@mysten-incubation/devstack 0.0.1 → 0.1.1

package/dist/plugins/seal/key-server.mjs

@@ -1,10 +1,13 @@
 import { ProbeTimeoutError, exitCodeProbeResult, waitForProbe } from "../../substrate/runtime/probes.mjs";
-import { ensureManagedContainer } from "../../substrate/runtime/managed-container.mjs";
+import { HOST_GATEWAY_EXTRA_HOSTS } from "../../substrate/runtime/host-gateway.mjs";
 import { DEFAULT_KEY_SERVER_PORT, SEAL_KEY_SERVER_ENDPOINT_NAME } from "./routable.mjs";
-import { sealError } from "./errors.mjs";
+import { ensureManagedContainer } from "../../substrate/runtime/managed-container.mjs";
+import { deriveSubnetPrefix } from "../../substrate/runtime/subnet-broker.mjs";
+import { isSealError, sealError } from "./errors.mjs";
+import { SealSpans } from "./spans.mjs";
 import { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from "./keygen.mjs";
 import { Effect } from "effect";
-import { basename, dirname } from "node:path";
+import { basename, dirname, relative } from "node:path";
 /** Inside-container config path. The binary reads `CONFIG_PATH` to
 *  locate the rendered yaml. */
 const INSIDE_CONFIG_PATH = "/etc/seal/key-server-config.yaml";
@@ -21,39 +24,35 @@ const CONTAINER_ENV = {
 	MASTER_KEY_ENVFILE: INSIDE_MASTER_KEY_ENVFILE,
 	RUST_LOG: "info"
 };
-const HOST_GATEWAY_EXTRA_HOSTS = { "host.docker.internal": "host-gateway" };
 const buildSealNetworkName = (app, stack, sealName) => `devstack-${app}-${stack}-seal-${sealName}-net`;
 /** Seal's key-server network gets a deterministic /24 so repeated
-*  local runs do not consume Docker's default bridge address pools. */
-const deriveSealSubnetPrefix = (identity) => {
-	const key = `${identity.app}\0${identity.stack}\0${identity.sealName}\0seal`;
-	let hash = 2166136261;
-	for (let i = 0; i < key.length; i += 1) {
-		hash ^= key.charCodeAt(i);
-		hash = Math.imul(hash, 16777619) >>> 0;
-	}
-	const bucket = hash % (64 * 256);
-	return `10.${128 + Math.floor(bucket / 256)}.${bucket % 256}`;
-};
-const sealNetworkCreateSpec = (spec, subnetPrefix) => ({
-	...spec,
-	subnet: `${subnetPrefix}.0/24`,
-	gateway: `${subnetPrefix}.1`
-});
+*  local runs do not consume Docker's default bridge address pools.
+*  Seal claims the `10.128.*` – `10.191.*` band; see
+*  substrate/runtime/subnet-broker.ts for the algorithm and band
+*  coordination with walrus. */
+const deriveSealSubnetPrefix = (identity) => deriveSubnetPrefix(`${identity.app}\0${identity.stack}\0${identity.sealName}\0seal`, 128);
 /** Per-probe interval inside the bounded retry. */
 const READY_PROBE_INTERVAL_MS = 500;
 /** Build the container spec. Distilled-doc invariants #1, #3, #5
 *  encoded here:
 *
 *   - `routedUrl` is the SAME value the on-chain Move call registers.
-*   - `env` is `CONTAINER_ENV` (no MASTER_KEY); `masterKeyEnvFileHostPath`
-*     bind-mount carries the secret.
+*   - `env` is `CONTAINER_ENV` (no MASTER_KEY); the bind-mounted env-file
+*     at `<servicePath>/master-key.env` (sourced by the entrypoint shell)
+*     carries the secret.
 *   - `routing[]` lists the seal-key-server entrypoint; the spec returned has
-*     NO `ports:` field (it's not modelled). */
+*     NO `ports:` field (it's not modelled).
+*
+*  Asserts at spec-build time that the substrate-provided `servicePath`
+*  lives under the derived `runtimeRootHostPath`. The single host
+*  mount publishes the entire `runtimeRootHostPath` subtree; if the
+*  caller ever drifts `servicePath` outside that subtree, the
+*  rendered config + master-key envfile silently would not reach the
+*  container — surface that drift here instead. */
 const buildKeyServerSpec = (inputs) => {
-	const masterKeyEnvFileHostPath = `${inputs.servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;
-	const configHostPath = `${inputs.servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;
 	const runtimeRootHostPath = dirname(dirname(inputs.servicePath));
+	const rel = relative(runtimeRootHostPath, inputs.servicePath);
+	if (rel.length === 0 || rel.startsWith("..") || runtimeRootHostPath === "/") throw new Error(`buildKeyServerSpec: servicePath (${inputs.servicePath}) must be a descendant of runtimeRootHostPath (${runtimeRootHostPath}) AND runtimeRootHostPath must not collapse to '/'. The single bind-mount publishes runtimeRootHostPath into the container — if servicePath drifts outside it, the rendered config + master-key envfile would silently not reach the container; if the root collapses to '/', the bind would publish the host root. Cross-check the substrate's seal servicePath layout.`);
 	const serviceDirName = basename(inputs.servicePath);
 	const configContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${KEY_SERVER_CONFIG_BASENAME}`;
 	const masterKeyEnvFileContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${MASTER_KEY_ENVFILE_BASENAME}`;
@@ -62,8 +61,6 @@ const buildKeyServerSpec = (inputs) => {
 		image: inputs.image,
 		containerName: inputs.containerName,
 		labels: inputs.labels,
-		configHostPath,
-		masterKeyEnvFileHostPath,
 		runtimeRootHostPath,
 		configContainerPath,
 		masterKeyEnvFileContainerPath,
@@ -152,11 +149,15 @@ const startKeyServer = (runtime, spec, name) => Effect.gen(function* () {
 			`(command -v curl >/dev/null 2>&1 && curl -fsS -m 2 ${directProbeUrl} >/dev/null) || nc -z 127.0.0.1 ${spec.containerPort} || exit 1`
 		]).pipe(Effect.map(exitCodeProbeResult))
 	}).pipe(Effect.mapError((cause) => {
-		if (cause instanceof ProbeTimeoutError) return sealError("ready", {
-			name,
-			message: `seal key-server never became ready within ${spec.readyTimeoutMs}ms (directProbeUrl=${directProbeUrl}, routedUrl=${spec.routedUrl})`,
-			cause: cause.lastError ?? cause.lastNotReady ?? cause
-		});
+		if (cause instanceof ProbeTimeoutError) {
+			const inner = cause.lastError ?? cause.lastNotReady ?? cause;
+			if (isSealError(inner)) return inner;
+			return sealError("ready", {
+				name,
+				message: `seal key-server never became ready within ${spec.readyTimeoutMs}ms (directProbeUrl=${directProbeUrl}, routedUrl=${spec.routedUrl})`,
+				cause: inner
+			});
+		}
 		return sealError("ready", {
 			name,
 			message: `seal key-server ready-probe exec failed: ${cause.reason}: ${cause.detail}`,
@@ -165,11 +166,11 @@ const startKeyServer = (runtime, spec, name) => Effect.gen(function* () {
 	}));
 	return { containerName: spec.containerName };
 }).pipe(Effect.withSpan("devstack.plugin.seal.keyServer.start", { attributes: {
-	"seal.name": name,
-	"seal.containerName": spec.containerName,
-	"seal.routedUrl": spec.routedUrl
+	[SealSpans.name]: name,
+	[SealSpans.containerName]: spec.containerName,
+	[SealSpans.routedUrl]: spec.routedUrl
 } }));
 //#endregion
-export { buildKeyServerSpec, buildSealNetworkName, deriveSealSubnetPrefix, sealNetworkCreateSpec, startKeyServer };
+export { buildKeyServerSpec, buildSealNetworkName, deriveSealSubnetPrefix, startKeyServer };
 
