@mysten-incubation/devstack 0.0.1 → 0.1.0

package/dist/substrate/runtime/sui-move-build/index.mjs

@@ -1,10 +1,11 @@
-import { decodeJsonTextSync } from "../runtime-decode.mjs";
 import { contentHash } from "../../brand.mjs";
+import { decodeJsonTextSync } from "../runtime-decode.mjs";
+import { mintRandomSuffix } from "../random-suffix.mjs";
 import { Effect, Schema } from "effect";
 import { createHash } from "node:crypto";
-import { basename, dirname, join, relative } from "node:path";
-import { homedir } from "node:os";
-import { lstat, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { basename, join, relative, resolve, sep } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/substrate/runtime/sui-move-build/index.ts
 const DEFAULT_SUI_CLI_VERSION = "devnet-v1.71.0";
 const suiCliImageBuildContext = (version = DEFAULT_SUI_CLI_VERSION) => ({
@@ -75,16 +76,31 @@ const extractTrailingJson = (text) => {
 	if (idx === -1) return trimmed;
 	return trimmed.slice(idx);
 };
-const containerInnerScript = (pkgName) => {
-	const scrub = containerScrubShellScript("/workspace", "/root/.move");
+/** One-shot-path inner script. Mirrors {@link containerInnerScript} — both copy
+*  the WHOLE `/workspace` tree into an in-container scratch dir and scrub + build
+*  THERE, never the mount in place. The difference is only WHAT is mounted at
+*  `/workspace`: the exec path bind-mounts the developer's real app dir (so the
+*  whole-tree copy naturally carries nested packages + sibling `../` deps),
+*  whereas the one-shot path mounts a disposable host-side staging copy whose
+*  transitive local deps were pre-staged (see `stageLocalMoveDeps`). Copying only
+*  `/workspace/<pkg>` would drop sibling local dependencies
+*  (`{ local = "../token" }`), failing the build with "Invalid directory at ../…". */
+const containerInnerScriptOneShot = (pkgName) => {
+	const quotedPkg = shellQuote(pkgName);
+	const scratchRoot = "/tmp/move-build-$$";
+	const scratchPkg = `${scratchRoot}/${quotedPkg}`;
+	const stage = `rm -rf ${scratchRoot} && mkdir -p ${scratchRoot} && cp -a /workspace/. ${scratchRoot}/`;
+	const scrub = containerScrubShellScript(scratchRoot, "/root/.move");
 	return [
 		"set -e",
+		stage,
 		scrub,
 		"set +e",
-		`sui move build --path /workspace/${shellQuote(pkgName)} -e testnet --no-tree-shaking --dump-bytecode-as-base64 --with-unpublished-dependencies`,
+		`sui move build --path ${scratchPkg} -e testnet --no-tree-shaking --dump-bytecode-as-base64 --with-unpublished-dependencies`,
 		"status=$?",
 		"set -e",
 		scrub,
+		`rm -rf ${scratchRoot}`,
 		"exit \"$status\""
 	].join("; ");
 };
@@ -170,15 +186,8 @@ const scrubCachedLockFiles = async (root) => {
 		await scrubOneLockFile(f);
 	} catch {}
 };
-const scrubLocksHost = (sourcePath, moveHomeRoot, options = {}) => Effect.tryPromise({
+const scrubLocksHost = (sourcePath, moveHomeRoot) => Effect.tryPromise({
 	try: async () => {
-		const ownLocks = await findMoveLockFiles(sourcePath);
-		for (const f of ownLocks) if (options.packageLockFailures === "best-effort") try {
-			await scrubOneLockFile(f);
-		} catch {
-			continue;
-		}
-		else await scrubOneLockFile(f);
 		const gitCache = join(expandHome(moveHomeRoot), "git");
 		try {
 			await lstat(gitCache);
@@ -242,17 +251,82 @@ const buildViaContainerExec = (inputs, bc) => Effect.gen(function* () {
 	if (result.exitCode !== 0) return yield* Effect.fail(promoteNonZero("docker exec", result, inputs.sourcePath, inputs.packageName));
 	return yield* parseBuildOutput(result.stdout, inputs.sourcePath, inputs.packageName);
 }).pipe(Effect.withSpan("sui-move-build.via-exec"));
+/** `{ local = "../path" }` dependency paths, harvested from a Move.toml. */
+const LOCAL_MOVE_DEP_RE = /\blocal\s*=\s*"([^"]+)"/g;
+/** Copy a package's transitive local-path Move dependencies into a staging
+*  tree, preserving each dep's path RELATIVE to the staged package so
+*  references like `{ local = "../token" }` resolve. Without this, a scoped
+*  copy of only the package fails `sui move build` / `sui move summary` with
+*  "Invalid directory at ../…". Throws if a dep resolves outside `stagingRoot`
+*  (the single-mount layout can't represent it). Promise-based so the build
+*  (`MoveBuildError`) and summary (`CodegenBindingsFailed`) call sites can
+*  wrap it in their own error type. */
+const copyLocalMoveDeps = async (packageSrc, stagedPackage, stagingRoot) => {
+	const staged = new Set([packageSrc]);
+	const walk = async (srcDir, stagedDir) => {
+		let toml;
+		try {
+			toml = await readFile(join(srcDir, "Move.toml"), "utf8");
+		} catch {
+			return;
+		}
+		for (const match of toml.matchAll(LOCAL_MOVE_DEP_RE)) {
+			const rel = match[1];
+			const depSrc = resolve(srcDir, rel);
+			const depStaged = resolve(stagedDir, rel);
+			if (depStaged !== stagingRoot && !depStaged.startsWith(stagingRoot + sep)) throw new Error(`local Move dependency "${rel}" of "${basename(srcDir)}" resolves outside the staging root; vendor it under the package tree so it can be staged.`);
+			if (staged.has(depSrc)) continue;
+			staged.add(depSrc);
+			await cp(depSrc, depStaged, { recursive: true });
+			await walk(depSrc, depStaged);
+		}
+	};
+	await walk(packageSrc, stagedPackage);
+};
+/** Build-path wrapper around {@link copyLocalMoveDeps}. */
+const stageLocalMoveDeps = (packageSrc, stagedPackage, stagingRoot, inputs) => Effect.tryPromise({
+	try: () => copyLocalMoveDeps(packageSrc, stagedPackage, stagingRoot),
+	catch: (cause) => moveBuildError("scrub", {
+		sourcePath: inputs.sourcePath,
+		packageName: inputs.packageName,
+		message: "failed to stage local Move dependencies for the one-shot build",
+		cause
+	})
+});
 const buildViaOneShot = (inputs, runtime, image) => Effect.gen(function* () {
-	const parent = dirname(inputs.sourcePath);
-	const inner = containerInnerScript(basename(inputs.sourcePath));
+	const pkgName = basename(inputs.sourcePath);
+	const inner = containerInnerScriptOneShot(pkgName);
 	const moveHome = join(homedir(), ".move");
 	yield* ensureMoveHomeMountSource(moveHome, inputs.sourcePath, inputs.packageName);
+	const stagingRoot = yield* Effect.acquireRelease(Effect.tryPromise({
+		try: () => mkdtemp(join(tmpdir(), `move-build-${mintRandomSuffix(12)}-`)),
+		catch: (cause) => moveBuildError("scrub", {
+			sourcePath: inputs.sourcePath,
+			packageName: inputs.packageName,
+			message: "failed to create staging dir for Move build copy",
+			cause
+		})
+	}), (dir) => Effect.promise(() => rm(dir, {
+		recursive: true,
+		force: true
+	})));
+	const stagedPackage = join(stagingRoot, pkgName);
+	yield* Effect.tryPromise({
+		try: () => cp(inputs.sourcePath, stagedPackage, { recursive: true }),
+		catch: (cause) => moveBuildError("scrub", {
+			sourcePath: inputs.sourcePath,
+			packageName: inputs.packageName,
+			message: `failed to stage package copy for Move build (staging=${stagedPackage})`,
+			cause
+		})
+	});
+	yield* stageLocalMoveDeps(inputs.sourcePath, stagedPackage, stagingRoot, inputs);
 	const result = yield* runtime.runOneShot({
 		image,
 		entrypoint: "sh",
 		argv: ["-c", inner],
 		mounts: [{
-			source: parent,
+			source: stagingRoot,
 			target: "/workspace"
 		}, {
 			source: moveHome,
@@ -278,6 +352,6 @@ const runMoveBuild = (inputs) => {
 	}));
 };
 //#endregion
-export { DEFAULT_SUI_CLI_VERSION, containerInnerScript, extractTrailingJson, hashMoveSources, parseBuildOutput, runMoveBuild, scrubLocksHost, shellQuote, stripPinnedSections, suiCliImageBuildContext };
+export { DEFAULT_SUI_CLI_VERSION, copyLocalMoveDeps, extractTrailingJson, hashMoveSources, parseBuildOutput, runMoveBuild, scrubLocksHost, shellQuote, stripPinnedSections, suiCliImageBuildContext };
 
 //# sourceMappingURL=index.mjs.map

package/dist/substrate/runtime/sui-move-build/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/substrate/runtime/sui-move-build/index.ts"],"sourcesContent":["// sui-move-build — shared Sui Move build helpers.\n//\n// ARCHITECTURE NOTE — substrate-name-awareness escape hatch:\n//\n// Like `sui-execute/`, this is an L1-adjacent Sui-aware helper. It owns\n// the mechanical \"scrub Move.lock → run sui move build → parse bytecode\"\n// path so Move-publishing plugins do not import each other's internals.\n\nimport { createHash } from 'node:crypto';\nimport { lstat, mkdir, readFile, readdir, writeFile } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { basename, dirname, join, relative } from 'node:path';\n\nimport { Effect, Schema, type Scope } from 'effect';\n\nimport type {\n\tContainerBuildContext,\n\tContainerRuntime,\n\tExecResult,\n\tImageRef,\n} from '../../../contracts/container-runtime.ts';\nimport { contentHash, type ChainId, type ContentHash } from '../../brand.ts';\nimport { decodeJsonTextSync } from '../runtime-decode.ts';\n\nexport type MoveBuildPhase = 'hash' | 'scrub' | 'build' | 'parse';\n\nexport const DEFAULT_SUI_CLI_VERSION = 'devnet-v1.71.0';\n\nexport const suiCliImageBuildContext = (\n\tversion = DEFAULT_SUI_CLI_VERSION,\n): ContainerBuildContext => ({\n\tcontextPath: new URL('../../../../images/', import.meta.url).pathname,\n\tdockerfile: 'sui/Dockerfile',\n\tfingerprintPaths: ['sui/Dockerfile', 'sui/entrypoint.sh', '_shared/signal-forward.sh'],\n\tbuildArgs: { SUI_VERSION: version },\n});\n\nexport class MoveBuildError extends Schema.TaggedErrorClass<MoveBuildError>()('MoveBuildError', {\n\tphase: Schema.Literals(['hash', 'scrub', 'build', 'parse']),\n\tsourcePath: Schema.String,\n\tpackageName: Schema.String,\n\tmessage: Schema.String,\n\tcause: Schema.optional(Schema.Defect),\n}) {}\n\nconst moveBuildError = (\n\tphase: MoveBuildPhase,\n\tparts: {\n\t\treadonly sourcePath: string;\n\t\treadonly packageName: string;\n\t\treadonly message: string;\n\t\treadonly cause?: unknown;\n\t},\n): MoveBuildError =>\n\tnew MoveBuildError({\n\t\tphase,\n\t\tsourcePath: parts.sourcePath,\n\t\tpackageName: parts.packageName,\n\t\tmessage: parts.message,\n\t\t...(parts.cause !== undefined ? { cause: parts.cause } : {}),\n\t});\n\nexport interface MoveBuildContainer {\n\treadonly runBuild: (hostPackagePath: string) => Effect.Effect<ExecResult, unknown, Scope.Scope>;\n}\n\nexport interface BuildInputs {\n\treadonly sourcePath: string;\n\treadonly packageName: string;\n\treadonly chainId: ChainId | string;\n\treadonly buildContainer?: MoveBuildContainer;\n\treadonly runtime?: ContainerRuntime;\n\treadonly buildImage?: ImageRef;\n}\n\nexport interface BuildOutput {\n\treadonly modules: ReadonlyArray<Uint8Array>;\n\treadonly dependencies: ReadonlyArray<string>;\n}\n\nexport interface ScrubLocksHostOptions {\n\treadonly packageLockFailures?: 'fatal' | 'best-effort';\n}\n\nexport const stripPinnedSections = (source: string): string => {\n\tconst lines = source.split('\\n');\n\tconst out: Array<string> = [];\n\tlet skipping = false;\n\tfor (const line of lines) {\n\t\tconst trimmed = line.trimStart();\n\t\tif (trimmed.startsWith('[')) {\n\t\t\tconst header = trimmed.replace(/\\s+/g, '');\n\t\t\tif (header.startsWith('[pinned.') || header === '[env]' || header.startsWith('[env.')) {\n\t\t\t\tskipping = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tskipping = false;\n\t\t}\n\t\tif (!skipping) out.push(line);\n\t}\n\tif (skipping && source.endsWith('\\n') && out.at(-1) === '') out.push('');\n\treturn out.join('\\n');\n};\n\nexport const CONTAINER_SCRUB_AWK_SCRIPT = [\n\t'/^\\\\[pinned\\\\./ || /^\\\\[env(\\\\.