@mysten-incubation/devstack 0.1.0 → 0.2.0

package/dist/plugins/package/publish-output.d.mts

@@ -1,7 +1,4 @@
-import { ChainId } from "../../substrate/brand.mjs";
-
 //#region src/plugins/package/publish-output.d.ts
-declare const LOCAL_PACKAGE_PUBLISHED_KIND: "package.local-published";
 interface PackagePublishObjectChange {
   readonly type: 'created' | 'published' | 'mutated' | 'wrapped' | 'transferred';
   readonly objectId?: string;
@@ -16,13 +13,6 @@ interface LocalPackagePublishOutput {
   readonly publisher: string;
   readonly objectChanges: ReadonlyArray<PackagePublishObjectChange>;
 }
-interface LocalPackagePublishedDecl {
-  readonly kind: typeof LOCAL_PACKAGE_PUBLISHED_KIND;
-  readonly packageName: string;
-  readonly packageId: string;
-  readonly chain: ChainId;
-  readonly output: LocalPackagePublishOutput;
-}
 //#endregion
-export { LocalPackagePublishOutput, LocalPackagePublishedDecl, PackagePublishObjectChange };
+export { LocalPackagePublishOutput, PackagePublishObjectChange };
 //# sourceMappingURL=publish-output.d.mts.map

package/dist/plugins/package/publish-output.mjs

@@ -1,12 +1,4 @@
 //#region src/plugins/package/publish-output.ts
-const LOCAL_PACKAGE_PUBLISHED_KIND = "package.local-published";
-const makeLocalPackagePublishedDecl = (inputs) => ({
-	kind: LOCAL_PACKAGE_PUBLISHED_KIND,
-	packageName: inputs.packageName,
-	packageId: inputs.packageId,
-	chain: inputs.chain,
-	output: inputs.output
-});
 const pickPublishedChange = (changes) => changes.find((c) => c.type === "published");
 const pickUpgradeCapChange = (changes) => changes.find((c) => c.type === "created" && (c.objectType?.endsWith("::package::UpgradeCap") ?? false));
 const createdKind = (change) => {
@@ -40,6 +32,6 @@ const pickCreatedByType = (changes, opts) => {
 	}));
 };
 //#endregion
-export { LOCAL_PACKAGE_PUBLISHED_KIND, makeLocalPackagePublishedDecl, pickCreatedByType, pickPublishedChange, pickUpgradeCapChange };
+export { pickCreatedByType, pickPublishedChange, pickUpgradeCapChange };
 
