@mysten-incubation/devstack 0.0.1 → 0.1.1

package/dist/plugins/dashboard/index.mjs

@@ -0,0 +1,91 @@
+import { definePlugin, resource } from "../../substrate/plugin.mjs";
+import "../../api/define-plugin.mjs";
+import { IdentityContext } from "../../substrate/runtime/paths.mjs";
+import { ControlPlaneService } from "../../substrate/runtime/control-plane/service.mjs";
+import { ContainerRuntimeService } from "../../runtime/docker/service.mjs";
+import { StrategyRegistryService } from "../../substrate/runtime/strategy-registry/service.mjs";
+import { PortBrokerService } from "../../substrate/runtime/port-broker/service.mjs";
+import "../../substrate/runtime/port-broker/index.mjs";
+import "../../substrate/runtime/strategy-registry/index.mjs";
+import { renderUrl, routedHostname } from "../../substrate/runtime/routed-url.mjs";
+import { DASHBOARD_ENTRYPOINT_PORT, makeDashboardRoutable } from "./routable.mjs";
+import { listenScopedHttpServer } from "../../substrate/runtime/scoped-http-server.mjs";
+import { buildDashboardDomain } from "./domain.mjs";
+import { resolveOriginPolicy } from "./origin-policy.mjs";
+import { makeDashboardListener } from "./server.mjs";
+import { Effect } from "effect";
+//#region src/plugins/dashboard/index.ts
+const dashboardResource = resource("dashboard");
+const DASHBOARD_DEFAULT_BIND = "0.0.0.0";
+/** Construct the devstack dashboard plugin. */
+function dashboard(opts = {}) {
+	return definePlugin({
+		id: dashboardResource.id,
+		role: "service",
+		section: "service",
+		start: () => Effect.gen(function* () {
+			const portBroker = yield* PortBrokerService;
+			const control = yield* ControlPlaneService;
+			const identity = yield* IdentityContext;
+			const containerRuntimeOpt = yield* Effect.serviceOption(ContainerRuntimeService);
+			const containerRuntime = containerRuntimeOpt._tag === "Some" ? containerRuntimeOpt.value : null;
+			const strategyRegistryOpt = yield* Effect.serviceOption(StrategyRegistryService);
+			const strategyRegistry = strategyRegistryOpt._tag === "Some" ? strategyRegistryOpt.value : null;
+			const pluginDomain = buildDashboardDomain({
+				control: control.domain,
+				identity,
+				containerRuntime,
+				strategyRegistry
+			});
+			const bindAddress = opts.bindAddress ?? DASHBOARD_DEFAULT_BIND;
+			const allocated = yield* portBroker.allocate({
+				owner: "dashboard",
+				windowHint: {
+					start: 39300,
+					size: 1e3
+				},
+				probeHost: bindAddress === "0.0.0.0" ? "0.0.0.0" : "127.0.0.1",
+				...opts.port === void 0 ? {} : { preferredPort: opts.port }
+			});
+			const routedDashboardOrigin = yield* routedHostname(identity, "api").pipe(Effect.map((hostname) => renderUrl({
+				protocol: "http",
+				hostname,
+				port: DASHBOARD_ENTRYPOINT_PORT
+			})), Effect.orElseSucceed(() => null));
+			const directOrigins = [`http://127.0.0.1:${allocated.port}`, `http://localhost:${allocated.port}`];
+			const originPolicy = yield* resolveOriginPolicy({
+				app: identity.app,
+				stack: identity.stack,
+				routedDashboardOrigin,
+				directOrigins,
+				extraOrigins: opts.allowedOrigins ?? []
+			});
+			return {
+				url: (yield* listenScopedHttpServer({
+					bindAddress,
+					port: allocated.port,
+					listener: makeDashboardListener({
+						originPolicy,
+						context: {
+							state: control.state,
+							publishCommand: control.publishCommand,
+							domain: control.domain,
+							pluginDomain
+						}
+					}),
+					onListenError: (cause) => /* @__PURE__ */ new Error(`dashboard HTTP server listen failed on ${bindAddress}:${allocated.port}: ${String(cause)}`)
+				})).url,
+				localPort: allocated.port
+			};
+		}),
+		capabilities: ({ value, runtime }) => [makeDashboardRoutable({
+			app: runtime.identity.app,
+			stack: runtime.identity.stack,
+			port: value.localPort
+		})]
+	});
+}
+//#endregion
+export { dashboard };
+
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/dashboard/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/dashboard/index.ts"],"sourcesContent":["// Dashboard plugin.\n//\n// Runs an in-process GraphQL server (Pothos schema + graphql-yoga) that\n// exposes the live projection, control commands, and the projection\n// subscription. Modeled on the `wallet` plugin: allocate a loopback port\n// from the port broker, start a scoped HTTP server, and contribute a\n// Routable so the router fronts it under `dashboard.<app>.<stack>.localhost`.\n//\n// Data access is pure control plane: the projection (`state`) and command\n// publisher (`publishCommand`) come from `ControlPlaneService`, handed to\n// the server as the GraphQL context.