|\\\\])/ { skip=1; next }',\n\t'/^\\\\[/ && !/^\\\\[pinned\\\\./ && !/^\\\\[env(\\\\.|\\\\])/ { skip=0 }',\n\t'!skip { print }',\n].join('\\n');\n\nexport const containerScrubShellScript = (workspaceRoot: string, moveHomeRoot: string): string => {\n\tconst lines = CONTAINER_SCRUB_AWK_SCRIPT.split('\\n')\n\t\t.map((l) => `'${l}'`)\n\t\t.join(' ');\n\tconst stage = `printf '%s\\\\n%s\\\\n%s\\\\n' ${lines} > /tmp/scrub-move-lock.awk`;\n\tconst findPkg =\n\t\t`find ${workspaceRoot} -type f -name Move.lock ` +\n\t\t`-not -path '*/node_modules/*' -not -path '*/.git/*' ` +\n\t\t`-exec gawk -i inplace -f /tmp/scrub-move-lock.awk {} ';'`;\n\tconst findCache =\n\t\t`[ -d ${moveHomeRoot}/git ] && find ${moveHomeRoot}/git -type f -name Move.lock ` +\n\t\t`-not -path '*/.git/*' ` +\n\t\t`-exec gawk -i inplace -f /tmp/scrub-move-lock.awk {} ';' || true`;\n\treturn [stage, findPkg, findCache].join('; ');\n};\n\nexport const scrubLocksContainerShellScript = containerScrubShellScript;\n\nexport interface MoveBuildInput {\n\treadonly packagePath: string;\n\treadonly rpcUrl: string;\n\treadonly faucetUrl?: string;\n}\n\nexport interface MoveBuildOutput {\n\treadonly exitCode: number;\n\treadonly stdoutJson: string;\n\treadonly stderr: string;\n}\n\nexport const shellQuote = (s: string): string => `'${s.replaceAll(\"'\", \"'\\\\''\")}'`;\n\nexport const extractTrailingJson = (text: string): string => {\n\tconst trimmed = text.trim();\n\tif (trimmed.startsWith('{')) return trimmed;\n\tconst idx = trimmed.lastIndexOf('{');\n\tif (idx === -1) return trimmed;\n\treturn trimmed.slice(idx);\n};\n\nexport const hostBuildArgv = (input: MoveBuildInput): ReadonlyArray<string> => [\n\t'move',\n\t'build',\n\t'--path',\n\tinput.packagePath,\n\t'-e',\n\t'testnet',\n\t'--no-tree-shaking',\n\t'--dump-bytecode-as-base64',\n\t'--with-unpublished-dependencies',\n];\n\nexport const containerInnerScript = (pkgName: string): string => {\n\tconst scrub = containerScrubShellScript('/workspace', '/root/.move');\n\tconst build =\n\t\t`sui move build --path /workspace/${shellQuote(pkgName)} ` +\n\t\t`-e testnet --no-tree-shaking --dump-bytecode-as-base64 ` +\n\t\t`--with-unpublished-dependencies`;\n\treturn ['set -e', scrub, 'set +e', build, 'status=$?', 'set -e', scrub, 'exit \"$status\"'].join(\n\t\t'; ',\n\t);\n};\n\nconst isHashedFile = (name: string): boolean =>\n\tname === 'Move.toml' || name === 'Move.lock' || name.endsWith('.move');\n\nconst isSkippedDir = (name: string): boolean =>\n\tname === 'build' || name === 'node_modules' || name === '.git' || name.startsWith('.');\n\nconst collectHashedSources = async (root: string): Promise<ReadonlyArray<string>> => {\n\tconst out: Array<string> = [];\n\tconst walk = async (dir: string): Promise<void> => {\n\t\tlet entries: ReadonlyArray<{\n\t\t\treadonly name: string;\n\t\t\treadonly isDirectory: () => boolean;\n\t\t\treadonly isFile: () => boolean;\n\t\t}> = [];\n\t\ttry {\n\t\t\tentries = await readdir(dir, { withFileTypes: true });\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\tif (isSkippedDir(entry.name)) continue;\n\t\t\t\tawait walk(join(dir, entry.name));\n\t\t\t} else if (entry.isFile() && isHashedFile(entry.name)) {\n\t\t\t\tconst abs = join(dir, entry.name);\n\t\t\t\ttry {\n\t\t\t\t\tconst stat = await lstat(abs);\n\t\t\t\t\tif (stat.isFile() && !stat.isSymbolicLink()) out.push(abs);\n\t\t\t\t} catch {\n\t\t\t\t\t// vanished / unreadable — skip\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t};\n\tawait walk(root);\n\treturn out;\n};\n\nexport const hashMoveSources = (sourcePath: string): Effect.Effect<ContentHash, MoveBuildError> =>\n\tEffect.tryPromise({\n\t\ttry: async (): Promise<ContentHash> => {\n\t\t\tconst files = await collectHashedSources(sourcePath);\n\t\t\tconst sorted = [...files].sort((a, b) =>\n\t\t\t\trelative(sourcePath, a).localeCompare(relative(sourcePath, b)),\n\t\t\t);\n\t\t\tconst hasher = createHash('sha256');\n\t\t\tfor (const abs of sorted) {\n\t\t\t\tconst rel = relative(sourcePath, abs);\n\t\t\t\tconst raw = await readFile(abs, 'utf8');\n\t\t\t\tconst normalised = basename(abs) === 'Move.lock' ? stripPinnedSections(raw) : raw;\n\t\t\t\thasher.update(rel);\n\t\t\t\thasher.update('\\0');\n\t\t\t\thasher.update(normalised);\n\t\t\t\thasher.update('\\0');\n\t\t\t}\n\t\t\treturn contentHash(hasher.digest('hex'));\n\t\t},\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('hash', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName: sourcePath,\n\t\t\t\tmessage: `source-tree hash failed: ${String((cause as Error)?.message ?? cause)}`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst expandHome = (p: string): string =>\n\tp.startsWith('~/') ? join(homedir(), p.slice(2)) : p === '~' ? homedir() : p;\n\nconst findMoveLockFiles = async (root: string): Promise<ReadonlyArray<string>> => {\n\tconst out: Array<string> = [];\n\tconst walk = async (dir: string): Promise<void> => {\n\t\tlet entries: ReadonlyArray<{\n\t\t\treadonly name: string;\n\t\t\treadonly isDirectory: () => boolean;\n\t\t\treadonly isFile: () => boolean;\n\t\t}> = [];\n\t\ttry {\n\t\t\tentries = await readdir(dir, { withFileTypes: true });\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'build') {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst child = join(dir, entry.name);\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\tawait walk(child);\n\t\t\t} else if (entry.isFile() && entry.name === 'Move.lock') {\n\t\t\t\ttry {\n\t\t\t\t\tconst stat = await lstat(child);\n\t\t\t\t\tif (stat.isFile() && !stat.isSymbolicLink()) out.push(child);\n\t\t\t\t} catch {\n\t\t\t\t\t// unreadable / vanished — skip\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t};\n\tawait walk(root);\n\treturn out;\n};\n\nconst scrubOneLockFile = async (path: string): Promise<void> => {\n\tconst original = await readFile(path, 'utf8');\n\tconst scrubbed = stripPinnedSections(original);\n\tif (scrubbed === original) return;\n\tawait writeFile(path, scrubbed, 'utf8');\n};\n\nconst scrubCachedLockFiles = async (root: string): Promise<void> => {\n\tconst cachedLocks = await findMoveLockFiles(root);\n\tfor (const f of cachedLocks) {\n\t\ttry {\n\t\t\tawait scrubOneLockFile(f);\n\t\t} catch {\n\t\t\t// The Docker build scrubs the mounted Move cache again from inside the container.\n\t\t}\n\t}\n};\n\nexport const scrubLocksHost = (\n\tsourcePath: string,\n\tmoveHomeRoot: string,\n\toptions: ScrubLocksHostOptions = {},\n): Effect.Effect<void, MoveBuildError, Scope.Scope> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tconst ownLocks = await findMoveLockFiles(sourcePath);\n\t\t\tfor (const f of ownLocks) {\n\t\t\t\tif (options.packageLockFailures === 'best-effort') {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait scrubOneLockFile(f);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tawait scrubOneLockFile(f);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst moveHome = expandHome(moveHomeRoot);\n\t\t\tconst gitCache = join(moveHome, 'git');\n\t\t\ttry {\n\t\t\t\tawait lstat(gitCache);\n\t\t\t} catch {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait scrubCachedLockFiles(gitCache);\n\t\t},\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('scrub', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName: sourcePath,\n\t\t\t\tmessage: `scrub host locks failed (root=${moveHomeRoot})`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst SuiBuildJsonSchema = Schema.Struct({\n\tmodules: Schema.Array(Schema.String),\n\tdependencies: Schema.Array(Schema.String),\n});\n\nconst decodeBase64Module = (s: string): Uint8Array =>\n\tUint8Array.from(globalThis.Buffer.from(s, 'base64'));\n\nexport const parseBuildOutput = (\n\tstdout: string,\n\tsourcePath: string,\n\tpackageName: string,\n): Effect.Effect<BuildOutput, MoveBuildError> =>\n\tEffect.try({\n\t\ttry: (): BuildOutput => {\n\t\t\tconst trimmed = extractTrailingJson(stdout);\n\t\t\tconst parsed = decodeJsonTextSync(SuiBuildJsonSchema, trimmed, {\n\t\t\t\tsource: 'sui move build stdout',\n\t\t\t\tmessage: 'unexpected sui move build JSON shape',\n\t\t\t\tmkError: (issue) => new Error(issue.message, { cause: issue.cause }),\n\t\t\t});\n\t\t\tconst modules = parsed.modules.map((m) => decodeBase64Module(m));\n\t\t\tconst dependencies = parsed.dependencies;\n\t\t\treturn { modules, dependencies };\n\t\t},\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('parse', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName,\n\t\t\t\tmessage: `failed to parse sui move build output: ${String((cause as Error)?.message ?? cause)}`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst promoteNonZero = (\n\top: 'docker exec' | 'docker run --rm' | 'host sui',\n\tresult: ExecResult,\n\tsourcePath: string,\n\tpackageName: string,\n): MoveBuildError =>\n\tmoveBuildError('build', {\n\t\tsourcePath,\n\t\tpackageName,\n\t\tmessage:\n\t\t\t`${op} sui move build exited ${result.exitCode} for package \"${packageName}\".\\n` +\n\t\t\t`stderr: ${result.stderr || '(empty)'}\\n` +\n\t\t\t`stdout (tail): ${result.stdout.slice(-400) || '(empty)'}`,\n\t});\n\nconst ensureMoveHomeMountSource = (\n\tmoveHome: string,\n\tsourcePath: string,\n\tpackageName: string,\n): Effect.Effect<void, MoveBuildError> =>\n\tEffect.tryPromise({\n\t\ttry: () => mkdir(moveHome, { recursive: true }),\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('build', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName,\n\t\t\t\tmessage: `failed to create Move cache mount source \"${moveHome}\"`,\n\t\t\t\tcause,\n\t\t\t}),\n\t}).pipe(Effect.asVoid);\n\nconst buildViaContainerExec = (\n\tinputs: BuildInputs,\n\tbc: MoveBuildContainer,\n): Effect.Effect<BuildOutput, MoveBuildError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst result = yield* bc.runBuild(inputs.sourcePath).pipe(\n\t\t\tEffect.mapError(\n\t\t\t\t(err): MoveBuildError =>\n\t\t\t\t\tmoveBuildError('build', {\n\t\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\t\tmessage: `buildContainer.runBuild failed: ${String(\n\t\t\t\t\t\t\t(err as { cause?: { message?: string } })?.cause?.message ?? err,\n\t\t\t\t\t\t)}`,\n\t\t\t\t\t\tcause: err,\n\t\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tpromoteNonZero('docker exec', result, inputs.sourcePath, inputs.packageName),\n\t\t\t);\n\t\t}\n\t\treturn yield* parseBuildOutput(result.stdout, inputs.sourcePath, inputs.packageName);\n\t}).pipe(Effect.withSpan('sui-move-build.via-exec'));\n\nconst buildViaOneShot = (\n\tinputs: BuildInputs,\n\truntime: ContainerRuntime,\n\timage: ImageRef,\n): Effect.Effect<BuildOutput, MoveBuildError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst parent = dirname(inputs.sourcePath);\n\t\tconst pkgName = basename(inputs.sourcePath);\n\t\tconst inner = containerInnerScript(pkgName);\n\t\tconst moveHome = join(homedir(), '.move');\n\t\tyield* ensureMoveHomeMountSource(moveHome, inputs.sourcePath, inputs.packageName);\n\t\tconst result = yield* runtime\n\t\t\t.runOneShot({\n\t\t\t\timage,\n\t\t\t\tentrypoint: 'sh',\n\t\t\t\targv: ['-c', inner],\n\t\t\t\tmounts: [\n\t\t\t\t\t{ source: parent, target: '/workspace' },\n\t\t\t\t\t{ source: moveHome, target: '/root/.move' },\n\t\t\t\t],\n\t\t\t\ttimeoutMillis: 5 * 60_000,\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.mapError(\n\t\t\t\t\t(err): MoveBuildError =>\n\t\t\t\t\t\tmoveBuildError('build', {\n\t\t\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\t\t\tmessage: `runtime.runOneShot failed: ${err.reason}: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tpromoteNonZero('docker run --rm', result, inputs.sourcePath, inputs.packageName),\n\t\t\t);\n\t\t}\n\t\treturn yield* parseBuildOutput(result.stdout, inputs.sourcePath, inputs.packageName);\n\t}).pipe(Effect.withSpan('sui-move-build.via-one-shot'));\n\nexport const runMoveBuild = (\n\tinputs: BuildInputs,\n): Effect.Effect<BuildOutput, MoveBuildError, Scope.Scope> => {\n\tif (inputs.buildContainer !