 //# sourceMappingURL=publish-output.mjs.map

package/dist/plugins/package/publish-output.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"publish-output.mjs","names":[],"sources":["../../../src/plugins/package/publish-output.ts"],"sourcesContent":["// Local package publish output.\n//\n// This is package-domain data: the transaction digest plus object-change\n// projection produced by a successful `localPackage(...)` publish.\n\nimport type { ChainId } from '../../substrate/brand.ts';\n\nexport const LOCAL_PACKAGE_PUBLISHED_KIND = 'package.local-published' as const;\n\nexport interface PackagePublishObjectChange {\n\treadonly type: 'created' | 'published' | 'mutated' | 'wrapped' | 'transferred';\n\treadonly objectId?: string;\n\treadonly objectType?: string;\n\treadonly owner?: unknown;\n\treadonly json?: unknown;\n}\n\nexport interface PickCreatedByTypeOptions {\n\treadonly type?: string;\n\treadonly suffix?: string;\n\treadonly contains?: string;\n}\n\nexport interface LocalPackagePublishOutput {\n\treadonly digest: string;\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n\treadonly publisher: string;\n\treadonly objectChanges: ReadonlyArray<PackagePublishObjectChange>;\n}\n\nexport interface LocalPackagePublishedDecl {\n\treadonly kind: typeof LOCAL_PACKAGE_PUBLISHED_KIND;\n\treadonly packageName: string;\n\treadonly packageId: string;\n\treadonly chain: ChainId;\n\treadonly output: LocalPackagePublishOutput;\n}\n\nexport const makeLocalPackagePublishedDecl = (inputs: {\n\treadonly packageName: string;\n\treadonly packageId: string;\n\treadonly chain: ChainId;\n\treadonly output: LocalPackagePublishOutput;\n}): LocalPackagePublishedDecl => ({\n\tkind: LOCAL_PACKAGE_PUBLISHED_KIND,\n\tpackageName: inputs.packageName,\n\tpackageId: inputs.packageId,\n\tchain: inputs.chain,\n\toutput: inputs.output,\n});\n\nexport const pickPublishedChange = (\n\tchanges: ReadonlyArray<PackagePublishObjectChange>,\n): PackagePublishObjectChange | undefined => changes.find((c) => c.type === 'published');\n\nexport const pickUpgradeCapChange = (\n\tchanges: ReadonlyArray<PackagePublishObjectChange>,\n): PackagePublishObjectChange | undefined =>\n\tchanges.find(\n\t\t(c) => c.type === 'created' && (c.objectType?.endsWith('::package::UpgradeCap') ?? false),\n\t);\n\nconst createdKind = (change: unknown): boolean => {\n\tif (change === undefined || change === null) return false;\n\tconst tag = (change as { readonly type?: unknown; readonly kind?: unknown }).type;\n\tconst kind = (change as { readonly kind?: unknown }).kind;\n\treturn tag === 'created' || kind === 'created';\n};\n\nconst objectIdOf = (change: unknown): string | undefined => {\n\tif (change === undefined || change === null) return undefined;\n\tconst objectId = (change as { readonly objectId?: unknown }).objectId;\n\treturn typeof objectId === 'string' ? objectId : undefined;\n};\n\nconst objectTypeOf = (change: unknown): string | undefined => {\n\tif (change === undefined || change === null) return undefined;\n\tconst objectType = (change as { readonly objectType?: unknown }).objectType;\n\treturn typeof objectType === 'string' ? objectType : undefined;\n};\n\nconst matchesType = (objectType: string, opts: PickCreatedByTypeOptions): boolean => {\n\tif (opts.type !== undefined && objectType === opts.type) return true;\n\tif (opts.suffix !== undefined && objectType.endsWith(opts.suffix)) return true;\n\tif (opts.contains !== undefined && objectType.includes(opts.contains)) return true;\n\treturn opts.type === undefined && opts.suffix === undefined && opts.contains === undefined;\n};\n\nexport const pickCreatedByType = (\n\tchanges: ReadonlyArray<unknown> | undefined,\n\topts: PickCreatedByTypeOptions,\n): string | undefined => {\n\tconst found = (changes ?? []).find((change) => {\n\t\tif (!createdKind(change)) return false;\n\t\tif (objectIdOf(change) === undefined) return false;\n\t\tconst objectType = objectTypeOf(change);\n\t\treturn objectType !== undefined && matchesType(objectType, opts);\n\t});\n\treturn objectIdOf(found);\n};\n"],"mappings":";AAOA,MAAa,+BAA+B;AAgC5C,MAAa,iCAAiC,YAKZ;CACjC,MAAM;CACN,aAAa,OAAO;CACpB,WAAW,OAAO;CAClB,OAAO,OAAO;CACd,QAAQ,OAAO;CACf;AAED,MAAa,uBACZ,YAC4C,QAAQ,MAAM,MAAM,EAAE,SAAS,YAAY;AAExF,MAAa,wBACZ,YAEA,QAAQ,MACN,MAAM,EAAE,SAAS,cAAc,EAAE,YAAY,SAAS,wBAAwB,IAAI,OACnF;AAEF,MAAM,eAAe,WAA6B;AACjD,KAAI,WAAW,KAAA,KAAa,WAAW,KAAM,QAAO;CACpD,MAAM,MAAO,OAAgE;CAC7E,MAAM,OAAQ,OAAuC;AACrD,QAAO,QAAQ,aAAa,SAAS;;AAGtC,MAAM,cAAc,WAAwC;AAC3D,KAAI,WAAW,KAAA,KAAa,WAAW,KAAM,QAAO,KAAA;CACpD,MAAM,WAAY,OAA2C;AAC7D,QAAO,OAAO,aAAa,WAAW,WAAW,KAAA;;AAGlD,MAAM,gBAAgB,WAAwC;AAC7D,KAAI,WAAW,KAAA,KAAa,WAAW,KAAM,QAAO,KAAA;CACpD,MAAM,aAAc,OAA6C;AACjE,QAAO,OAAO,eAAe,WAAW,aAAa,KAAA;;AAGtD,MAAM,eAAe,YAAoB,SAA4C;AACpF,KAAI,KAAK,SAAS,KAAA,KAAa,eAAe,KAAK,KAAM,QAAO;AAChE,KAAI,KAAK,WAAW,KAAA,KAAa,WAAW,SAAS,KAAK,OAAO,CAAE,QAAO;AAC1E,KAAI,KAAK,aAAa,KAAA,KAAa,WAAW,SAAS,KAAK,SAAS,CAAE,QAAO;AAC9E,QAAO,KAAK,SAAS,KAAA,KAAa,KAAK,WAAW,KAAA,KAAa,KAAK,aAAa,KAAA;;AAGlF,MAAa,qBACZ,SACA,SACwB;AAOxB,QAAO,YANQ,WAAW,EAAE,EAAE,MAAM,WAAW;AAC9C,MAAI,CAAC,YAAY,OAAO,CAAE,QAAO;AACjC,MAAI,WAAW,OAAO,KAAK,KAAA,EAAW,QAAO;EAC7C,MAAM,aAAa,aAAa,OAAO;AACvC,SAAO,eAAe,KAAA,KAAa,YAAY,YAAY,KAAK;GAE1C,CAAC"}
+{"version":3,"file":"publish-output.mjs","names":[],"sources":["../../../src/plugins/package/publish-output.ts"],"sourcesContent":["// Local package publish output.\n//\n// This is package-domain data: the transaction digest plus object-change\n// projection produced by a successful `localPackage(...)` publish. The\n// package plugin's `start` folds this output's coins into the per-stack\n// CoinRegistry directly (see `discoverPublishedCoins`); there is no\n// custom contribution-decl kind for it.\n\nexport interface PackagePublishObjectChange {\n\treadonly type: 'created' | 'published' | 'mutated' | 'wrapped' | 'transferred';\n\treadonly objectId?: string;\n\treadonly objectType?: string;\n\treadonly owner?: unknown;\n\treadonly json?: unknown;\n}\n\nexport interface PickCreatedByTypeOptions {\n\treadonly type?: string;\n\treadonly suffix?: string;\n\treadonly contains?: string;\n}\n\nexport interface LocalPackagePublishOutput {\n\treadonly digest: string;\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n\treadonly publisher: string;\n\treadonly objectChanges: ReadonlyArray<PackagePublishObjectChange>;\n}\n\nexport const pickPublishedChange = (\n\tchanges: ReadonlyArray<PackagePublishObjectChange>,\n): PackagePublishObjectChange | undefined => changes.find((c) => c.type === 'published');\n\nexport const pickUpgradeCapChange = (\n\tchanges: ReadonlyArray<PackagePublishObjectChange>,\n): PackagePublishObjectChange | undefined =>\n\tchanges.find(\n\t\t(c) => c.type === 'created' && (c.objectType?.endsWith('::package::UpgradeCap') ?? false),\n\t);\n\nconst createdKind = (change: unknown): boolean => {\n\tif (change === undefined || change === null) return false;\n\tconst tag = (change as { readonly type?: unknown; readonly kind?: unknown }).type;\n\tconst kind = (change as { readonly kind?: unknown }).kind;\n\treturn tag === 'created' || kind === 'created';\n};\n\nconst objectIdOf = (change: unknown): string | undefined => {\n\tif (change === undefined || change === null) return undefined;\n\tconst objectId = (change as { readonly objectId?: unknown }).objectId;\n\treturn typeof objectId === 'string' ? objectId : undefined;\n};\n\nconst objectTypeOf = (change: unknown): string | undefined => {\n\tif (change === undefined || change === null) return undefined;\n\tconst objectType = (change as { readonly objectType?: unknown }).objectType;\n\treturn typeof objectType === 'string' ? objectType : undefined;\n};\n\nconst matchesType = (objectType: string, opts: PickCreatedByTypeOptions): boolean => {\n\tif (opts.type !== undefined && objectType === opts.type) return true;\n\tif (opts.suffix !== undefined && objectType.endsWith(opts.suffix)) return true;\n\tif (opts.contains !== undefined && objectType.includes(opts.contains)) return true;\n\treturn opts.type === undefined && opts.suffix === undefined && opts.contains === undefined;\n};\n\nexport const pickCreatedByType = (\n\tchanges: ReadonlyArray<unknown> | undefined,\n\topts: PickCreatedByTypeOptions,\n): string | undefined => {\n\tconst found = (changes ?? []).find((change) => {\n\t\tif (!createdKind(change)) return false;\n\t\tif (objectIdOf(change) === undefined) return false;\n\t\tconst objectType = objectTypeOf(change);\n\t\treturn objectType !== undefined && matchesType(objectType, opts);\n\t});\n\treturn objectIdOf(found);\n};\n"],"mappings":";AA8BA,MAAa,uBACZ,YAC4C,QAAQ,MAAM,MAAM,EAAE,SAAS,WAAW;AAEvF,MAAa,wBACZ,YAEA,QAAQ,MACN,MAAM,EAAE,SAAS,cAAc,EAAE,YAAY,SAAS,uBAAuB,KAAK,MACpF;AAED,MAAM,eAAe,WAA6B;CACjD,IAAI,WAAW,KAAA,KAAa,WAAW,MAAM,OAAO;CACpD,MAAM,MAAO,OAAgE;CAC7E,MAAM,OAAQ,OAAuC;CACrD,OAAO,QAAQ,aAAa,SAAS;AACtC;AAEA,MAAM,cAAc,WAAwC;CAC3D,IAAI,WAAW,KAAA,KAAa,WAAW,MAAM,OAAO,KAAA;CACpD,MAAM,WAAY,OAA2C;CAC7D,OAAO,OAAO,aAAa,WAAW,WAAW,KAAA;AAClD;AAEA,MAAM,gBAAgB,WAAwC;CAC7D,IAAI,WAAW,KAAA,KAAa,WAAW,MAAM,OAAO,KAAA;CACpD,MAAM,aAAc,OAA6C;CACjE,OAAO,OAAO,eAAe,WAAW,aAAa,KAAA;AACtD;AAEA,MAAM,eAAe,YAAoB,SAA4C;CACpF,IAAI,KAAK,SAAS,KAAA,KAAa,eAAe,KAAK,MAAM,OAAO;CAChE,IAAI,KAAK,WAAW,KAAA,KAAa,WAAW,SAAS,KAAK,MAAM,GAAG,OAAO;CAC1E,IAAI,KAAK,aAAa,KAAA,KAAa,WAAW,SAAS,KAAK,QAAQ,GAAG,OAAO;CAC9E,OAAO,KAAK,SAAS,KAAA,KAAa,KAAK,WAAW,KAAA,KAAa,KAAK,aAAa,KAAA;AAClF;AAEA,MAAa,qBACZ,SACA,SACwB;CAOxB,OAAO,YANQ,WAAW,CAAC,EAAA,CAAG,MAAM,WAAW;EAC9C,IAAI,CAAC,YAAY,MAAM,GAAG,OAAO;EACjC,IAAI,WAAW,MAAM,MAAM,KAAA,GAAW,OAAO;EAC7C,MAAM,aAAa,aAAa,MAAM;EACtC,OAAO,eAAe,KAAA,KAAa,YAAY,YAAY,IAAI;CAChE,CACsB,CAAC;AACxB"}