 //# sourceMappingURL=key-server.mjs.map

package/dist/plugins/seal/key-server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"key-server.mjs","names":[],"sources":["../../../src/plugins/seal/key-server.ts"],"sourcesContent":["// Seal plugin — long-running key-server container lifecycle.\n//\n// Distilled-doc invariants pinned by this file:\n//\n//   #1 (KeyServer.url == routed hostname): the URL handed to the\n//      on-chain Move call MUST equal the routed hostname stamped on\n//      the `seal-key-server` route. We resolve the URL ONCE via the\n//      router (see `routable.ts`) and pipe the same value into both\n//      the Move register pass (`deploy.ts` + `registry-publish.ts`)\n//      and this file's container spec.\n//\n//   #3 (env-file not -e MASTER_KEY=…): the container is launched\n//      with `envFiles: [<masterKeyEnvFile>]` and a `env:` map that\n//      does NOT contain `MASTER_KEY`. Distilled doc §Hard\n//      requirements #3 — the inline form surfaces the key in host\n//      process env + docker inspect output.\n//\n//      IMPLEMENTATION CONSTRAINT: the L1 `EnsureContainerSpec`\n//      contract today does NOT expose an `envFiles:` slot — only\n//      `env:`. We work around this by bind-mounting the env-file\n//      into the container under a stack-root bind mount; the cargo\n//      image's entrypoint shell (see Hard requirement #7) is\n//      responsible for `set -a; . \"$MASTER_KEY_ENVFILE\"; set +a`\n//      BEFORE exec'ing the daemon, so the secret never appears in\n//      `docker inspect`. ARCHITECTURE REVISION TRACKED: add `envFiles`\n//      to `EnsureContainerSpec`.\n//\n//   #5 (NO host-port publish): the `ports:` field is INTENTIONALLY\n//      absent from the `EnsureContainerSpec` we pass to the runtime.\n//      Traefik dispatches by Host: header from the well-known router\n//      entrypoint `seal-key-server`.\n//\n//   #7 (signal-forwarding entrypoint shell): the cargo-built image\n//      embeds the entrypoint shell that traps SIGTERM and forwards\n//      SIGTERM to the key-server child. Distilled doc §Hard\n//      requirements #21. The image declares the right entrypoint;\n//      this file does NOT re-declare it.\n\nimport { Effect, type Scope } from 'effect';\nimport { basename, dirname } from 'node:path';\n\nimport type {\n\tContainerHandle,\n\tContainerRuntime,\n\tEnsureContainerSpec,\n\tEnsureNetworkSpec,\n\tImageRef,\n} from '../../contracts/container-runtime.ts';\nimport type { ContainerLabelTuple } from '../../contracts/snapshotable.ts';\nimport {\n\tProbeTimeoutError,\n\texitCodeProbeResult,\n\twaitForProbe,\n} from '../../substrate/runtime/probes.ts';\nimport { ensureManagedContainer } from '../../substrate/runtime/managed-container.ts';\nimport { sealError, type SealError } from './errors.ts';\nimport { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from './keygen.ts';\nimport { DEFAULT_KEY_SERVER_PORT, SEAL_KEY_SERVER_ENDPOINT_NAME } from './routable.ts';\n\nexport { DEFAULT_KEY_SERVER_PORT } from './routable.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — mirror v3 `seal/internal.ts:102-103`\n// ---------------------------------------------------------------------------\n\n/** Default `/health` probe timeout. */\nexport const DEFAULT_READY_TIMEOUT_MS = 60_000 as const;\n\n/** Inside-container config path. The binary reads `CONFIG_PATH` to\n *  locate the rendered yaml. */\nexport const INSIDE_CONFIG_PATH = '/etc/seal/key-server-config.yaml' as const;\n\n/** Inside-container master-key env-file path. The entrypoint shell\n *  sources this before exec'ing the daemon (Hard requirement #3 +\n *  #7). */\nexport const INSIDE_MASTER_KEY_ENVFILE = '/etc/seal/master-key.env' as const;\n\nconst INSIDE_RUNTIME_ROOT = '/devstack/runtime' as const;\n\n/** Container-side env defaults. NB: `MASTER_KEY` is NOT here — it\n *  flows via the bind-mounted env-file sourced by the entrypoint\n *  shell. Distilled-doc invariant #3. */\nexport const CONTAINER_ENV: Readonly<Record<string, string>> = {\n\tCONFIG_PATH: INSIDE_CONFIG_PATH,\n\tMASTER_KEY_ENVFILE: INSIDE_MASTER_KEY_ENVFILE,\n\tRUST_LOG: 'info',\n};\n\nexport const HOST_GATEWAY_EXTRA_HOSTS: Readonly<Record<string, string>> = {\n\t'host.docker.internal': 'host-gateway',\n};\n\nexport const buildSealNetworkName = (app: string, stack: string, sealName: string): string =>\n\t`devstack-${app}-${stack}-seal-${sealName}-net`;\n\nexport interface SealNetworkIdentity {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly sealName: string;\n}\n\n/** Seal's key-server network gets a deterministic /24 so repeated\n *  local runs do not consume Docker's default bridge address pools. */\nexport const deriveSealSubnetPrefix = (identity: SealNetworkIdentity): string => {\n\tconst key = `${identity.app}\\0${identity.stack}\\0${identity.sealName}\\0seal`;\n\tlet hash = 0x811c9dc5;\n\tfor (let i = 0; i < key.length; i += 1) {\n\t\thash ^= key.charCodeAt(i);\n\t\thash = Math.imul(hash, 0x01000193) >>> 0;\n\t}\n\tconst bucket = hash % (64 * 256);\n\tconst secondOctet = 128 + Math.floor(bucket / 256);\n\tconst thirdOctet = bucket % 256;\n\treturn `10.${secondOctet}.${thirdOctet}`;\n};\n\nexport const sealNetworkCreateSpec = <Spec extends EnsureNetworkSpec>(\n\tspec: Spec,\n\tsubnetPrefix: string,\n): Spec & Required<Pick<EnsureNetworkSpec, 'subnet' | 'gateway'>> => ({\n\t...spec,\n\tsubnet: `${subnetPrefix}.0/24`,\n\tgateway: `${subnetPrefix}.1`,\n});\n\n/** Per-probe interval inside the bounded retry. */\nconst READY_PROBE_INTERVAL_MS = 500;\n\n// ---------------------------------------------------------------------------\n// Spec shape\n// ---------------------------------------------------------------------------\n\n/** The container spec produced for the long-running key-server. This\n *  is the substrate-blind value the ContainerRuntime adapter\n *  consumes. */\nexport interface KeyServerContainerSpec {\n\t/** Image ref from the Seal image resolver. */\n\treadonly image: ImageRef;\n\t/** Composed container name (substrate folds `<app>-<stack>-…`). */\n\treadonly containerName: string;\n\t/** Label tuple — drives the snapshot orchestrator's filter +\n\t *  `inspectByLabels`. */\n\treadonly labels: ContainerLabelTuple;\n\t/** Mount source on host — the rendered key-server-config.yaml. */\n\treadonly configHostPath: string;\n\t/** Env-file holding `MASTER_KEY=<hex>`. Mode-bit 0o600 inside\n\t *  0o700 parent. Distilled-doc invariant #2. Bind-mounted (see\n\t *  file header for the missing-envFiles workaround). */\n\treadonly masterKeyEnvFileHostPath: string;\n\t/** Mount source on host. Docker Desktop can reject freshly-created\n\t *  nested file/leaf-directory bind sources even when a parent mount\n\t *  can see them, so key-server mounts the stack root and points the\n\t *  entrypoint at the config/envfile inside that mount. */\n\treadonly runtimeRootHostPath: string;\n\treadonly configContainerPath: string;\n\treadonly masterKeyEnvFileContainerPath: string;\n\t/** Fingerprint of config contents that affect key-server boot. */\n\treadonly configFingerprint: string;\n\t/** Inner docker network for sui DNS resolution. */\n\treadonly network: string;\n\t/** Router routing spec — Traefik file-provider stamped per\n\t *  container. Distilled-doc invariant #5 (no host-port publish). */\n\treadonly routing: ReadonlyArray<{\n\t\treadonly name: string;\n\t\treadonly entrypoint: string;\n\t\treadonly servicePort: number;\n\t}>;\n\t/** Routed URL — `<routedUrl>/health` is what the ready probe\n\t *  would hit if/when an HTTP probe contract lands. Today we use\n\t *  an exec-based probe (see `startKeyServer`). */\n\treadonly routedUrl: string;\n\t/** Timeout for the ready probe. */\n\treadonly readyTimeoutMs: number;\n\t/** Graceful stop deadline. Distilled-doc invariant #21 — the\n\t *  entrypoint shell forwards Docker's SIGTERM to the key-server. */\n\treadonly stopGraceSeconds: number;\n\t/** In-container port the daemon binds. */\n\treadonly containerPort: number;\n}\n\n// ---------------------------------------------------------------------------\n// Spec builder\n// ---------------------------------------------------------------------------\n\n/** Inputs to assemble the container spec. */\nexport interface KeyServerSpecInputs {\n\treadonly name: string;\n\treadonly image: ImageRef;\n\treadonly containerName: string;\n\treadonly labels: ContainerLabelTuple;\n\treadonly suiNetwork: string;\n\treadonly servicePath: string;\n\treadonly configFingerprint: string;\n\treadonly routedHostname: string;\n\treadonly routedUrl: string;\n\treadonly readyTimeoutMs?: number;\n}\n\n/** Build the container spec. Distilled-doc invariants #1, #3, #5\n *  encoded here:\n *\n *   - `routedUrl` is the SAME value the on-chain Move call registers.\n *   - `env` is `CONTAINER_ENV` (no MASTER_KEY); `masterKeyEnvFileHostPath`\n *     bind-mount carries the secret.\n *   - `routing[]` lists the seal-key-server entrypoint; the spec returned has\n *     NO `ports:` field (it's not modelled). */\nexport const buildKeyServerSpec = (inputs: KeyServerSpecInputs): KeyServerContainerSpec => {\n\tconst masterKeyEnvFileHostPath = `${inputs.servicePath}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\tconst configHostPath = `${inputs.servicePath}/${KEY_SERVER_CONFIG_BASENAME}`;\n\tconst runtimeRootHostPath = dirname(dirname(inputs.servicePath));\n\tconst serviceDirName = basename(inputs.servicePath);\n\tconst configContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${KEY_SERVER_CONFIG_BASENAME}`;\n\tconst masterKeyEnvFileContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\tvoid inputs.routedHostname; // flows through routedUrl\n\treturn {\n\t\timage: inputs.image,\n\t\tcontainerName: inputs.containerName,\n\t\tlabels: inputs.labels,\n\t\tconfigHostPath,\n\t\tmasterKeyEnvFileHostPath,\n\t\truntimeRootHostPath,\n\t\tconfigContainerPath,\n\t\tmasterKeyEnvFileContainerPath,\n\t\tconfigFingerprint: inputs.configFingerprint,\n\t\tnetwork: inputs.suiNetwork,\n\t\trouting: [\n\t\t\t{\n\t\t\t\tname: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\t\t\t\tentrypoint: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\t\t\t\tservicePort: DEFAULT_KEY_SERVER_PORT,\n\t\t\t},\n\t\t],\n\t\troutedUrl: inputs.routedUrl,\n\t\treadyTimeoutMs: inputs.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,\n\t\tstopGraceSeconds: 15,\n\t\tcontainerPort: DEFAULT_KEY_SERVER_PORT,\n\t};\n};\n\nexport const buildKeyServerEnsureContainerSpec = (\n\tspec: KeyServerContainerSpec,\n): EnsureContainerSpec => ({\n\tname: spec.containerName,\n\timage: spec.image,\n\tlabels: spec.labels,\n\trecreate: 'on-config-change',\n\tconfigHash: [\n\t\t'seal-key-server',\n\t\t`runtime=${spec.runtimeRootHostPath}`,\n\t\t`config=${spec.configContainerPath}`,\n\t\t`master=${spec.masterKeyEnvFileContainerPath}`,\n\t\t`content=${spec.configFingerprint}`,\n\t\t`network=${spec.network}`,\n\t].join('|'),\n\t// Distilled-doc invariant #3 — MASTER_KEY is NOT here.\n\t// The bind-mounted env-file is sourced by the entrypoint\n\t// shell BEFORE the daemon exec. See file header on the\n\t// L1 `envFiles:` gap.\n\tenv: {\n\t\t...CONTAINER_ENV,\n\t\tCONFIG_PATH: spec.configContainerPath,\n\t\tMASTER_KEY_ENVFILE: spec.masterKeyEnvFileContainerPath,\n\t},\n\tstopGraceSeconds: spec.stopGraceSeconds,\n\tnetworkAttach: [spec.network],\n\t// Distilled-doc invariant #5 — `ports` intentionally absent.\n\textraHosts: HOST_GATEWAY_EXTRA_HOSTS,\n\tmounts: [\n\t\t{\n\t\t\tsource: spec.runtimeRootHostPath,\n\t\t\ttarget: INSIDE_RUNTIME_ROOT,\n\t\t\treadonly: true,\n\t\t},\n\t],\n});\n\n// ---------------------------------------------------------------------------\n// Start procedure — real ContainerRuntime wiring\n// ---------------------------------------------------------------------------\n\n/** Start the long-running key-server container.\n *\n *  Wiring:\n *\n *    1. `runtime.ensureContainer` — content-addressed image, label\n *       tuple, recreate-on-config-change. Two bind mounts: the\n *       rendered yaml (read-only) + the master-key env-file\n *       (read-only). NO `ports:` — Traefik dispatches by Host:\n *       header on the well-known `seal-key-server` entrypoint port.\n *    2. In-container ready probe via `runtime.exec` — issues an\n *       HTTP GET against `http://127.0.0.1:2024/health`. Bounded\n *       retries until `readyTimeoutMs`. We shell out to `curl`\n *       (present in the vendored `debian:bookworm-slim` base) +\n *       fall back to `nc -z` for the stub image which doesn't\n *       carry curl. Both probes hit the same socket; curl\n *       additionally confirms the binary has parsed CONFIG_PATH\n *       and is serving the upstream's `/health` route (returns\n *       `{name,version,status:\"up\"}` once boot completes —\n *       distilled-doc §\"Container start + ready\").