== undefined) {\n\t\treturn buildViaContainerExec(inputs, inputs.buildContainer);\n\t}\n\tif (inputs.runtime !== undefined && inputs.buildImage !== undefined) {\n\t\treturn buildViaOneShot(inputs, inputs.runtime, inputs.buildImage);\n\t}\n\treturn Effect.fail(\n\t\tmoveBuildError('build', {\n\t\t\tsourcePath: inputs.sourcePath,\n\t\t\tpackageName: inputs.packageName,\n\t\t\tmessage:\n\t\t\t\t'runMoveBuild: no build container and no fresh-container runtime/image — ' +\n\t\t\t\t'host `sui` CLI path is not available without a routed ChildProcessSpawner',\n\t\t}),\n\t);\n};\n"],"mappings":";;;;;;;;AA0BA,MAAa,0BAA0B;AAEvC,MAAa,2BACZ,UAAU,6BACkB;CAC5B,aAAa,IAAI,IAAI,uBAAuB,OAAO,KAAK,IAAI,CAAC;CAC7D,YAAY;CACZ,kBAAkB;EAAC;EAAkB;EAAqB;EAA4B;CACtF,WAAW,EAAE,aAAa,SAAS;CACnC;AAED,IAAa,iBAAb,cAAoC,OAAO,kBAAkC,CAAC,kBAAkB;CAC/F,OAAO,OAAO,SAAS;EAAC;EAAQ;EAAS;EAAS;EAAQ,CAAC;CAC3D,YAAY,OAAO;CACnB,aAAa,OAAO;CACpB,SAAS,OAAO;CAChB,OAAO,OAAO,SAAS,OAAO,OAAO;CACrC,CAAC,CAAC;AAEH,MAAM,kBACL,OACA,UAOA,IAAI,eAAe;CAClB;CACA,YAAY,MAAM;CAClB,aAAa,MAAM;CACnB,SAAS,MAAM;CACf,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,OAAO,GAAG,EAAE;CAC3D,CAAC;AAwBH,MAAa,uBAAuB,WAA2B;CAC9D,MAAM,QAAQ,OAAO,MAAM,KAAK;CAChC,MAAM,MAAqB,EAAE;CAC7B,IAAI,WAAW;AACf,MAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,UAAU,KAAK,WAAW;AAChC,MAAI,QAAQ,WAAW,IAAI,EAAE;GAC5B,MAAM,SAAS,QAAQ,QAAQ,QAAQ,GAAG;AAC1C,OAAI,OAAO,WAAW,WAAW,IAAI,WAAW,WAAW,OAAO,WAAW,QAAQ,EAAE;AACtF,eAAW;AACX;;AAED,cAAW;;AAEZ,MAAI,CAAC,SAAU,KAAI,KAAK,KAAK;;AAE9B,KAAI,YAAY,OAAO,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,GAAI,KAAI,KAAK,GAAG;AACxE,QAAO,IAAI,KAAK,KAAK;;AAGtB,MAAa,6BAA6B;CACzC;CACA;CACA;CACA,CAAC,KAAK,KAAK;AAEZ,MAAa,6BAA6B,eAAuB,iBAAiC;AAajG,QAAO;EAAC,4BAZM,2BAA2B,MAAM,KAAK,CAClD,KAAK,MAAM,IAAI,EAAE,GAAG,CACpB,KAAK,IACwC,CAAC;EASjC,QAPN,cAAc;EAOC,QAHf,aAAa,iBAAiB,aAAa;EAGlB,CAAC,KAAK,KAAK;;AAiB9C,MAAa,cAAc,MAAsB,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC;AAEhF,MAAa,uBAAuB,SAAyB;CAC5D,MAAM,UAAU,KAAK,MAAM;AAC3B,KAAI,QAAQ,WAAW,IAAI,CAAE,QAAO;CACpC,MAAM,MAAM,QAAQ,YAAY,IAAI;AACpC,KAAI,QAAQ,GAAI,QAAO;AACvB,QAAO,QAAQ,MAAM,IAAI;;AAe1B,MAAa,wBAAwB,YAA4B;CAChE,MAAM,QAAQ,0BAA0B,cAAc,cAAc;AAKpE,QAAO;EAAC;EAAU;EAAO;EAAU,oCAHE,WAAW,QAAQ,CAAC;EAGf;EAAa;EAAU;EAAO;EAAiB,CAAC,KACzF,KACA;;AAGF,MAAM,gBAAgB,SACrB,SAAS,eAAe,SAAS,eAAe,KAAK,SAAS,QAAQ;AAEvE,MAAM,gBAAgB,SACrB,SAAS,WAAW,SAAS,kBAAkB,SAAS,UAAU,KAAK,WAAW,IAAI;AAEvF,MAAM,uBAAuB,OAAO,SAAiD;CACpF,MAAM,MAAqB,EAAE;CAC7B,MAAM,OAAO,OAAO,QAA+B;EAClD,IAAI,UAIC,EAAE;AACP,MAAI;AACH,aAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,MAAM,CAAC;UAC9C;AACP;;AAED,OAAK,MAAM,SAAS,QACnB,KAAI,MAAM,aAAa,EAAE;AACxB,OAAI,aAAa,MAAM,KAAK,CAAE;AAC9B,SAAM,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;aACvB,MAAM,QAAQ,IAAI,aAAa,MAAM,KAAK,EAAE;GACtD,MAAM,MAAM,KAAK,KAAK,MAAM,KAAK;AACjC,OAAI;IACH,MAAM,OAAO,MAAM,MAAM,IAAI;AAC7B,QAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,gBAAgB,CAAE,KAAI,KAAK,IAAI;WACnD;;;AAMX,OAAM,KAAK,KAAK;AAChB,QAAO;;AAGR,MAAa,mBAAmB,eAC/B,OAAO,WAAW;CACjB,KAAK,YAAkC;EAEtC,MAAM,SAAS,CAAC,GAAG,MADC,qBAAqB,WAAW,CAC3B,CAAC,MAAM,GAAG,MAClC,SAAS,YAAY,EAAE,CAAC,cAAc,SAAS,YAAY,EAAE,CAAC,CAC9D;EACD,MAAM,SAAS,WAAW,SAAS;AACnC,OAAK,MAAM,OAAO,QAAQ;GACzB,MAAM,MAAM,SAAS,YAAY,IAAI;GACrC,MAAM,MAAM,MAAM,SAAS,KAAK,OAAO;GACvC,MAAM,aAAa,SAAS,IAAI,KAAK,cAAc,oBAAoB,IAAI,GAAG;AAC9E,UAAO,OAAO,IAAI;AAClB,UAAO,OAAO,KAAK;AACnB,UAAO,OAAO,WAAW;AACzB,UAAO,OAAO,KAAK;;AAEpB,SAAO,YAAY,OAAO,OAAO,MAAM,CAAC;;CAEzC,QAAQ,UACP,eAAe,QAAQ;EACtB;EACA,aAAa;EACb,SAAS,4BAA4B,OAAQ,OAAiB,WAAW,MAAM;EAC/E;EACA,CAAC;CACH,CAAC;AAEH,MAAM,cAAc,MACnB,EAAE,WAAW,KAAK,GAAG,KAAK,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,MAAM,SAAS,GAAG;AAE5E,MAAM,oBAAoB,OAAO,SAAiD;CACjF,MAAM,MAAqB,EAAE;CAC7B,MAAM,OAAO,OAAO,QAA+B;EAClD,IAAI,UAIC,EAAE;AACP,MAAI;AACH,aAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,MAAM,CAAC;UAC9C;AACP;;AAED,OAAK,MAAM,SAAS,SAAS;AAC5B,OAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,UAAU,MAAM,SAAS,QAC5E;GAED,MAAM,QAAQ,KAAK,KAAK,MAAM,KAAK;AACnC,OAAI,MAAM,aAAa,CACtB,OAAM,KAAK,MAAM;YACP,MAAM,QAAQ,IAAI,MAAM,SAAS,YAC3C,KAAI;IACH,MAAM,OAAO,MAAM,MAAM,MAAM;AAC/B,QAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,gBAAgB,CAAE,KAAI,KAAK,MAAM;WACrD;;;AAMX,OAAM,KAAK,KAAK;AAChB,QAAO;;AAGR,MAAM,mBAAmB,OAAO,SAAgC;CAC/D,MAAM,WAAW,MAAM,SAAS,MAAM,OAAO;CAC7C,MAAM,WAAW,oBAAoB,SAAS;AAC9C,KAAI,aAAa,SAAU;AAC3B,OAAM,UAAU,MAAM,UAAU,OAAO;;AAGxC,MAAM,uBAAuB,OAAO,SAAgC;CACnE,MAAM,cAAc,MAAM,kBAAkB,KAAK;AACjD,MAAK,MAAM,KAAK,YACf,KAAI;AACH,QAAM,iBAAiB,EAAE;SAClB;;AAMV,MAAa,kBACZ,YACA,cACA,UAAiC,EAAE,KAEnC,OAAO,WAAW;CACjB,KAAK,YAAY;EAChB,MAAM,WAAW,MAAM,kBAAkB,WAAW;AACpD,OAAK,MAAM,KAAK,SACf,KAAI,QAAQ,wBAAwB,cACnC,KAAI;AACH,SAAM,iBAAiB,EAAE;UAClB;AACP;;MAGD,OAAM,iBAAiB,EAAE;EAK3B,MAAM,WAAW,KADA,WAAW,aACE,EAAE,MAAM;AACtC,MAAI;AACH,SAAM,MAAM,SAAS;UACd;AACP;;AAED,QAAM,qBAAqB,SAAS;;CAErC,QAAQ,UACP,eAAe,SAAS;EACvB;EACA,aAAa;EACb,SAAS,iCAAiC,aAAa;EACvD;EACA,CAAC;CACH,CAAC;AAEH,MAAM,qBAAqB,OAAO,OAAO;CACxC,SAAS,OAAO,MAAM,OAAO,OAAO;CACpC,cAAc,OAAO,MAAM,OAAO,OAAO;CACzC,CAAC;AAEF,MAAM,sBAAsB,MAC3B,WAAW,KAAK,WAAW,OAAO,KAAK,GAAG,SAAS,CAAC;AAErD,MAAa,oBACZ,QACA,YACA,gBAEA,OAAO,IAAI;CACV,WAAwB;EAEvB,MAAM,SAAS,mBAAmB,oBADlB,oBAAoB,OACyB,EAAE;GAC9D,QAAQ;GACR,SAAS;GACT,UAAU,UAAU,IAAI,MAAM,MAAM,SAAS,EAAE,OAAO,MAAM,OAAO,CAAC;GACpE,CAAC;AAGF,SAAO;GAAE,SAFO,OAAO,QAAQ,KAAK,MAAM,mBAAmB,EAAE,CAE/C;GAAE,cADG,OAAO;GACI;;CAEjC,QAAQ,UACP,eAAe,SAAS;EACvB;EACA;EACA,SAAS,0CAA0C,OAAQ,OAAiB,WAAW,MAAM;EAC7F;EACA,CAAC;CACH,CAAC;AAEH,MAAM,kBACL,IACA,QACA,YACA,gBAEA,eAAe,SAAS;CACvB;CACA;CACA,SACC,GAAG,GAAG,yBAAyB,OAAO,SAAS,gBAAgB,YAAY,cAChE,OAAO,UAAU,UAAU,mBACpB,OAAO,OAAO,MAAM,KAAK,IAAI;CAChD,CAAC;AAEH,MAAM,6BACL,UACA,YACA,gBAEA,OAAO,WAAW;CACjB,WAAW,MAAM,UAAU,EAAE,WAAW,MAAM,CAAC;CAC/C,QAAQ,UACP,eAAe,SAAS;EACvB;EACA;EACA,SAAS,6CAA6C,SAAS;EAC/D;EACA,CAAC;CACH,CAAC,CAAC,KAAK,OAAO,OAAO;AAEvB,MAAM,yBACL,QACA,OAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,GAAG,SAAS,OAAO,WAAW,CAAC,KACpD,OAAO,UACL,QACA,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,mCAAmC,OAC1C,KAA0C,OAAO,WAAW,IAC7D;EACD,OAAO;EACP,CAAC,CACH,CACD;AACD,KAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,eAAe,eAAe,QAAQ,OAAO,YAAY,OAAO,YAAY,CAC5E;AAEF,QAAO,OAAO,iBAAiB,OAAO,QAAQ,OAAO,YAAY,OAAO,YAAY;EACnF,CAAC,KAAK,OAAO,SAAS,0BAA0B,CAAC;AAEpD,MAAM,mBACL,QACA,SACA,UAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,QAAQ,OAAO,WAAW;CAEzC,MAAM,QAAQ,qBADE,SAAS,OAAO,WACU,CAAC;CAC3C,MAAM,WAAW,KAAK,SAAS,EAAE,QAAQ;AACzC,QAAO,0BAA0B,UAAU,OAAO,YAAY,OAAO,YAAY;CACjF,MAAM,SAAS,OAAO,QACpB,WAAW;EACX;EACA,YAAY;EACZ,MAAM,CAAC,MAAM,MAAM;EACnB,QAAQ,CACP;GAAE,QAAQ;GAAQ,QAAQ;GAAc,EACxC;GAAE,QAAQ;GAAU,QAAQ;GAAe,CAC3C;EACD,eAAe,IAAI;EACnB,CAAC,CACD,KACA,OAAO,UACL,QACA,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,8BAA8B,IAAI,OAAO,IAAI,IAAI;EAC1D,OAAO;EACP,CAAC,CACH,CACD;AACF,KAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,eAAe,mBAAmB,QAAQ,OAAO,YAAY,OAAO,YAAY,CAChF;AAEF,QAAO,OAAO,iBAAiB,OAAO,QAAQ,OAAO,YAAY,OAAO,YAAY;EACnF,CAAC,KAAK,OAAO,SAAS,8BAA8B,CAAC;AAExD,MAAa,gBACZ,WAC6D;AAC7D,KAAI,OAAO,mBAAmB,KAAA,EAC7B,QAAO,sBAAsB,QAAQ,OAAO,eAAe;AAE5D,KAAI,OAAO,YAAY,KAAA,KAAa,OAAO,eAAe,KAAA,EACzD,QAAO,gBAAgB,QAAQ,OAAO,SAAS,OAAO,WAAW;AAElE,QAAO,OAAO,KACb,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SACC;EAED,CAAC,CACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/substrate/runtime/sui-move-build/index.ts"],"sourcesContent":["// sui-move-build — shared Sui Move build helpers.\n//\n// ARCHITECTURE NOTE — substrate-name-awareness escape hatch:\n//\n// Like `sui-execute/`, this is an L1-adjacent Sui-aware helper. It owns\n// the mechanical \"scrub Move.lock → run sui move build → parse bytecode\"\n// path so Move-publishing plugins do not import each other's internals.\n// Listed as a documented exception in `ARCHITECTURE.md` §\"Substrate\n// name-blindness\" alongside `sui-execute/`. Rationale + alternative-\n// rejection are recorded there; new substrate-side Sui-aware exceptions\n// need explicit justification in that section before landing.\n\nimport { createHash } from 'node:crypto';\nimport { cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';\nimport { homedir, tmpdir } from 'node:os';\nimport { basename, join, relative, resolve, sep } from 'node:path';\n\nimport { Effect, Schema, type Scope } from 'effect';\n\nimport type {\n\tContainerBuildContext,\n\tContainerRuntime,\n\tExecResult,\n\tImageRef,\n} from '../../../contracts/container-runtime.ts';\nimport { contentHash, type ChainId, type ContentHash } from '../../brand.ts';\nimport { mintRandomSuffix } from '../random-suffix.ts';\nimport { decodeJsonTextSync } from '../runtime-decode.ts';\n\nexport type MoveBuildPhase = 'hash' | 'scrub' | 'build' | 'parse';\n\nexport const DEFAULT_SUI_CLI_VERSION = 'devnet-v1.71.0';\n\nexport const suiCliImageBuildContext = (\n\tversion = DEFAULT_SUI_CLI_VERSION,\n): ContainerBuildContext => ({\n\tcontextPath: new URL('../../../../images/', import.meta.url).pathname,\n\tdockerfile: 'sui/Dockerfile',\n\tfingerprintPaths: ['sui/Dockerfile', 'sui/entrypoint.sh', '_shared/signal-forward.sh'],\n\tbuildArgs: { SUI_VERSION: version },\n});\n\nexport class MoveBuildError extends Schema.TaggedErrorClass<MoveBuildError>()('MoveBuildError', {\n\tphase: Schema.Literals(['hash', 'scrub', 'build', 'parse']),\n\tsourcePath: Schema.String,\n\tpackageName: Schema.String,\n\tmessage: Schema.String,\n\tcause: Schema.optional(Schema.Defect),\n}) {}\n\nconst moveBuildError = (\n\tphase: MoveBuildPhase,\n\tparts: {\n\t\treadonly sourcePath: string;\n\t\treadonly packageName: string;\n\t\treadonly message: string;\n\t\treadonly cause?: unknown;\n\t},\n): MoveBuildError =>\n\tnew MoveBuildError({\n\t\tphase,\n\t\tsourcePath: parts.sourcePath,\n\t\tpackageName: parts.packageName,\n\t\tmessage: parts.message,\n\t\t...