package/dist/plugins/package/registry.d.mts

@@ -1,4 +1,4 @@
-import { Context, Effect, Layer, Stream } from "effect";
+import { Context, Effect, Layer } from "effect";
 
 //#region src/plugins/package/registry.d.ts
 /** Resolved package handle for a local (built + published) package. */

package/dist/plugins/package/registry.mjs

@@ -1,14 +1,29 @@
-import { defineScopedRefMap } from "../../substrate/runtime/scoped-ref-map/service.mjs";
-import "../../substrate/runtime/scoped-ref-map/index.mjs";
-import { Context, Effect, Layer } from "effect";
+import { Context, Effect, Layer, Ref } from "effect";
 //#region src/plugins/package/registry.ts
-const PackageRefMap = defineScopedRefMap("PackageRegistry");
-const wrapRefMap = (refMap) => ({
-	set: refMap.set,
-	find: refMap.find,
-	has: refMap.has,
-	entries: refMap.entries,
-	changes: refMap.changes
+/** Build a self-contained last-write-wins `PackageKey ->
+*  ResolvedPackage` registry over a plain `Ref<Map>`. One entry per
+*  key (each `set` replaces the key's lone entry under a fresh seq),
+*  and `entries` returns pairs ordered by their entry's seq — a
+*  re-set of an existing key advances its seq and re-sorts it to the
+*  end. */
+const makePackageRegistry = () => Effect.gen(function* () {
+	const store = yield* Ref.make(/* @__PURE__ */ new Map());
+	const seqRef = yield* Ref.make(0);
+	return {
+		set: (key, value) => Effect.gen(function* () {
+			const seq = yield* Ref.updateAndGet(seqRef, (n) => n + 1);
+			yield* Ref.update(store, (current) => {
+				const next = new Map(current);
+				next.set(key, {
+					value,
+					seq
+				});
+				return next;
+			});
+		}),
+		find: (key) => Ref.get(store).pipe(Effect.map((state) => state.get(key)?.value ?? null)),
+		entries: () => Ref.get(store).pipe(Effect.map((state) => [...state.entries()].sort(([, a], [, b]) => a.seq - b.seq).map(([key, e]) => [key, e.value])))
+	};
 });
 /** Context.Service tag for the per-stack `PackageRegistry`. Plugins
 *  yield this in their acquire body. */
@@ -17,10 +32,7 @@ var PackageRegistryService = class extends Context.Service()("@devstack/plugins/
 *  scope. Boot wiring (CLI / e2e) provides this once per stack;
 *  every package/coin/wallet/faucet plugin in the stack yields the
 *  SAME instance via Context. */
-const layerPackageRegistry = Layer.effect(PackageRegistryService, Effect.gen(function* () {
-	const refMap = yield* PackageRefMap.Service;
-	return PackageRegistryService.of(wrapRefMap(refMap));
-})).pipe(Layer.provide(PackageRefMap.layer));
+const layerPackageRegistry = Layer.effect(PackageRegistryService, makePackageRegistry().pipe(Effect.map(PackageRegistryService.of)));
 /** Capability-key constant for the per-stack registry — siblings
 *  (Coin, Action, manifest emitter, faucet strategies) look it up
 *  through the StrategyContributor registry. */