\n\nimport { Effect } from 'effect';\nimport { type AnyPlugin, definePlugin, resource } from '../../api/define-plugin.ts';\nimport { ContainerRuntimeService } from '../../runtime/docker/service.ts';\nimport type { ContainerRuntime } from '../../contracts/container-runtime.ts';\nimport type { StrategyRegistry } from '../../contracts/strategy-contributor.ts';\nimport { StrategyRegistryService } from '../../substrate/runtime/strategy-registry/index.ts';\nimport { ControlPlaneService } from '../../substrate/runtime/control-plane/service.ts';\nimport { IdentityContext } from '../../substrate/runtime/paths.ts';\nimport { PortBrokerService } from '../../substrate/runtime/port-broker/index.ts';\nimport { renderUrl, routedHostname } from '../../substrate/runtime/routed-url.ts';\nimport { listenScopedHttpServer } from '../../substrate/runtime/scoped-http-server.ts';\nimport { buildDashboardDomain } from './domain.ts';\nimport { resolveOriginPolicy } from './origin-policy.ts';\nimport {\n\tDASHBOARD_ENTRYPOINT_PORT,\n\tDASHBOARD_ROUTE_ROLE,\n\tmakeDashboardRoutable,\n} from './routable.ts';\nimport { makeDashboardListener } from './server.ts';\n\nexport interface DashboardOptions {\n\t/** Preferred loopback port; the broker forward-scans if it's busy. */\n\treadonly port?: number;\n\t/** NIC the HTTP server binds. Defaults to `'0.0.0.0'` because the router\n\t *  runs in Docker and must reach this host process through the host-gateway\n\t *  address on native Linux (a `127.0.0.1`-only listener is unreachable from\n\t *  the host-gateway IP). The public dashboard URL stays router-fronted and\n\t *  stack-scoped. */\n\treadonly bindAddress?: string;\n\t/** Extra origins merged on top of the dashboard's own router-fronted origin\n\t *  for this stack (and the direct loopback origins). Useful for headless\n\t *  test runners and custom dev hosts. The dashboard does NOT auto-allowlist\n\t *  a bare `*.localhost` form — that is not stack-scoped, so a sibling stack\n\t *  could drive the destructive control-plane mutations cross-origin. */\n\treadonly allowedOrigins?: ReadonlyArray<string>;\n\t// Note on log retention: the queryable cross-service log store the\n\t// dashboard reads is process-scoped and owned by the SUPERVISOR (not this\n\t// plugin), so its capacity is configured there. Tune it with the\n\t// `DEVSTACK_DASHBOARD_LOG_CAPACITY` (per-service record cap, default 2000)\n\t// and `DEVSTACK_DASHBOARD_LOG_MAX_SERVICES` (distinct-ring cap, default\n\t// 256) env vars, or programmatically via `SupervisorStartupOptions.logStore`.\n\t// See substrate/runtime/observability/log-store.ts.\n}\n\nexport interface DashboardValue {\n\t/** Loopback URL of the dashboard server. */\n\treadonly url: string;\n\t/** The allocated loopback port. */\n\treadonly localPort: number;\n}\n\nconst dashboardResource = resource<'dashboard', DashboardValue>('dashboard');\n// `0.0.0.0`: the router runs in Docker, so on native Linux it reaches this\n// host process through the Docker host-gateway address instead of host\n// loopback — a `127.0.0.1`-only listener is unreachable from that IP, which\n// produced a 502 from Traefik and the `RouteReadinessProbeFailed` WARN. The\n// published dashboard URL remains stack-scoped through the router. Mirrors\n// `WALLET_DEFAULT_BIND_ADDRESS`.\nconst DASHBOARD_DEFAULT_BIND = '0.0.0.0';\n\n/** Construct the devstack dashboard plugin. */\nexport function dashboard(opts: DashboardOptions = {}): AnyPlugin {\n\treturn definePlugin({\n\t\tid: dashboardResource.id,\n\t\trole: 'service',\n\t\tsection: 'service',\n\t\tstart: () =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst portBroker = yield* PortBrokerService;\n\t\t\t\tconst control = yield* ControlPlaneService;\n\t\t\t\tconst identity = yield* IdentityContext;\n\t\t\t\t// The ContainerRuntime drives the Postgres `psql` exec-probe.\n\t\t\t\t// It is in the base substrate plugin context in production\n\t\t\t\t// wiring; read it optionally so bare smoke-test paths that\n\t\t\t\t// don't layer it degrade `postgresStats` to unavailable\n\t\t\t\t// rather than failing acquisition.\n\t\t\t\tconst containerRuntimeOpt = yield* Effect.serviceOption(ContainerRuntimeService);\n\t\t\t\tconst containerRuntime: ContainerRuntime | null =\n\t\t\t\t\tcontainerRuntimeOpt._tag === 'Some' ? containerRuntimeOpt.value : null;\n\n\t\t\t\t// The scope-local strategy registry — the SAME registry the\n\t\t\t\t// boot-time account funding pass dispatches through. Drives the\n\t\t\t\t// Faucet panel's `fundableCoins` + `fundAccount` (SUI via the\n\t\t\t\t// faucet strategy, WAL/DEEP via the coin-specific funding\n\t\t\t\t// strategies). Read optionally so bare smoke-test paths that don't\n\t\t\t\t// layer it degrade the fund accessors to unavailable.\n\t\t\t\tconst strategyRegistryOpt = yield* Effect.serviceOption(StrategyRegistryService);\n\t\t\t\tconst strategyRegistry: StrategyRegistry | null =\n\t\t\t\t\tstrategyRegistryOpt._tag === 'Some' ? strategyRegistryOpt.value : null;\n\n\t\t\t\t// Plugin-name-aware shaping lives HERE (the plugin layer is\n\t\t\t\t// allowed to name plugins), built off the generic, name-blind\n\t\t\t\t// control-plane `resolvedValues` seam + the container runtime.