(parts.cause !== undefined ? { cause: parts.cause } : {}),\n\t});\n\nexport interface MoveBuildContainer {\n\treadonly runBuild: (hostPackagePath: string) => Effect.Effect<ExecResult, unknown, Scope.Scope>;\n}\n\nexport interface BuildInputs {\n\treadonly sourcePath: string;\n\treadonly packageName: string;\n\treadonly chainId: ChainId | string;\n\treadonly buildContainer?: MoveBuildContainer;\n\treadonly runtime?: ContainerRuntime;\n\treadonly buildImage?: ImageRef;\n}\n\nexport interface BuildOutput {\n\treadonly modules: ReadonlyArray<Uint8Array>;\n\treadonly dependencies: ReadonlyArray<string>;\n}\n\nexport const stripPinnedSections = (source: string): string => {\n\tconst lines = source.split('\\n');\n\tconst out: Array<string> = [];\n\tlet skipping = false;\n\tfor (const line of lines) {\n\t\tconst trimmed = line.trimStart();\n\t\tif (trimmed.startsWith('[')) {\n\t\t\tconst header = trimmed.replace(/\\s+/g, '');\n\t\t\tif (header.startsWith('[pinned.') || header === '[env]' || header.startsWith('[env.')) {\n\t\t\t\tskipping = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tskipping = false;\n\t\t}\n\t\tif (!skipping) out.push(line);\n\t}\n\tif (skipping && source.endsWith('\\n') && out.at(-1) === '') out.push('');\n\treturn out.join('\\n');\n};\n\nexport const CONTAINER_SCRUB_AWK_SCRIPT = [\n\t'/^\\\\[pinned\\\\./ || /^\\\\[env(\\\\.|\\\\])/ { skip=1; next }',\n\t'/^\\\\[/ && !/^\\\\[pinned\\\\./ && !/^\\\\[env(\\\\.|\\\\])/ { skip=0 }',\n\t'!skip { print }',\n].join('\\n');\n\nexport const containerScrubShellScript = (workspaceRoot: string, moveHomeRoot: string): string => {\n\tconst lines = CONTAINER_SCRUB_AWK_SCRIPT.split('\\n')\n\t\t.map((l) => `'${l}'`)\n\t\t.join(' ');\n\tconst stage = `printf '%s\\\\n%s\\\\n%s\\\\n' ${lines} > /tmp/scrub-move-lock.awk`;\n\tconst findPkg =\n\t\t`find ${workspaceRoot} -type f -name Move.lock ` +\n\t\t`-not -path '*/node_modules/*' -not -path '*/.git/*' ` +\n\t\t`-exec gawk -i inplace -f /tmp/scrub-move-lock.awk {} ';'`;\n\tconst findCache =\n\t\t`[ -d ${moveHomeRoot}/git ] && find ${moveHomeRoot}/git -type f -name Move.lock ` +\n\t\t`-not -path '*/.git/*' ` +\n\t\t`-exec gawk -i inplace -f /tmp/scrub-move-lock.awk {} ';' || true`;\n\treturn [stage, findPkg, findCache].join('; ');\n};\n\nexport interface MoveBuildInput {\n\treadonly packagePath: string;\n\treadonly rpcUrl: string;\n\treadonly faucetUrl?: string;\n}\n\nexport interface MoveBuildOutput {\n\treadonly exitCode: number;\n\treadonly stdoutJson: string;\n\treadonly stderr: string;\n}\n\nexport const shellQuote = (s: string): string => `'${s.replaceAll(\"'\", \"'\\\\''\")}'`;\n\nexport const extractTrailingJson = (text: string): string => {\n\tconst trimmed = text.trim();\n\tif (trimmed.startsWith('{')) return trimmed;\n\tconst idx = trimmed.lastIndexOf('{');\n\tif (idx === -1) return trimmed;\n\treturn trimmed.slice(idx);\n};\n\nexport const containerInnerScript = (pkgName: string): string => {\n\t// Copy the WHOLE mounted tree into an in-container scratch dir and scrub +\n\t// build the package THERE, never `/workspace/<pkg>` directly. `/workspace`\n\t// is a bind mount of the developer's real source tree (the per-app build\n\t// container in `chain-build-container.ts` mounts the app dir as-is), and the\n\t// scrub's `gawk -i inplace` rewrite of Move.lock would corrupt their\n\t// checked-in pinned deps if run against the mount.\n\t//\n\t// Two reasons we copy `/workspace/.` (the whole tree) rather than only\n\t// `/workspace/<pkgName>`:\n\t//   1. NESTED PACKAGES. `pkgName` is the package path RELATIVE to the\n\t//      bind-mounted app dir (e.g. `packages/demo`), so it can contain a\n\t//      slash. Copying only `/workspace/<pkgName>` into\n\t//      `/tmp/move-build-$$/<pkgName>` would need the intermediate\n\t//      `packages/` dir to exist first — it doesn't, and `set -e` would\n\t//      abort the build before `sui move build` ran.\n\t//   2. SIBLING LOCAL DEPS. A package can reference siblings via\n\t//      `{ local = \"../token\" }`. A scoped copy of only the package subtree\n\t//      drops those, failing the build with \"Invalid directory at ../…\".\n\t// Copying the whole tree both materialises the nested path AND carries the\n\t// sibling `../` deps. The mount itself is never rewritten (mirrors\n\t// `containerInnerScriptOneShot`, whose host-side staging tree is the disposable\n\t// copy there; here the in-container copy is the disposable one).\n\t//\n\t// `$$` (the shell PID) scopes the scratch dir per exec so concurrent\n\t// builds of the same package don't share a tree.\n\tconst quotedPkg = shellQuote(pkgName);\n\tconst scratchRoot = '/tmp/move-build-$$';\n\tconst scratchPkg = `${scratchRoot}/${quotedPkg}`;\n\tconst stage = `rm -rf ${scratchRoot} && mkdir -p ${scratchRoot} && cp -a /workspace/. ${scratchRoot}/`;\n\t// Scrub the whole scratch tree AND the mounted Move git cache. The cache\n\t// (`/root/.move/git`) is process-shared mutable state we legitimately want\n\t// scrubbed so a stale pin can't leak into the build; the scratch tree is the\n\t// disposable copy, so scrubbing all of it (package + staged siblings) is safe.\n\tconst scrub = containerScrubShellScript(scratchRoot, '/root/.move');\n\tconst build =\n\t\t`sui move build --path ${scratchPkg} ` +\n\t\t`-e testnet --no-tree-shaking --dump-bytecode-as-base64 ` +\n\t\t`--with-unpublished-dependencies`;\n\tconst cleanup = `rm -rf ${scratchRoot}`;\n\treturn [\n\t\t'set -e',\n\t\tstage,\n\t\tscrub,\n\t\t'set +e',\n\t\tbuild,\n\t\t'status=$?',\n\t\t'set -e',\n\t\tscrub,\n\t\tcleanup,\n\t\t'exit \"$status\"',\n\t].join('; ');\n};\n\n/** One-shot-path inner script. Mirrors {@link containerInnerScript} — both copy\n *  the WHOLE `/workspace` tree into an in-container scratch dir and scrub + build\n *  THERE, never the mount in place. The difference is only WHAT is mounted at\n *  `/workspace`: the exec path bind-mounts the developer's real app dir (so the\n *  whole-tree copy naturally carries nested packages + sibling `../` deps),\n *  whereas the one-shot path mounts a disposable host-side staging copy whose\n *  transitive local deps were pre-staged (see `stageLocalMoveDeps`). Copying only\n *  `/workspace/<pkg>` would drop sibling local dependencies\n *  (`{ local = \"../token\" }`), failing the build with \"Invalid directory at ../…\". */\nexport const containerInnerScriptOneShot = (pkgName: string): string => {\n\tconst quotedPkg = shellQuote(pkgName);\n\tconst scratchRoot = '/tmp/move-build-$$';\n\tconst scratchPkg = `${scratchRoot}/${quotedPkg}`;\n\t// Copy the WHOLE staging mount (package + its staged local `../` deps) into\n\t// an in-container scratch tree and scrub + build THERE — never the mounted\n\t// host staging dir. Building in the mount leaves root-owned `build/` +\n\t// scrubbed Move.lock files behind that the (non-root) host can't remove,\n\t// failing scope cleanup with EACCES. Copying ALL of /workspace (like\n\t// containerInnerScript) keeps sibling local deps like `{ local = \"../token\" }`\n\t// present in the scratch tree.\n\tconst stage = `rm -rf ${scratchRoot} && mkdir -p ${scratchRoot} && cp -a /workspace/. ${scratchRoot}/`;\n\tconst scrub = containerScrubShellScript(scratchRoot, '/root/.move');\n\tconst build =\n\t\t`sui move build --path ${scratchPkg} ` +\n\t\t`-e testnet --no-tree-shaking --dump-bytecode-as-base64 ` +\n\t\t`--with-unpublished-dependencies`;\n\tconst cleanup = `rm -rf ${scratchRoot}`;\n\treturn [\n\t\t'set -e',\n\t\tstage,\n\t\tscrub,\n\t\t'set +e',\n\t\tbuild,\n\t\t'status=$?',\n\t\t'set -e',\n\t\tscrub,\n\t\tcleanup,\n\t\t'exit \"$status\"',\n\t].join('; ');\n};\n\nconst isHashedFile = (name: string): boolean =>\n\tname === 'Move.toml' || name === 'Move.lock' || name.endsWith('.move');\n\nconst isSkippedDir = (name: string): boolean =>\n\tname === 'build' || name === 'node_modules' || name === '.git' || name.startsWith('.');\n\nconst collectHashedSources = async (root: string): Promise<ReadonlyArray<string>> => {\n\tconst out: Array<string> = [];\n\tconst walk = async (dir: string): Promise<void> => {\n\t\tlet entries: ReadonlyArray<{\n\t\t\treadonly name: string;\n\t\t\treadonly isDirectory: () => boolean;\n\t\t\treadonly isFile: () => boolean;\n\t\t}> = [];\n\t\ttry {\n\t\t\tentries = await readdir(dir, { withFileTypes: true });\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\tif (isSkippedDir(entry.name)) continue;\n\t\t\t\tawait walk(join(dir, entry.name));\n\t\t\t} else if (entry.isFile() && isHashedFile(entry.name)) {\n\t\t\t\tconst abs = join(dir, entry.name);\n\t\t\t\ttry {\n\t\t\t\t\tconst stat = await lstat(abs);\n\t\t\t\t\tif (stat.isFile() && !stat.isSymbolicLink()) out.push(abs);\n\t\t\t\t} catch {\n\t\t\t\t\t// vanished / unreadable — skip\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t};\n\tawait walk(root);\n\treturn out;\n};\n\nexport const hashMoveSources = (sourcePath: string): Effect.Effect<ContentHash, MoveBuildError> =>\n\tEffect.tryPromise({\n\t\ttry: async (): Promise<ContentHash> => {\n\t\t\tconst files = await collectHashedSources(sourcePath);\n\t\t\tconst sorted = [...files].sort((a, b) =>\n\t\t\t\trelative(sourcePath, a).localeCompare(relative(sourcePath, b)),\n\t\t\t);\n\t\t\tconst hasher = createHash('sha256');\n\t\t\tfor (const abs of sorted) {\n\t\t\t\tconst rel = relative(sourcePath, abs);\n\t\t\t\tconst raw = await readFile(abs, 'utf8');\n\t\t\t\tconst normalised = basename(abs) === 'Move.lock' ? stripPinnedSections(raw) : raw;\n\t\t\t\thasher.update(rel);\n\t\t\t\thasher.update('\\0');\n\t\t\t\thasher.update(normalised);\n\t\t\t\thasher.update('\\0');\n\t\t\t}\n\t\t\treturn contentHash(hasher.digest('hex'));\n\t\t},\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('hash', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName: sourcePath,\n\t\t\t\tmessage: `source-tree hash failed: ${String((cause as Error)?.message ?? cause)}`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst expandHome = (p: string): string =>\n\tp.startsWith('~/') ? join(homedir(), p.slice(2)) : p === '~' ? homedir() : p;\n\nconst findMoveLockFiles = async (root: string): Promise<ReadonlyArray<string>> => {\n\tconst out: Array<string> = [];\n\tconst walk = async (dir: string): Promise<void> => {\n\t\tlet entries: ReadonlyArray<{\n\t\t\treadonly name: string;\n\t\t\treadonly isDirectory: () => boolean;\n\t\t\treadonly isFile: () => boolean;\n\t\t}> = [];\n\t\ttry {\n\t\t\tentries = await readdir(dir, { withFileTypes: true });\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tfor (const entry of entries) {\n\t\t\tif (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'build') {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst child = join(dir, entry.name);\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\tawait walk(child);\n\t\t\t} else if (entry.isFile() && entry.name === 'Move.lock') {\n\t\t\t\ttry {\n\t\t\t\t\tconst stat = await lstat(child);\n\t\t\t\t\tif (stat.isFile() && !stat.isSymbolicLink()) out.push(child);\n\t\t\t\t} catch {\n\t\t\t\t\t// unreadable / vanished — skip\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t};\n\tawait walk(root);\n\treturn out;\n};\n\nconst scrubOneLockFile = async (path: string): Promise<void> => {\n\tconst original = await readFile(path, 'utf8');\n\tconst scrubbed = stripPinnedSections(original);\n\tif (scrubbed === original) return;\n\tawait writeFile(path, scrubbed, 'utf8');\n};\n\nconst scrubCachedLockFiles = async (root: string): Promise<void> => {\n\tconst cachedLocks = await findMoveLockFiles(root);\n\tfor (const f of cachedLocks) {\n\t\ttry {\n\t\t\tawait scrubOneLockFile(f);\n\t\t} catch {\n\t\t\t// The Docker build scrubs the mounted Move cache again from inside the container.