package/dist/plugins/package/registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry.mjs","names":[],"sources":["../../../src/plugins/package/registry.ts"],"sourcesContent":["// Per-stack PackageRegistry — owned by the L2 Package plugin.\n//\n// Architecture (ARCHITECTURE.md § Substrate name-blindness): the\n// substrate exposes ONLY the generic `defineScopedRefMap<K, V>` factory;\n// the package-domain shape (`ResolvedLocalPackage` / `ResolvedKnownPackage`)\n// lives here at L2 where it belongs. Two `localPackage(...)` calls in\n// the same stack see the same Service instance (one per stack scope),\n// so cross-plugin lookups stay consistent and warm-restart verify can\n// use the previously-resolved `packageId` as a hint.\n//\n// Wrapper-service pattern (STYLE_GUIDE §6 / \"L2 wrapper-service around\n// defineScopedRefMap\"): the module-private inner `PackageRefMap` is the\n// raw substrate primitive; the publicly-exported `PackageRegistryService`\n// is the L2 wrapper that the rest of the plugin (and external siblings)\n// yield. Today the wrapper only re-exposes the four substrate ops\n// (`set` / `find` / `has` / `entries` + `changes`), but the shape\n// matches Coin's wrapper so future plugin-specific lookups (e.g.\n// `byPublisher`, `byPackageId`) land in one place instead of every\n// consumer reaching into the raw map.\n\nimport { Context, Effect, Layer, type Stream } from 'effect';\n\nimport {\n\tdefineScopedRefMap,\n\ttype ScopedRefMap,\n} from '../../substrate/runtime/scoped-ref-map/index.ts';\n\n/** Resolved package handle for a local (built + published) package. */\nexport interface ResolvedLocalPackage {\n\treadonly kind: 'local';\n\treadonly name: string;\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n\treadonly sourcePath: string;\n\treadonly mvrPlaceholder: string;\n\t/** Captured object ids — keyed by user-declared name. */\n\treadonly captured: Readonly<Record<string, string>>;\n}\n\n/** Resolved package handle for a known (verify-only) package. */\nexport interface ResolvedKnownPackage {\n\treadonly kind: 'known';\n\treadonly name: string;\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n\treadonly mvrPlaceholder: string;\n}\n\nexport type ResolvedPackage = ResolvedLocalPackage | ResolvedKnownPackage;\n\n/** Registry key — the user-declared symbolic package name. Kept as a\n *  type alias (not a brand) because the same string flows verbatim\n *  through `localPackage(name, ...)` / `knownPackage(name, ...)` and\n *  out via `entries()` to consumers (codegen, snapshot identity). */\nexport type PackageKey = string;\n\n/** L2 wrapper shape — the operations exposed on `PackageRegistryService`.\n *  Today these are a 1:1 re-projection of the substrate primitive's\n *  generic `ScopedRefMap<K, V>`; future plugin-specific lookups land\n *  here without forcing every consumer to learn a new shape. */\nexport interface PackageRegistry {\n\treadonly set: (key: PackageKey, value: ResolvedPackage) => Effect.Effect<void>;\n\treadonly find: (key: PackageKey) => Effect.Effect<ResolvedPackage | null>;\n\treadonly has: (key: PackageKey) => Effect.Effect<boolean>;\n\treadonly entries: () => Effect.Effect<ReadonlyArray<readonly [PackageKey, ResolvedPackage]>>;\n\treadonly changes: Stream.Stream<ReadonlyArray<readonly [PackageKey, ResolvedPackage]>>;\n}\n\n// Module-private inner substrate primitive — instantiated once per\n// logical registry. The service identity is namespaced by the `name`\n// argument; substrate stays name-blind (it sees only `K` and `V`).\nconst PackageRefMap = defineScopedRefMap<PackageKey, ResolvedPackage>('PackageRegistry');\n\nconst wrapRefMap = (refMap: ScopedRefMap<PackageKey, ResolvedPackage>): PackageRegistry => ({\n\tset: refMap.set,\n\tfind: refMap.find,\n\thas: refMap.has,\n\tentries: refMap.entries,\n\tchanges: refMap.changes,\n});\n\n/** Context.Service tag for the per-stack `PackageRegistry`. Plugins\n *  yield this in their acquire body. */\nexport class PackageRegistryService extends Context.Service<\n\tPackageRegistryService,\n\tPackageRegistry\n>()('@devstack/plugins/package/PackageRegistry') {}\n\n/** Scope-bound Layer materializing one `PackageRegistry` per stack\n *  scope. Boot wiring (CLI / e2e) provides this once per stack;\n *  every package/coin/wallet/faucet plugin in the stack yields the\n *  SAME instance via Context. */\nexport const layerPackageRegistry: Layer.Layer<PackageRegistryService> = Layer.effect(\n\tPackageRegistryService,\n\tEffect.gen(function* () {\n\t\tconst refMap = yield* PackageRefMap.Service;\n\t\treturn PackageRegistryService.of(wrapRefMap(refMap));\n\t}),\n).pipe(Layer.provide(PackageRefMap.layer));\n\n/** Capability-key constant for the per-stack registry — siblings\n *  (Coin, Action, manifest emitter, faucet strategies) look it up\n *  through the StrategyContributor registry. */\nexport const PACKAGE_REGISTRY_CAPABILITY_KEY = 'package-registry' as const;\n"],"mappings":";;;;AAuEA,MAAM,gBAAgB,mBAAgD,kBAAkB;AAExF,MAAM,cAAc,YAAwE;CAC3F,KAAK,OAAO;CACZ,MAAM,OAAO;CACb,KAAK,OAAO;CACZ,SAAS,OAAO;CAChB,SAAS,OAAO;CAChB;;;AAID,IAAa,yBAAb,cAA4C,QAAQ,SAGjD,CAAC,4CAA4C,CAAC;;;;;AAMjD,MAAa,uBAA4D,MAAM,OAC9E,wBACA,OAAO,IAAI,aAAa;CACvB,MAAM,SAAS,OAAO,cAAc;AACpC,QAAO,uBAAuB,GAAG,WAAW,OAAO,CAAC;EACnD,CACF,CAAC,KAAK,MAAM,QAAQ,cAAc,MAAM,CAAC;;;;AAK1C,MAAa,kCAAkC"}