\n\t\t\t\tconst pluginDomain = buildDashboardDomain({\n\t\t\t\t\tcontrol: control.domain,\n\t\t\t\t\tidentity,\n\t\t\t\t\tcontainerRuntime,\n\t\t\t\t\tstrategyRegistry,\n\t\t\t\t});\n\n\t\t\t\tconst bindAddress = opts.bindAddress ?? DASHBOARD_DEFAULT_BIND;\n\t\t\t\tconst allocated = yield* portBroker.allocate({\n\t\t\t\t\towner: 'dashboard',\n\t\t\t\t\twindowHint: { start: 39300, size: 1000 },\n\t\t\t\t\tprobeHost: bindAddress === '0.0.0.0' ? '0.0.0.0' : '127.0.0.1',\n\t\t\t\t\t...(opts.port === undefined ? {} : { preferredPort: opts.port }),\n\t\t\t\t});\n\n\t\t\t\t// Derive the dashboard's OWN router-fronted origin for this stack.\n\t\t\t\t// The bundled SPA is served same-origin from this hostname, so the\n\t\t\t\t// browser's `Origin` on `/graphql` is exactly this value — it MUST\n\t\t\t\t// be in the allowlist. Host = `<role:api>.<app>.<stack>.localhost`\n\t\t\t\t// (per `routedHostname`), port = the router entrypoint port (9810),\n\t\t\t\t// which is the port the browser actually uses, NOT the broker\n\t\t\t\t// loopback port. Router-derivation failure → `null` (allowlist still\n\t\t\t\t// includes the direct loopback + caller origins).\n\t\t\t\tconst routedDashboardOrigin = yield* routedHostname(identity, DASHBOARD_ROUTE_ROLE).pipe(\n\t\t\t\t\tEffect.map((hostname) =>\n\t\t\t\t\t\trenderUrl({ protocol: 'http', hostname, port: DASHBOARD_ENTRYPOINT_PORT }),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.orElseSucceed(() => null),\n\t\t\t\t);\n\n\t\t\t\t// Direct loopback origins: when the dashboard is reached on the raw\n\t\t\t\t// broker port (host-loopback fallback / direct tooling) the SPA's\n\t\t\t\t// same-origin `Origin` is the loopback form. Both 127.0.0.1 and\n\t\t\t\t// localhost name the same listener; allow both for this stack's port.\n\t\t\t\tconst directOrigins = [\n\t\t\t\t\t`http://127.0.0.1:${allocated.port}`,\n\t\t\t\t\t`http://localhost:${allocated.port}`,\n\t\t\t\t];\n\n\t\t\t\tconst originPolicy = yield* resolveOriginPolicy({\n\t\t\t\t\tapp: identity.app,\n\t\t\t\t\tstack: identity.stack,\n\t\t\t\t\troutedDashboardOrigin,\n\t\t\t\t\tdirectOrigins,\n\t\t\t\t\textraOrigins: opts.allowedOrigins ?? [],\n\t\t\t\t});\n\n\t\t\t\tconst server = yield* listenScopedHttpServer({\n\t\t\t\t\tbindAddress,\n\t\t\t\t\tport: allocated.port,\n\t\t\t\t\tlistener: makeDashboardListener({\n\t\t\t\t\t\toriginPolicy,\n\t\t\t\t\t\tcontext: {\n\t\t\t\t\t\t\tstate: control.state,\n\t\t\t\t\t\t\tpublishCommand: control.publishCommand,\n\t\t\t\t\t\t\tdomain: control.domain,\n\t\t\t\t\t\t\tpluginDomain,\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t\tonListenError: (cause) =>\n\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t`dashboard HTTP server listen failed on ${bindAddress}:${allocated.port}: ${String(cause)}`,\n\t\t\t\t\t\t),\n\t\t\t\t});\n\n\t\t\t\treturn { url: server.url, localPort: allocated.port } satisfies DashboardValue;\n\t\t\t}),\n\t\tcapabilities: ({ value, runtime }) => [\n\t\t\tmakeDashboardRoutable({\n\t\t\t\tapp: runtime.identity.app,\n\t\t\t\tstack: runtime.identity.stack,\n\t\t\t\tport: value.localPort,\n\t\t\t}),\n\t\t],\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA+DA,MAAM,oBAAoB,SAAsC,YAAY;AAO5E,MAAM,yBAAyB;;AAG/B,SAAgB,UAAU,OAAyB,EAAE,EAAa;AACjE,QAAO,aAAa;EACnB,IAAI,kBAAkB;EACtB,MAAM;EACN,SAAS;EACT,aACC,OAAO,IAAI,aAAa;GACvB,MAAM,aAAa,OAAO;GAC1B,MAAM,UAAU,OAAO;GACvB,MAAM,WAAW,OAAO;GAMxB,MAAM,sBAAsB,OAAO,OAAO,cAAc,wBAAwB;GAChF,MAAM,mBACL,oBAAoB,SAAS,SAAS,oBAAoB,QAAQ;GAQnE,MAAM,sBAAsB,OAAO,OAAO,cAAc,wBAAwB;GAChF,MAAM,mBACL,oBAAoB,SAAS,SAAS,oBAAoB,QAAQ;GAKnE,MAAM,eAAe,qBAAqB;IACzC,SAAS,QAAQ;IACjB;IACA;IACA;IACA,CAAC;GAEF,MAAM,cAAc,KAAK,eAAe;GACxC,MAAM,YAAY,OAAO,WAAW,SAAS;IAC5C,OAAO;IACP,YAAY;KAAE,OAAO;KAAO,MAAM;KAAM;IACxC,WAAW,gBAAgB,YAAY,YAAY;IACnD,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,GAAG,EAAE,eAAe,KAAK,MAAM;IAC/D,CAAC;GAUF,MAAM,wBAAwB,OAAO,eAAe,UAAA,MAA+B,CAAC,KACnF,OAAO,KAAK,aACX,UAAU;IAAE,UAAU;IAAQ;IAAU,MAAM;IAA2B,CAAC,CAC1E,EACD,OAAO,oBAAoB,KAAK,CAChC;GAMD,MAAM,gBAAgB,CACrB,oBAAoB,UAAU,QAC9B,oBAAoB,UAAU,OAC9B;GAED,MAAM,eAAe,OAAO,oBAAoB;IAC/C,KAAK,SAAS;IACd,OAAO,SAAS;IAChB;IACA;IACA,cAAc,KAAK,kBAAkB,EAAE;IACvC,CAAC;AAoBF,UAAO;IAAE,MAAK,OAlBQ,uBAAuB;KAC5C;KACA,MAAM,UAAU;KAChB,UAAU,sBAAsB;MAC/B;MACA,SAAS;OACR,OAAO,QAAQ;OACf,gBAAgB,QAAQ;OACxB,QAAQ,QAAQ;OAChB;OACA;MACD,CAAC;KACF,gBAAgB,0BACf,IAAI,MACH,0CAA0C,YAAY,GAAG,UAAU,KAAK,IAAI,OAAO,MAAM,GACzF;KACF,CAAC,EAEmB;IAAK,WAAW,UAAU;IAAM;IACpD;EACH,eAAe,EAAE,OAAO,cAAc,CACrC,sBAAsB;GACrB,KAAK,QAAQ,SAAS;GACtB,OAAO,QAAQ,SAAS;GACxB,MAAM,MAAM;GACZ,CAAC,CACF;EACD,CAAC"}

package/dist/plugins/dashboard/origin-policy.mjs

@@ -0,0 +1,36 @@
+import { SpanAttr } from "../../substrate/runtime/observability/spans.mjs";
+import { Effect } from "effect";
+//#region src/plugins/dashboard/origin-policy.ts
+/**
+* Resolve the per-stack origin allowlist.