\n\t\t}\n\t}\n};\n\n// Scrub ONLY the shared Move git cache (`~/.move/git`), never the caller's\n// source tree. The package's own Move.lock is scrubbed inside the container on\n// a disposable copy (see `containerInnerScript`), so rewriting the developer's\n// checked-in Move.lock here would corrupt their pinned deps for no benefit. The\n// cache is process-shared mutable state, so scrubbing it host-side keeps a stale\n// pin from leaking into the build.\nexport const scrubLocksHost = (\n\tsourcePath: string,\n\tmoveHomeRoot: string,\n): Effect.Effect<void, MoveBuildError, Scope.Scope> =>\n\tEffect.tryPromise({\n\t\ttry: async () => {\n\t\t\tconst moveHome = expandHome(moveHomeRoot);\n\t\t\tconst gitCache = join(moveHome, 'git');\n\t\t\ttry {\n\t\t\t\tawait lstat(gitCache);\n\t\t\t} catch {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait scrubCachedLockFiles(gitCache);\n\t\t},\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('scrub', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName: sourcePath,\n\t\t\t\tmessage: `scrub host locks failed (root=${moveHomeRoot})`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst SuiBuildJsonSchema = Schema.Struct({\n\tmodules: Schema.Array(Schema.String),\n\tdependencies: Schema.Array(Schema.String),\n});\n\nconst decodeBase64Module = (s: string): Uint8Array =>\n\tUint8Array.from(globalThis.Buffer.from(s, 'base64'));\n\nexport const parseBuildOutput = (\n\tstdout: string,\n\tsourcePath: string,\n\tpackageName: string,\n): Effect.Effect<BuildOutput, MoveBuildError> =>\n\tEffect.try({\n\t\ttry: (): BuildOutput => {\n\t\t\tconst trimmed = extractTrailingJson(stdout);\n\t\t\tconst parsed = decodeJsonTextSync(SuiBuildJsonSchema, trimmed, {\n\t\t\t\tsource: 'sui move build stdout',\n\t\t\t\tmessage: 'unexpected sui move build JSON shape',\n\t\t\t\tmkError: (issue) => new Error(issue.message, { cause: issue.cause }),\n\t\t\t});\n\t\t\tconst modules = parsed.modules.map((m) => decodeBase64Module(m));\n\t\t\tconst dependencies = parsed.dependencies;\n\t\t\treturn { modules, dependencies };\n\t\t},\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('parse', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName,\n\t\t\t\tmessage: `failed to parse sui move build output: ${String((cause as Error)?.message ?? cause)}`,\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst promoteNonZero = (\n\top: 'docker exec' | 'docker run --rm',\n\tresult: ExecResult,\n\tsourcePath: string,\n\tpackageName: string,\n): MoveBuildError =>\n\tmoveBuildError('build', {\n\t\tsourcePath,\n\t\tpackageName,\n\t\tmessage:\n\t\t\t`${op} sui move build exited ${result.exitCode} for package \"${packageName}\".\\n` +\n\t\t\t`stderr: ${result.stderr || '(empty)'}\\n` +\n\t\t\t`stdout (tail): ${result.stdout.slice(-400) || '(empty)'}`,\n\t});\n\nconst ensureMoveHomeMountSource = (\n\tmoveHome: string,\n\tsourcePath: string,\n\tpackageName: string,\n): Effect.Effect<void, MoveBuildError> =>\n\tEffect.tryPromise({\n\t\ttry: () => mkdir(moveHome, { recursive: true }),\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('build', {\n\t\t\t\tsourcePath,\n\t\t\t\tpackageName,\n\t\t\t\tmessage: `failed to create Move cache mount source \"${moveHome}\"`,\n\t\t\t\tcause,\n\t\t\t}),\n\t}).pipe(Effect.asVoid);\n\nconst buildViaContainerExec = (\n\tinputs: BuildInputs,\n\tbc: MoveBuildContainer,\n): Effect.Effect<BuildOutput, MoveBuildError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst result = yield* bc.runBuild(inputs.sourcePath).pipe(\n\t\t\tEffect.mapError(\n\t\t\t\t(err): MoveBuildError =>\n\t\t\t\t\tmoveBuildError('build', {\n\t\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\t\tmessage: `buildContainer.runBuild failed: ${String(\n\t\t\t\t\t\t\t(err as { cause?: { message?: string } })?.cause?.message ?? err,\n\t\t\t\t\t\t)}`,\n\t\t\t\t\t\tcause: err,\n\t\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tpromoteNonZero('docker exec', result, inputs.sourcePath, inputs.packageName),\n\t\t\t);\n\t\t}\n\t\treturn yield* parseBuildOutput(result.stdout, inputs.sourcePath, inputs.packageName);\n\t}).pipe(Effect.withSpan('sui-move-build.via-exec'));\n\n/** `{ local = \"../path\" }` dependency paths, harvested from a Move.toml. */\nconst LOCAL_MOVE_DEP_RE = /\\blocal\\s*=\\s*\"([^\"]+)\"/g;\n\n/** Copy a package's transitive local-path Move dependencies into a staging\n *  tree, preserving each dep's path RELATIVE to the staged package so\n *  references like `{ local = \"../token\" }` resolve. Without this, a scoped\n *  copy of only the package fails `sui move build` / `sui move summary` with\n *  \"Invalid directory at ../…\". Throws if a dep resolves outside `stagingRoot`\n *  (the single-mount layout can't represent it). Promise-based so the build\n *  (`MoveBuildError`) and summary (`CodegenBindingsFailed`) call sites can\n *  wrap it in their own error type. */\nexport const copyLocalMoveDeps = async (\n\tpackageSrc: string,\n\tstagedPackage: string,\n\tstagingRoot: string,\n): Promise<void> => {\n\tconst staged = new Set<string>([packageSrc]);\n\tconst walk = async (srcDir: string, stagedDir: string): Promise<void> => {\n\t\tlet toml: string;\n\t\ttry {\n\t\t\ttoml = await readFile(join(srcDir, 'Move.toml'), 'utf8');\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tfor (const match of toml.matchAll(LOCAL_MOVE_DEP_RE)) {\n\t\t\tconst rel = match[1]!;\n\t\t\tconst depSrc = resolve(srcDir, rel);\n\t\t\tconst depStaged = resolve(stagedDir, rel);\n\t\t\tif (depStaged !== stagingRoot && !depStaged.startsWith(stagingRoot + sep)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`local Move dependency \"${rel}\" of \"${basename(srcDir)}\" resolves outside the ` +\n\t\t\t\t\t\t`staging root; vendor it under the package tree so it can be staged.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (staged.has(depSrc)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tstaged.add(depSrc);\n\t\t\tawait cp(depSrc, depStaged, { recursive: true });\n\t\t\tawait walk(depSrc, depStaged);\n\t\t}\n\t};\n\tawait walk(packageSrc, stagedPackage);\n};\n\n/** Build-path wrapper around {@link copyLocalMoveDeps}. */\nexport const stageLocalMoveDeps = (\n\tpackageSrc: string,\n\tstagedPackage: string,\n\tstagingRoot: string,\n\tinputs: BuildInputs,\n): Effect.Effect<void, MoveBuildError> =>\n\tEffect.tryPromise({\n\t\ttry: () => copyLocalMoveDeps(packageSrc, stagedPackage, stagingRoot),\n\t\tcatch: (cause): MoveBuildError =>\n\t\t\tmoveBuildError('scrub', {\n\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\tmessage: 'failed to stage local Move dependencies for the one-shot build',\n\t\t\t\tcause,\n\t\t\t}),\n\t});\n\nconst buildViaOneShot = (\n\tinputs: BuildInputs,\n\truntime: ContainerRuntime,\n\timage: ImageRef,\n): Effect.Effect<BuildOutput, MoveBuildError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst pkgName = basename(inputs.sourcePath);\n\t\tconst inner = containerInnerScriptOneShot(pkgName);\n\t\tconst moveHome = join(homedir(), '.move');\n\t\tyield* ensureMoveHomeMountSource(moveHome, inputs.sourcePath, inputs.packageName);\n\n\t\t// Stage a scoped copy of the package and mount THAT, never the user's\n\t\t// source tree. The container scrub (`gawk -i inplace`) rewrites Move.lock\n\t\t// in place; pointing it at the developer's checked-in tree corrupts their\n\t\t// pinned deps. The staging dir is scope-bound (acquireRelease removes it on\n\t\t// scope close) and carries a random suffix so two concurrent builds of the\n\t\t// same package don't share a tree. We keep the `/workspace/<pkgName>` layout\n\t\t// so `containerInnerScript(pkgName)` and the mounted Move cache stay unchanged.\n\t\tconst stagingRoot = yield* Effect.acquireRelease(\n\t\t\tEffect.tryPromise({\n\t\t\t\ttry: () => mkdtemp(join(tmpdir(), `move-build-${mintRandomSuffix(12)}-`)),\n\t\t\t\tcatch: (cause): MoveBuildError =>\n\t\t\t\t\tmoveBuildError('scrub', {\n\t\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\t\tmessage: 'failed to create staging dir for Move build copy',\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t}),\n\t\t\t(dir) => Effect.promise(() => rm(dir, { recursive: true, force: true })),\n\t\t);\n\t\tconst stagedPackage = join(stagingRoot, pkgName);\n\t\tyield* Effect.tryPromise({\n\t\t\ttry: () => cp(inputs.sourcePath, stagedPackage, { recursive: true }),\n\t\t\tcatch: (cause): MoveBuildError =>\n\t\t\t\tmoveBuildError('scrub', {\n\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\tmessage: `failed to stage package copy for Move build (staging=${stagedPackage})`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\t// Bring the package's transitive local `../` deps into the staging tree\n\t\t// so the in-place one-shot build resolves them (the scoped copy alone\n\t\t// would omit siblings like `{ local = \"../token\" }`).\n\t\tyield* stageLocalMoveDeps(inputs.sourcePath, stagedPackage, stagingRoot, inputs);\n\n\t\tconst result = yield* runtime\n\t\t\t.runOneShot({\n\t\t\t\timage,\n\t\t\t\tentrypoint: 'sh',\n\t\t\t\targv: ['-c', inner],\n\t\t\t\tmounts: [\n\t\t\t\t\t{ source: stagingRoot, target: '/workspace' },\n\t\t\t\t\t{ source: moveHome, target: '/root/.move' },\n\t\t\t\t],\n\t\t\t\ttimeoutMillis: 5 * 60_000,\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.mapError(\n\t\t\t\t\t(err): MoveBuildError =>\n\t\t\t\t\t\tmoveBuildError('build', {\n\t\t\t\t\t\t\tsourcePath: inputs.sourcePath,\n\t\t\t\t\t\t\tpackageName: inputs.packageName,\n\t\t\t\t\t\t\tmessage: `runtime.runOneShot failed: ${err.reason}: ${err.detail}`,\n\t\t\t\t\t\t\tcause: err,\n\t\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tpromoteNonZero('docker run --rm', result, inputs.sourcePath, inputs.packageName),\n\t\t\t);\n\t\t}\n\t\treturn yield* parseBuildOutput(result.stdout, inputs.sourcePath, inputs.packageName);\n\t}).pipe(Effect.withSpan('sui-move-build.via-one-shot'));\n\nexport const runMoveBuild = (\n\tinputs: BuildInputs,\n): Effect.Effect<BuildOutput, MoveBuildError, Scope.Scope> => {\n\tif (inputs.buildContainer !