+{"version":3,"file":"registry.mjs","names":[],"sources":["../../../src/plugins/package/registry.ts"],"sourcesContent":["// Per-stack PackageRegistry — owned by the L2 Package plugin.\n//\n// The package-domain shape (`ResolvedLocalPackage` /\n// `ResolvedKnownPackage`) lives here at L2 where it belongs. Two\n// `localPackage(...)` calls in the same stack see the same Service\n// instance (one per stack scope), so cross-plugin lookups stay\n// consistent and warm-restart verify can use the previously-resolved\n// `packageId` as a hint.\n//\n// Storage: a self-contained last-write-wins `PackageKey ->\n// ResolvedPackage` map over a plain `Ref<Map>` (formerly the\n// substrate `defineScopedRefMap` single mode, which had exactly two\n// consumers — coin + package — so it was strangled out and inlined\n// here). LWW semantics: each `set` stamps a fresh monotonic `seq`\n// and replaces the key's lone entry (one entry per key); `entries`\n// orders keys by their entry's seq, so a re-set advances the key's\n// seq and sorts it to the end.\n\nimport { Context, Effect, Layer, Ref } from 'effect';\n\n/** Resolved package handle for a local (built + published) package. */\nexport interface ResolvedLocalPackage {\n\treadonly kind: 'local';\n\treadonly name: string;\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n\treadonly sourcePath: string;\n\treadonly mvrPlaceholder: string;\n\t/** Captured object ids — keyed by user-declared name. */\n\treadonly captured: Readonly<Record<string, string>>;\n}\n\n/** Resolved package handle for a known (verify-only) package. */\nexport interface ResolvedKnownPackage {\n\treadonly kind: 'known';\n\treadonly name: string;\n\treadonly packageId: string;\n\treadonly upgradeCapId?: string;\n\treadonly mvrPlaceholder: string;\n}\n\nexport type ResolvedPackage = ResolvedLocalPackage | ResolvedKnownPackage;\n\n/** Registry key — the user-declared symbolic package name. Kept as a\n *  type alias (not a brand) because the same string flows verbatim\n *  through `localPackage(name, ...)` / `knownPackage(name, ...)` and\n *  out via `entries()` to consumers (codegen, snapshot identity). */\nexport type PackageKey = string;\n\n/** L2 registry shape — the operations exposed on\n *  `PackageRegistryService`. A last-write-wins `PackageKey ->\n *  ResolvedPackage` map, namespaced to the package domain so\n *  consumers share one shape. */\nexport interface PackageRegistry {\n\treadonly set: (key: PackageKey, value: ResolvedPackage) => Effect.Effect<void>;\n\treadonly find: (key: PackageKey) => Effect.Effect<ResolvedPackage | null>;\n\treadonly entries: () => Effect.Effect<ReadonlyArray<readonly [PackageKey, ResolvedPackage]>>;\n}\n\n/** One stored entry: the package plus the monotonic `seq` the last\n *  `set` stamped it with. The `seq` drives last-write-wins (highest\n *  seq under a key wins) and `entries` insertion order. */\ninterface SeqEntry {\n\treadonly value: ResolvedPackage;\n\treadonly seq: number;\n}\n\n/** Build a self-contained last-write-wins `PackageKey ->\n *  ResolvedPackage` registry over a plain `Ref<Map>`. One entry per\n *  key (each `set` replaces the key's lone entry under a fresh seq),\n *  and `entries` returns pairs ordered by their entry's seq — a\n *  re-set of an existing key advances its seq and re-sorts it to the\n *  end. */\nconst makePackageRegistry = (): Effect.Effect<PackageRegistry> =>\n\tEffect.gen(function* () {\n\t\tconst store = yield* Ref.make<ReadonlyMap<PackageKey, SeqEntry>>(new Map());\n\t\tconst seqRef = yield* Ref.make(0);\n\n\t\treturn {\n\t\t\tset: (key, value) =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst seq = yield* Ref.updateAndGet(seqRef, (n) => n + 1);\n\t\t\t\t\tyield* Ref.update(store, (current) => {\n\t\t\t\t\t\tconst next = new Map(current);\n\t\t\t\t\t\tnext.set(key, { value, seq });\n\t\t\t\t\t\treturn next;\n\t\t\t\t\t});\n\t\t\t\t}),\n\t\t\tfind: (key) => Ref.get(store).pipe(Effect.map((state) => state.get(key)?.value ?? null)),\n\t\t\tentries: () =>\n\t\t\t\tRef.get(store).pipe(\n\t\t\t\t\tEffect.map((state) =>\n\t\t\t\t\t\t[...state.entries()]\n\t\t\t\t\t\t\t.sort(([, a], [, b]) => a.seq - b.seq)\n\t\t\t\t\t\t\t.map(([key, e]) => [key, e.value] as const),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t};\n\t});\n\n/** Context.Service tag for the per-stack `PackageRegistry`. Plugins\n *  yield this in their acquire body. */\nexport class PackageRegistryService extends Context.Service<\n\tPackageRegistryService,\n\tPackageRegistry\n>()('@devstack/plugins/package/PackageRegistry') {}\n\n/** Scope-bound Layer materializing one `PackageRegistry` per stack\n *  scope. Boot wiring (CLI / e2e) provides this once per stack;\n *  every package/coin/wallet/faucet plugin in the stack yields the\n *  SAME instance via Context. */\nexport const layerPackageRegistry: Layer.Layer<PackageRegistryService> = Layer.effect(\n\tPackageRegistryService,\n\tmakePackageRegistry().pipe(Effect.map(PackageRegistryService.of)),\n);\n\n/** Capability-key constant for the per-stack registry — siblings\n *  (Coin, Action, manifest emitter, faucet strategies) look it up\n *  through the StrategyContributor registry. */\nexport const PACKAGE_REGISTRY_CAPABILITY_KEY = 'package-registry' as const;\n"],"mappings":";;;;;;;;AAyEA,MAAM,4BACL,OAAO,IAAI,aAAa;CACvB,MAAM,QAAQ,OAAO,IAAI,qBAAwC,IAAI,IAAI,CAAC;CAC1E,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;CAEhC,OAAO;EACN,MAAM,KAAK,UACV,OAAO,IAAI,aAAa;GACvB,MAAM,MAAM,OAAO,IAAI,aAAa,SAAS,MAAM,IAAI,CAAC;GACxD,OAAO,IAAI,OAAO,QAAQ,YAAY;IACrC,MAAM,OAAO,IAAI,IAAI,OAAO;IAC5B,KAAK,IAAI,KAAK;KAAE;KAAO;IAAI,CAAC;IAC5B,OAAO;GACR,CAAC;EACF,CAAC;EACF,OAAO,QAAQ,IAAI,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU,MAAM,IAAI,GAAG,CAAC,EAAE,SAAS,IAAI,CAAC;EACvF,eACC,IAAI,IAAI,KAAK,CAAC,CAAC,KACd,OAAO,KAAK,UACX,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,CAClB,MAAM,GAAG,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CACrC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,KAAK,CAAU,CAC5C,CACD;CACF;AACD,CAAC;;;AAIF,IAAa,yBAAb,cAA4C,QAAQ,QAGlD,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC;;;;;AAMlD,MAAa,uBAA4D,MAAM,OAC9E,wBACA,oBAAoB,CAAC,CAAC,KAAK,OAAO,IAAI,uBAAuB,EAAE,CAAC,CACjE;;;;AAKA,MAAa,kCAAkC"}