+*
+*  - Always allowlisted: the dashboard's router-fronted origin for this
+*    stack (`routedDashboardOrigin`), when the router derivation produced
+*    one — this is the same-origin the bundled SPA loads from.
+*  - Always allowlisted: the direct loopback origins + any explicit
+*    caller-supplied `extraOrigins`.
+*
+* Empty-allowlist policy: allowed. The dashboard boots normally; with an
+* empty allowlist the per-request gate refuses every cross-origin request
+* (every Origin lands in `forbidden`). A `logWarning` surfaces the
+* configuration for operator visibility.
+*/
+const resolveOriginPolicy = (inputs) => Effect.gen(function* () {
+	const allowed = /* @__PURE__ */ new Set();
+	if (inputs.routedDashboardOrigin !== null) allowed.add(inputs.routedDashboardOrigin);
+	for (const o of inputs.directOrigins) allowed.add(o);
+	for (const o of inputs.extraOrigins) allowed.add(o);
+	if (allowed.size === 0) yield* Effect.logWarning("dashboard origin allowlist is empty").pipe(Effect.annotateLogs({
+		[SpanAttr.app]: inputs.app,
+		[SpanAttr.stack]: inputs.stack
+	}));
+	return { allowed };
+});
+const checkOrigin = (policy, headerValue) => {
+	if (headerValue === void 0 || headerValue === null || headerValue.length === 0) return "missing";
+	return policy.allowed.has(headerValue) ? "ok" : "forbidden";
+};
+//#endregion
+export { checkOrigin, resolveOriginPolicy };
+
+//# sourceMappingURL=origin-policy.mjs.map

package/dist/plugins/dashboard/origin-policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-policy.mjs","names":[],"sources":["../../../src/plugins/dashboard/origin-policy.ts"],"sourcesContent":["// Dashboard plugin — CORS / origin allowlist policy.\n//\n// This MIRRORS the wallet's `plugins/wallet/origin-policy.ts` pattern\n// (stack-scoped allowlist, `resolveOriginPolicy` / `checkOrigin`) rather\n// than importing it, to avoid coupling dashboard→wallet. The two policies\n// are intentionally small and self-contained; the wallet copy carries\n// bearer-specific history that does not apply here.\n//\n// The allowed set is built from real, substrate-wired sources:\n//\n//   - the dashboard's OWN router-fronted origin for THIS stack\n//     (`routedDashboardOrigin`) — the SPA is served same-origin from this\n//     hostname, so the browser's `Origin` on `/graphql` IS this value;\n//   - the direct loopback origin(s) the bundled SPA might be loaded from\n//     when reached on the raw broker port (`directOrigins`);\n//   - any explicit caller-supplied origins (`extraOrigins` →\n//     `DashboardOptions.allowedOrigins`).\n//\n// We deliberately do NOT auto-allow a bare `*.localhost` / `localhost:<port>`\n// form: `localhost` is not stack-scoped, so a sibling stack on the same\n// port could drive the destructive control-plane mutations cross-origin.\n\nimport { Effect } from 'effect';\n\nimport { SpanAttr } from '../../substrate/runtime/observability/spans.ts';\n\n/** Result of resolving the origin allowlist at boot. Captured into the\n *  server closure so per-request checks are pure string comparison. */\nexport interface OriginPolicy {\n\treadonly allowed: ReadonlySet<string>;\n}\n\n/** Per-stack inputs the policy resolver needs. Supplied by the plugin at\n *  start time (identity + routed-url derivation); this module does not\n *  reach into the broker or router itself. */\nexport interface OriginPolicyInputs {\n\treadonly app: string;\n\treadonly stack: string;\n\t/** The dashboard's router-fronted origin for this stack\n\t *  (`http://api.<app>.<stack>.localhost:<entrypoint-port>`). `null`\n\t *  only in tests that bypass the router derivation. */\n\treadonly routedDashboardOrigin: string | null;\n\t/** Direct loopback origins the SPA may be loaded from when reached on\n\t *  the raw broker port (host-loopback fallback / direct tooling). */\n\treadonly directOrigins: ReadonlyArray<string>;\n\t/** Explicit caller-supplied origins (`DashboardOptions.allowedOrigins`). */\n\treadonly extraOrigins: ReadonlyArray<string>;\n}\n\n/**\n * Resolve the per-stack origin allowlist.\n *\n *  - Always allowlisted: the dashboard's router-fronted origin for this\n *    stack (`routedDashboardOrigin`), when the router derivation produced\n *    one — this is the same-origin the bundled SPA loads from.\n *  - Always allowlisted: the direct loopback origins + any explicit\n *    caller-supplied `extraOrigins`.