== undefined) {\n\t\treturn buildViaContainerExec(inputs, inputs.buildContainer);\n\t}\n\tif (inputs.runtime !== undefined && inputs.buildImage !== undefined) {\n\t\treturn buildViaOneShot(inputs, inputs.runtime, inputs.buildImage);\n\t}\n\treturn Effect.fail(\n\t\tmoveBuildError('build', {\n\t\t\tsourcePath: inputs.sourcePath,\n\t\t\tpackageName: inputs.packageName,\n\t\t\tmessage:\n\t\t\t\t'runMoveBuild: no build container and no fresh-container runtime/image — ' +\n\t\t\t\t'host `sui` CLI path is not available without a routed ChildProcessSpawner',\n\t\t}),\n\t);\n};\n"],"mappings":";;;;;;;;;AA+BA,MAAa,0BAA0B;AAEvC,MAAa,2BACZ,UAAU,6BACkB;CAC5B,aAAa,IAAI,IAAI,uBAAuB,OAAO,KAAK,IAAI,CAAC;CAC7D,YAAY;CACZ,kBAAkB;EAAC;EAAkB;EAAqB;EAA4B;CACtF,WAAW,EAAE,aAAa,SAAS;CACnC;AAED,IAAa,iBAAb,cAAoC,OAAO,kBAAkC,CAAC,kBAAkB;CAC/F,OAAO,OAAO,SAAS;EAAC;EAAQ;EAAS;EAAS;EAAQ,CAAC;CAC3D,YAAY,OAAO;CACnB,aAAa,OAAO;CACpB,SAAS,OAAO;CAChB,OAAO,OAAO,SAAS,OAAO,OAAO;CACrC,CAAC,CAAC;AAEH,MAAM,kBACL,OACA,UAOA,IAAI,eAAe;CAClB;CACA,YAAY,MAAM;CAClB,aAAa,MAAM;CACnB,SAAS,MAAM;CACf,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,OAAO,GAAG,EAAE;CAC3D,CAAC;AAoBH,MAAa,uBAAuB,WAA2B;CAC9D,MAAM,QAAQ,OAAO,MAAM,KAAK;CAChC,MAAM,MAAqB,EAAE;CAC7B,IAAI,WAAW;AACf,MAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,UAAU,KAAK,WAAW;AAChC,MAAI,QAAQ,WAAW,IAAI,EAAE;GAC5B,MAAM,SAAS,QAAQ,QAAQ,QAAQ,GAAG;AAC1C,OAAI,OAAO,WAAW,WAAW,IAAI,WAAW,WAAW,OAAO,WAAW,QAAQ,EAAE;AACtF,eAAW;AACX;;AAED,cAAW;;AAEZ,MAAI,CAAC,SAAU,KAAI,KAAK,KAAK;;AAE9B,KAAI,YAAY,OAAO,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,GAAI,KAAI,KAAK,GAAG;AACxE,QAAO,IAAI,KAAK,KAAK;;AAGtB,MAAa,6BAA6B;CACzC;CACA;CACA;CACA,CAAC,KAAK,KAAK;AAEZ,MAAa,6BAA6B,eAAuB,iBAAiC;AAajG,QAAO;EAAC,4BAZM,2BAA2B,MAAM,KAAK,CAClD,KAAK,MAAM,IAAI,EAAE,GAAG,CACpB,KAAK,IACwC,CAAC;EASjC,QAPN,cAAc;EAOC,QAHf,aAAa,iBAAiB,aAAa;EAGlB,CAAC,KAAK,KAAK;;AAe9C,MAAa,cAAc,MAAsB,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC;AAEhF,MAAa,uBAAuB,SAAyB;CAC5D,MAAM,UAAU,KAAK,MAAM;AAC3B,KAAI,QAAQ,WAAW,IAAI,CAAE,QAAO;CACpC,MAAM,MAAM,QAAQ,YAAY,IAAI;AACpC,KAAI,QAAQ,GAAI,QAAO;AACvB,QAAO,QAAQ,MAAM,IAAI;;;;;;;;;;;AAkE1B,MAAa,+BAA+B,YAA4B;CACvE,MAAM,YAAY,WAAW,QAAQ;CACrC,MAAM,cAAc;CACpB,MAAM,aAAa,GAAG,YAAY,GAAG;CAQrC,MAAM,QAAQ,UAAU,YAAY,eAAe,YAAY,yBAAyB,YAAY;CACpG,MAAM,QAAQ,0BAA0B,aAAa,cAAc;AAMnE,QAAO;EACN;EACA;EACA;EACA;EACA,yBATyB,WAAW;EAUpC;EACA;EACA;EACA,UAVyB;EAWzB;EACA,CAAC,KAAK,KAAK;;AAGb,MAAM,gBAAgB,SACrB,SAAS,eAAe,SAAS,eAAe,KAAK,SAAS,QAAQ;AAEvE,MAAM,gBAAgB,SACrB,SAAS,WAAW,SAAS,kBAAkB,SAAS,UAAU,KAAK,WAAW,IAAI;AAEvF,MAAM,uBAAuB,OAAO,SAAiD;CACpF,MAAM,MAAqB,EAAE;CAC7B,MAAM,OAAO,OAAO,QAA+B;EAClD,IAAI,UAIC,EAAE;AACP,MAAI;AACH,aAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,MAAM,CAAC;UAC9C;AACP;;AAED,OAAK,MAAM,SAAS,QACnB,KAAI,MAAM,aAAa,EAAE;AACxB,OAAI,aAAa,MAAM,KAAK,CAAE;AAC9B,SAAM,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;aACvB,MAAM,QAAQ,IAAI,aAAa,MAAM,KAAK,EAAE;GACtD,MAAM,MAAM,KAAK,KAAK,MAAM,KAAK;AACjC,OAAI;IACH,MAAM,OAAO,MAAM,MAAM,IAAI;AAC7B,QAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,gBAAgB,CAAE,KAAI,KAAK,IAAI;WACnD;;;AAMX,OAAM,KAAK,KAAK;AAChB,QAAO;;AAGR,MAAa,mBAAmB,eAC/B,OAAO,WAAW;CACjB,KAAK,YAAkC;EAEtC,MAAM,SAAS,CAAC,GAAG,MADC,qBAAqB,WAAW,CAC3B,CAAC,MAAM,GAAG,MAClC,SAAS,YAAY,EAAE,CAAC,cAAc,SAAS,YAAY,EAAE,CAAC,CAC9D;EACD,MAAM,SAAS,WAAW,SAAS;AACnC,OAAK,MAAM,OAAO,QAAQ;GACzB,MAAM,MAAM,SAAS,YAAY,IAAI;GACrC,MAAM,MAAM,MAAM,SAAS,KAAK,OAAO;GACvC,MAAM,aAAa,SAAS,IAAI,KAAK,cAAc,oBAAoB,IAAI,GAAG;AAC9E,UAAO,OAAO,IAAI;AAClB,UAAO,OAAO,KAAK;AACnB,UAAO,OAAO,WAAW;AACzB,UAAO,OAAO,KAAK;;AAEpB,SAAO,YAAY,OAAO,OAAO,MAAM,CAAC;;CAEzC,QAAQ,UACP,eAAe,QAAQ;EACtB;EACA,aAAa;EACb,SAAS,4BAA4B,OAAQ,OAAiB,WAAW,MAAM;EAC/E;EACA,CAAC;CACH,CAAC;AAEH,MAAM,cAAc,MACnB,EAAE,WAAW,KAAK,GAAG,KAAK,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,MAAM,SAAS,GAAG;AAE5E,MAAM,oBAAoB,OAAO,SAAiD;CACjF,MAAM,MAAqB,EAAE;CAC7B,MAAM,OAAO,OAAO,QAA+B;EAClD,IAAI,UAIC,EAAE;AACP,MAAI;AACH,aAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,MAAM,CAAC;UAC9C;AACP;;AAED,OAAK,MAAM,SAAS,SAAS;AAC5B,OAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,UAAU,MAAM,SAAS,QAC5E;GAED,MAAM,QAAQ,KAAK,KAAK,MAAM,KAAK;AACnC,OAAI,MAAM,aAAa,CACtB,OAAM,KAAK,MAAM;YACP,MAAM,QAAQ,IAAI,MAAM,SAAS,YAC3C,KAAI;IACH,MAAM,OAAO,MAAM,MAAM,MAAM;AAC/B,QAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,gBAAgB,CAAE,KAAI,KAAK,MAAM;WACrD;;;AAMX,OAAM,KAAK,KAAK;AAChB,QAAO;;AAGR,MAAM,mBAAmB,OAAO,SAAgC;CAC/D,MAAM,WAAW,MAAM,SAAS,MAAM,OAAO;CAC7C,MAAM,WAAW,oBAAoB,SAAS;AAC9C,KAAI,aAAa,SAAU;AAC3B,OAAM,UAAU,MAAM,UAAU,OAAO;;AAGxC,MAAM,uBAAuB,OAAO,SAAgC;CACnE,MAAM,cAAc,MAAM,kBAAkB,KAAK;AACjD,MAAK,MAAM,KAAK,YACf,KAAI;AACH,QAAM,iBAAiB,EAAE;SAClB;;AAYV,MAAa,kBACZ,YACA,iBAEA,OAAO,WAAW;CACjB,KAAK,YAAY;EAEhB,MAAM,WAAW,KADA,WAAW,aACE,EAAE,MAAM;AACtC,MAAI;AACH,SAAM,MAAM,SAAS;UACd;AACP;;AAED,QAAM,qBAAqB,SAAS;;CAErC,QAAQ,UACP,eAAe,SAAS;EACvB;EACA,aAAa;EACb,SAAS,iCAAiC,aAAa;EACvD;EACA,CAAC;CACH,CAAC;AAEH,MAAM,qBAAqB,OAAO,OAAO;CACxC,SAAS,OAAO,MAAM,OAAO,OAAO;CACpC,cAAc,OAAO,MAAM,OAAO,OAAO;CACzC,CAAC;AAEF,MAAM,sBAAsB,MAC3B,WAAW,KAAK,WAAW,OAAO,KAAK,GAAG,SAAS,CAAC;AAErD,MAAa,oBACZ,QACA,YACA,gBAEA,OAAO,IAAI;CACV,WAAwB;EAEvB,MAAM,SAAS,mBAAmB,oBADlB,oBAAoB,OACyB,EAAE;GAC9D,QAAQ;GACR,SAAS;GACT,UAAU,UAAU,IAAI,MAAM,MAAM,SAAS,EAAE,OAAO,MAAM,OAAO,CAAC;GACpE,CAAC;AAGF,SAAO;GAAE,SAFO,OAAO,QAAQ,KAAK,MAAM,mBAAmB,EAAE,CAE/C;GAAE,cADG,OAAO;GACI;;CAEjC,QAAQ,UACP,eAAe,SAAS;EACvB;EACA;EACA,SAAS,0CAA0C,OAAQ,OAAiB,WAAW,MAAM;EAC7F;EACA,CAAC;CACH,CAAC;AAEH,MAAM,kBACL,IACA,QACA,YACA,gBAEA,eAAe,SAAS;CACvB;CACA;CACA,SACC,GAAG,GAAG,yBAAyB,OAAO,SAAS,gBAAgB,YAAY,cAChE,OAAO,UAAU,UAAU,mBACpB,OAAO,OAAO,MAAM,KAAK,IAAI;CAChD,CAAC;AAEH,MAAM,6BACL,UACA,YACA,gBAEA,OAAO,WAAW;CACjB,WAAW,MAAM,UAAU,EAAE,WAAW,MAAM,CAAC;CAC/C,QAAQ,UACP,eAAe,SAAS;EACvB;EACA;EACA,SAAS,6CAA6C,SAAS;EAC/D;EACA,CAAC;CACH,CAAC,CAAC,KAAK,OAAO,OAAO;AAEvB,MAAM,yBACL,QACA,OAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,GAAG,SAAS,OAAO,WAAW,CAAC,KACpD,OAAO,UACL,QACA,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,mCAAmC,OAC1C,KAA0C,OAAO,WAAW,IAC7D;EACD,OAAO;EACP,CAAC,CACH,CACD;AACD,KAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,eAAe,eAAe,QAAQ,OAAO,YAAY,OAAO,YAAY,CAC5E;AAEF,QAAO,OAAO,iBAAiB,OAAO,QAAQ,OAAO,YAAY,OAAO,YAAY;EACnF,CAAC,KAAK,OAAO,SAAS,0BAA0B,CAAC;;AAGpD,MAAM,oBAAoB;;;;;;;;;AAU1B,MAAa,oBAAoB,OAChC,YACA,eACA,gBACmB;CACnB,MAAM,SAAS,IAAI,IAAY,CAAC,WAAW,CAAC;CAC5C,MAAM,OAAO,OAAO,QAAgB,cAAqC;EACxE,IAAI;AACJ,MAAI;AACH,UAAO,MAAM,SAAS,KAAK,QAAQ,YAAY,EAAE,OAAO;UACjD;AACP;;AAED,OAAK,MAAM,SAAS,KAAK,SAAS,kBAAkB,EAAE;GACrD,MAAM,MAAM,MAAM;GAClB,MAAM,SAAS,QAAQ,QAAQ,IAAI;GACnC,MAAM,YAAY,QAAQ,WAAW,IAAI;AACzC,OAAI,cAAc,eAAe,CAAC,UAAU,WAAW,cAAc,IAAI,CACxE,OAAM,IAAI,MACT,0BAA0B,IAAI,QAAQ,SAAS,OAAO,CAAC,4FAEvD;AAEF,OAAI,OAAO,IAAI,OAAO,CACrB;AAED,UAAO,IAAI,OAAO;AAClB,SAAM,GAAG,QAAQ,WAAW,EAAE,WAAW,MAAM,CAAC;AAChD,SAAM,KAAK,QAAQ,UAAU;;;AAG/B,OAAM,KAAK,YAAY,cAAc;;;AAItC,MAAa,sBACZ,YACA,eACA,aACA,WAEA,OAAO,WAAW;CACjB,WAAW,kBAAkB,YAAY,eAAe,YAAY;CACpE,QAAQ,UACP,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS;EACT;EACA,CAAC;CACH,CAAC;AAEH,MAAM,mBACL,QACA,SACA,UAEA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,SAAS,OAAO,WAAW;CAC3C,MAAM,QAAQ,4BAA4B,QAAQ;CAClD,MAAM,WAAW,KAAK,SAAS,EAAE,QAAQ;AACzC,QAAO,0BAA0B,UAAU,OAAO,YAAY,OAAO,YAAY;CASjF,MAAM,cAAc,OAAO,OAAO,eACjC,OAAO,WAAW;EACjB,WAAW,QAAQ,KAAK,QAAQ,EAAE,cAAc,iBAAiB,GAAG,CAAC,GAAG,CAAC;EACzE,QAAQ,UACP,eAAe,SAAS;GACvB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,SAAS;GACT;GACA,CAAC;EACH,CAAC,GACD,QAAQ,OAAO,cAAc,GAAG,KAAK;EAAE,WAAW;EAAM,OAAO;EAAM,CAAC,CAAC,CACxE;CACD,MAAM,gBAAgB,KAAK,aAAa,QAAQ;AAChD,QAAO,OAAO,WAAW;EACxB,WAAW,GAAG,OAAO,YAAY,eAAe,EAAE,WAAW,MAAM,CAAC;EACpE,QAAQ,UACP,eAAe,SAAS;GACvB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,SAAS,wDAAwD,cAAc;GAC/E;GACA,CAAC;EACH,CAAC;AAIF,QAAO,mBAAmB,OAAO,YAAY,eAAe,aAAa,OAAO;CAEhF,MAAM,SAAS,OAAO,QACpB,WAAW;EACX;EACA,YAAY;EACZ,MAAM,CAAC,MAAM,MAAM;EACnB,QAAQ,CACP;GAAE,QAAQ;GAAa,QAAQ;GAAc,EAC7C;GAAE,QAAQ;GAAU,QAAQ;GAAe,CAC3C;EACD,eAAe,IAAI;EACnB,CAAC,CACD,KACA,OAAO,UACL,QACA,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SAAS,8BAA8B,IAAI,OAAO,IAAI,IAAI;EAC1D,OAAO;EACP,CAAC,CACH,CACD;AACF,KAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,eAAe,mBAAmB,QAAQ,OAAO,YAAY,OAAO,YAAY,CAChF;AAEF,QAAO,OAAO,iBAAiB,OAAO,QAAQ,OAAO,YAAY,OAAO,YAAY;EACnF,CAAC,KAAK,OAAO,SAAS,8BAA8B,CAAC;AAExD,MAAa,gBACZ,WAC6D;AAC7D,KAAI,OAAO,mBAAmB,KAAA,EAC7B,QAAO,sBAAsB,QAAQ,OAAO,eAAe;AAE5D,KAAI,OAAO,YAAY,KAAA,KAAa,OAAO,eAAe,KAAA,EACzD,QAAO,gBAAgB,QAAQ,OAAO,SAAS,OAAO,WAAW;AAElE,QAAO,OAAO,KACb,eAAe,SAAS;EACvB,YAAY,OAAO;EACnB,aAAa,OAAO;EACpB,SACC;EAED,CAAC,CACF"}

package/dist/substrate/runtime/supervisor/acquire-node.mjs

@@ -0,0 +1,181 @@
+import { resolvePluginDependencies } from "../../plugin.mjs";
+import { annotateOp, annotatePhase, withPluginSpan } from "../observability/spans.mjs";
+import "../capability-sinks/index.mjs";
+import { prettyErrorStructured } from "../observability/pretty-error.mjs";
+import "../observability/index.mjs";
+import { buildDependencyReaderFor, makeEntry, makeRegistry } from "../lifecycle/plugin-registry.mjs";
+import { awaitUpstreams } from "../lifecycle/ready-gate.mjs";
+import "../lifecycle/index.mjs";
+import { CurrentPluginKey, CurrentPluginProgress } from "../current-plugin.mjs";
+import { operationalEndpointEventsFromResolvedValue } from "../projection/operational-endpoints.mjs";
+import { bestEffort, publish } from "./wiring.mjs";
+import { dispatchContributions, resolveCapabilities } from "./dispatch-contributions.mjs";
+import { Cause, Context, Effect, Exit, Scope } from "effect";
+//#region src/substrate/runtime/supervisor/acquire-node.ts
+const buildRegistry = (graph, parentScope, emit) => Effect.gen(function* () {
+	const entries = /* @__PURE__ */ new Map();
+	for (const [key, node] of graph.nodes) {
+		const entry = yield* makeEntry(node, parentScope);
+		entries.set(key, entry);
+	}
+	return makeRegistry(entries, emit);
+});
+/**
+* Run one node's `start` under its own scope. Steps:
+*  1. Await upstreams (their ready-gates).
+*  2. Transition `pending → acquiring` (publishes the event).
+*  3. Build resolved dependency values from declared resource refs.
+*  4. Run the plugin's `start` Effect inside the entry's Scope,
+*     after providing the substrate-context services bundle so the
+*     plugin's R-channel yields (`IdentityContext`,
+*     `ContainerRuntimeService`, etc.) resolve to live instances.
+*  5. On success: stash the resolved value + `markReady` (publishes
+*     the `ready` transition).
+*  6. On failure: `markFailed` (publishes the `failed` transition, fails
+*     the deferred so downstream consumers short-circuit).
+*
+* Errors are caught and stashed onto the registry entry — the outer
+* scheduler doesn't propagate per-plugin failures; ready-gate failure
+* propagation handles the downstream blocking. The supervisor's outer
+* fiber surfaces the union via `Fiber.join` when the user asks for
+* "stack ready or err".