package/dist/plugins/package/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/package/service.ts"],"sourcesContent":["// Package plugin — main acquire body.\n//\n// Dispatch on `opts.mode` ∈ {local, known} and delegate to the\n// per-mode acquire. This file is INTENTIONALLY thin: the substrate\n// concerns (cache key, verify, produce, register) live inside the\n// ArtifactPublisher primitive; the toolchain concerns (build,\n// scrub) live in `build.ts`. We just route.\n//\n// Substrate dependencies arrive via `definePlugin({ dependsOn })`:\n//\n//   - suiResource           — resolved SuiClient + chainId\n//   - publisher account     — publisher address + sign-and-execute\n//\n// And via the StrategyContributor registry (by capability key):\n//\n//   - chain-probe:<chainId> — ChainProbe<SuiProbeKey>\n//   - artifact-publisher     — the ArtifactPublisher (substrate\n//                             primitive, available everywhere)\n//\n// And via the plugin-owned PackageRegistry service (instantiated from\n// the substrate's generic ScopedRefMap primitive — see `registry.ts`).\n//\n// The wiring of these lookups happens at the barrel (`index.ts`); this\n// file accepts them as parameters so it stays testable.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport type { ChainProbe } from '../../contracts/chain-probe.ts';\nimport type { SuiProbeKey } from '../sui/index.ts';\nimport { acquireKnown, type KnownModeInputs } from './mode-known.ts';\nimport { acquireLocal, type LocalModeInputs } from './mode-local.ts';\nimport type {\n\tPackageRegistry,\n\tResolvedKnownPackage,\n\tResolvedLocalPackage,\n\tResolvedPackage,\n} from './registry.ts';\nimport type { LocalPackagePublishOutput } from './publish-output.ts';\nimport type { PublishError } from './errors.ts';\n\n/** Discriminated mode union — mirrors the public factory shape\n *  (`localPackage(...)` and `knownPackage(...)`). The barrel\n *  constructs ONE of these per declared package and the body below\n *  routes. */\nexport type PackageMode =\n\t| ({ readonly mode: 'local' } & LocalModeInputs)\n\t| ({ readonly mode: 'known' } & KnownModeInputs);\n\nexport interface BootPackageResult {\n\treadonly resolved: ResolvedPackage;\n\t/** Fresh publish output — populated on cache MISS (the produce\n\t *  path ran), `null` on cache hit (verify path). Threaded out so\n\t *  the barrel can fan out coin auto-discovery (and any other\n\t *  output-consuming siblings) once per fresh publish.\n\t *\n\t *  Known mode never publishes, so this is always `null` there. */\n\treadonly output: LocalPackagePublishOutput | null;\n}\n\nexport interface BootLocalPackageResult {\n\treadonly resolved: ResolvedLocalPackage;\n\treadonly output: LocalPackagePublishOutput | null;\n}\n\nexport interface BootKnownPackageResult {\n\treadonly resolved: ResolvedKnownPackage;\n\treadonly output: null;\n}\n\n/** Dispatch on the typed mode. */\nexport function bootPackageService(\n\tpublisher: ArtifactPublisher,\n\tprobe: ChainProbe<SuiProbeKey>,\n\tregistry: PackageRegistry,\n\topts: { readonly mode: 'local' } & LocalModeInputs,\n): Effect.Effect<BootLocalPackageResult, PublishError | ArtifactPublishError, Scope.Scope>;\nexport function bootPackageService(\n\tpublisher: ArtifactPublisher,\n\tprobe: ChainProbe<SuiProbeKey>,\n\tregistry: PackageRegistry,\n\topts: { readonly mode: 'known' } & KnownModeInputs,\n): Effect.Effect<BootKnownPackageResult, PublishError | ArtifactPublishError, Scope.Scope>;\nexport function bootPackageService(\n\tpublisher: ArtifactPublisher,\n\tprobe: ChainProbe<SuiProbeKey>,\n\tregistry: PackageRegistry,\n\topts: PackageMode,\n): Effect.Effect<BootPackageResult, PublishError | ArtifactPublishError, Scope.Scope> {\n\tswitch (opts.mode) {\n\t\tcase 'local':\n\t\t\treturn acquireLocal(publisher, probe, registry, opts).pipe(\n\t\t\t\tEffect.map(({ resolved, output }) => ({ resolved, output })),\n\t\t\t);\n\t\tcase 'known':\n\t\t\treturn acquireKnown(probe, registry, opts).pipe(\n\t\t\t\tEffect.map(({ resolved }) => ({ resolved, output: null })),\n\t\t\t);\n\t}\n}\n"],"mappings":";;;;AAsFA,SAAgB,mBACf,WACA,OACA,UACA,MACqF;AACrF,SAAQ,KAAK,MAAb;EACC,KAAK,QACJ,QAAO,aAAa,WAAW,OAAO,UAAU,KAAK,CAAC,KACrD,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;GAAQ,EAAE,CAC5D;EACF,KAAK,QACJ,QAAO,aAAa,OAAO,UAAU,KAAK,CAAC,KAC1C,OAAO,KAAK,EAAE,gBAAgB;GAAE;GAAU,QAAQ;GAAM,EAAE,CAC1D"}
+{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/package/service.ts"],"sourcesContent":["// Package plugin — main acquire body.\n//\n// Dispatch on `opts.mode` ∈ {local, known} and delegate to the\n// per-mode acquire. This file is INTENTIONALLY thin: the substrate\n// concerns (cache key, verify, produce, register) live inside the\n// ArtifactPublisher primitive; the toolchain concerns (build,\n// scrub) live in `build.ts`. We just route.\n//\n// Substrate dependencies arrive via `definePlugin({ dependsOn })`:\n//\n//   - suiResource           — resolved SuiClient + chainId\n//   - publisher account     — publisher address + sign-and-execute\n//\n// And via the StrategyContributor registry (by capability key):\n//\n//   - chain-probe:<chainId> — ChainProbe<SuiProbeKey>\n//   - artifact-publisher     — the ArtifactPublisher (substrate\n//                             primitive, available everywhere)\n//\n// And via the plugin-owned PackageRegistry service (a self-contained\n// last-write-wins `PackageKey -> ResolvedPackage` map — see `registry.ts`).\n//\n// The wiring of these lookups happens at the barrel (`index.ts`); this\n// file accepts them as parameters so it stays testable.\n\nimport { Effect, type Scope } from 'effect';\n\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n} from '../../primitives/artifact-publisher.ts';\nimport type { ChainProbe } from '../../contracts/chain-probe.ts';\nimport type { SuiProbeKey } from '../sui/index.ts';\nimport { acquireKnown, type KnownModeInputs } from './mode-known.ts';\nimport { acquireLocal, type LocalModeInputs } from './mode-local.ts';\nimport type {\n\tPackageRegistry,\n\tResolvedKnownPackage,\n\tResolvedLocalPackage,\n\tResolvedPackage,\n} from './registry.ts';\nimport type { LocalPackagePublishOutput } from './publish-output.ts';\nimport type { PublishError } from './errors.ts';\n\n/** Discriminated mode union — mirrors the public factory shape\n *  (`localPackage(...)` and `knownPackage(...)`). The barrel\n *  constructs ONE of these per declared package and the body below\n *  routes. */\nexport type PackageMode =\n\t| ({ readonly mode: 'local' } & LocalModeInputs)\n\t| ({ readonly mode: 'known' } & KnownModeInputs);\n\nexport interface BootPackageResult {\n\treadonly resolved: ResolvedPackage;\n\t/** Fresh publish output — populated on cache MISS (the produce\n\t *  path ran), `null` on cache hit (verify path). Threaded out so\n\t *  the barrel can fan out coin auto-discovery (and any other\n\t *  output-consuming siblings) once per fresh publish.\n\t *\n\t *  Known mode never publishes, so this is always `null` there. */\n\treadonly output: LocalPackagePublishOutput | null;\n}\n\nexport interface BootLocalPackageResult {\n\treadonly resolved: ResolvedLocalPackage;\n\treadonly output: LocalPackagePublishOutput | null;\n}\n\nexport interface BootKnownPackageResult {\n\treadonly resolved: ResolvedKnownPackage;\n\treadonly output: null;\n}\n\n/** Dispatch on the typed mode. */\nexport function bootPackageService(\n\tpublisher: ArtifactPublisher,\n\tprobe: ChainProbe<SuiProbeKey>,\n\tregistry: PackageRegistry,\n\topts: { readonly mode: 'local' } & LocalModeInputs,\n): Effect.Effect<BootLocalPackageResult, PublishError | ArtifactPublishError, Scope.Scope>;\nexport function bootPackageService(\n\tpublisher: ArtifactPublisher,\n\tprobe: ChainProbe<SuiProbeKey>,\n\tregistry: PackageRegistry,\n\topts: { readonly mode: 'known' } & KnownModeInputs,\n): Effect.Effect<BootKnownPackageResult, PublishError | ArtifactPublishError, Scope.Scope>;\nexport function bootPackageService(\n\tpublisher: ArtifactPublisher,\n\tprobe: ChainProbe<SuiProbeKey>,\n\tregistry: PackageRegistry,\n\topts: PackageMode,\n): Effect.Effect<BootPackageResult, PublishError | ArtifactPublishError, Scope.Scope> {\n\tswitch (opts.mode) {\n\t\tcase 'local':\n\t\t\treturn acquireLocal(publisher, probe, registry, opts).pipe(\n\t\t\t\tEffect.map(({ resolved, output }) => ({ resolved, output })),\n\t\t\t);\n\t\tcase 'known':\n\t\t\treturn acquireKnown(probe, registry, opts).pipe(\n\t\t\t\tEffect.map(({ resolved }) => ({ resolved, output: null })),\n\t\t\t);\n\t}\n}\n"],"mappings":";;;;AAsFA,SAAgB,mBACf,WACA,OACA,UACA,MACqF;CACrF,QAAQ,KAAK,MAAb;EACC,KAAK,SACJ,OAAO,aAAa,WAAW,OAAO,UAAU,IAAI,CAAC,CAAC,KACrD,OAAO,KAAK,EAAE,UAAU,cAAc;GAAE;GAAU;EAAO,EAAE,CAC5D;EACD,KAAK,SACJ,OAAO,aAAa,OAAO,UAAU,IAAI,CAAC,CAAC,KAC1C,OAAO,KAAK,EAAE,gBAAgB;GAAE;GAAU,QAAQ;EAAK,EAAE,CAC1D;CACF;AACD"}