\n *\n *  Stop semantics: scope-close runs `ensureContainer`'s finalizer\n *  which calls `docker stop` with the Seal-specific grace window. */\nexport const startKeyServer = (\n\truntime: ContainerRuntime,\n\tspec: KeyServerContainerSpec,\n\tname: string,\n): Effect.Effect<{ readonly containerName: string }, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst ensureSpec = buildKeyServerEnsureContainerSpec(spec);\n\t\tconst { labels, ...containerSpec } = ensureSpec;\n\t\tconst handle: ContainerHandle = yield* ensureManagedContainer({\n\t\t\truntime,\n\t\t\tlabels,\n\t\t\tspec: containerSpec,\n\t\t\tmapError: (cause) =>\n\t\t\t\tsealError('container', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal key-server (name=${spec.containerName}) ensureContainer failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\n\t\t// Exec-based ready probe — distilled-doc §\"Container start +\n\t\t// ready\". The vendored debian:bookworm-slim base ships\n\t\t// `curl`; the e2e stub image (alpine) ships busybox `nc`. We\n\t\t// probe with curl first (real `/health` round-trip — confirms\n\t\t// the daemon parsed CONFIG_PATH AND bound the listener) and\n\t\t// fall back to `nc -z` (TCP-only — confirms only the socket\n\t\t// is listening). One of the two MUST succeed on a healthy\n\t\t// container.\n\t\t//\n\t\t// `/health` returns `{name, version, status: \"up\"}` once the\n\t\t// binary finishes config + master-key load. Pre-boot we\n\t\t// expect connection-refused → curl returns non-zero, retry.\n\t\tconst directProbeUrl = `http://127.0.0.1:${spec.containerPort}/health`;\n\t\tyield* waitForProbe({\n\t\t\tlabel: `seal.key-server.${name}`,\n\t\t\ttimeoutMs: spec.readyTimeoutMs,\n\t\t\tintervalMs: READY_PROBE_INTERVAL_MS,\n\t\t\tprobe: () =>\n\t\t\t\truntime\n\t\t\t\t\t.exec(handle, [\n\t\t\t\t\t\t'sh',\n\t\t\t\t\t\t'-c',\n\t\t\t\t\t\t`(command -v curl >/dev/null 2>&1 && ` +\n\t\t\t\t\t\t\t`curl -fsS -m 2 ${directProbeUrl} >/dev/null) ` +\n\t\t\t\t\t\t\t`|| nc -z 127.0.0.1 ${spec.containerPort} ` +\n\t\t\t\t\t\t\t`|| exit 1`,\n\t\t\t\t\t])\n\t\t\t\t\t.pipe(Effect.map(exitCodeProbeResult)),\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) => {\n\t\t\t\tif (cause instanceof ProbeTimeoutError) {\n\t\t\t\t\treturn sealError('ready', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t`seal key-server never became ready within ${spec.readyTimeoutMs}ms ` +\n\t\t\t\t\t\t\t`(directProbeUrl=${directProbeUrl}, routedUrl=${spec.routedUrl})`,\n\t\t\t\t\t\tcause: cause.lastError ?? cause.lastNotReady ?? cause,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn sealError('ready', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal key-server ready-probe exec failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\tcause,\n\t\t\t\t});\n\t\t\t}),\n\t\t);\n\n\t\treturn { containerName: spec.containerName };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.keyServer.start', {\n\t\t\tattributes: {\n\t\t\t\t'seal.name': name,\n\t\t\t\t'seal.containerName': spec.containerName,\n\t\t\t\t'seal.routedUrl': spec.routedUrl,\n\t\t\t},\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;AAsEA,MAAa,qBAAqB;;;;AAKlC,MAAa,4BAA4B;AAEzC,MAAM,sBAAsB;;;;AAK5B,MAAa,gBAAkD;CAC9D,aAAa;CACb,oBAAoB;CACpB,UAAU;CACV;AAED,MAAa,2BAA6D,EACzE,wBAAwB,gBACxB;AAED,MAAa,wBAAwB,KAAa,OAAe,aAChE,YAAY,IAAI,GAAG,MAAM,QAAQ,SAAS;;;AAU3C,MAAa,0BAA0B,aAA0C;CAChF,MAAM,MAAM,GAAG,SAAS,IAAI,IAAI,SAAS,MAAM,IAAI,SAAS,SAAS;CACrE,IAAI,OAAO;AACX,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;AACvC,UAAQ,IAAI,WAAW,EAAE;AACzB,SAAO,KAAK,KAAK,MAAM,SAAW,KAAK;;CAExC,MAAM,SAAS,QAAQ,KAAK;AAG5B,QAAO,MAFa,MAAM,KAAK,MAAM,SAAS,IAAI,CAEzB,GADN,SAAS;;AAI7B,MAAa,yBACZ,MACA,kBACqE;CACrE,GAAG;CACH,QAAQ,GAAG,aAAa;CACxB,SAAS,GAAG,aAAa;CACzB;;AAGD,MAAM,0BAA0B;;;;;;;;;AAgFhC,MAAa,sBAAsB,WAAwD;CAC1F,MAAM,2BAA2B,GAAG,OAAO,YAAY,GAAG;CAC1D,MAAM,iBAAiB,GAAG,OAAO,YAAY,GAAG;CAChD,MAAM,sBAAsB,QAAQ,QAAQ,OAAO,YAAY,CAAC;CAChE,MAAM,iBAAiB,SAAS,OAAO,YAAY;CACnD,MAAM,sBAAsB,GAAG,oBAAoB,QAAQ,eAAe,GAAG;CAC7E,MAAM,gCAAgC,GAAG,oBAAoB,QAAQ,eAAe,GAAG;AAClF,QAAO;AACZ,QAAO;EACN,OAAO,OAAO;EACd,eAAe,OAAO;EACtB,QAAQ,OAAO;EACf;EACA;EACA;EACA;EACA;EACA,mBAAmB,OAAO;EAC1B,SAAS,OAAO;EAChB,SAAS,CACR;GACC,MAAM;GACN,YAAY;GACZ,aAAa;GACb,CACD;EACD,WAAW,OAAO;EAClB,gBAAgB,OAAO,kBAAA;EACvB,kBAAkB;EAClB,eAAe;EACf;;AAGF,MAAa,qCACZ,UAC0B;CAC1B,MAAM,KAAK;CACX,OAAO,KAAK;CACZ,QAAQ,KAAK;CACb,UAAU;CACV,YAAY;EACX;EACA,WAAW,KAAK;EAChB,UAAU,KAAK;EACf,UAAU,KAAK;EACf,WAAW,KAAK;EAChB,WAAW,KAAK;EAChB,CAAC,KAAK,IAAI;CAKX,KAAK;EACJ,GAAG;EACH,aAAa,KAAK;EAClB,oBAAoB,KAAK;EACzB;CACD,kBAAkB,KAAK;CACvB,eAAe,CAAC,KAAK,QAAQ;CAE7B,YAAY;CACZ,QAAQ,CACP;EACC,QAAQ,KAAK;EACb,QAAQ;EACR,UAAU;EACV,CACD;CACD;;;;;;;;;;;;;;;;;;;;;;;AA4BD,MAAa,kBACZ,SACA,MACA,SAEA,OAAO,IAAI,aAAa;CAEvB,MAAM,EAAE,QAAQ,GAAG,kBADA,kCAAkC,KACN;CAC/C,MAAM,SAA0B,OAAO,uBAAuB;EAC7D;EACA;EACA,MAAM;EACN,WAAW,UACV,UAAU,aAAa;GACtB;GACA,SAAS,yBAAyB,KAAK,cAAc,4BAA4B,MAAM,OAAO,IAAI,MAAM;GACxG;GACA,CAAC;EACH,CAAC;CAcF,MAAM,iBAAiB,oBAAoB,KAAK,cAAc;AAC9D,QAAO,aAAa;EACnB,OAAO,mBAAmB;EAC1B,WAAW,KAAK;EAChB,YAAY;EACZ,aACC,QACE,KAAK,QAAQ;GACb;GACA;GACA,sDACmB,eAAe,kCACX,KAAK,cAAc;GAE1C,CAAC,CACD,KAAK,OAAO,IAAI,oBAAoB,CAAC;EACxC,CAAC,CAAC,KACF,OAAO,UAAU,UAAU;AAC1B,MAAI,iBAAiB,kBACpB,QAAO,UAAU,SAAS;GACzB;GACA,SACC,6CAA6C,KAAK,eAAe,qBAC9C,eAAe,cAAc,KAAK,UAAU;GAChE,OAAO,MAAM,aAAa,MAAM,gBAAgB;GAChD,CAAC;AAEH,SAAO,UAAU,SAAS;GACzB;GACA,SAAS,4CAA4C,MAAM,OAAO,IAAI,MAAM;GAC5E;GACA,CAAC;GACD,CACF;AAED,QAAO,EAAE,eAAe,KAAK,eAAe;EAC3C,CAAC,KACF,OAAO,SAAS,wCAAwC,EACvD,YAAY;CACX,aAAa;CACb,sBAAsB,KAAK;CAC3B,kBAAkB,KAAK;CACvB,EACD,CAAC,CACF"}
+{"version":3,"file":"key-server.mjs","names":[],"sources":["../../../src/plugins/seal/key-server.ts"],"sourcesContent":["// Seal plugin — long-running key-server container lifecycle.\n//\n// Distilled-doc invariants pinned by this file:\n//\n//   #1 (KeyServer.url == routed hostname): the URL handed to the\n//      on-chain Move call MUST equal the routed hostname stamped on\n//      the `seal-key-server` route. We resolve the URL ONCE via the\n//      router (see `routable.ts`) and pipe the same value into both\n//      the Move register pass (`deploy.ts` + `registry-publish.ts`)\n//      and this file's container spec.\n//\n//   #3 (env-file not -e MASTER_KEY=…): the container is launched\n//      with `envFiles: [<masterKeyEnvFile>]` and a `env:` map that\n//      does NOT contain `MASTER_KEY`. Distilled doc §Hard\n//      requirements #3 — the inline form surfaces the key in host\n//      process env + docker inspect output.\n//\n//      IMPLEMENTATION CONSTRAINT: the L1 `EnsureContainerSpec`\n//      contract today does NOT expose an `envFiles:` slot — only\n//      `env:`. We work around this by bind-mounting the env-file\n//      into the container under a stack-root bind mount; the cargo\n//      image's entrypoint shell (see Hard requirement #7) is\n//      responsible for `set -a; . \"$MASTER_KEY_ENVFILE\"; set +a`\n//      BEFORE exec'ing the daemon, so the secret never appears in\n//      `docker inspect`. ARCHITECTURE REVISION TRACKED: add `envFiles`\n//      to `EnsureContainerSpec`.\n//\n//   #5 (NO host-port publish): the `ports:` field is INTENTIONALLY\n//      absent from the `EnsureContainerSpec` we pass to the runtime.\n//      Traefik dispatches by Host: header from the well-known router\n//      entrypoint `seal-key-server`.\n//\n//   #7 (signal-forwarding entrypoint shell): the cargo-built image\n//      embeds the entrypoint shell that traps SIGTERM and forwards\n//      SIGTERM to the key-server child. Distilled doc §Hard\n//      requirements #21. The image declares the right entrypoint;\n//      this file does NOT re-declare it.\n\nimport { Effect, type Scope } from 'effect';\nimport { basename, dirname, relative } from 'node:path';\n\nimport type {\n\tContainerHandle,\n\tContainerRuntime,\n\tEnsureContainerSpec,\n\tImageRef,\n} from '../../contracts/container-runtime.ts';\nimport type { ContainerLabelTuple } from '../../contracts/snapshotable.ts';\nimport {\n\tProbeTimeoutError,\n\texitCodeProbeResult,\n\twaitForProbe,\n} from '../../substrate/runtime/probes.ts';\nimport { ensureManagedContainer } from '../../substrate/runtime/managed-container.ts';\nimport { HOST_GATEWAY_EXTRA_HOSTS } from '../../substrate/runtime/host-gateway.ts';\nimport { deriveSubnetPrefix } from '../../substrate/runtime/subnet-broker.ts';\nimport { isSealError, sealError, type SealError } from './errors.ts';\nimport { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from './keygen.ts';\nimport { DEFAULT_KEY_SERVER_PORT, SEAL_KEY_SERVER_ENDPOINT_NAME } from './routable.ts';\nimport { SealSpans } from './spans.ts';\n\nexport { DEFAULT_KEY_SERVER_PORT } from './routable.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — mirror v3 `seal/internal.ts:102-103`\n// ---------------------------------------------------------------------------\n\n/** Default `/health` probe timeout. */\nexport const DEFAULT_READY_TIMEOUT_MS = 60_000 as const;\n\n/** Inside-container config path. The binary reads `CONFIG_PATH` to\n *  locate the rendered yaml. */\nexport const INSIDE_CONFIG_PATH = '/etc/seal/key-server-config.yaml' as const;\n\n/** Inside-container master-key env-file path. The entrypoint shell\n *  sources this before exec'ing the daemon (Hard requirement #3 +\n *  #7). */\nexport const INSIDE_MASTER_KEY_ENVFILE = '/etc/seal/master-key.env' as const;\n\nconst INSIDE_RUNTIME_ROOT = '/devstack/runtime' as const;\n\n/** Container-side env defaults. NB: `MASTER_KEY` is NOT here — it\n *  flows via the bind-mounted env-file sourced by the entrypoint\n *  shell. Distilled-doc invariant #3. */\nexport const CONTAINER_ENV: Readonly<Record<string, string>> = {\n\tCONFIG_PATH: INSIDE_CONFIG_PATH,\n\tMASTER_KEY_ENVFILE: INSIDE_MASTER_KEY_ENVFILE,\n\tRUST_LOG: 'info',\n};\n\nexport { HOST_GATEWAY_EXTRA_HOSTS };\n\nexport const buildSealNetworkName = (app: string, stack: string, sealName: string): string =>\n\t`devstack-${app}-${stack}-seal-${sealName}-net`;\n\nexport interface SealNetworkIdentity {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly sealName: string;\n}\n\n/** Seal's key-server network gets a deterministic /24 so repeated\n *  local runs do not consume Docker's default bridge address pools.\n *  Seal claims the `10.128.*` – `10.191.*` band; see\n *  substrate/runtime/subnet-broker.ts for the algorithm and band\n *  coordination with walrus. */\nexport const deriveSealSubnetPrefix = (identity: SealNetworkIdentity): string =>\n\tderiveSubnetPrefix(`${identity.app}\\0${identity.stack}\\0${identity.sealName}\\0seal`, 128);\n\n/** Per-probe interval inside the bounded retry. */\nconst READY_PROBE_INTERVAL_MS = 500;\n\n// ---------------------------------------------------------------------------\n// Spec shape\n// ---------------------------------------------------------------------------\n\n/** The container spec produced for the long-running key-server. This\n *  is the substrate-blind value the ContainerRuntime adapter\n *  consumes. */\nexport interface KeyServerContainerSpec {\n\t/** Image ref from the Seal image resolver. */\n\treadonly image: ImageRef;\n\t/** Composed container name (substrate folds `<app>-<stack>-…`). */\n\treadonly containerName: string;\n\t/** Label tuple — drives the snapshot orchestrator's filter +\n\t *  `inspectByLabels`. */\n\treadonly labels: ContainerLabelTuple;\n\t/** Mount source on host. Docker Desktop can reject freshly-created\n\t *  nested file/leaf-directory bind sources even when a parent mount\n\t *  can see them, so key-server mounts the stack root and points the\n\t *  entrypoint at the config/envfile inside that mount.