+*/
+const acquireNode = (registry, key, ref, hub, pluginContext, sinks, logger, identity, runtimeRoot) => Effect.gen(function* () {
+	const entry = registry.entries.get(key);
+	if (entry === void 0) return;
+	if ((yield* awaitUpstreams(registry, entry.node).pipe(Effect.matchEffect({
+		onFailure: (cause) => Effect.gen(function* () {
+			yield* bestEffort(registry.markFailed(key, cause));
+			return false;
+		}),
+		onSuccess: () => Effect.succeed(true)
+	}))) !== true) {
+		yield* logger.log(`supervisor/${key}`, key, {
+			level: "warn",
+			message: "plugin acquire skipped — upstream failed"
+		});
+		return;
+	}
+	yield* annotatePhase("acquire");
+	yield* logger.log(`supervisor/${key}`, key, {
+		level: "debug",
+		message: "plugin acquire start",
+		fields: { role: entry.node.member.role }
+	});
+	yield* Effect.exit(registry.transition(key, "acquiring"));
+	const readDependency = buildDependencyReaderFor(registry, entry.node);
+	const deps = resolvePluginDependencies(entry.node.member, readDependency);
+	const start = entry.node.member.start;
+	const currentPluginContext = pluginContext.pipe(Context.add(CurrentPluginKey, { key }), Context.add(CurrentPluginProgress, { setPhase: (phase) => publish(ref, hub, {
+		tag: "lifecycle.phaseSet",
+		pluginKey: key,
+		phase,
+		at: Date.now()
+	}) }));
+	const providedAcquire = Effect.provide(start(deps), currentPluginContext);
+	const result = yield* Scope.provide(providedAcquire, entry.scope).pipe(Effect.matchEffect({
+		onFailure: (cause) => Effect.gen(function* () {
+			yield* bestEffort(registry.markFailed(key, cause));
+			yield* publish(ref, hub, {
+				tag: "error.reported",
+				error: prettyErrorStructured(Cause.fail(cause), {
+					pluginKey: key,
+					severity: "error",
+					at: Date.now()
+				})
+			});
+			return { ok: false };
+		}),
+		onSuccess: (value) => Effect.succeed({
+			ok: true,
+			value
+		})
+	}));
+	if (result.ok) {
+		const acquireContext = {
+			identity,
+			chain: identity.chain,
+			runtimeRoot
+		};
+		const capsExit = yield* Effect.exit(resolveCapabilities(key, entry.node.member.capabilities, result.value, acquireContext));
+		if (Exit.isFailure(capsExit)) {
+			yield* bestEffort(registry.markFailed(key, capsExit.cause));
+			yield* publish(ref, hub, {
+				tag: "error.reported",
+				error: prettyErrorStructured(capsExit.cause, {
+					pluginKey: key,
+					severity: "error",
+					at: Date.now()
+				})
+			});
+			yield* logger.log(`supervisor/${key}`, key, {
+				level: "error",
+				message: "plugin capability factory failed"
+			});
+			return;
+		}
+		const caps = capsExit.value;
+		const errorContributions = entry.node.member.errorContributions ?? [];
+		if (caps.length > 0 || errorContributions.length > 0) {
+			const dispatchExit = yield* Effect.exit(dispatchContributions(key, caps, errorContributions, entry.node.member.role, identity, pluginContext, entry.scope, sinks, ref, hub));
+			if (Exit.isFailure(dispatchExit)) {
+				yield* bestEffort(registry.markFailed(key, dispatchExit.cause));
+				yield* publish(ref, hub, {
+					tag: "error.reported",
+					error: prettyErrorStructured(dispatchExit.cause, {
+						pluginKey: key,
+						severity: "error",
+						at: Date.now()
+					})
+				});
+				yield* logger.log(`supervisor/${key}`, key, {
+					level: "error",
+					message: "plugin capability dispatch failed"
+				});
+				return;
+			}
+		}
+		const routablesPresent = caps.some((capability) => capability.kind === "routable");
+		for (const event of operationalEndpointEventsFromResolvedValue(key, result.value, Date.now(), { routablesPresent })) yield* publish(ref, hub, event);
+		yield* publish(ref, hub, {
+			tag: "lifecycle.phaseSet",
+			pluginKey: key,
+			phase: null,
+			at: Date.now()
+		});
+		yield* bestEffort(registry.markReady(key, result.value));
+		if (entry.node.member.role === "task") yield* bestEffort(registry.transition(key, "done"));
+		yield* logger.log(`supervisor/${key}`, key, {
+			level: "debug",
+			message: entry.node.member.role === "task" ? "plugin done" : "plugin ready",
+			fields: {
+				capabilities: caps.length,
+				errorContributions: errorContributions.length
+			}
+		});
+	} else yield* logger.log(`supervisor/${key}`, key, {
+		level: "debug",
+		message: "plugin acquire failed"
+	});
+}).pipe(withPluginSpan("lifecycle.supervisor.acquireNode", {
+	app: identity.app,
+	stack: identity.stack,
+	network: identity.chain,
+	pluginKey: key,
+	role: registry.entries.get(key)?.node.member.role ?? "service"
+}));
+const acquireKeys = (registry, keys, ref, hub, pluginContext, sinks, logger, identity, runtimeRoot) => Effect.gen(function* () {
+	yield* Effect.annotateCurrentSpan({ "devstack.level.size": keys.length });
+	yield* Effect.all(keys.map((key) => acquireNode(registry, key, ref, hub, pluginContext, sinks, logger, identity, runtimeRoot)), {
+		concurrency: "unbounded",
+		discard: true
+	});
+}).pipe(Effect.withSpan("lifecycle.supervisor.acquireKeys"));
+const acquireFullGraph = (graph, registry, ref, hub, pluginContext, sinks, logger, identity, runtimeRoot) => Effect.gen(function* () {
+	yield* annotateOp("acquireFullGraph");
+	yield* acquireKeys(registry, [...graph.nodes.keys()], ref, hub, pluginContext, sinks, logger, identity, runtimeRoot);
+}).pipe(Effect.withSpan("lifecycle.supervisor.acquireFullGraph"));
+//#endregion
+export { acquireFullGraph, acquireKeys, buildRegistry };
+
+//# sourceMappingURL=acquire-node.mjs.map

package/dist/substrate/runtime/supervisor/acquire-node.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"acquire-node.mjs","names":[],"sources":["../../../../src/substrate/runtime/supervisor/acquire-node.ts"],"sourcesContent":["// Per-plugin acquire pipeline.\n//\n// Three entrypoints:\n//   - `buildRegistry(graph, parentScope, emit)` — boots the plugin\n//     registry from a resolved graph; each plugin's scope is parented\n//     to the supervisor's outer scope.\n//   - `acquireNode(...)` — runs one plugin's `start` body inside its\n//     entry scope; on success harvests `capabilities` +\n//     `errorContributions` and registers them through `CapabilitySinks`.\n//   - `acquireKeys` / `acquireFullGraph` — fan out per-node acquires\n//     in parallel; each node waits on its own upstream ready gate.\n\nimport { Cause, Context, Effect, Exit, Queue, Scope, SubscriptionRef } from 'effect';\n\nimport type { CapabilityDecl } from '../../../contracts/capability-decl.ts';\nimport type { PluginKey } from '../../brand.ts';\nimport type { EngineEvent } from '../../events.ts';\nimport type { Identity } from '../../identity.ts';\nimport type { LifecycleStatus } from '../../lifecycle.ts';\nimport { resolvePluginDependencies, type AcquireContext } from '../../plugin.ts';\nimport type { SubscribableState } from '../../projection.ts';\nimport { type CapabilitySinksShape } from '../capability-sinks/index.ts';\nimport { CurrentPluginKey, CurrentPluginProgress } from '../current-plugin.ts';\nimport {\n\tannotateOp,\n\tannotatePhase,\n\tprettyErrorStructured,\n\twithPluginSpan,\n\ttype LoggerShape,\n} from '../observability/index.ts';\nimport {\n\tawaitUpstreams,\n\tbuildDependencyReaderFor,\n\tmakeEntry,\n\tmakeRegistry,\n\ttype PluginEntry,\n\ttype PluginRegistry,\n\ttype ResolvedGraph,\n} from '../lifecycle/index.ts';\nimport { operationalEndpointEventsFromResolvedValue } from '../projection/operational-endpoints.ts';\nimport { dispatchContributions, resolveCapabilities } from './dispatch-contributions.ts';\nimport { bestEffort, publish } from './wiring.ts';\n\n// -----------------------------------------------------------------------------\n// Boot the registry from a graph\n// -----------------------------------------------------------------------------\n\nexport const buildRegistry = (\n\tgraph: ResolvedGraph,\n\tparentScope: Scope.Scope,\n\temit: (key: PluginKey, from: LifecycleStatus, to: LifecycleStatus) => Effect.Effect<void>,\n): Effect.Effect<PluginRegistry, never, never> =>\n\tEffect.gen(function* () {\n\t\tconst entries = new Map<PluginKey, PluginEntry>();\n\t\tfor (const [key, node] of graph.nodes) {\n\t\t\tconst entry = yield* makeEntry(node, parentScope);\n\t\t\tentries.set(key, entry);\n\t\t}\n\t\treturn makeRegistry(entries, emit);\n\t});\n\n// -----------------------------------------------------------------------------\n// Acquire one node\n// -----------------------------------------------------------------------------\n\n/**\n * Run one node's `start` under its own scope. Steps:\n *  1. Await upstreams (their ready-gates).\n *  2. Transition `pending → acquiring` (publishes the event).\n *  3. Build resolved dependency values from declared resource refs.\n *  4. Run the plugin's `start` Effect inside the entry's Scope,\n *     after providing the substrate-context services bundle so the\n *     plugin's R-channel yields (`IdentityContext`,\n *     `ContainerRuntimeService`, etc.) resolve to live instances.\n *  5. On success: stash the resolved value + `markReady` (publishes\n *     the `ready` transition).\n *  6. On failure: `markFailed` (publishes the `failed` transition, fails\n *     the deferred so downstream consumers short-circuit).\n *\n * Errors are caught and stashed onto the registry entry — the outer\n * scheduler doesn't propagate per-plugin failures; ready-gate failure\n * propagation handles the downstream blocking. The supervisor's outer\n * fiber surfaces the union via `Fiber.join` when the user asks for\n * \"stack ready or err\".\n */\nexport const acquireNode = (\n\tregistry: PluginRegistry,\n\tkey: PluginKey,\n\tref: SubscriptionRef.SubscriptionRef<SubscribableState>,\n\thub: Queue.Enqueue<EngineEvent>,\n\tpluginContext: Context.Context<never>,\n\tsinks: CapabilitySinksShape,\n\tlogger: LoggerShape,\n\tidentity: Identity,\n\truntimeRoot: string,\n): Effect.Effect<void, never, never> =>\n\tEffect.gen(function* () {\n\t\tconst entry = registry.entries.get(key);\n\t\tif (entry === undefined) return;\n\t\tconst upstreamWait = awaitUpstreams(registry, entry.node).pipe(\n\t\t\tEffect.matchEffect({\n\t\t\t\tonFailure: (cause) =>\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tyield* bestEffort(registry.markFailed(key, cause));\n\t\t\t\t\t\treturn false as const;\n\t\t\t\t\t}),\n\t\t\t\tonSuccess: () => Effect.succeed(true as const),\n\t\t\t}),\n\t\t);\n\t\tconst ok = yield* upstreamWait;\n\t\tif (ok !== true) {\n\t\t\tyield* logger.log(`supervisor/${key}`, key, {\n\t\t\t\tlevel: 'warn',\n\t\t\t\tmessage: 'plugin acquire skipped — upstream failed',\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\t\tyield* annotatePhase('acquire');\n\t\tyield* logger.log(`supervisor/${key}`, key, {\n\t\t\tlevel: 'debug',\n\t\t\tmessage: 'plugin acquire start',\n\t\t\tfields: { role: entry.node.member.role },\n\t\t});\n\t\t// Best-effort claim. `transition` `Effect.die`s on an off-table move,\n\t\t// which a concurrent acquire can trigger: an in-flight initial\n\t\t// `acquireNode` racing a selective-restart re-acquire of the same key\n\t\t// hits `acquiring → acquiring`. `Effect.catch` (used originally here)\n\t\t// cannot catch that DEFECT, so it would escape and kill the\n\t\t// command-loop fiber (supervisor wedge — same class as the lifecycle\n\t\t// reset fix). `Effect.exit` swallows BOTH failure and defect, keeping\n\t\t// this the best-effort transition it was always meant to be.