package/dist/plugins/package/snapshot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/package/snapshot.ts"],"sourcesContent":["// Package plugin — Snapshotable contribution.\n//\n// Distilled doc §Cross-component references §snapshot: \"persisted\n// Package cache entries survive snapshot save/restore; the chain\n// containers are tarred separately and on restore the verify probe\n// re-confirms.\"\n//\n// The Package plugin OWNS the publishMove cache entries in the\n// StateStore — those land under the substrate's runtime-dir root\n// at `state-store/<plugin-key>/...` and are auto-captured by the\n// substrate without an explicit subtree decl. We declare a\n// `missingTolerance: 'fine'` shape because:\n//\n//   - A restored stack with a missing cache entry simply re-publishes\n//     (cache miss). No data loss.\n//   - A restored stack with a present cache entry runs the lenient\n//     verify probe; if the chain snapshot also restored, the probe\n//     resolves the cached id; otherwise it misses and re-publishes.\n//\n// No managed containers — the build container belongs to the Sui\n// plugin (per-app, declared there). The Move build cache lives at\n// `~/.move/git` on the host (NOT in a container) and is intentionally\n// NOT captured: distilled doc §Cross-component references — vendored\n// deps are content-addressed by sui-cli, re-fetched on demand.\n\nimport { Effect } from 'effect';\n\nimport type { SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\n/** Build the Snapshotable contribution.\n *\n *  Identity guard: contributes the package's symbolic name + content\n *  hash to the pre-restore identity record. A snapshot taken under\n *  source-hash A restored against source-hash A is OK (verify probe\n *  re-confirms); a mismatch lets the substrate decide (typically:\n *  also OK — re-publish). The identity guard is mostly informational\n *  here. */\nexport const makeSnapshotable = (packageName: string, sourceHash: string): SnapshotableDecl => ({\n\tkind: 'snapshotable',\n\tsubtrees: [],\n\tmissingTolerance: 'fine',\n\tpreRestore: Effect.succeed({\n\t\tkind: 'package' as const,\n\t\tname: packageName,\n\t\tsourceHash,\n\t}),\n\tpostRestore: Effect.void,\n});\n"],"mappings":";;;;;;;;;;AAqCA,MAAa,oBAAoB,aAAqB,gBAA0C;CAC/F,MAAM;CACN,UAAU,EAAE;CACZ,kBAAkB;CAClB,YAAY,OAAO,QAAQ;EAC1B,MAAM;EACN,MAAM;EACN;EACA,CAAC;CACF,aAAa,OAAO;CACpB"}
+{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/package/snapshot.ts"],"sourcesContent":["// Package plugin — Snapshotable contribution.\n//\n// Distilled doc §Cross-component references §snapshot: \"persisted\n// Package cache entries survive snapshot save/restore; the chain\n// containers are tarred separately and on restore the verify probe\n// re-confirms.\"\n//\n// The Package plugin OWNS the publishMove cache entries in the\n// substrate's content-addressed cache — those land under the per-stack\n// runtime root at `cache/<namespace>/<chainId>/...` and are auto-captured\n// by the substrate's cache subtree without an explicit subtree decl. We\n// declare a `missingTolerance: 'fine'` shape because:\n//\n//   - A restored stack with a missing cache entry simply re-publishes\n//     (cache miss). No data loss.\n//   - A restored stack with a present cache entry runs the lenient\n//     verify probe; if the chain snapshot also restored, the probe\n//     resolves the cached id; otherwise it misses and re-publishes.\n//\n// No managed containers — the build container belongs to the Sui\n// plugin (per-app, declared there). The Move build cache lives at\n// `~/.move/git` on the host (NOT in a container) and is intentionally\n// NOT captured: distilled doc §Cross-component references — vendored\n// deps are content-addressed by sui-cli, re-fetched on demand.\n\nimport { Effect } from 'effect';\n\nimport type { SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\n/** Build the Snapshotable contribution.\n *\n *  Identity guard: contributes the package's symbolic name + content\n *  hash to the pre-restore identity record. A snapshot taken under\n *  source-hash A restored against source-hash A is OK (verify probe\n *  re-confirms); a mismatch lets the substrate decide (typically:\n *  also OK — re-publish). The identity guard is mostly informational\n *  here. */\nexport const makeSnapshotable = (packageName: string, sourceHash: string): SnapshotableDecl => ({\n\tkind: 'snapshotable',\n\tsubtrees: [],\n\tmissingTolerance: 'fine',\n\tpreRestore: Effect.succeed({\n\t\tkind: 'package' as const,\n\t\tname: packageName,\n\t\tsourceHash,\n\t}),\n\tpostRestore: Effect.void,\n});\n"],"mappings":";;;;;;;;;;AAqCA,MAAa,oBAAoB,aAAqB,gBAA0C;CAC/F,MAAM;CACN,UAAU,CAAC;CACX,kBAAkB;CAClB,YAAY,OAAO,QAAQ;EAC1B,MAAM;EACN,MAAM;EACN;CACD,CAAC;CACD,aAAa,OAAO;AACrB"}