\n\t *\n\t *  The rendered config + master-key envfile do not appear as their\n\t *  own fields on this spec — they live under `servicePath` inside\n\t *  `runtimeRootHostPath`. The single host mount publishes both into\n\t *  the container; `configContainerPath` /\n\t *  `masterKeyEnvFileContainerPath` give the entrypoint shell the\n\t *  inside-container locations. The spec-builder asserts the\n\t *  relationship between `servicePath` and `runtimeRootHostPath`. */\n\treadonly runtimeRootHostPath: string;\n\treadonly configContainerPath: string;\n\treadonly masterKeyEnvFileContainerPath: string;\n\t/** Fingerprint of config contents that affect key-server boot. */\n\treadonly configFingerprint: string;\n\t/** Inner docker network for sui DNS resolution. */\n\treadonly network: string;\n\t/** Router routing spec — Traefik file-provider stamped per\n\t *  container. Distilled-doc invariant #5 (no host-port publish). */\n\treadonly routing: ReadonlyArray<{\n\t\treadonly name: string;\n\t\treadonly entrypoint: string;\n\t\treadonly servicePort: number;\n\t}>;\n\t/** Routed URL — `<routedUrl>/health` is what the ready probe\n\t *  would hit if/when an HTTP probe contract lands. Today we use\n\t *  an exec-based probe (see `startKeyServer`). */\n\treadonly routedUrl: string;\n\t/** Timeout for the ready probe. */\n\treadonly readyTimeoutMs: number;\n\t/** Graceful stop deadline. Distilled-doc invariant #21 — the\n\t *  entrypoint shell forwards Docker's SIGTERM to the key-server. */\n\treadonly stopGraceSeconds: number;\n\t/** In-container port the daemon binds. */\n\treadonly containerPort: number;\n}\n\n// ---------------------------------------------------------------------------\n// Spec builder\n// ---------------------------------------------------------------------------\n\n/** Inputs to assemble the container spec. */\nexport interface KeyServerSpecInputs {\n\treadonly name: string;\n\treadonly image: ImageRef;\n\treadonly containerName: string;\n\treadonly labels: ContainerLabelTuple;\n\treadonly suiNetwork: string;\n\treadonly servicePath: string;\n\treadonly configFingerprint: string;\n\treadonly routedHostname: string;\n\treadonly routedUrl: string;\n\treadonly readyTimeoutMs?: number;\n}\n\n/** Build the container spec. Distilled-doc invariants #1, #3, #5\n *  encoded here:\n *\n *   - `routedUrl` is the SAME value the on-chain Move call registers.\n *   - `env` is `CONTAINER_ENV` (no MASTER_KEY); the bind-mounted env-file\n *     at `<servicePath>/master-key.env` (sourced by the entrypoint shell)\n *     carries the secret.\n *   - `routing[]` lists the seal-key-server entrypoint; the spec returned has\n *     NO `ports:` field (it's not modelled).\n *\n *  Asserts at spec-build time that the substrate-provided `servicePath`\n *  lives under the derived `runtimeRootHostPath`. The single host\n *  mount publishes the entire `runtimeRootHostPath` subtree; if the\n *  caller ever drifts `servicePath` outside that subtree, the\n *  rendered config + master-key envfile silently would not reach the\n *  container — surface that drift here instead. */\nexport const buildKeyServerSpec = (inputs: KeyServerSpecInputs): KeyServerContainerSpec => {\n\tconst runtimeRootHostPath = dirname(dirname(inputs.servicePath));\n\tconst rel = relative(runtimeRootHostPath, inputs.servicePath);\n\tif (rel.length === 0 || rel.startsWith('..') || runtimeRootHostPath === '/') {\n\t\t// `runtimeRootHostPath === '/'` catches the degenerate case\n\t\t// where the `dirname(dirname(...))` walk-up collapses to the\n\t\t// host root (e.g. servicePath shorter than 3 segments) — that\n\t\t// would bind-mount the entire host into the container. Same\n\t\t// family of bug as the walrus deploy-paths walk-up.\n\t\tthrow new Error(\n\t\t\t`buildKeyServerSpec: servicePath (${inputs.servicePath}) must be a descendant of ` +\n\t\t\t\t`runtimeRootHostPath (${runtimeRootHostPath}) AND runtimeRootHostPath must not ` +\n\t\t\t\t`collapse to '/'. The single bind-mount publishes runtimeRootHostPath into the ` +\n\t\t\t\t`container — if servicePath drifts outside it, the rendered config + master-key ` +\n\t\t\t\t`envfile would silently not reach the container; if the root collapses to '/', the ` +\n\t\t\t\t`bind would publish the host root. Cross-check the substrate's seal servicePath layout.`,\n\t\t);\n\t}\n\tconst serviceDirName = basename(inputs.servicePath);\n\tconst configContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${KEY_SERVER_CONFIG_BASENAME}`;\n\tconst masterKeyEnvFileContainerPath = `${INSIDE_RUNTIME_ROOT}/seal/${serviceDirName}/${MASTER_KEY_ENVFILE_BASENAME}`;\n\tvoid inputs.routedHostname; // flows through routedUrl\n\treturn {\n\t\timage: inputs.image,\n\t\tcontainerName: inputs.containerName,\n\t\tlabels: inputs.labels,\n\t\truntimeRootHostPath,\n\t\tconfigContainerPath,\n\t\tmasterKeyEnvFileContainerPath,\n\t\tconfigFingerprint: inputs.configFingerprint,\n\t\tnetwork: inputs.suiNetwork,\n\t\trouting: [\n\t\t\t{\n\t\t\t\tname: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\t\t\t\tentrypoint: SEAL_KEY_SERVER_ENDPOINT_NAME,\n\t\t\t\tservicePort: DEFAULT_KEY_SERVER_PORT,\n\t\t\t},\n\t\t],\n\t\troutedUrl: inputs.routedUrl,\n\t\treadyTimeoutMs: inputs.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,\n\t\tstopGraceSeconds: 15,\n\t\tcontainerPort: DEFAULT_KEY_SERVER_PORT,\n\t};\n};\n\nexport const buildKeyServerEnsureContainerSpec = (\n\tspec: KeyServerContainerSpec,\n): EnsureContainerSpec => ({\n\tname: spec.containerName,\n\timage: spec.image,\n\tlabels: spec.labels,\n\trecreate: 'on-config-change',\n\tconfigHash: [\n\t\t'seal-key-server',\n\t\t`runtime=${spec.runtimeRootHostPath}`,\n\t\t`config=${spec.configContainerPath}`,\n\t\t`master=${spec.masterKeyEnvFileContainerPath}`,\n\t\t`content=${spec.configFingerprint}`,\n\t\t`network=${spec.network}`,\n\t].join('|'),\n\t// Distilled-doc invariant #3 — MASTER_KEY is NOT here.\n\t// The bind-mounted env-file is sourced by the entrypoint\n\t// shell BEFORE the daemon exec. See file header on the\n\t// L1 `envFiles:` gap.\n\tenv: {\n\t\t...CONTAINER_ENV,\n\t\tCONFIG_PATH: spec.configContainerPath,\n\t\tMASTER_KEY_ENVFILE: spec.masterKeyEnvFileContainerPath,\n\t},\n\tstopGraceSeconds: spec.stopGraceSeconds,\n\tnetworkAttach: [spec.network],\n\t// Distilled-doc invariant #5 — `ports` intentionally absent.\n\textraHosts: HOST_GATEWAY_EXTRA_HOSTS,\n\tmounts: [\n\t\t{\n\t\t\tsource: spec.runtimeRootHostPath,\n\t\t\ttarget: INSIDE_RUNTIME_ROOT,\n\t\t\treadonly: true,\n\t\t},\n\t],\n});\n\n// ---------------------------------------------------------------------------\n// Start procedure — real ContainerRuntime wiring\n// ---------------------------------------------------------------------------\n\n/** Start the long-running key-server container.\n *\n *  Wiring:\n *\n *    1. `runtime.ensureContainer` — content-addressed image, label\n *       tuple, recreate-on-config-change. Two bind mounts: the\n *       rendered yaml (read-only) + the master-key env-file\n *       (read-only). NO `ports:` — Traefik dispatches by Host:\n *       header on the well-known `seal-key-server` entrypoint port.\n *    2. In-container ready probe via `runtime.exec` — issues an\n *       HTTP GET against `http://127.0.0.1:2024/health`. Bounded\n *       retries until `readyTimeoutMs`. We shell out to `curl`\n *       (present in the vendored `debian:bookworm-slim` base) +\n *       fall back to `nc -z` for the stub image which doesn't\n *       carry curl. Both probes hit the same socket; curl\n *       additionally confirms the binary has parsed CONFIG_PATH\n *       and is serving the upstream's `/health` route (returns\n *       `{name,version,status:\"up\"}` once boot completes —\n *       distilled-doc §\"Container start + ready\").\n *\n *  Stop semantics: scope-close runs `ensureContainer`'s finalizer\n *  which calls `docker stop` with the Seal-specific grace window. */\nexport const startKeyServer = (\n\truntime: ContainerRuntime,\n\tspec: KeyServerContainerSpec,\n\tname: string,\n): Effect.Effect<{ readonly containerName: string }, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst ensureSpec = buildKeyServerEnsureContainerSpec(spec);\n\t\tconst { labels, ...containerSpec } = ensureSpec;\n\t\tconst handle: ContainerHandle = yield* ensureManagedContainer({\n\t\t\truntime,\n\t\t\tlabels,\n\t\t\tspec: containerSpec,\n\t\t\tmapError: (cause) =>\n\t\t\t\tsealError('container', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal key-server (name=${spec.containerName}) ensureContainer failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\n\t\t// Exec-based ready probe — distilled-doc §\"Container start +\n\t\t// ready\". The vendored debian:bookworm-slim base ships\n\t\t// `curl`; the e2e stub image (alpine) ships busybox `nc`. We\n\t\t// probe with curl first (real `/health` round-trip — confirms\n\t\t// the daemon parsed CONFIG_PATH AND bound the listener) and\n\t\t// fall back to `nc -z` (TCP-only — confirms only the socket\n\t\t// is listening). One of the two MUST succeed on a healthy\n\t\t// container.\n\t\t//\n\t\t// `/health` returns `{name, version, status: \"up\"}` once the\n\t\t// binary finishes config + master-key load. Pre-boot we\n\t\t// expect connection-refused → curl returns non-zero, retry.\n\t\tconst directProbeUrl = `http://127.0.0.1:${spec.containerPort}/health`;\n\t\tyield* waitForProbe({\n\t\t\tlabel: `seal.key-server.${name}`,\n\t\t\ttimeoutMs: spec.readyTimeoutMs,\n\t\t\tintervalMs: READY_PROBE_INTERVAL_MS,\n\t\t\tprobe: () =>\n\t\t\t\truntime\n\t\t\t\t\t.exec(handle, [\n\t\t\t\t\t\t'sh',\n\t\t\t\t\t\t'-c',\n\t\t\t\t\t\t`(command -v curl >/dev/null 2>&1 && ` +\n\t\t\t\t\t\t\t`curl -fsS -m 2 ${directProbeUrl} >/dev/null) ` +\n\t\t\t\t\t\t\t`|| nc -z 127.0.0.1 ${spec.containerPort} ` +\n\t\t\t\t\t\t\t`|| exit 1`,\n\t\t\t\t\t])\n\t\t\t\t\t.pipe(Effect.map(exitCodeProbeResult)),\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause) => {\n\t\t\t\tif (cause instanceof ProbeTimeoutError) {\n\t\t\t\t\t// Unwrap so we don't double-wrap an inner `SealError`:\n\t\t\t\t\t// if `lastError` was itself a `SealError` (e.g. an\n\t\t\t\t\t// upstream probe site that already promoted to typed),\n\t\t\t\t\t// re-wrapping inside `sealError('ready', …)` would\n\t\t\t\t\t// leave the cause walker chasing two layers. The\n\t\t\t\t\t// outer `passthroughOrWrap.for<SealError>` in\n\t\t\t\t\t// `index.ts` strips one such layer, but the direct\n\t\t\t\t\t// `sealError('ready', …)` path doesn't — collapse\n\t\t\t\t\t// here at the source.\n\t\t\t\t\tconst inner = cause.lastError ?? cause.lastNotReady ?? cause;\n\t\t\t\t\tif (isSealError(inner)) {\n\t\t\t\t\t\treturn inner;\n\t\t\t\t\t}\n\t\t\t\t\treturn sealError('ready', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t`seal key-server never became ready within ${spec.readyTimeoutMs}ms ` +\n\t\t\t\t\t\t\t`(directProbeUrl=${directProbeUrl}, routedUrl=${spec.routedUrl})`,\n\t\t\t\t\t\tcause: inner,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn sealError('ready', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal key-server ready-probe exec failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\tcause,\n\t\t\t\t});\n\t\t\t}),\n\t\t);\n\n\t\treturn { containerName: spec.containerName };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.keyServer.start', {\n\t\t\tattributes: {\n\t\t\t\t[SealSpans.name]: name,\n\t\t\t\t[SealSpans.containerName]: spec.containerName,\n\t\t\t\t[SealSpans.routedUrl]: spec.routedUrl,\n\t\t\t},\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;;AAwEA,MAAa,qBAAqB;;;;AAKlC,MAAa,4BAA4B;AAEzC,MAAM,sBAAsB;;;;AAK5B,MAAa,gBAAkD;CAC9D,aAAa;CACb,oBAAoB;CACpB,UAAU;CACV;AAID,MAAa,wBAAwB,KAAa,OAAe,aAChE,YAAY,IAAI,GAAG,MAAM,QAAQ,SAAS;;;;;;AAa3C,MAAa,0BAA0B,aACtC,mBAAmB,GAAG,SAAS,IAAI,IAAI,SAAS,MAAM,IAAI,SAAS,SAAS,SAAS,IAAI;;AAG1F,MAAM,0BAA0B;;;;;;;;;;;;;;;;;AA0FhC,MAAa,sBAAsB,WAAwD;CAC1F,MAAM,sBAAsB,QAAQ,QAAQ,OAAO,YAAY,CAAC;CAChE,MAAM,MAAM,SAAS,qBAAqB,OAAO,YAAY;AAC7D,KAAI,IAAI,WAAW,KAAK,IAAI,WAAW,KAAK,IAAI,wBAAwB,IAMvE,OAAM,IAAI,MACT,oCAAoC,OAAO,YAAY,iDAC9B,oBAAoB,0WAK7C;CAEF,MAAM,iBAAiB,SAAS,OAAO,YAAY;CACnD,MAAM,sBAAsB,GAAG,oBAAoB,QAAQ,eAAe,GAAG;CAC7E,MAAM,gCAAgC,GAAG,oBAAoB,QAAQ,eAAe,GAAG;AAClF,QAAO;AACZ,QAAO;EACN,OAAO,OAAO;EACd,eAAe,OAAO;EACtB,QAAQ,OAAO;EACf;EACA;EACA;EACA,mBAAmB,OAAO;EAC1B,SAAS,OAAO;EAChB,SAAS,CACR;GACC,MAAM;GACN,YAAY;GACZ,aAAa;GACb,CACD;EACD,WAAW,OAAO;EAClB,gBAAgB,OAAO,kBAAA;EACvB,kBAAkB;EAClB,eAAe;EACf;;AAGF,MAAa,qCACZ,UAC0B;CAC1B,MAAM,KAAK;CACX,OAAO,KAAK;CACZ,QAAQ,KAAK;CACb,UAAU;CACV,YAAY;EACX;EACA,WAAW,KAAK;EAChB,UAAU,KAAK;EACf,UAAU,KAAK;EACf,WAAW,KAAK;EAChB,WAAW,KAAK;EAChB,CAAC,KAAK,IAAI;CAKX,KAAK;EACJ,GAAG;EACH,aAAa,KAAK;EAClB,oBAAoB,KAAK;EACzB;CACD,kBAAkB,KAAK;CACvB,eAAe,CAAC,KAAK,QAAQ;CAE7B,YAAY;CACZ,QAAQ,CACP;EACC,QAAQ,KAAK;EACb,QAAQ;EACR,UAAU;EACV,CACD;CACD;;;;;;;;;;;;;;;;;;;;;;;AA4BD,MAAa,kBACZ,SACA,MACA,SAEA,OAAO,IAAI,aAAa;CAEvB,MAAM,EAAE,QAAQ,GAAG,kBADA,kCAAkC,KACN;CAC/C,MAAM,SAA0B,OAAO,uBAAuB;EAC7D;EACA;EACA,MAAM;EACN,WAAW,UACV,UAAU,aAAa;GACtB;GACA,SAAS,yBAAyB,KAAK,cAAc,4BAA4B,MAAM,OAAO,IAAI,MAAM;GACxG;GACA,CAAC;EACH,CAAC;CAcF,MAAM,iBAAiB,oBAAoB,KAAK,cAAc;AAC9D,QAAO,aAAa;EACnB,OAAO,mBAAmB;EAC1B,WAAW,KAAK;EAChB,YAAY;EACZ,aACC,QACE,KAAK,QAAQ;GACb;GACA;GACA,sDACmB,eAAe,kCACX,KAAK,cAAc;GAE1C,CAAC,CACD,KAAK,OAAO,IAAI,oBAAoB,CAAC;EACxC,CAAC,CAAC,KACF,OAAO,UAAU,UAAU;AAC1B,MAAI,iBAAiB,mBAAmB;GAUvC,MAAM,QAAQ,MAAM,aAAa,MAAM,gBAAgB;AACvD,OAAI,YAAY,MAAM,CACrB,QAAO;AAER,UAAO,UAAU,SAAS;IACzB;IACA,SACC,6CAA6C,KAAK,eAAe,qBAC9C,eAAe,cAAc,KAAK,UAAU;IAChE,OAAO;IACP,CAAC;;AAEH,SAAO,UAAU,SAAS;GACzB;GACA,SAAS,4CAA4C,MAAM,OAAO,IAAI,MAAM;GAC5E;GACA,CAAC;GACD,CACF;AAED,QAAO,EAAE,eAAe,KAAK,eAAe;EAC3C,CAAC,KACF,OAAO,SAAS,wCAAwC,EACvD,YAAY;EACV,UAAU,OAAO;EACjB,UAAU,gBAAgB,KAAK;EAC/B,UAAU,YAAY,KAAK;CAC5B,EACD,CAAC,CACF"}