\n *\n * Empty-allowlist policy: allowed. The dashboard boots normally; with an\n * empty allowlist the per-request gate refuses every cross-origin request\n * (every Origin lands in `forbidden`). A `logWarning` surfaces the\n * configuration for operator visibility.\n */\nexport const resolveOriginPolicy = (inputs: OriginPolicyInputs): Effect.Effect<OriginPolicy> =>\n\tEffect.gen(function* () {\n\t\tconst allowed = new Set<string>();\n\n\t\tif (inputs.routedDashboardOrigin !== null) {\n\t\t\tallowed.add(inputs.routedDashboardOrigin);\n\t\t}\n\t\tfor (const o of inputs.directOrigins) {\n\t\t\tallowed.add(o);\n\t\t}\n\t\tfor (const o of inputs.extraOrigins) {\n\t\t\tallowed.add(o);\n\t\t}\n\n\t\tif (allowed.size === 0) {\n\t\t\tyield* Effect.logWarning('dashboard origin allowlist is empty').pipe(\n\t\t\t\tEffect.annotateLogs({\n\t\t\t\t\t[SpanAttr.app]: inputs.app,\n\t\t\t\t\t[SpanAttr.stack]: inputs.stack,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn { allowed } satisfies OriginPolicy;\n\t});\n\n/** Per-request origin gate. Returns `'missing'` for absent Origin,\n *  `'forbidden'` for an Origin not in the allowlist, `'ok'` for accepted.\n *\n *  `'missing'` is its OWN shape: a request with no Origin (server-side\n *  tooling, the route-readiness probe, curl) is NOT a cross-origin browser\n *  request, so CORS does not govern it — the caller emits a normal response\n *  with no `Access-Control-Allow-Origin` header. */\nexport type OriginCheckResult = 'missing' | 'forbidden' | 'ok';\n\nexport const checkOrigin = (\n\tpolicy: OriginPolicy,\n\theaderValue: string | null | undefined,\n): OriginCheckResult => {\n\tif (headerValue === undefined || headerValue === null || headerValue.length === 0) {\n\t\treturn 'missing';\n\t}\n\treturn policy.allowed.has(headerValue) ? 'ok' : 'forbidden';\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AA+DA,MAAa,uBAAuB,WACnC,OAAO,IAAI,aAAa;CACvB,MAAM,0BAAU,IAAI,KAAa;AAEjC,KAAI,OAAO,0BAA0B,KACpC,SAAQ,IAAI,OAAO,sBAAsB;AAE1C,MAAK,MAAM,KAAK,OAAO,cACtB,SAAQ,IAAI,EAAE;AAEf,MAAK,MAAM,KAAK,OAAO,aACtB,SAAQ,IAAI,EAAE;AAGf,KAAI,QAAQ,SAAS,EACpB,QAAO,OAAO,WAAW,sCAAsC,CAAC,KAC/D,OAAO,aAAa;GAClB,SAAS,MAAM,OAAO;GACtB,SAAS,QAAQ,OAAO;EACzB,CAAC,CACF;AAGF,QAAO,EAAE,SAAS;EACjB;AAWH,MAAa,eACZ,QACA,gBACuB;AACvB,KAAI,gBAAgB,KAAA,KAAa,gBAAgB,QAAQ,YAAY,WAAW,EAC/E,QAAO;AAER,QAAO,OAAO,QAAQ,IAAI,YAAY,GAAG,OAAO"}

package/dist/plugins/dashboard/routable.mjs

@@ -0,0 +1,27 @@
+//#region src/plugins/dashboard/routable.ts
+const DASHBOARD_ENDPOINT_NAME = "dashboard";
+const DASHBOARD_ENTRYPOINT_PORT = 9810;
+const DASHBOARD_ENTRYPOINTS = [{
+	name: DASHBOARD_ENDPOINT_NAME,
+	port: DASHBOARD_ENTRYPOINT_PORT,
+	protocol: "http"
+}];
+/** Construct the Routable decl for the stack-scoped dashboard endpoint. */
+const makeDashboardRoutable = (parts) => ({
+	kind: "routable",
+	endpointName: DASHBOARD_ENDPOINT_NAME,
+	dispatchId: {
+		serviceKey: `dashboard.${parts.app}.${parts.stack}`,
+		role: "api"
+	},
+	upstream: {
+		type: "host-loopback",
+		port: parts.port
+	},
+	cors: false,
+	wireProtocol: "http"
+});
+//#endregion
+export { DASHBOARD_ENTRYPOINTS, DASHBOARD_ENTRYPOINT_PORT, makeDashboardRoutable };
+
+//# sourceMappingURL=routable.mjs.map

package/dist/plugins/dashboard/routable.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"routable.mjs","names":[],"sources":["../../../src/plugins/dashboard/routable.ts"],"sourcesContent":["// Dashboard plugin — Routable contribution.\n//\n// The dashboard's HTTP/GraphQL server is a host process (not a docker\n// container) listening on a loopback port the substrate's port broker\n// hands us. The router (Traefik) fronts the loopback port under a\n// stack-scoped hostname like `dashboard.<app>.localhost:<router-port>`.\n//\n// Mirrors `plugins/wallet/routable.ts`. The entrypoint declared here must\n// be aggregated into `plugins/router-entrypoints.ts` so Traefik opens the\n// listener port.\n\nimport type { EntrypointDecl, RoutableDecl } from '../../contracts/routable.ts';\n\nexport const DASHBOARD_ENDPOINT_NAME = 'dashboard';\nexport const DASHBOARD_ROUTE_ROLE = 'api' as const;\nexport const DASHBOARD_ENTRYPOINT_PORT = 9810;\n\nexport const DASHBOARD_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t{ name: DASHBOARD_ENDPOINT_NAME, port: DASHBOARD_ENTRYPOINT_PORT, protocol: 'http' },\n];\n\n/** Construct the Routable decl for the stack-scoped dashboard endpoint. */\nexport const makeDashboardRoutable = (parts: {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly port: number;\n}): RoutableDecl => ({\n\tkind: 'routable',\n\tendpointName: DASHBOARD_ENDPOINT_NAME,\n\tdispatchId: {\n\t\tserviceKey: `dashboard.