\n\t\t// NOTE: this prevents the wedge but not the underlying double-acquire\n\t\t// (two fibers running one node's `start`). A complete fix must\n\t\t// interrupt a node's in-flight acquire fiber before a restart\n\t\t// re-acquires it — tracked as a follow-up (needs per-node acquire-fiber\n\t\t// handles, which `acquireKeys`' `Effect.all` does not retain today).\n\t\tyield* Effect.exit(registry.transition(key, 'acquiring'));\n\t\tconst readDependency = buildDependencyReaderFor(registry, entry.node);\n\t\tconst deps = resolvePluginDependencies(entry.node.member, readDependency);\n\t\t// eslint-disable-next-line @typescript-eslint/no-explicit-any\n\t\tconst start = entry.node.member.start as (\n\t\t\tdeps: unknown,\n\t\t) => Effect.Effect<unknown, unknown, any>;\n\t\tconst currentPluginContext = pluginContext.pipe(\n\t\t\tContext.add(CurrentPluginKey, { key }),\n\t\t\tContext.add(CurrentPluginProgress, {\n\t\t\t\tsetPhase: (phase) =>\n\t\t\t\t\tpublish(ref, hub, {\n\t\t\t\t\t\ttag: 'lifecycle.phaseSet',\n\t\t\t\t\t\tpluginKey: key,\n\t\t\t\t\t\tphase,\n\t\t\t\t\t\tat: Date.now(),\n\t\t\t\t\t}),\n\t\t\t}),\n\t\t);\n\t\tconst providedAcquire = Effect.provide(start(deps), currentPluginContext) as Effect.Effect<\n\t\t\tunknown,\n\t\t\tunknown,\n\t\t\tScope.Scope\n\t\t>;\n\t\tconst result = yield* Scope.provide(providedAcquire, entry.scope).pipe(\n\t\t\tEffect.matchEffect({\n\t\t\t\tonFailure: (cause) =>\n\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\tyield* bestEffort(registry.markFailed(key, cause));\n\t\t\t\t\t\tyield* publish(ref, hub, {\n\t\t\t\t\t\t\ttag: 'error.reported',\n\t\t\t\t\t\t\terror: prettyErrorStructured(Cause.fail(cause), {\n\t\t\t\t\t\t\t\tpluginKey: key,\n\t\t\t\t\t\t\t\tseverity: 'error',\n\t\t\t\t\t\t\t\tat: Date.now(),\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t});\n\t\t\t\t\t\treturn { ok: false as const };\n\t\t\t\t\t}),\n\t\t\t\tonSuccess: (value: unknown) =>\n\t\t\t\t\tEffect.succeed({ ok: true as const, value: value as unknown }),\n\t\t\t}),\n\t\t);\n\t\tif (result.ok) {\n\t\t\tconst acquireContext: AcquireContext = {\n\t\t\t\tidentity,\n\t\t\t\tchain: identity.chain,\n\t\t\t\truntimeRoot,\n\t\t\t};\n\t\t\tconst capsExit = yield* Effect.exit(\n\t\t\t\tresolveCapabilities(\n\t\t\t\t\tkey,\n\t\t\t\t\tentry.node.member.capabilities as\n\t\t\t\t\t\t| ReadonlyArray<CapabilityDecl>\n\t\t\t\t\t\t| ((r: unknown, c: AcquireContext) => ReadonlyArray<CapabilityDecl>)\n\t\t\t\t\t\t| undefined,\n\t\t\t\t\tresult.value,\n\t\t\t\t\tacquireContext,\n\t\t\t\t),\n\t\t\t);\n\t\t\tif (Exit.isFailure(capsExit)) {\n\t\t\t\tyield* bestEffort(registry.markFailed(key, capsExit.cause));\n\t\t\t\tyield* publish(ref, hub, {\n\t\t\t\t\ttag: 'error.reported',\n\t\t\t\t\terror: prettyErrorStructured(capsExit.cause, {\n\t\t\t\t\t\tpluginKey: key,\n\t\t\t\t\t\tseverity: 'error',\n\t\t\t\t\t\tat: Date.now(),\n\t\t\t\t\t}),\n\t\t\t\t});\n\t\t\t\tyield* logger.log(`supervisor/${key}`, key, {\n\t\t\t\t\tlevel: 'error',\n\t\t\t\t\tmessage: 'plugin capability factory failed',\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst caps = capsExit.value;\n\t\t\tconst errorContributions = entry.node.member.errorContributions ?? [];\n\t\t\tif (caps.length > 0 || errorContributions.length > 0) {\n\t\t\t\tconst dispatchExit = yield* Effect.exit(\n\t\t\t\t\tdispatchContributions(\n\t\t\t\t\t\tkey,\n\t\t\t\t\t\tcaps,\n\t\t\t\t\t\terrorContributions,\n\t\t\t\t\t\tentry.node.member.role,\n\t\t\t\t\t\tidentity,\n\t\t\t\t\t\tpluginContext,\n\t\t\t\t\t\tentry.scope,\n\t\t\t\t\t\tsinks,\n\t\t\t\t\t\tref,\n\t\t\t\t\t\thub,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tif (Exit.isFailure(dispatchExit)) {\n\t\t\t\t\t// dispatchContributions catches both UnknownContributionKind\n\t\t\t\t\t// (no-op) and ContributionSinkFailed (orchestrator event +\n\t\t\t\t\t// warning) internally. A surfaced failure here therefore\n\t\t\t\t\t// reflects an unexpected defect — keep the legacy\n\t\t\t\t\t// markFailed projection so the unknown shape doesn't\n\t\t\t\t\t// silently degrade the plugin.\n\t\t\t\t\tyield* bestEffort(registry.markFailed(key, dispatchExit.cause));\n\t\t\t\t\tyield* publish(ref, hub, {\n\t\t\t\t\t\ttag: 'error.reported',\n\t\t\t\t\t\terror: prettyErrorStructured(dispatchExit.cause, {\n\t\t\t\t\t\t\tpluginKey: key,\n\t\t\t\t\t\t\tseverity: 'error',\n\t\t\t\t\t\t\tat: Date.now(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t});\n\t\t\t\t\tyield* logger.log(`supervisor/${key}`, key, {\n\t\t\t\t\t\tlevel: 'error',\n\t\t\t\t\t\tmessage: 'plugin capability dispatch failed',\n\t\t\t\t\t});\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst routablesPresent = caps.some((capability) => capability.kind === 'routable');\n\t\t\tfor (const event of operationalEndpointEventsFromResolvedValue(\n\t\t\t\tkey,\n\t\t\t\tresult.value,\n\t\t\t\tDate.now(),\n\t\t\t\t{\n\t\t\t\t\troutablesPresent,\n\t\t\t\t},\n\t\t\t)) {\n\t\t\t\tyield* publish(ref, hub, event);\n\t\t\t}\n\t\t\tyield* publish(ref, hub, {\n\t\t\t\ttag: 'lifecycle.phaseSet',\n\t\t\t\tpluginKey: key,\n\t\t\t\tphase: null,\n\t\t\t\tat: Date.now(),\n\t\t\t});\n\t\t\tyield* bestEffort(registry.markReady(key, result.value));\n\t\t\tif (entry.node.member.role === 'task') {\n\t\t\t\tyield* bestEffort(registry.transition(key, 'done'));\n\t\t\t}\n\t\t\tyield* logger.log(`supervisor/${key}`, key, {\n\t\t\t\tlevel: 'debug',\n\t\t\t\tmessage: entry.node.member.role === 'task' ? 'plugin done' : 'plugin ready',\n\t\t\t\tfields: {\n\t\t\t\t\tcapabilities: caps.length,\n\t\t\t\t\terrorContributions: errorContributions.length,\n\t\t\t\t},\n\t\t\t});\n\t\t} else {\n\t\t\tyield* logger.log(`supervisor/${key}`, key, {\n\t\t\t\tlevel: 'debug',\n\t\t\t\tmessage: 'plugin acquire failed',\n\t\t\t});\n\t\t}\n\t}).pipe(\n\t\twithPluginSpan('lifecycle.supervisor.acquireNode', {\n\t\t\tapp: identity.app,\n\t\t\tstack: identity.stack,\n\t\t\tnetwork: identity.chain,\n\t\t\tpluginKey: key,\n\t\t\trole: registry.entries.get(key)?.node.member.role ?? 'service',\n\t\t}),\n\t);\n\n// -----------------------------------------------------------------------------\n// Acquire a key set in parallel. Each node waits on its own upstreams,\n// so downstream nodes begin as soon as their dependencies are ready\n// instead of waiting for unrelated nodes in the same topological level.\n// -----------------------------------------------------------------------------\n\nexport const acquireKeys = (\n\tregistry: PluginRegistry,\n\tkeys: ReadonlyArray<PluginKey>,\n\tref: SubscriptionRef.SubscriptionRef<SubscribableState>,\n\thub: Queue.Enqueue<EngineEvent>,\n\tpluginContext: Context.Context<never>,\n\tsinks: CapabilitySinksShape,\n\tlogger: LoggerShape,\n\tidentity: Identity,\n\truntimeRoot: string,\n): Effect.Effect<void, never, never> =>\n\tEffect.gen(function* () {\n\t\tyield* Effect.annotateCurrentSpan({ 'devstack.level.size': keys.length });\n\t\tyield* Effect.all(\n\t\t\tkeys.map((key) =>\n\t\t\t\tacquireNode(registry, key, ref, hub, pluginContext, sinks, logger, identity, runtimeRoot),\n\t\t\t),\n\t\t\t{ concurrency: 'unbounded', discard: true },\n\t\t);\n\t}).pipe(Effect.withSpan('lifecycle.supervisor.acquireKeys'));\n\nexport const acquireFullGraph = (\n\tgraph: ResolvedGraph,\n\tregistry: PluginRegistry,\n\tref: SubscriptionRef.SubscriptionRef<SubscribableState>,\n\thub: Queue.Enqueue<EngineEvent>,\n\tpluginContext: Context.Context<never>,\n\tsinks: CapabilitySinksShape,\n\tlogger: LoggerShape,\n\tidentity: Identity,\n\truntimeRoot: string,\n): Effect.Effect<void, never, never> =>\n\tEffect.gen(function* () {\n\t\tyield* annotateOp('acquireFullGraph');\n\t\tyield* acquireKeys(\n\t\t\tregistry,\n\t\t\t[...graph.nodes.keys()],\n\t\t\tref,\n\t\t\thub,\n\t\t\tpluginContext,\n\t\t\tsinks,\n\t\t\tlogger,\n\t\t\tidentity,\n\t\t\truntimeRoot,\n\t\t);\n\t}).pipe(Effect.withSpan('lifecycle.supervisor.acquireFullGraph'));\n"],"mappings":";;;;;;;;;;;;;;AA+CA,MAAa,iBACZ,OACA,aACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,0BAAU,IAAI,KAA6B;AACjD,MAAK,MAAM,CAAC,KAAK,SAAS,MAAM,OAAO;EACtC,MAAM,QAAQ,OAAO,UAAU,MAAM,YAAY;AACjD,UAAQ,IAAI,KAAK,MAAM;;AAExB,QAAO,aAAa,SAAS,KAAK;EACjC;;;;;;;;;;;;;;;;;;;;;AA0BH,MAAa,eACZ,UACA,KACA,KACA,KACA,eACA,OACA,QACA,UACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,QAAQ,SAAS,QAAQ,IAAI,IAAI;AACvC,KAAI,UAAU,KAAA,EAAW;AAYzB,MAAI,OAXiB,eAAe,UAAU,MAAM,KAAK,CAAC,KACzD,OAAO,YAAY;EAClB,YAAY,UACX,OAAO,IAAI,aAAa;AACvB,UAAO,WAAW,SAAS,WAAW,KAAK,MAAM,CAAC;AAClD,UAAO;IACN;EACH,iBAAiB,OAAO,QAAQ,KAAc;EAC9C,CAAC,CAE2B,MACnB,MAAM;AAChB,SAAO,OAAO,IAAI,cAAc,OAAO,KAAK;GAC3C,OAAO;GACP,SAAS;GACT,CAAC;AACF;;AAED,QAAO,cAAc,UAAU;AAC/B,QAAO,OAAO,IAAI,cAAc,OAAO,KAAK;EAC3C,OAAO;EACP,SAAS;EACT,QAAQ,EAAE,MAAM,MAAM,KAAK,OAAO,MAAM;EACxC,CAAC;AAcF,QAAO,OAAO,KAAK,SAAS,WAAW,KAAK,YAAY,CAAC;CACzD,MAAM,iBAAiB,yBAAyB,UAAU,MAAM,KAAK;CACrE,MAAM,OAAO,0BAA0B,MAAM,KAAK,QAAQ,eAAe;CAEzE,MAAM,QAAQ,MAAM,KAAK,OAAO;CAGhC,MAAM,uBAAuB,cAAc,KAC1C,QAAQ,IAAI,kBAAkB,EAAE,KAAK,CAAC,EACtC,QAAQ,IAAI,uBAAuB,EAClC,WAAW,UACV,QAAQ,KAAK,KAAK;EACjB,KAAK;EACL,WAAW;EACX;EACA,IAAI,KAAK,KAAK;EACd,CAAC,EACH,CAAC,CACF;CACD,MAAM,kBAAkB,OAAO,QAAQ,MAAM,KAAK,EAAE,qBAAqB;CAKzE,MAAM,SAAS,OAAO,MAAM,QAAQ,iBAAiB,MAAM,MAAM,CAAC,KACjE,OAAO,YAAY;EAClB,YAAY,UACX,OAAO,IAAI,aAAa;AACvB,UAAO,WAAW,SAAS,WAAW,KAAK,MAAM,CAAC;AAClD,UAAO,QAAQ,KAAK,KAAK;IACxB,KAAK;IACL,OAAO,sBAAsB,MAAM,KAAK,MAAM,EAAE;KAC/C,WAAW;KACX,UAAU;KACV,IAAI,KAAK,KAAK;KACd,CAAC;IACF,CAAC;AACF,UAAO,EAAE,IAAI,OAAgB;IAC5B;EACH,YAAY,UACX,OAAO,QAAQ;GAAE,IAAI;GAAsB;GAAkB,CAAC;EAC/D,CAAC,CACF;AACD,KAAI,OAAO,IAAI;EACd,MAAM,iBAAiC;GACtC;GACA,OAAO,SAAS;GAChB;GACA;EACD,MAAM,WAAW,OAAO,OAAO,KAC9B,oBACC,KACA,MAAM,KAAK,OAAO,cAIlB,OAAO,OACP,eACA,CACD;AACD,MAAI,KAAK,UAAU,SAAS,EAAE;AAC7B,UAAO,WAAW,SAAS,WAAW,KAAK,SAAS,MAAM,CAAC;AAC3D,UAAO,QAAQ,KAAK,KAAK;IACxB,KAAK;IACL,OAAO,sBAAsB,SAAS,OAAO;KAC5C,WAAW;KACX,UAAU;KACV,IAAI,KAAK,KAAK;KACd,CAAC;IACF,CAAC;AACF,UAAO,OAAO,IAAI,cAAc,OAAO,KAAK;IAC3C,OAAO;IACP,SAAS;IACT,CAAC;AACF;;EAED,MAAM,OAAO,SAAS;EACtB,MAAM,qBAAqB,MAAM,KAAK,OAAO,sBAAsB,EAAE;AACrE,MAAI,KAAK,SAAS,KAAK,mBAAmB,SAAS,GAAG;GACrD,MAAM,eAAe,OAAO,OAAO,KAClC,sBACC,KACA,MACA,oBACA,MAAM,KAAK,OAAO,MAClB,UACA,eACA,MAAM,OACN,OACA,KACA,IACA,CACD;AACD,OAAI,KAAK,UAAU,aAAa,EAAE;AAOjC,WAAO,WAAW,SAAS,WAAW,KAAK,aAAa,MAAM,CAAC;AAC/D,WAAO,QAAQ,KAAK,KAAK;KACxB,KAAK;KACL,OAAO,sBAAsB,aAAa,OAAO;MAChD,WAAW;MACX,UAAU;MACV,IAAI,KAAK,KAAK;MACd,CAAC;KACF,CAAC;AACF,WAAO,OAAO,IAAI,cAAc,OAAO,KAAK;KAC3C,OAAO;KACP,SAAS;KACT,CAAC;AACF;;;EAGF,MAAM,mBAAmB,KAAK,MAAM,eAAe,WAAW,SAAS,WAAW;AAClF,OAAK,MAAM,SAAS,2CACnB,KACA,OAAO,OACP,KAAK,KAAK,EACV,EACC,kBACA,CACD,CACA,QAAO,QAAQ,KAAK,KAAK,MAAM;AAEhC,SAAO,QAAQ,KAAK,KAAK;GACxB,KAAK;GACL,WAAW;GACX,OAAO;GACP,IAAI,KAAK,KAAK;GACd,CAAC;AACF,SAAO,WAAW,SAAS,UAAU,KAAK,OAAO,MAAM,CAAC;AACxD,MAAI,MAAM,KAAK,OAAO,SAAS,OAC9B,QAAO,WAAW,SAAS,WAAW,KAAK,OAAO,CAAC;AAEpD,SAAO,OAAO,IAAI,cAAc,OAAO,KAAK;GAC3C,OAAO;GACP,SAAS,MAAM,KAAK,OAAO,SAAS,SAAS,gBAAgB;GAC7D,QAAQ;IACP,cAAc,KAAK;IACnB,oBAAoB,mBAAmB;IACvC;GACD,CAAC;OAEF,QAAO,OAAO,IAAI,cAAc,OAAO,KAAK;EAC3C,OAAO;EACP,SAAS;EACT,CAAC;EAEF,CAAC,KACF,eAAe,oCAAoC;CAClD,KAAK,SAAS;CACd,OAAO,SAAS;CAChB,SAAS,SAAS;CAClB,WAAW;CACX,MAAM,SAAS,QAAQ,IAAI,IAAI,EAAE,KAAK,OAAO,QAAQ;CACrD,CAAC,CACF;AAQF,MAAa,eACZ,UACA,MACA,KACA,KACA,eACA,OACA,QACA,UACA,gBAEA,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,oBAAoB,EAAE,uBAAuB,KAAK,QAAQ,CAAC;AACzE,QAAO,OAAO,IACb,KAAK,KAAK,QACT,YAAY,UAAU,KAAK,KAAK,KAAK,eAAe,OAAO,QAAQ,UAAU,YAAY,CACzF,EACD;EAAE,aAAa;EAAa,SAAS;EAAM,CAC3C;EACA,CAAC,KAAK,OAAO,SAAS,mCAAmC,CAAC;AAE7D,MAAa,oBACZ,OACA,UACA,KACA,KACA,eACA,OACA,QACA,UACA,gBAEA,OAAO,IAAI,aAAa;AACvB,QAAO,WAAW,mBAAmB;AACrC,QAAO,YACN,UACA,CAAC,GAAG,MAAM,MAAM,MAAM,CAAC,EACvB,KACA,KACA,eACA,OACA,QACA,UACA,YACA;EACA,CAAC,KAAK,OAAO,SAAS,wCAAwC,CAAC"}