package/dist/plugins/seal/keygen.mjs

@@ -1,5 +1,7 @@
 import { redactText } from "../../substrate/runtime/observability/redaction.mjs";
+import "../../substrate/runtime/observability/index.mjs";
 import { sealError } from "./errors.mjs";
+import { SealSpans } from "./spans.mjs";
 import { Duration, Effect } from "effect";
 //#region src/plugins/seal/keygen.ts
 /** Entrypoint binary inside the seal image. */
@@ -14,15 +16,20 @@ const KEY_SERVER_CONFIG_BASENAME = "key-server-config.yaml";
 *  small — under 1s. 30s ceiling absorbs container startup overhead
 *  on slow CI runners. */
 const KEYGEN_TIMEOUT_MS = 3e4;
-const MASTER_KEY_REDACTION_RULE = {
+const MASTER_KEY_REDACTION_RULES = [{
 	kind: "pattern",
 	pattern: /^.*master[_\- ]?key.*$/gim,
 	replacement: "[REDACTED master key]"
-};
+}, {
+	kind: "pattern",
+	pattern: /(?<![0-9a-fA-F])[0-9a-fA-F]{64,}(?![0-9a-fA-F])/g,
+	replacement: "<REDACTED-HEX-RUN>"
+}];
 /** Replace any line containing `master_key` / `master-key` / `masterkey`
-*  (case-insensitive) with the literal `[REDACTED master key]`. Used at
-*  every site that may surface stdout/stderr from `seal-cli`. */
-const redactMasterKey = (s) => redactText(s, [MASTER_KEY_REDACTION_RULE]);
+*  (case-insensitive) with `[REDACTED master key]`, AND any standalone
+*  hex run of 64+ chars with `<REDACTED-HEX-RUN>`. Used at every site
+*  that may surface stdout/stderr from `seal-cli`. */
+const redactMasterKey = (s) => redactText(s, MASTER_KEY_REDACTION_RULES);
 /** Parse `Master key:` / `Public key:` hex lines from `seal-cli genkey`
 *  stdout. Hex prefix may or may not include `0x` (we strip it).
 *
@@ -31,8 +38,8 @@ const redactMasterKey = (s) => redactText(s, [MASTER_KEY_REDACTION_RULE]);
 *  stdout so a parser drift doesn't leak the master key into logs. */
 const parseSealKeygenOutput = (stdout, name) => {
 	const stripHex = (s) => s.startsWith("0x") ? s.slice(2) : s;
-	const masterMatch = stdout.match(/Master key:\s*(0x)?([0-9a-fA-F]+)/);
-	const publicMatch = stdout.match(/Public key:\s*(0x)?([0-9a-fA-F]+)/);
+	const masterMatch = stdout.match(/Master key:\s*(0x)?([0-9a-fA-F]{64})\b/);
+	const publicMatch = stdout.match(/Public key:\s*(0x)?([0-9a-fA-F]{192})\b/);
 	if (!masterMatch || !publicMatch) return Effect.fail(sealError("keygen", {
 		name,
 		message: "seal.keygen: could not parse seal-cli genkey output (Master key: / Public key: lines missing)",
@@ -43,14 +50,6 @@ const parseSealKeygenOutput = (stdout, name) => {
 		publicKey: stripHex(publicMatch[2])
 	});
 };
-/** Decode hex → bytes. Tolerates leading `0x`; fails on odd length. */
-const decodeHex = (hex) => {
-	const stripped = hex.startsWith("0x") ? hex.slice(2) : hex;
-	if (stripped.length % 2 !== 0) throw new Error("decodeHex: odd-length hex string");
-	const out = new Uint8Array(stripped.length / 2);
-	for (let i = 0; i < out.length; i++) out[i] = parseInt(stripped.slice(i * 2, i * 2 + 2), 16);
-	return out;
-};
 /** Run `seal-cli genkey` inside the cargo-built seal image and
 *  parse the BLS12-381 master + public keys.
 *
@@ -83,7 +82,7 @@ const runSealKeygen = (runtime, name, image) => Effect.gen(function* () {
 		stderr: redactMasterKey(result.stderr)
 	}));
 	return yield* parseSealKeygenOutput(result.stdout, name);
-}).pipe(Effect.withSpan("devstack.plugin.seal.keygen.oneShot", { attributes: { "seal.name": name } }), Effect.timeoutOrElse({
+}).pipe(Effect.withSpan("devstack.plugin.seal.keygen.oneShot", { attributes: { [SealSpans.name]: name } }), Effect.timeoutOrElse({
 	duration: Duration.millis(KEYGEN_TIMEOUT_MS + 5e3),
 	orElse: () => Effect.fail(sealError("keygen", {
 		name,
@@ -91,6 +90,6 @@ const runSealKeygen = (runtime, name, image) => Effect.gen(function* () {
 	}))
 }));
 //#endregion
-export { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME, decodeHex, runSealKeygen };
+export { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME, runSealKeygen };
 
