
+			name: spec.name,
+			cause
+		})), Effect.catch(() => Effect.succeed(null))))?.id === id) yield* stopWithGrace(spec.name, spec.stopGraceSeconds ?? 10);
 		yield* removeClaim({
 			stackLockFile: paths.stackLockFile,
-			rosterFile: paths.rosterFile
-		}, spec.name).pipe(Effect.catch(() => Effect.succeed({ lastClaimReleased: false })));
+			rosterFile: paths.rosterFile,
+			containerClaimsFile: paths.containerClaimsFile
+		}, spec.name).pipe(Effect.tapCause((cause) => Effect.logDebug("removeClaim during scope-close failed", {
+			name: spec.name,
+			cause
+		})), Effect.catch(() => Effect.succeed({ lastClaimReleased: false })));
 	}).pipe(Effect.uninterruptible));
+	const { id, ips, ports } = yield* withSerializedContainerOp(spec.name, deps.perNameLock, Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+		const facts = yield* inspectContainer(spec.name);
+		if (facts !== null) yield* assertOwnedFacts(spec.name, facts, spec.labels);
+		const id = yield* ensureEffectivePublishedPorts(yield* applyAction(decideRunAction(facts, desiredImageRef, spec.recreate, canonicalPortBindings(spec.ports), spec.portBindingReconciliation ?? "exact", spec.configHash, spec.image.digest, spec.networkAttach), spec, deps), spec, deps);
+		yield* registerStopFinalizer(id);
+		const tail = yield* restore(Effect.gen(function* () {
+			yield* assertContainerHandleOwned({
+				id,
+				name: spec.name,
+				labels: spec.labels,
+				imageName: spec.image.tag ?? spec.image.digest,
+				status: "running",
+				ips: []
+			});
+			const secondaries = (spec.networkAttach ?? []).slice(1).map(normalizeNetworkAttachment);
+			for (const net of secondaries) {
+				yield* connect(spec.name, net.name, net.aliases);
+				yield* waitForIp(spec.name, net.name);
+			}
+			const ips = yield* readIps(spec.name);
+			const refreshedFacts = yield* inspectContainer(spec.name);
+			const ports = refreshedFacts?.effectivePorts ?? refreshedFacts?.ports ?? spec.ports;
+			yield* mapSubstrateClaimError(addClaim({
+				stackLockFile: paths.stackLockFile,
+				rosterFile: paths.rosterFile,
+				containerClaimsFile: paths.containerClaimsFile
+			}, spec.name));
+			return {
+				ips,
+				ports
+			};
+		}));
+		return {
+			id,
+			ips: tail.ips,
+			ports: tail.ports
+		};
+	})));
 	return handleOf(id, spec.name, spec.image.tag ?? spec.image.digest, "running", ips, ports, spec.labels);
 }).pipe(Effect.withSpan("runtime.docker.container.ensure"));
 /** Apply the decided action. Recovers from name-collision via
@@ -545,10 +592,50 @@ const pause = (name) => Effect.gen(function* () {
 const unpause = (name) => Effect.gen(function* () {
 	yield* dockerRun("unpause", [name]).pipe(Effect.mapError(wrapGeneric("docker.unpause")));
 }).pipe(Effect.withSpan("runtime.docker.container.unpause"));
+/** Reserved `devstack.role` value stamped on every committed snapshot
+*  byproduct image. Plugin BUILD images carry the source plugin's real
+*  role (`db`, `validator`, …) or no role at all; committed snapshot
+*  images carry THIS sentinel instead. Snapshot prune scopes its image
+*  sweep to `{app, stack, role: SNAPSHOT_IMAGE_ROLE}` so it reaps the
+*  byproducts WITHOUT ever matching the live stack's build images.
+*
+*  This is a label-value protocol token shared with the snapshot prune
+*  orchestrator (`orchestrators/snapshot/prune.ts`), which imports it. */
+const SNAPSHOT_IMAGE_ROLE = "snapshot-image";
+/** Render `{managed, app, stack, role}` ownership labels into
+*  `docker commit --change 'LABEL …'` argv. `docker commit` has no
+*  `--label` flag, so labels must ride in as `--change` Dockerfile
+*  instructions. Values are quoted so an app/stack carrying whitespace
+*  cannot split the instruction. */
+const snapshotImageChangeArgs = (app, stack) => {
+	const labels = [[LabelKey.managed, "true"]];
+	if (app !== void 0) labels.push([LabelKey.app, app]);
+	if (stack !== void 0) labels.push([LabelKey.stack, stack]);
+	labels.push([LabelKey.role, SNAPSHOT_IMAGE_ROLE]);
+	return labels.flatMap(([key, value]) => ["--change", `LABEL "${key}"="${value}"`]);
+};
 /** `docker commit <name> <tag>` — writable layer → image. Used by
-*  snapshot capture. */
+*  snapshot capture.
+*
+*  The committed image is stamped with `{managed:'true', app, stack,
+*  role:SNAPSHOT_IMAGE_ROLE}` ownership labels so label-driven snapshot
+*  prune can reap leaked byproducts (a hard-killed capture that never
+*  reached its `removeImage` cleanup) while leaving the stack's build
+*  images untouched. A bare `docker commit` produces an UNlabelled image
+*  that no label-driven sweep can find — hence the explicit stamp.
+*
+*  `app`/`stack` are recovered from the source container's own ownership
+*  labels (`docker commit` does NOT copy container labels onto the image).
+*  Capture only commits containers it owns, so those labels are present;
+*  if the inspect misses they are simply omitted and prune's app/stack-
+*  scoped filter will not match — a degenerate case capture cannot reach. */
 const commit = (name, tag) => Effect.gen(function* () {
-	const digest = (yield* dockerRun("commit", [name, tag]).pipe(Effect.mapError(wrapGeneric("docker.commit")))).stdout.trim();
+	const sourceLabels = (yield* inspectContainer(name).pipe(Effect.catch(() => Effect.succeed(null))))?.labels ?? {};
+	const digest = (yield* dockerRun("commit", [
+		...snapshotImageChangeArgs(sourceLabels[LabelKey.app], sourceLabels[LabelKey.stack]),
+		name,
+		tag
+	]).pipe(Effect.mapError(wrapGeneric("docker.commit")))).stdout.trim();
 	if (digest.length === 0) return yield* Effect.fail(new ContainerCreateFailed({
 		name,
 		stderr: "commit returned empty digest",
@@ -557,6 +644,6 @@ const commit = (name, tag) => Effect.gen(function* () {
 	return digest;
 }).pipe(Effect.withSpan("runtime.docker.container.commit"));
 //#endregion
-export { assertContainerHandleOwned, commit, ensureContainer, inspectContainer, pause, stop, unpause };
+export { SNAPSHOT_IMAGE_ROLE, assertContainerHandleOwned, commit, decideRunAction, ensureContainer, inspectContainer, pause, stop, unpause };
 
 //# sourceMappingURL=container.mjs.map