${parts.app}.${parts.stack}`,\n\t\trole: DASHBOARD_ROUTE_ROLE,\n\t},\n\tupstream: { type: 'host-loopback', port: parts.port },\n\t// CORS is owned by the dashboard server itself (`server.ts` `corsOptionsFor`\n\t// + `origin-policy.ts`): a STACK-SCOPED origin allowlist (this dashboard's\n\t// own router-fronted origin + direct loopback origins + caller-supplied\n\t// `allowedOrigins`) that guards the destructive control-plane mutations and\n\t// closes the cross-stack `*.localhost` hole. We deliberately do NOT attach\n\t// the shared `devstack-cors` Traefik middleware here — that middleware is\n\t// permissive (`*` allow-origin, allow-credentials) and, when the dashboard\n\t// is reached via the router hostname, would overwrite the server's allowlist\n\t// headers and re-open the cross-origin hole. `false` keeps the in-process\n\t// policy authoritative on both the direct loopback port and the router-\n\t// fronted hostname.\n\t//\n\t// The upstream host process binds `0.0.0.0` (see `DASHBOARD_DEFAULT_BIND` in\n\t// `index.ts`) so the Docker-hosted router reaches it via the host-gateway IP\n\t// on native Linux — a `127.0.0.1`-only listener would 502 and trip the route\n\t// readiness probe.\n\tcors: false,\n\twireProtocol: 'http',\n});\n"],"mappings":";AAaA,MAAa,0BAA0B;AAEvC,MAAa,4BAA4B;AAEzC,MAAa,wBAAuD,CACnE;CAAE,MAAM;CAAyB,MAAM;CAA2B,UAAU;CAAQ,CACpF;;AAGD,MAAa,yBAAyB,WAIjB;CACpB,MAAM;CACN,cAAc;CACd,YAAY;EACX,YAAY,aAAa,MAAM,IAAI,GAAG,MAAM;EAC5C,MAAA;EACA;CACD,UAAU;EAAE,MAAM;EAAiB,MAAM,MAAM;EAAM;CAiBrD,MAAM;CACN,cAAc;CACd"}

package/dist/plugins/dashboard/schema/builder.mjs

@@ -0,0 +1,21 @@
+import SchemaBuilder from "@pothos/core";
+import RelayPlugin from "@pothos/plugin-relay";
+import SimpleObjectsPlugin from "@pothos/plugin-simple-objects";
+import WithInputPlugin from "@pothos/plugin-with-input";
+//#region src/plugins/dashboard/schema/builder.ts
+/** The single module-level builder. Object types, enums, and root types are
+*  defined against this instance across the sibling `schema/*` modules; the
+*  built schema is `dashboardSchema` (see `../schema.ts`). */
+const builder = new SchemaBuilder({
+	plugins: [
+		SimpleObjectsPlugin,
+		RelayPlugin,
+		WithInputPlugin
+	],
+	relay: {},
+	defaultFieldNullability: false
+});
+//#endregion
+export { builder };
+
+//# sourceMappingURL=builder.mjs.map

package/dist/plugins/dashboard/schema/builder.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.mjs","names":[],"sources":["../../../../src/plugins/dashboard/schema/builder.ts"],"sourcesContent":["// Dashboard Pothos `SchemaBuilder` — the single module-level instance.\n//\n// One typed schema covers the control plane: the live projection (`state`),\n// relay node/connection access over the snapshot arrays, control mutations,\n// and the projection subscription. The builder is parameterized with the\n// relay, simple-objects, and with-input plugins (Pothos v4 defaults).\n//\n// Dependencies (the `state` ref + a `publishCommand`) are supplied per\n// request through the GraphQL context (`DashboardContext`), so the schema is\n// a single module-level value with no per-instance closure state. Resolvers\n// read deps from the 3rd resolver argument.\n\nimport SchemaBuilder from '@pothos/core';\nimport RelayPlugin from '@pothos/plugin-relay';\nimport SimpleObjectsPlugin from '@pothos/plugin-simple-objects';\nimport WithInputPlugin from '@pothos/plugin-with-input';\nimport type { Effect, SubscriptionRef } from 'effect';\nimport type { EngineCommand } from '../../../substrate/events.ts';\nimport type { SubscribableState } from '../../../substrate/projection.ts';\nimport type { ControlPlaneDomain } from '../../../substrate/runtime/control-plane/service.ts';\nimport type { DashboardDomain } from '../domain.ts';\n\n/** Per-request GraphQL context for the dashboard control plane. Resolvers\n *  read the live projection ref, the command publisher, and the\n *  plugin-domain accessor surfaces from here (3rd resolver arg), so the\n *  schema carries no closed-over state. */\nexport interface DashboardContext {\n\treadonly state: SubscriptionRef.SubscriptionRef<SubscribableState>;\n\treadonly publishCommand: (command: EngineCommand) => Effect.Effect<void>;\n\t/** Generic, name-blind control-plane accessors: snapshot catalog +\n\t *  restore/delete, the observability rings, and the resolved-values\n\t *  seam. (Plugin-name-aware shaping lives in `pluginDomain`.) */\n\treadonly domain: ControlPlaneDomain;\n\t/** Plugin-name-aware accessors the dashboard plugin shapes from the\n\t *  generic control-plane `resolvedValues`: fork-vs-local mode,\n\t *  deepbook/seal/coin capability ids, postgres wire-protocol stats,\n\t *  and the coin mint action. */\n\treadonly pluginDomain: DashboardDomain;\n}\n\ninterface SchemaTypes {\n\tContext: DashboardContext;\n\t// Output fields are non-nullable unless a resolver opts in with\n\t// `nullable: true` — the projection always resolves a concrete value.\n\tDefaultFieldNullability: false;\n}\n\n/** The single module-level builder. Object types, enums, and root types are\n *  defined against this instance across the sibling `schema/*` modules; the\n *  built schema is `dashboardSchema` (see `../schema.ts`). */\nexport const builder = new SchemaBuilder<SchemaTypes>({\n\tplugins: [SimpleObjectsPlugin, RelayPlugin, WithInputPlugin],\n\trelay: {},\n\tdefaultFieldNullability: false,\n});\n"],"mappings":";;;;;;;;AAkDA,MAAa,UAAU,IAAI,cAA2B;CACrD,SAAS;EAAC;EAAqB;EAAa;EAAgB;CAC5D,OAAO,EAAE;CACT,yBAAyB;CACzB,CAAC"}

package/dist/plugins/dashboard/schema/enums.mjs

@@ -0,0 +1,72 @@
+import { builder } from "./builder.mjs";
+//#region src/plugins/dashboard/schema/enums.ts
+const LifecycleStatus = builder.enumType("LifecycleStatus", { values: [
+	"pending",
+	"acquiring",
+	"ready",
+	"failed",
+	"stopping",
+	"stopped",
+	"done"
+] });
+const PluginRole = builder.enumType("PluginRole", { values: ["service", "task"] });
+const RowSection = builder.enumType("RowSection", { values: [
+	"service",
+	"package",
+	"account",
+	"action",
+	"app",
+	"other"
+] });
+const WireProtocol = builder.enumType("WireProtocol", { values: [
+	"http",
+	"h2c",
+	"tcp"
+] });
+const LogLevel = builder.enumType("LogLevel", { values: [
+	"info",
+	"warn",
+	"error"
+] });
+const ErrorSeverity = builder.enumType("ErrorSeverity", { values: [
+	"warn",
+	"error",
+	"fatal"
+] });
+const AccountScheme = builder.enumType("AccountScheme", { values: [
+	"ed25519",
+	"secp256k1",
+	"secp256r1"
+] });
+const AccountSource = builder.enumType("AccountSource", { values: ["real", "impersonate"] });
+const FundingStatus = builder.enumType("FundingStatus", { values: [
+	"pending",
+	"funded",
+	"skipped",
+	"failed",
+	"unknown"
+] });
+const PackageKind = builder.enumType("PackageKind", { values: ["local", "known"] });
+const Health = builder.enumType("Health", { values: [
+	"ready",
+	"active",
+	"blocked",
+	"empty"
+] });
+/** Fork-vs-local stack mode (advance-clock gating). Derived from the sui
+*  plugin's resolved mode; `local-rpc` collapses to `local`. */
+const StackMode = builder.enumType("StackMode", { values: [
+	"fork",
+	"local",
+	"live"
+] });
+/** DeepBook deployment mode. */
+const DeepbookMode = builder.enumType("DeepbookMode", { values: [
+	"local",
+	"override",
+	"known"
+] });
+//#endregion
+export { AccountScheme, AccountSource, DeepbookMode, ErrorSeverity, FundingStatus, Health, LifecycleStatus, LogLevel, PackageKind, PluginRole, RowSection, StackMode, WireProtocol };
+
+//# sourceMappingURL=enums.mjs.map

package/dist/plugins/dashboard/schema/enums.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"enums.mjs","names":[],"sources":["../../../../src/plugins/dashboard/schema/enums.ts"],"sourcesContent":["// Pothos enums mirroring the closed unions in projection.ts / lifecycle.ts.\n//\n// Each `values` array is the EXACT string union from the source type — if\n// a substrate union gains a member, the corresponding `satisfies` below\n// stops compiling until this list is updated. That keeps the GraphQL\n// vocabulary in lockstep with the projection vocabulary.\n\nimport { builder } from './builder.ts';\nimport type {\n\tLifecycleStatus as LifecycleStatusUnion,\n\tPluginRole as PluginRoleUnion,\n} from '../../../substrate/lifecycle.ts';\nimport type {\n\tAccountProjection,\n\tEndpoint,\n\tLogTail,\n\tPackageProjection,\n\tRowSection as RowSectionUnion,\n\tStructuredError,\n} from '../../../substrate/projection.ts';\n\n// NOTE: CyclePhase ('shutting-down') and FundingEntryStatus ('already-satisfied')\n// are intentionally NOT GraphQL enums — their values contain hyphens, which are\n// illegal in GraphQL enum value names. Those fields are exposed as String (the\n// raw union string is the wire contract). See schema/types.ts.