 //# sourceMappingURL=keygen.mjs.map

package/dist/plugins/seal/keygen.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"keygen.mjs","names":[],"sources":["../../../src/plugins/seal/keygen.ts"],"sourcesContent":["// Seal plugin — BLS12-381 keygen helpers + master-key redactor.\n//\n// Distilled-doc invariant (07-seal.md §\"Generic artifact-publisher-publish\"\n// + §Hard requirements #16): the master-key MUST be redacted from any\n// stdout/stderr that may surface in a SealError. The redactor lives\n// here as the single owner so call sites (`mode/local-keygen.ts`,\n// `key-manager.ts`) all funnel through one regex.\n//\n// The keygen pipeline is REAL — `runtime.runOneShot` against the cargo\n// image runs `seal-cli genkey`, captures stdout, parses the BLS hex\n// pair. The image itself is the seam (`SEAL_CARGO_IMAGE_OVERRIDE` env\n// — see `bootstrap-assets/cargo-image.ts`).\n\nimport { Duration, Effect, type Scope } from 'effect';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport { redactText, type RedactionRule } from '../../substrate/runtime/observability/index.ts';\nimport { sealError, type SealError } from './errors.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — mirror v3 (`seal/internal.ts:115-149`)\n// ---------------------------------------------------------------------------\n\n/** Entrypoint binary inside the seal image. */\nexport const SEAL_KEYGEN_ENTRYPOINT = 'seal-cli';\n\n/** Args for the keygen one-shot. */\nexport const SEAL_KEYGEN_ARGS = ['genkey'] as const;\n\n/** Default master-key env-file basename inside `runtime/seal/`. */\nexport const MASTER_KEY_ENVFILE_BASENAME = 'master-key.env';\n\n/** Default key-server config yaml basename inside `runtime/seal/`. */\nexport const KEY_SERVER_CONFIG_BASENAME = 'key-server-config.yaml';\n\n/** Wall-clock timeout for the keygen one-shot. BLS12-381 keygen is\n *  small — under 1s. 30s ceiling absorbs container startup overhead\n *  on slow CI runners. */\nconst KEYGEN_TIMEOUT_MS = 30_000;\n\n// ---------------------------------------------------------------------------\n// PersistedBlsKeypair — the cache-stored shape\n// ---------------------------------------------------------------------------\n\n/** Two hex blobs round-tripped through the substrate StateStore. The\n *  master key is the secret; the public key is on-chain in the\n *  registered `KeyServer` object. Distilled-doc §\"Persistence model\"\n *  + §Hard requirements #5 — chainId is folded into the cache key by\n *  the ArtifactPublisher substrate. */\nexport interface PersistedBlsKeypair {\n\treadonly masterKey: string;\n\treadonly publicKey: string;\n}\n\n// ---------------------------------------------------------------------------\n// Redaction — distilled-doc invariant #16\n// ---------------------------------------------------------------------------\n\n/** Case-insensitive line-level pattern matching any `master[_-]?key`\n *  mention. Mirrors v3's `MASTER_KEY_LINE_RE` (`seal/internal.ts:1343`). */\nconst MASTER_KEY_LINE_RE = /^.*master[_\\- ]?key.*$/gim;\n\nconst MASTER_KEY_REDACTION_RULE: RedactionRule = {\n\tkind: 'pattern',\n\tpattern: MASTER_KEY_LINE_RE,\n\treplacement: '[REDACTED master key]',\n};\n\n/** Replace any line containing `master_key` / `master-key` / `masterkey`\n *  (case-insensitive) with the literal `[REDACTED master key]`. Used at\n *  every site that may surface stdout/stderr from `seal-cli`. */\nexport const redactMasterKey = (s: string): string => redactText(s, [MASTER_KEY_REDACTION_RULE]);\n\n// ---------------------------------------------------------------------------\n// Output parser — distilled-doc §\"Helpers\"\n// ---------------------------------------------------------------------------\n\n/** Parse `Master key:` / `Public key:` hex lines from `seal-cli genkey`\n *  stdout. Hex prefix may or may not include `0x` (we strip it).\n *\n *  Returns a typed `PersistedBlsKeypair` on success, or fails with a\n *  `SealError({phase: 'keygen'})` carrying the REDACTED tail of the\n *  stdout so a parser drift doesn't leak the master key into logs. */\nexport const parseSealKeygenOutput = (\n\tstdout: string,\n\tname: string,\n): Effect.Effect<PersistedBlsKeypair, SealError> => {\n\tconst stripHex = (s: string): string => (s.startsWith('0x') ? s.slice(2) : s);\n\tconst masterMatch = stdout.match(/Master key:\\s*(0x)?([0-9a-fA-F]+)/);\n\tconst publicMatch = stdout.match(/Public key:\\s*(0x)?([0-9a-fA-F]+)/);\n\tif (!masterMatch || !publicMatch) {\n\t\treturn Effect.fail(\n\t\t\tsealError('keygen', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t'seal.keygen: could not parse seal-cli genkey output (Master key: / Public key: lines missing)',\n\t\t\t\tstdout: redactMasterKey(stdout),\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed({\n\t\tmasterKey: stripHex(masterMatch[2]!),\n\t\tpublicKey: stripHex(publicMatch[2]!),\n\t} satisfies PersistedBlsKeypair);\n};\n\n// ---------------------------------------------------------------------------\n// Hex decode — minimal helper\n// ---------------------------------------------------------------------------\n\n/** Decode hex → bytes. Tolerates leading `0x`; fails on odd length. */\nexport const decodeHex = (hex: string): Uint8Array => {\n\tconst stripped = hex.startsWith('0x') ? hex.slice(2) : hex;\n\tif (stripped.length % 2 !== 0) {\n\t\tthrow new Error('decodeHex: odd-length hex string');\n\t}\n\tconst out = new Uint8Array(stripped.length / 2);\n\tfor (let i = 0; i < out.length; i++) {\n\t\tout[i] = parseInt(stripped.slice(i * 2, i * 2 + 2), 16);\n\t}\n\treturn out;\n};\n\n// ---------------------------------------------------------------------------\n// Real keygen one-shot\n// ---------------------------------------------------------------------------\n\n/** Run `seal-cli genkey` inside the cargo-built seal image and\n *  parse the BLS12-381 master + public keys.\n *\n *  Implementation:\n *   1. `runtime.runOneShot({ image, entrypoint: 'seal-cli', argv:\n *      ['genkey'], timeoutMillis: 30s })` — fresh `docker run --rm`.\n *   2. Promote non-zero exit to typed SealError with REDACTED tails.\n *   3. Parse stdout via `parseSealKeygenOutput`.\n *\n *  Distilled-doc invariant #16 — every stdout/stderr capture site\n *  passes through `redactMasterKey` BEFORE landing in the error. The\n *  parser handles the success-path; the failure path does its own\n *  redact at the raise site. */\nexport const runSealKeygen = (\n\truntime: ContainerRuntime,\n\tname: string,\n\timage: ImageRef,\n): Effect.Effect<PersistedBlsKeypair, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst result = yield* runtime\n\t\t\t.runOneShot({\n\t\t\t\timage,\n\t\t\t\tentrypoint: SEAL_KEYGEN_ENTRYPOINT,\n\t\t\t\targv: SEAL_KEYGEN_ARGS,\n\t\t\t\ttimeoutMillis: KEYGEN_TIMEOUT_MS,\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\tsealError('keygen', {\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tmessage: `seal-cli genkey one-shot failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('keygen', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal-cli genkey exited with code ${result.exitCode}`,\n\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\t// Defense-in-depth — the redactor handles success-path\n\t\t\t\t\t// output (where the key is the parsed value) but the\n\t\t\t\t\t// failure path's stdout MAY also carry the key, e.g.\n\t\t\t\t\t// when stderr says \"wrote master key to <log>\".\n\t\t\t\t\tstdout: redactMasterKey(result.stdout),\n\t\t\t\t\tstderr: redactMasterKey(result.stderr),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn yield* parseSealKeygenOutput(result.stdout, name);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.keygen.oneShot', {\n\t\t\tattributes: { 'seal.name': name },\n\t\t}),\n\t\tEffect.timeoutOrElse({\n\t\t\tduration: Duration.millis(KEYGEN_TIMEOUT_MS + 5_000),\n\t\t\torElse: () =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('keygen', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.keygen: outer timeout ${KEYGEN_TIMEOUT_MS}ms exceeded`,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t}),\n\t);\n"],"mappings":";;;;;AAwBA,MAAa,yBAAyB;;AAGtC,MAAa,mBAAmB,CAAC,SAAS;;AAG1C,MAAa,8BAA8B;;AAG3C,MAAa,6BAA6B;;;;AAK1C,MAAM,oBAAoB;AAwB1B,MAAM,4BAA2C;CAChD,MAAM;CACN,SAAS;CACT,aAAa;CACb;;;;AAKD,MAAa,mBAAmB,MAAsB,WAAW,GAAG,CAAC,0BAA0B,CAAC;;;;;;;AAYhG,MAAa,yBACZ,QACA,SACmD;CACnD,MAAM,YAAY,MAAuB,EAAE,WAAW,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG;CAC3E,MAAM,cAAc,OAAO,MAAM,oCAAoC;CACrE,MAAM,cAAc,OAAO,MAAM,oCAAoC;AACrE,KAAI,CAAC,eAAe,CAAC,YACpB,QAAO,OAAO,KACb,UAAU,UAAU;EACnB;EACA,SACC;EACD,QAAQ,gBAAgB,OAAO;EAC/B,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ;EACrB,WAAW,SAAS,YAAY,GAAI;EACpC,WAAW,SAAS,YAAY,GAAI;EACpC,CAA+B;;;AAQjC,MAAa,aAAa,QAA4B;CACrD,MAAM,WAAW,IAAI,WAAW,KAAK,GAAG,IAAI,MAAM,EAAE,GAAG;AACvD,KAAI,SAAS,SAAS,MAAM,EAC3B,OAAM,IAAI,MAAM,mCAAmC;CAEpD,MAAM,MAAM,IAAI,WAAW,SAAS,SAAS,EAAE;AAC/C,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,IAC/B,KAAI,KAAK,SAAS,SAAS,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,EAAE,GAAG;AAExD,QAAO;;;;;;;;;;;;;;;AAoBR,MAAa,iBACZ,SACA,MACA,UAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,QACpB,WAAW;EACX;EACA,YAAY;EACZ,MAAM;EACN,eAAe;EACf,CAAC,CACD,KACA,OAAO,OAAO,UACb,OAAO,KACN,UAAU,UAAU;EACnB;EACA,SAAS,oCAAoC,MAAM,OAAO,IAAI,MAAM;EACpE;EACA,CAAC,CACF,CACD,CACD;AAEF,KAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,UAAU,UAAU;EACnB;EACA,SAAS,oCAAoC,OAAO;EACpD,UAAU,OAAO;EAKjB,QAAQ,gBAAgB,OAAO,OAAO;EACtC,QAAQ,gBAAgB,OAAO,OAAO;EACtC,CAAC,CACF;AAGF,QAAO,OAAO,sBAAsB,OAAO,QAAQ,KAAK;EACvD,CAAC,KACF,OAAO,SAAS,uCAAuC,EACtD,YAAY,EAAE,aAAa,MAAM,EACjC,CAAC,EACF,OAAO,cAAc;CACpB,UAAU,SAAS,OAAO,oBAAoB,IAAM;CACpD,cACC,OAAO,KACN,UAAU,UAAU;EACnB;EACA,SAAS,8BAA8B,kBAAkB;EACzD,CAAC,CACF;CACF,CAAC,CACF"}
+{"version":3,"file":"keygen.mjs","names":[],"sources":["../../../src/plugins/seal/keygen.ts"],"sourcesContent":["// Seal plugin — BLS12-381 keygen helpers + master-key redactor.\n//\n// Distilled-doc invariant (07-seal.md §\"Generic artifact-publisher-publish\"\n// + §Hard requirements #16): the master-key MUST be redacted from any\n// stdout/stderr that may surface in a SealError. The redactor lives\n// here as the single owner so call sites (`mode/local-keygen.ts`,\n// `key-manager.ts`) all funnel through one regex.\n//\n// The keygen pipeline is REAL — `runtime.runOneShot` against the cargo\n// image runs `seal-cli genkey`, captures stdout, parses the BLS hex\n// pair. The image itself is the seam (`SEAL_CARGO_IMAGE_OVERRIDE` env\n// — see `bootstrap-assets/cargo-image.ts`).\n\nimport { Duration, Effect, type Scope } from 'effect';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport { redactText, type RedactionRule } from '../../substrate/runtime/observability/index.ts';\nimport { sealError, type SealError } from './errors.ts';\nimport { SealSpans } from './spans.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — mirror v3 (`seal/internal.ts:115-149`)\n// ---------------------------------------------------------------------------\n\n/** Entrypoint binary inside the seal image. */\nexport const SEAL_KEYGEN_ENTRYPOINT = 'seal-cli';\n\n/** Args for the keygen one-shot. */\nexport const SEAL_KEYGEN_ARGS = ['genkey'] as const;\n\n/** Default master-key env-file basename inside `runtime/seal/`. */\nexport const MASTER_KEY_ENVFILE_BASENAME = 'master-key.env';\n\n/** Default key-server config yaml basename inside `runtime/seal/`. */\nexport const KEY_SERVER_CONFIG_BASENAME = 'key-server-config.yaml';\n\n/** Wall-clock timeout for the keygen one-shot. BLS12-381 keygen is\n *  small — under 1s. 30s ceiling absorbs container startup overhead\n *  on slow CI runners. */\nconst KEYGEN_TIMEOUT_MS = 30_000;\n\n// ---------------------------------------------------------------------------\n// PersistedBlsKeypair — the cache-stored shape\n// ---------------------------------------------------------------------------\n\n/** Two hex blobs round-tripped through the substrate StateStore. The\n *  master key is the secret; the public key is on-chain in the\n *  registered `KeyServer` object. Distilled-doc §\"Persistence model\"\n *  + §Hard requirements #5 — chainId is folded into the cache key by\n *  the ArtifactPublisher substrate. */\nexport interface PersistedBlsKeypair {\n\treadonly masterKey: string;\n\treadonly publicKey: string;\n}\n\n// ---------------------------------------------------------------------------\n// Redaction — distilled-doc invariant #16\n// ---------------------------------------------------------------------------\n\n/** Case-insensitive line-level pattern matching any `master[_-]?key`\n *  mention. Mirrors v3's `MASTER_KEY_LINE_RE` (`seal/internal.ts:1343`). */\nconst MASTER_KEY_LINE_RE = /^.*master[_\\- ]?key.*$/gim;\n\n/** Defense-in-depth: any contiguous hex run of 64+ chars is treated as\n *  a possible BLS12-381 master key (32 bytes = 64 hex chars). The\n *  label-based pass catches the canonical `Master key: 0x…` format;\n *  this pass catches stray hex emissions that drop the label (e.g. a\n *  `log::info!(\"{}\", master)` call site upstream that prints only the\n *  hex). Bounded at 64+ to avoid false-positives on shorter hex like\n *  4-byte chain ids or 8-byte object-id prefixes; legitimate Sui\n *  object ids are 32 bytes (64 hex chars) and would also trip the\n *  rule — acceptable, since a redacted object id is a tractable\n *  diagnostic regression while a leaked master key is not.\n *\n *  Boundary shape: negative lookbehind/lookahead against the hex class\n *  itself (NOT `\\b`). The `\\b` form had a known gap — `0x<hex>` and\n *  `<word-prefix>0x<hex>` failed to match because `0` and `x` are\n *  both `\\w` characters, so `\\b` couldn't anchor at the start of the\n *  hex run. The lookbehind form starts the match anywhere not\n *  preceded by a hex character, so an adversarial concat like\n *  `...key0xdeadbeef…` redacts the hex run starting right after the\n *  non-hex `x`. */\nconst HIGH_ENTROPY_HEX_RE = /(?<![0-9a-fA-F])[0-9a-fA-F]{64,}(?![0-9a-fA-F])/g;\n\nconst MASTER_KEY_REDACTION_RULES: ReadonlyArray<RedactionRule> = [\n\t// Order matters: redact the labeled line first (replaces the whole\n\t// line including the hex), then the standalone-hex pass picks up\n\t// anything left over. Because the first pass replaces the full line\n\t// with a fixed literal containing no hex, the second pass cannot\n\t// double-replace.\n\t{\n\t\tkind: 'pattern',\n\t\tpattern: MASTER_KEY_LINE_RE,\n\t\treplacement: '[REDACTED master key]',\n\t},\n\t{\n\t\tkind: 'pattern',\n\t\tpattern: HIGH_ENTROPY_HEX_RE,\n\t\treplacement: '<REDACTED-HEX-RUN>',\n\t},\n];\n\n/** Replace any line containing `master_key` / `master-key` / `masterkey`\n *  (case-insensitive) with `[REDACTED master key]`, AND any standalone\n *  hex run of 64+ chars with `<REDACTED-HEX-RUN>`. Used at every site\n *  that may surface stdout/stderr from `seal-cli`. */\nexport const redactMasterKey = (s: string): string => redactText(s, MASTER_KEY_REDACTION_RULES);\n\n// ---------------------------------------------------------------------------\n// Output parser — distilled-doc §\"Helpers\"\n// ---------------------------------------------------------------------------\n\n/** Parse `Master key:` / `Public key:` hex lines from `seal-cli genkey`\n *  stdout. Hex prefix may or may not include `0x` (we strip it).\n *\n *  Returns a typed `PersistedBlsKeypair` on success, or fails with a\n *  `SealError({phase: 'keygen'})` carrying the REDACTED tail of the\n *  stdout so a parser drift doesn't leak the master key into logs. */\nexport const parseSealKeygenOutput = (\n\tstdout: string,\n\tname: string,\n): Effect.Effect<PersistedBlsKeypair, SealError> => {\n\tconst stripHex = (s: string): string => (s.startsWith('0x') ? s.slice(2) : s);\n\t// Bounded widths — BLS12-381 master is 32 bytes (64 hex chars);\n\t// public key is 96 bytes uncompressed G2 (192 hex chars). The\n\t// trailing `\\b` prevents a greedy slurp if the upstream binary\n\t// ever prints adjacent hex on the same line.\n\tconst masterMatch = stdout.match(/Master key:\\s*(0x)?([0-9a-fA-F]{64})\\b/);\n\tconst publicMatch = stdout.match(/Public key:\\s*(0x)?([0-9a-fA-F]{192})\\b/);\n\tif (!masterMatch || !publicMatch) {\n\t\treturn Effect.fail(\n\t\t\tsealError('keygen', {\n\t\t\t\tname,\n\t\t\t\tmessage:\n\t\t\t\t\t'seal.keygen: could not parse seal-cli genkey output (Master key: / Public key: lines missing)',\n\t\t\t\tstdout: redactMasterKey(stdout),\n\t\t\t}),\n\t\t);\n\t}\n\treturn Effect.succeed({\n\t\tmasterKey: stripHex(masterMatch[2]!),\n\t\tpublicKey: stripHex(publicMatch[2]!),\n\t} satisfies PersistedBlsKeypair);\n};\n\n// ---------------------------------------------------------------------------\n// Real keygen one-shot\n// ---------------------------------------------------------------------------\n\n/** Run `seal-cli genkey` inside the cargo-built seal image and\n *  parse the BLS12-381 master + public keys.\n *\n *  Implementation:\n *   1. `runtime.runOneShot({ image, entrypoint: 'seal-cli', argv:\n *      ['genkey'], timeoutMillis: 30s })` — fresh `docker run --rm`.\n *   2. Promote non-zero exit to typed SealError with REDACTED tails.\n *   3. Parse stdout via `parseSealKeygenOutput`.\n *\n *  Distilled-doc invariant #16 — every stdout/stderr capture site\n *  passes through `redactMasterKey` BEFORE landing in the error. The\n *  parser handles the success-path; the failure path does its own\n *  redact at the raise site. */\nexport const runSealKeygen = (\n\truntime: ContainerRuntime,\n\tname: string,\n\timage: ImageRef,\n): Effect.Effect<PersistedBlsKeypair, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst result = yield* runtime\n\t\t\t.runOneShot({\n\t\t\t\timage,\n\t\t\t\tentrypoint: SEAL_KEYGEN_ENTRYPOINT,\n\t\t\t\targv: SEAL_KEYGEN_ARGS,\n\t\t\t\ttimeoutMillis: KEYGEN_TIMEOUT_MS,\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\tsealError('keygen', {\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tmessage: `seal-cli genkey one-shot failed: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\n\t\tif (result.exitCode !== 0) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('keygen', {\n\t\t\t\t\tname,\n\t\t\t\t\tmessage: `seal-cli genkey exited with code ${result.exitCode}`,\n\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\t// Defense-in-depth — the redactor handles success-path\n\t\t\t\t\t// output (where the key is the parsed value) but the\n\t\t\t\t\t// failure path's stdout MAY also carry the key, e.g.\n\t\t\t\t\t// when stderr says \"wrote master key to <log>\".\n\t\t\t\t\tstdout: redactMasterKey(result.stdout),\n\t\t\t\t\tstderr: redactMasterKey(result.stderr),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\treturn yield* parseSealKeygenOutput(result.stdout, name);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.keygen.oneShot', {\n\t\t\tattributes: { [SealSpans.name]: name },\n\t\t}),\n\t\tEffect.timeoutOrElse({\n\t\t\tduration: Duration.millis(KEYGEN_TIMEOUT_MS + 5_000),\n\t\t\torElse: () =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tsealError('keygen', {\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tmessage: `seal.keygen: outer timeout ${KEYGEN_TIMEOUT_MS}ms exceeded`,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t}),\n\t);\n"],"mappings":";;;;;;;AAyBA,MAAa,yBAAyB;;AAGtC,MAAa,mBAAmB,CAAC,SAAS;;AAG1C,MAAa,8BAA8B;;AAG3C,MAAa,6BAA6B;;;;AAK1C,MAAM,oBAAoB;AA6C1B,MAAM,6BAA2D,CAMhE;CACC,MAAM;CACN,SAAS;CACT,aAAa;CACb,EACD;CACC,MAAM;CACN,SAAS;CACT,aAAa;CACb,CACD;;;;;AAMD,MAAa,mBAAmB,MAAsB,WAAW,GAAG,2BAA2B;;;;;;;AAY/F,MAAa,yBACZ,QACA,SACmD;CACnD,MAAM,YAAY,MAAuB,EAAE,WAAW,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG;CAK3E,MAAM,cAAc,OAAO,MAAM,yCAAyC;CAC1E,MAAM,cAAc,OAAO,MAAM,0CAA0C;AAC3E,KAAI,CAAC,eAAe,CAAC,YACpB,QAAO,OAAO,KACb,UAAU,UAAU;EACnB;EACA,SACC;EACD,QAAQ,gBAAgB,OAAO;EAC/B,CAAC,CACF;AAEF,QAAO,OAAO,QAAQ;EACrB,WAAW,SAAS,YAAY,GAAI;EACpC,WAAW,SAAS,YAAY,GAAI;EACpC,CAA+B;;;;;;;;;;;;;;;AAoBjC,MAAa,iBACZ,SACA,MACA,UAEA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,QACpB,WAAW;EACX;EACA,YAAY;EACZ,MAAM;EACN,eAAe;EACf,CAAC,CACD,KACA,OAAO,OAAO,UACb,OAAO,KACN,UAAU,UAAU;EACnB;EACA,SAAS,oCAAoC,MAAM,OAAO,IAAI,MAAM;EACpE;EACA,CAAC,CACF,CACD,CACD;AAEF,KAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,UAAU,UAAU;EACnB;EACA,SAAS,oCAAoC,OAAO;EACpD,UAAU,OAAO;EAKjB,QAAQ,gBAAgB,OAAO,OAAO;EACtC,QAAQ,gBAAgB,OAAO,OAAO;EACtC,CAAC,CACF;AAGF,QAAO,OAAO,sBAAsB,OAAO,QAAQ,KAAK;EACvD,CAAC,KACF,OAAO,SAAS,uCAAuC,EACtD,YAAY,GAAG,UAAU,OAAO,MAAM,EACtC,CAAC,EACF,OAAO,cAAc;CACpB,UAAU,SAAS,OAAO,oBAAoB,IAAM;CACpD,cACC,OAAO,KACN,UAAU,UAAU;EACnB;EACA,SAAS,8BAA8B,kBAAkB;EACzD,CAAC,CACF;CACF,CAAC,CACF"}

package/dist/plugins/seal/mode/fork-known.mjs

@@ -1,23 +1,45 @@
-import { sealError } from "../errors.mjs";
-import { acquireLive } from "./live.mjs";
-import { Effect } from "effect";
+import { acquireLive, validateLiveInputs } from "./live.mjs";
+import "effect";
 //#region src/plugins/seal/mode/fork-known.ts
 /** Resolve the wrapped upstream's known deployment key. Distilled-
 *  doc invariant #13. */
 const resolveDeploymentNetwork = (upstream) => upstream;
-/** Acquire body for the fork-known mode. Delegates to live mode
-*  with the resolved network. */
+/** Resolve the fork-known overrides + upstream-derived defaults into
+*  a validated tuple. Pure synchronous projection — mirrors the
+*  factory-boundary `validateLiveInputs` call in `index.ts` for the
+*  live branch. Throws on missing fields after fallback (matches the
+*  live branch's behaviour — see `validateLiveInputs`). */
+const validateForkKnownInputs = (inputs) => {
+	try {
+		return validateLiveInputs({
+			name: inputs.name,
+			network: resolveDeploymentNetwork(inputs.upstream),
+			objectId: inputs.objectId,
+			keyServerUrl: inputs.keyServerUrl
+		});
+	} catch (err) {
+		if (isSealConfigError(err)) throw {
+			...err,
+			message: `seal.fork-known (upstream=${inputs.upstream}): ${err.message}`
+		};
+		throw err;
+	}
+};
+const isSealConfigError = (value) => typeof value === "object" && value !== null && value._tag === "SealConfigError" && typeof value.message === "string";
+/** Acquire body for the fork-known mode. Inputs already pre-validated
+*  by the barrel via `validateForkKnownInputs`; delegates the
+*  read-side projection to live mode. The `upstream` field rides
+*  through for downstream span attribution.
+*
+*  Error channel kept typed as `SealError` for forward-compatibility
+*  with any future fallible work this body needs to do (currently
+*  `acquireLive` is `Effect.sync` so the channel is effectively
+*  `never`). */
 const acquireForkKnown = (inputs) => acquireLive({
 	name: inputs.name,
-	network: resolveDeploymentNetwork(inputs.upstream),
-	objectId: inputs.objectId,
-	keyServerUrl: inputs.keyServerUrl
-}).pipe(Effect.mapError((err) => sealError("seal", {
-	name: inputs.name,
-	message: `seal.fork-known (upstream=${inputs.upstream}): ${err.message}`,
-	cause: err
-})));
+	resolved: inputs.resolved
+});
 //#endregion
-export { acquireForkKnown };
+export { acquireForkKnown, validateForkKnownInputs };
 
 //# sourceMappingURL=fork-known.mjs.map

package/dist/plugins/seal/mode/fork-known.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"fork-known.mjs","names":[],"sources":["../../../../src/plugins/seal/mode/fork-known.ts"],"sourcesContent":["// Seal fork-known mode — *-fork networks route to the wrapped\n// upstream's known key-server deployment.\n//\n// Distilled-doc §\"Startup — `sealKnownKeyServer` (testnet / mainnet\n// / fork)\": structurally IDENTICAL to live mode. The only difference\n// is the network resolver step at the barrel — `*-fork` networks\n// route to the wrapped upstream (mainnet-fork → mainnet,\n// testnet-fork → testnet, devnet-fork → devnet) BEFORE the\n// known-deployment lookup fires.\n//\n// Distilled-doc invariant #13: `Seal()` on `*-fork` MUST route to\n// `sealKnownKeyServer` with the wrapped upstream's deployment. The\n// barrel (`index.ts`) enforces this via `resolveDeploymentNetwork`;\n// this file's mode body simply consumes the resolved network the\n// barrel passed.\n//\n// The mode body re-uses `acquireLive` since the boot pipeline is\n// identical. We expose a distinct factory only so the mode-narrowed\n// factory namespace (`sealFor(network).forkKnown(opts)`) can\n// route by mode without leaking the live-mode internals.\n\nimport { Effect } from 'effect';\n\nimport { acquireLive, type KnownNetwork } from './live.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport type { SealKnownResolved } from '../registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Fork → upstream network mapping\n// ---------------------------------------------------------------------------\n\n/** Map a fork upstream to its known-deployment lookup target. */\nexport type ForkUpstream = 'mainnet' | 'testnet' | 'devnet';\n\n/** Resolve the wrapped upstream's known deployment key. Distilled-\n *  doc invariant #13. */\nexport const resolveDeploymentNetwork = (upstream: ForkUpstream): KnownNetwork => upstream;\n\n// ---------------------------------------------------------------------------\n// Inputs\n// ---------------------------------------------------------------------------\n\nexport interface ForkKnownInputs {\n\treadonly name: string;\n\treadonly upstream: ForkUpstream;\n\t/** Explicit overrides (rare — the wrapped upstream's known\n\t *  deployment is usually authoritative). */\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Mode acquire\n// ---------------------------------------------------------------------------\n\n/** Acquire body for the fork-known mode. Delegates to live mode\n *  with the resolved network. */\nexport const acquireForkKnown = (\n\tinputs: ForkKnownInputs,\n): Effect.Effect<SealKnownResolved, SealError> =>\n\tacquireLive({\n\t\tname: inputs.name,\n\t\tnetwork: resolveDeploymentNetwork(inputs.upstream),\n\t\tobjectId: inputs.objectId,\n\t\tkeyServerUrl: inputs.keyServerUrl,\n\t}).pipe(\n\t\t// Re-tag the error so the cause walker can attribute fork-mode\n\t\t// failures distinctly from live-mode failures.\n\t\tEffect.mapError((err) =>\n\t\t\tsealError('seal', {\n\t\t\t\tname: inputs.name,\n\t\t\t\tmessage: `seal.fork-known (upstream=${inputs.upstream}): ${err.message}`,\n\t\t\t\tcause: err,\n\t\t\t}),\n\t\t),\n\t);\n"],"mappings":";;;;;;AAoCA,MAAa,4BAA4B,aAAyC;;;AAqBlF,MAAa,oBACZ,WAEA,YAAY;CACX,MAAM,OAAO;CACb,SAAS,yBAAyB,OAAO,SAAS;CAClD,UAAU,OAAO;CACjB,cAAc,OAAO;CACrB,CAAC,CAAC,KAGF,OAAO,UAAU,QAChB,UAAU,QAAQ;CACjB,MAAM,OAAO;CACb,SAAS,6BAA6B,OAAO,SAAS,KAAK,IAAI;CAC/D,OAAO;CACP,CAAC,CACF,CACD"}
+{"version":3,"file":"fork-known.mjs","names":[],"sources":["../../../../src/plugins/seal/mode/fork-known.ts"],"sourcesContent":["// Seal fork-known mode — *-fork networks route to the wrapped\n// upstream's known key-server deployment.\n//\n// Distilled-doc §\"Startup — `sealKnownKeyServer` (testnet / mainnet\n// / fork)\": structurally IDENTICAL to live mode. The only difference\n// is the network resolver step at the barrel — `*-fork` networks\n// route to the wrapped upstream (mainnet-fork → mainnet,\n// testnet-fork → testnet, devnet-fork → devnet) BEFORE the\n// known-deployment lookup fires.\n//\n// Distilled-doc invariant #13: `Seal()` on `*-fork` MUST route to\n// `sealKnownKeyServer` with the wrapped upstream's deployment. The\n// barrel (`index.ts`) enforces this via `resolveDeploymentNetwork`;\n// this file's mode body simply consumes the resolved network the\n// barrel passed.\n//\n// The mode body re-uses `acquireLive` since the boot pipeline is\n// identical. We expose a distinct factory only so the mode-narrowed\n// factory namespace (`sealFor(network).forkKnown(opts)`) can\n// route by mode without leaking the live-mode internals.\n\nimport { Effect } from 'effect';\n\nimport { acquireLive, validateLiveInputs, type KnownNetwork } from './live.ts';\nimport type { SealError } from '../errors.ts';\nimport type { SealKnownResolved } from '../registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Fork → upstream network mapping\n// ---------------------------------------------------------------------------\n\n/** Map a fork upstream to its known-deployment lookup target. */\nexport type ForkUpstream = 'mainnet' | 'testnet' | 'devnet';\n\n/** Resolve the wrapped upstream's known deployment key. Distilled-\n *  doc invariant #13. */\nexport const resolveDeploymentNetwork = (upstream: ForkUpstream): KnownNetwork => upstream;\n\n// ---------------------------------------------------------------------------\n// Inputs\n// ---------------------------------------------------------------------------\n\n/** Pre-validated fork-known inputs. Symmetric with the live mode's\n *  `{ name, resolved }` shape — the barrel resolves\n *  `upstream → KnownNetwork → validated tuple` synchronously at\n *  factory time so both branches reach `acquireLive` with the same\n *  structural envelope. */\nexport interface ForkKnownInputs {\n\treadonly name: string;\n\treadonly upstream: ForkUpstream;\n\treadonly resolved: { readonly objectId: string; readonly keyServerUrl: string };\n}\n\n/** Resolve the fork-known overrides + upstream-derived defaults into\n *  a validated tuple. Pure synchronous projection — mirrors the\n *  factory-boundary `validateLiveInputs` call in `index.ts` for the\n *  live branch. Throws on missing fields after fallback (matches the\n *  live branch's behaviour — see `validateLiveInputs`). */\nexport const validateForkKnownInputs = (inputs: {\n\treadonly name: string;\n\treadonly upstream: ForkUpstream;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}): { readonly objectId: string; readonly keyServerUrl: string } => {\n\ttry {\n\t\treturn validateLiveInputs({\n\t\t\tname: inputs.name,\n\t\t\tnetwork: resolveDeploymentNetwork(inputs.upstream),\n\t\t\tobjectId: inputs.objectId,\n\t\t\tkeyServerUrl: inputs.keyServerUrl,\n\t\t});\n\t} catch (err) {\n\t\t// Re-throw the original tagged error so downstream\n\t\t// `Effect.catchTag('SealConfigError', …)` still matches.\n\t\t// Wrapping in `new Error(…)` would strip the `_tag` and turn\n\t\t// the typed refusal into an untyped runtime crash. Prepend the\n\t\t// upstream context to the message in-place instead.\n\t\tif (isSealConfigError(err)) {\n\t\t\tthrow {\n\t\t\t\t...err,\n\t\t\t\tmessage: `seal.fork-known (upstream=${inputs.upstream}): ${err.message}`,\n\t\t\t};\n\t\t}\n\t\tthrow err;\n\t}\n};\n\nconst isSealConfigError = (\n\tvalue: unknown,\n): value is { readonly _tag: 'SealConfigError'; readonly message: string; [k: string]: unknown } =>\n\ttypeof value === 'object' &&\n\tvalue !== null &&\n\t(value as { _tag?: unknown })._tag === 'SealConfigError' &&\n\ttypeof (value as { message?: unknown }).message === 'string';\n\n// ---------------------------------------------------------------------------\n// Mode acquire\n// ---------------------------------------------------------------------------\n\n/** Acquire body for the fork-known mode. Inputs already pre-validated\n *  by the barrel via `validateForkKnownInputs`; delegates the\n *  read-side projection to live mode. The `upstream` field rides\n *  through for downstream span attribution.\n *\n *  Error channel kept typed as `SealError` for forward-compatibility\n *  with any future fallible work this body needs to do (currently\n *  `acquireLive` is `Effect.sync` so the channel is effectively\n *  `never`). */\nexport const acquireForkKnown = (\n\tinputs: ForkKnownInputs,\n): Effect.Effect<SealKnownResolved, SealError> =>\n\tacquireLive({ name: inputs.name, resolved: inputs.resolved });\n"],"mappings":";;;;;AAoCA,MAAa,4BAA4B,aAAyC;;;;;;AAsBlF,MAAa,2BAA2B,WAK4B;AACnE,KAAI;AACH,SAAO,mBAAmB;GACzB,MAAM,OAAO;GACb,SAAS,yBAAyB,OAAO,SAAS;GAClD,UAAU,OAAO;GACjB,cAAc,OAAO;GACrB,CAAC;UACM,KAAK;AAMb,MAAI,kBAAkB,IAAI,CACzB,OAAM;GACL,GAAG;GACH,SAAS,6BAA6B,OAAO,SAAS,KAAK,IAAI;GAC/D;AAEF,QAAM;;;AAIR,MAAM,qBACL,UAEA,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS,qBACvC,OAAQ,MAAgC,YAAY;;;;;;;;;;AAerD,MAAa,oBACZ,WAEA,YAAY;CAAE,MAAM,OAAO;CAAM,UAAU,OAAO;CAAU,CAAC"}

package/dist/plugins/seal/mode/live.d.mts

@@ -2,12 +2,14 @@ import { Effect } from "effect";
 
 //#region src/plugins/seal/mode/live.d.ts
 /** Closed set of known deployments. `mainnet` + `devnet` intentionally
- *  null (distilled-doc cross-ref). v2 plans should canonicalize this
- *  table — for now we mirror v3's structure. */
+ *  null (no public default key server). `testnet` carries the public
+ *  key-server URL but `keyServerObjectId` is `null` until a real id is
+ *  sourced — `validateLiveInputs` forces the caller to supply
+ *  `objectId` explicitly in that case. */
 declare const KNOWN_DEPLOYMENTS: {
   readonly testnet: {
-    readonly keyServerObjectId: string;
-    readonly keyServerUrl: "https://seal-keyserver.testnet.mystenlabs.com";
+    readonly keyServerObjectId: string | null;
+    readonly keyServerUrl: string;
   };
   readonly mainnet: null;
   readonly devnet: null;

package/dist/plugins/seal/mode/live.mjs

@@ -1,13 +1,15 @@
 import { expectNonEmptyString } from "../../../substrate/runtime/config-validation.mjs";
-import { sealConfigError, sealError } from "../errors.mjs";
+import { sealConfigError } from "../errors.mjs";
 import { Effect } from "effect";
 //#region src/plugins/seal/mode/live.ts
 /** Closed set of known deployments. `mainnet` + `devnet` intentionally
-*  null (distilled-doc cross-ref). v2 plans should canonicalize this
-*  table — for now we mirror v3's structure. */
+*  null (no public default key server). `testnet` carries the public
+*  key-server URL but `keyServerObjectId` is `null` until a real id is
+*  sourced — `validateLiveInputs` forces the caller to supply
+*  `objectId` explicitly in that case. */
 const KNOWN_DEPLOYMENTS = {
 	testnet: {
-		keyServerObjectId: "0x000000000000000000000000000000000000000000000000000000000000mysten",
+		keyServerObjectId: null,
 		keyServerUrl: "https://seal-keyserver.testnet.mystenlabs.com"
 	},
 	mainnet: null,
@@ -35,27 +37,18 @@ const validateLiveInputs = (inputs) => {
 		})
 	};
 };
-/** Acquire body for the live mode. Returns the read-side handle
-*  ONLY (no manager tag — distilled-doc invariant #15). */
-const acquireLive = (inputs) => Effect.gen(function* () {
-	let resolved;
-	try {
-		resolved = validateLiveInputs(inputs);
-	} catch (err) {
-		if (typeof err === "object" && err !== null && "_tag" in err && err._tag === "SealConfigError") return yield* Effect.fail(err);
-		return yield* Effect.fail(sealError("seal", {
-			name: inputs.name,
-			message: err instanceof Error ? err.message : String(err),
-			cause: err
-		}));
-	}
+/** Acquire body for the live mode. Validation already ran at the
+*  factory boundary (see `index.ts:buildLivePlugin`); this projects
+*  the validated bundle into the resolved shape. Returns the
+*  read-side handle ONLY (no manager tag — distilled-doc invariant #15). */
+const acquireLive = (inputs) => Effect.sync(() => {
 	return { keyServer: {
 		serverConfigs: [{
-			objectId: resolved.objectId,
+			objectId: inputs.resolved.objectId,
 			weight: 1
 		}],
-		keyServerUrl: resolved.keyServerUrl,
-		objectId: resolved.objectId
+		keyServerUrl: inputs.resolved.keyServerUrl,
+		objectId: inputs.resolved.objectId
 	} };
 });
 //#endregion