\ntype WireProtocol = Endpoint['wireProtocol'];\ntype LogLevel = LogTail['level'];\ntype ErrorSeverity = StructuredError['severity'];\ntype AccountScheme = NonNullable<AccountProjection['scheme']>;\ntype AccountSource = NonNullable<AccountProjection['source']>;\ntype FundingStatus = AccountProjection['funding']['status'];\ntype PackageKind = PackageProjection['kind'];\n\n/** Derived health classification for a single service row + the stack. */\nexport type Health = 'ready' | 'active' | 'blocked' | 'empty';\n\nexport const LifecycleStatus = builder.enumType('LifecycleStatus', {\n\tvalues: [\n\t\t'pending',\n\t\t'acquiring',\n\t\t'ready',\n\t\t'failed',\n\t\t'stopping',\n\t\t'stopped',\n\t\t'done',\n\t] satisfies LifecycleStatusUnion[],\n});\n\nexport const PluginRole = builder.enumType('PluginRole', {\n\tvalues: ['service', 'task'] satisfies PluginRoleUnion[],\n});\n\nexport const RowSection = builder.enumType('RowSection', {\n\tvalues: ['service', 'package', 'account', 'action', 'app', 'other'] satisfies RowSectionUnion[],\n});\n\nexport const WireProtocol = builder.enumType('WireProtocol', {\n\tvalues: ['http', 'h2c', 'tcp'] satisfies WireProtocol[],\n});\n\nexport const LogLevel = builder.enumType('LogLevel', {\n\tvalues: ['info', 'warn', 'error'] satisfies LogLevel[],\n});\n\nexport const ErrorSeverity = builder.enumType('ErrorSeverity', {\n\tvalues: ['warn', 'error', 'fatal'] satisfies ErrorSeverity[],\n});\n\nexport const AccountScheme = builder.enumType('AccountScheme', {\n\tvalues: ['ed25519', 'secp256k1', 'secp256r1'] satisfies AccountScheme[],\n});\n\nexport const AccountSource = builder.enumType('AccountSource', {\n\tvalues: ['real', 'impersonate'] satisfies AccountSource[],\n});\n\nexport const FundingStatus = builder.enumType('FundingStatus', {\n\tvalues: ['pending', 'funded', 'skipped', 'failed', 'unknown'] satisfies FundingStatus[],\n});\n\nexport const PackageKind = builder.enumType('PackageKind', {\n\tvalues: ['local', 'known'] satisfies PackageKind[],\n});\n\nexport const Health = builder.enumType('Health', {\n\tvalues: ['ready', 'active', 'blocked', 'empty'] satisfies Health[],\n});\n\n// --- Plugin-domain enums (control-plane `domain` surface) ------------------\n//\n// These mirror the closed unions on the control-plane domain shapes. They\n// carry no hyphenated members EXCEPT seal's `fork-known` / `local-keygen`,\n// which would be illegal GraphQL enum names — so SealMode is exposed as a\n// raw String field (see schema/types.ts), NOT an enum.\n\n/** Fork-vs-local stack mode (advance-clock gating). Derived from the sui\n *  plugin's resolved mode; `local-rpc` collapses to `local`. */\nexport const StackMode = builder.enumType('StackMode', {\n\tvalues: ['fork', 'local', 'live'] as const,\n});\n\n/** DeepBook deployment mode. */\nexport const DeepbookMode = builder.enumType('DeepbookMode', {\n\tvalues: ['local', 'override', 'known'] as const,\n});\n\n// NOTE: CoinSource ('on-chain') and SealMode ('local-keygen' / 'fork-known')\n// are intentionally NOT GraphQL enums — their values contain hyphens, which\n// are illegal in GraphQL enum value names. Those fields are exposed as String\n// (the raw union string is the wire contract). See schema/types.ts.\n"],"mappings":";;AAoCA,MAAa,kBAAkB,QAAQ,SAAS,mBAAmB,EAClE,QAAQ;CACP;CACA;CACA;CACA;CACA;CACA;CACA;CACA,EACD,CAAC;AAEF,MAAa,aAAa,QAAQ,SAAS,cAAc,EACxD,QAAQ,CAAC,WAAW,OAAO,EAC3B,CAAC;AAEF,MAAa,aAAa,QAAQ,SAAS,cAAc,EACxD,QAAQ;CAAC;CAAW;CAAW;CAAW;CAAU;CAAO;CAAQ,EACnE,CAAC;AAEF,MAAa,eAAe,QAAQ,SAAS,gBAAgB,EAC5D,QAAQ;CAAC;CAAQ;CAAO;CAAM,EAC9B,CAAC;AAEF,MAAa,WAAW,QAAQ,SAAS,YAAY,EACpD,QAAQ;CAAC;CAAQ;CAAQ;CAAQ,EACjC,CAAC;AAEF,MAAa,gBAAgB,QAAQ,SAAS,iBAAiB,EAC9D,QAAQ;CAAC;CAAQ;CAAS;CAAQ,EAClC,CAAC;AAEF,MAAa,gBAAgB,QAAQ,SAAS,iBAAiB,EAC9D,QAAQ;CAAC;CAAW;CAAa;CAAY,EAC7C,CAAC;AAEF,MAAa,gBAAgB,QAAQ,SAAS,iBAAiB,EAC9D,QAAQ,CAAC,QAAQ,cAAc,EAC/B,CAAC;AAEF,MAAa,gBAAgB,QAAQ,SAAS,iBAAiB,EAC9D,QAAQ;CAAC;CAAW;CAAU;CAAW;CAAU;CAAU,EAC7D,CAAC;AAEF,MAAa,cAAc,QAAQ,SAAS,eAAe,EAC1D,QAAQ,CAAC,SAAS,QAAQ,EAC1B,CAAC;AAEF,MAAa,SAAS,QAAQ,SAAS,UAAU,EAChD,QAAQ;CAAC;CAAS;CAAU;CAAW;CAAQ,EAC/C,CAAC;;;AAWF,MAAa,YAAY,QAAQ,SAAS,aAAa,EACtD,QAAQ;CAAC;CAAQ;CAAS;CAAO,EACjC,CAAC;;AAGF,MAAa,eAAe,QAAQ,SAAS,gBAAgB,EAC5D,QAAQ;CAAC;CAAS;CAAY;CAAQ,EACtC,CAAC"}