package/dist/plugins/seal/mode/live.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"live.mjs","names":[],"sources":["../../../../src/plugins/seal/mode/live.ts"],"sourcesContent":["// Seal live mode — testnet / mainnet known key server.\n//\n// Distilled-doc §\"Startup — `sealKnownKeyServer`\": far simpler than\n// the local-keygen path.\n//\n//   1. Look up the known deployment (or accept explicit overrides).\n//   2. Publish the endpoint + state-store entry to the substrate\n//      registries (the codegen + manifest emitters consume these).\n//   3. Return the read-side handle.\n//\n// NO chain interactions, NO docker, NO state-store writes, NO\n// keygen. Distilled-doc invariant #15 — the manager tag is NOT\n// produced (we don't own the master key for a remote deployment).\n//\n// Known-deployment lookup: distilled-doc §\"Adjacent Seal references\"\n// → `engine/known-deployments.ts:153-157` carries the\n// `mysten-testnet-1` Open-mode independent server. `mainnet`\n// intentionally empty (Mysten doesn't ship a public default key\n// server on mainnet — production is via Enoki). `devnet`\n// intentionally empty.\n\nimport { Effect } from 'effect';\n\nimport { expectNonEmptyString } from '../../../substrate/runtime/config-validation.ts';\nimport { sealConfigError, sealError, type SealAnyError } from '../errors.ts';\nimport type { SealKeyServerEntry, SealKnownResolved } from '../registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Known-deployment table — distilled-doc reference\n// ---------------------------------------------------------------------------\n\n/** Closed set of known deployments. `mainnet` + `devnet` intentionally\n *  null (distilled-doc cross-ref). v2 plans should canonicalize this\n *  table — for now we mirror v3's structure. */\nexport const KNOWN_DEPLOYMENTS = {\n\ttestnet: {\n\t\tkeyServerObjectId:\n\t\t\t'0x000000000000000000000000000000000000000000000000000000000000mysten' as string,\n\t\tkeyServerUrl: 'https://seal-keyserver.testnet.mystenlabs.com',\n\t},\n\tmainnet: null,\n\tdevnet: null,\n} as const;\n\nexport type KnownNetwork = keyof typeof KNOWN_DEPLOYMENTS;\n\n// ---------------------------------------------------------------------------\n// Inputs\n// ---------------------------------------------------------------------------\n\n/** Live-mode inputs. Either `network` resolves to a known deployment\n *  OR the user supplies explicit `objectId` + `keyServerUrl`\n *  overrides. Distilled-doc §\"Configuration\" — the factory throws\n *  synchronously if neither path produces a usable tuple. */\nexport interface LiveModeInputs {\n\treadonly name: string;\n\treadonly network?: KnownNetwork;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Resolved\n// ---------------------------------------------------------------------------\n\n/** Validate the inputs at the factory boundary. Pure synchronous\n *  function. The plugin `start` body is reserved for Effect-flavored\n *  work; the throw here matches v3's pattern (distilled-doc\n *  §Failure modes). */\nexport const validateLiveInputs = (\n\tinputs: LiveModeInputs,\n): {\n\treadonly objectId: string;\n\treadonly keyServerUrl: string;\n} => {\n\tconst fromNetwork =\n\t\tinputs.network && KNOWN_DEPLOYMENTS[inputs.network] ? KNOWN_DEPLOYMENTS[inputs.network] : null;\n\tconst objectId = inputs.objectId ?? fromNetwork?.keyServerObjectId;\n\tconst keyServerUrl = inputs.keyServerUrl ?? fromNetwork?.keyServerUrl;\n\tconst message = `seal.live: missing required fields. Pass network ('testnet') or set objectId + keyServerUrl explicitly (got network=${String(\n\t\tinputs.network,\n\t)}, objectId=${String(inputs.objectId)}, keyServerUrl=${String(inputs.keyServerUrl)}).`;\n\treturn {\n\t\tobjectId: expectNonEmptyString(objectId, {\n\t\t\tfield: 'objectId',\n\t\t\tmessage,\n\t\t\tmkError: sealConfigError,\n\t\t}),\n\t\tkeyServerUrl: expectNonEmptyString(keyServerUrl, {\n\t\t\tfield: 'keyServerUrl',\n\t\t\tmessage,\n\t\t\tmkError: sealConfigError,\n\t\t}),\n\t};\n};\n\n// ---------------------------------------------------------------------------\n// Mode acquire\n// ---------------------------------------------------------------------------\n\n/** Acquire body for the live mode. Returns the read-side handle\n *  ONLY (no manager tag — distilled-doc invariant #15). */\nexport const acquireLive = (\n\tinputs: LiveModeInputs,\n): Effect.Effect<SealKnownResolved, SealAnyError> =>\n\tEffect.gen(function* () {\n\t\t// Validation runs at the factory layer; here we trust the\n\t\t// validated fields. The substrate's registry publishes happen\n\t\t// at the orchestrator layer (manifest emitter walks the\n\t\t// codegen contributions); this body just returns the resolved\n\t\t// value.\n\t\tlet resolved: { readonly objectId: string; readonly keyServerUrl: string };\n\t\ttry {\n\t\t\tresolved = validateLiveInputs(inputs);\n\t\t} catch (err) {\n\t\t\tif (\n\t\t\t\ttypeof err === 'object' &&\n\t\t\t\terr !== null &&\n\t\t\t\t'_tag' in err &&\n\t\t\t\terr._tag === 'SealConfigError'\n\t\t\t) {\n\t\t\t\treturn yield* Effect.fail(err as SealAnyError);\n\t\t\t}\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tsealError('seal', {\n\t\t\t\t\tname: inputs.name,\n\t\t\t\t\tmessage: err instanceof Error ? err.message : String(err),\n\t\t\t\t\tcause: err,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst serverConfigs: ReadonlyArray<SealKeyServerEntry> = [\n\t\t\t{ objectId: resolved.objectId, weight: 1 },\n\t\t];\n\t\treturn {\n\t\t\tkeyServer: {\n\t\t\t\tserverConfigs,\n\t\t\t\tkeyServerUrl: resolved.keyServerUrl,\n\t\t\t\tobjectId: resolved.objectId,\n\t\t\t},\n\t\t} satisfies SealKnownResolved;\n\t});\n"],"mappings":";;;;;;;AAkCA,MAAa,oBAAoB;CAChC,SAAS;EACR,mBACC;EACD,cAAc;EACd;CACD,SAAS;CACT,QAAQ;CACR;;;;;AA2BD,MAAa,sBACZ,WAII;CACJ,MAAM,cACL,OAAO,WAAW,kBAAkB,OAAO,WAAW,kBAAkB,OAAO,WAAW;CAC3F,MAAM,WAAW,OAAO,YAAY,aAAa;CACjD,MAAM,eAAe,OAAO,gBAAgB,aAAa;CACzD,MAAM,UAAU,uHAAuH,OACtI,OAAO,QACP,CAAC,aAAa,OAAO,OAAO,SAAS,CAAC,iBAAiB,OAAO,OAAO,aAAa,CAAC;AACpF,QAAO;EACN,UAAU,qBAAqB,UAAU;GACxC,OAAO;GACP;GACA,SAAS;GACT,CAAC;EACF,cAAc,qBAAqB,cAAc;GAChD,OAAO;GACP;GACA,SAAS;GACT,CAAC;EACF;;;;AASF,MAAa,eACZ,WAEA,OAAO,IAAI,aAAa;CAMvB,IAAI;AACJ,KAAI;AACH,aAAW,mBAAmB,OAAO;UAC7B,KAAK;AACb,MACC,OAAO,QAAQ,YACf,QAAQ,QACR,UAAU,OACV,IAAI,SAAS,kBAEb,QAAO,OAAO,OAAO,KAAK,IAAoB;AAE/C,SAAO,OAAO,OAAO,KACpB,UAAU,QAAQ;GACjB,MAAM,OAAO;GACb,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GACzD,OAAO;GACP,CAAC,CACF;;AAKF,QAAO,EACN,WAAW;EACV,eAAA,CAJD;GAAE,UAAU,SAAS;GAAU,QAAQ;GAAG,CAI5B;EACb,cAAc,SAAS;EACvB,UAAU,SAAS;EACnB,EACD;EACA"}
+{"version":3,"file":"live.mjs","names":[],"sources":["../../../../src/plugins/seal/mode/live.ts"],"sourcesContent":["// Seal live mode — testnet / mainnet known key server.\n//\n// Distilled-doc §\"Startup — `sealKnownKeyServer`\": far simpler than\n// the local-keygen path.\n//\n//   1. Look up the known deployment (or accept explicit overrides).\n//   2. Publish the endpoint + state-store entry to the substrate\n//      registries (the codegen + manifest emitters consume these).\n//   3. Return the read-side handle.\n//\n// NO chain interactions, NO docker, NO state-store writes, NO\n// keygen. Distilled-doc invariant #15 — the manager tag is NOT\n// produced (we don't own the master key for a remote deployment).\n//\n// Known-deployment lookup: distilled-doc §\"Adjacent Seal references\"\n// → `engine/known-deployments.ts:153-157` carries the\n// `mysten-testnet-1` Open-mode independent server. `mainnet`\n// intentionally empty (Mysten doesn't ship a public default key\n// server on mainnet — production is via Enoki). `devnet`\n// intentionally empty.\n\nimport { Effect } from 'effect';\n\nimport { expectNonEmptyString } from '../../../substrate/runtime/config-validation.ts';\nimport { sealConfigError } from '../errors.ts';\nimport type { SealKeyServerEntry, SealKnownResolved } from '../registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Known-deployment table — distilled-doc reference\n// ---------------------------------------------------------------------------\n\n/** Closed set of known deployments. `mainnet` + `devnet` intentionally\n *  null (no public default key server). `testnet` carries the public\n *  key-server URL but `keyServerObjectId` is `null` until a real id is\n *  sourced — `validateLiveInputs` forces the caller to supply\n *  `objectId` explicitly in that case. */\nexport const KNOWN_DEPLOYMENTS: {\n\treadonly testnet: {\n\t\treadonly keyServerObjectId: string | null;\n\t\treadonly keyServerUrl: string;\n\t};\n\treadonly mainnet: null;\n\treadonly devnet: null;\n} = {\n\ttestnet: {\n\t\tkeyServerObjectId: null,\n\t\tkeyServerUrl: 'https://seal-keyserver.testnet.mystenlabs.com',\n\t},\n\tmainnet: null,\n\tdevnet: null,\n};\n\nexport type KnownNetwork = keyof typeof KNOWN_DEPLOYMENTS;\n\n// ---------------------------------------------------------------------------\n// Inputs\n// ---------------------------------------------------------------------------\n\n/** Live-mode inputs. Either `network` resolves to a known deployment\n *  OR the user supplies explicit `objectId` + `keyServerUrl`\n *  overrides. Distilled-doc §\"Configuration\" — the factory throws\n *  synchronously if neither path produces a usable tuple. */\nexport interface LiveModeInputs {\n\treadonly name: string;\n\treadonly network?: KnownNetwork;\n\treadonly objectId?: string;\n\treadonly keyServerUrl?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Resolved\n// ---------------------------------------------------------------------------\n\n/** Validate the inputs at the factory boundary. Pure synchronous\n *  function. The plugin `start` body is reserved for Effect-flavored\n *  work; the throw here matches v3's pattern (distilled-doc\n *  §Failure modes). */\nexport const validateLiveInputs = (\n\tinputs: LiveModeInputs,\n): {\n\treadonly objectId: string;\n\treadonly keyServerUrl: string;\n} => {\n\tconst fromNetwork =\n\t\tinputs.network && KNOWN_DEPLOYMENTS[inputs.network] ? KNOWN_DEPLOYMENTS[inputs.network] : null;\n\tconst objectId = inputs.objectId ?? fromNetwork?.keyServerObjectId;\n\tconst keyServerUrl = inputs.keyServerUrl ?? fromNetwork?.keyServerUrl;\n\tconst message = `seal.live: missing required fields. Pass network ('testnet') or set objectId + keyServerUrl explicitly (got network=${String(\n\t\tinputs.network,\n\t)}, objectId=${String(inputs.objectId)}, keyServerUrl=${String(inputs.keyServerUrl)}).`;\n\treturn {\n\t\tobjectId: expectNonEmptyString(objectId, {\n\t\t\tfield: 'objectId',\n\t\t\tmessage,\n\t\t\tmkError: sealConfigError,\n\t\t}),\n\t\tkeyServerUrl: expectNonEmptyString(keyServerUrl, {\n\t\t\tfield: 'keyServerUrl',\n\t\t\tmessage,\n\t\t\tmkError: sealConfigError,\n\t\t}),\n\t};\n};\n\n// ---------------------------------------------------------------------------\n// Mode acquire\n// ---------------------------------------------------------------------------\n\n/** Acquire body for the live mode. Validation already ran at the\n *  factory boundary (see `index.ts:buildLivePlugin`); this projects\n *  the validated bundle into the resolved shape. Returns the\n *  read-side handle ONLY (no manager tag — distilled-doc invariant #15). */\nexport const acquireLive = (inputs: {\n\treadonly name: string;\n\treadonly resolved: { readonly objectId: string; readonly keyServerUrl: string };\n}): Effect.Effect<SealKnownResolved> =>\n\tEffect.sync(() => {\n\t\tconst serverConfigs: ReadonlyArray<SealKeyServerEntry> = [\n\t\t\t{ objectId: inputs.resolved.objectId, weight: 1 },\n\t\t];\n\t\treturn {\n\t\t\tkeyServer: {\n\t\t\t\tserverConfigs,\n\t\t\t\tkeyServerUrl: inputs.resolved.keyServerUrl,\n\t\t\t\tobjectId: inputs.resolved.objectId,\n\t\t\t},\n\t\t} satisfies SealKnownResolved;\n\t});\n"],"mappings":";;;;;;;;;AAoCA,MAAa,oBAOT;CACH,SAAS;EACR,mBAAmB;EACnB,cAAc;EACd;CACD,SAAS;CACT,QAAQ;CACR;;;;;AA2BD,MAAa,sBACZ,WAII;CACJ,MAAM,cACL,OAAO,WAAW,kBAAkB,OAAO,WAAW,kBAAkB,OAAO,WAAW;CAC3F,MAAM,WAAW,OAAO,YAAY,aAAa;CACjD,MAAM,eAAe,OAAO,gBAAgB,aAAa;CACzD,MAAM,UAAU,uHAAuH,OACtI,OAAO,QACP,CAAC,aAAa,OAAO,OAAO,SAAS,CAAC,iBAAiB,OAAO,OAAO,aAAa,CAAC;AACpF,QAAO;EACN,UAAU,qBAAqB,UAAU;GACxC,OAAO;GACP;GACA,SAAS;GACT,CAAC;EACF,cAAc,qBAAqB,cAAc;GAChD,OAAO;GACP;GACA,SAAS;GACT,CAAC;EACF;;;;;;AAWF,MAAa,eAAe,WAI3B,OAAO,WAAW;AAIjB,QAAO,EACN,WAAW;EACV,eAAA,CAJD;GAAE,UAAU,OAAO,SAAS;GAAU,QAAQ;GAAG,CAInC;EACb,cAAc,OAAO,SAAS;EAC9B,UAAU,OAAO,SAAS;EAC1B,EACD;EACA"}