package/dist/plugins/router-entrypoints.mjs

@@ -1,6 +1,5 @@
 import { DASHBOARD_ENTRYPOINTS } from "./dashboard/routable.mjs";
 import { HOST_SERVICE_ENTRYPOINTS } from "./host-service/routable.mjs";
-import { POSTGRES_ENTRYPOINTS } from "./postgres/routable.mjs";
 import { SEAL_ENTRYPOINTS } from "./seal/routable.mjs";
 import { SUI_ENTRYPOINTS } from "./sui/routable.mjs";
 import { WALLET_ENTRYPOINTS } from "./wallet/routable.mjs";
@@ -12,8 +11,7 @@ const BUILT_IN_ENTRYPOINTS = [
 	...HOST_SERVICE_ENTRYPOINTS,
 	...WALLET_ENTRYPOINTS,
 	...WALRUS_ENTRYPOINTS,
-	...SEAL_ENTRYPOINTS,
-	...POSTGRES_ENTRYPOINTS
+	...SEAL_ENTRYPOINTS
 ];
 //#endregion
 export { BUILT_IN_ENTRYPOINTS };

package/dist/plugins/router-entrypoints.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"router-entrypoints.mjs","names":[],"sources":["../../src/plugins/router-entrypoints.ts"],"sourcesContent":["// Built-in plugin router entrypoints.\n//\n// The router orchestrator owns registry validation and collision checks.\n// Built-in plugins own their public listener names and ports.\n\nimport type { EntrypointDecl } from '../contracts/routable.ts';\nimport { DASHBOARD_ENTRYPOINTS } from './dashboard/routable.ts';\nimport { HOST_SERVICE_ENTRYPOINTS } from './host-service/routable.ts';\nimport { POSTGRES_ENTRYPOINTS } from './postgres/routable.ts';\nimport { SEAL_ENTRYPOINTS } from './seal/routable.ts';\nimport { SUI_ENTRYPOINTS } from './sui/routable.ts';\nimport { WALLET_ENTRYPOINTS } from './wallet/routable.ts';\nimport { WALRUS_ENTRYPOINTS } from './walrus/routable.ts';\n\nexport const BUILT_IN_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t...DASHBOARD_ENTRYPOINTS,\n\t...SUI_ENTRYPOINTS,\n\t...HOST_SERVICE_ENTRYPOINTS,\n\t...WALLET_ENTRYPOINTS,\n\t...WALRUS_ENTRYPOINTS,\n\t...SEAL_ENTRYPOINTS,\n\t...POSTGRES_ENTRYPOINTS,\n];\n"],"mappings":";;;;;;;;AAcA,MAAa,uBAAsD;CAClE,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH"}
+{"version":3,"file":"router-entrypoints.mjs","names":[],"sources":["../../src/plugins/router-entrypoints.ts"],"sourcesContent":["// Built-in plugin router entrypoints.\n//\n// The router orchestrator owns registry validation and collision checks.\n// Built-in plugins own their public listener names and ports.\n\nimport type { EntrypointDecl } from '../contracts/routable.ts';\nimport { DASHBOARD_ENTRYPOINTS } from './dashboard/routable.ts';\nimport { HOST_SERVICE_ENTRYPOINTS } from './host-service/routable.ts';\nimport { SEAL_ENTRYPOINTS } from './seal/routable.ts';\nimport { SUI_ENTRYPOINTS } from './sui/routable.ts';\nimport { WALLET_ENTRYPOINTS } from './wallet/routable.ts';\nimport { WALRUS_ENTRYPOINTS } from './walrus/routable.ts';\n\nexport const BUILT_IN_ENTRYPOINTS: ReadonlyArray<EntrypointDecl> = [\n\t...DASHBOARD_ENTRYPOINTS,\n\t...SUI_ENTRYPOINTS,\n\t...HOST_SERVICE_ENTRYPOINTS,\n\t...WALLET_ENTRYPOINTS,\n\t...WALRUS_ENTRYPOINTS,\n\t...SEAL_ENTRYPOINTS,\n];\n"],"mappings":";;;;;;;AAaA,MAAa,uBAAsD;CAClE,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;AACJ"}

package/dist/plugins/seal/bootstrap-assets/cargo-image.mjs

@@ -1,6 +1,5 @@
 import { readEnv } from "../../../substrate/runtime/typed-env.mjs";
 import { sealError } from "../errors.mjs";
-import { SealSpans } from "../spans.mjs";
 import { DEFAULT_SEAL_REPO, DEFAULT_SEAL_VERSION } from "./source-fetch.mjs";
 import { Effect } from "effect";
 import { fileURLToPath } from "node:url";
@@ -48,7 +47,7 @@ const resolveSealCargoImage = (runtime, inputs) => Effect.gen(function* () {
 		message: `seal image build failed: ${cause.reason}: ${cause.detail}. SEAL_VERSION=${inputs.sealRef} (from ${inputs.sealRepo}/releases). Set SEAL_CARGO_IMAGE_OVERRIDE=<tag> to bypass the build.`,
 		cause
 	})));
-}).pipe(Effect.withSpan("devstack.plugin.seal.cargoImage.resolve", { attributes: { [SealSpans.ref]: inputs.sealRef } }));
+});
 /** Convenience: resolve via the default inputs. */
 const resolveDefaultSealCargoImage = (runtime, owner) => resolveSealCargoImage(runtime, {
 	sealRepo: DEFAULT_SEAL_REPO,

package/dist/plugins/seal/bootstrap-assets/cargo-image.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cargo-image.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/cargo-image.ts"],"sourcesContent":["// Seal vendored-Dockerfile docker image.\n//\n// The upstream seal release ships pre-built `seal-cli` + `key-server`\n// binaries per platform, and our vendored Dockerfile at\n// `images/seal/Dockerfile` just fetches and packages them.\n//\n// Resolution paths (mirror walrus's two-stage dispatch — distilled-doc\n// §\"Pinned upstream version\" + §\"Optional pre-built image tag override\"):\n//\n//   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env — points at a pre-baked\n//        registry tag (or a locally-tagged image like `seal-test-stub:latest`).\n//        Skips the docker build entirely. The on-disk image is\n//        content-addressed by the registry; we just thread it through.\n//\n//   (b) Real build via `runtime.ensureImage({ contextPath,\n//        dockerfile: 'Dockerfile', buildArgs: { SEAL_VERSION } })`\n//        against the vendored Dockerfile at `images/seal/`. Mirrors\n//        the sui plugin's `resolveImage` shape.\n\nimport { Effect, type Scope } from 'effect';\nimport { fileURLToPath } from 'node:url';\n\nimport type {\n\tContainerBuildContext,\n\tContainerRuntime,\n\tImageRef,\n} from '../../../contracts/container-runtime.ts';\nimport { readEnv } from '../../../substrate/runtime/typed-env.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { SealSpans } from '../spans.ts';\nimport { DEFAULT_SEAL_REPO, DEFAULT_SEAL_VERSION } from './source-fetch.ts';\n\n// ---------------------------------------------------------------------------\n/** Inputs to the seal image resolver. */\nexport interface SealCargoImageInputs<Ref extends string = string> {\n\treadonly sealRepo: typeof DEFAULT_SEAL_REPO;\n\treadonly sealRef: Ref;\n\t/** Owner identity stamped on the built image so label-driven prune\n\t *  finds it. */\n\treadonly owner: {\n\t\treadonly app: string;\n\t\treadonly stack: string;\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Resolve the seal image. Two staged paths:\n *\n *   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked\n *        registry tag (or a locally-built fixture image like\n *        `seal-test-stub:latest`). Skips the docker build entirely\n *        and returns a bare `ImageRef` synthesized from the override\n *        tag. CI bakes the image once + pins the tag; the local-\n *        keygen boot just reads the env.\n *\n *   (b) Real build via `runtime.ensureImage` against the vendored\n *        Dockerfile at `packages/devstack/images/seal/`. The\n *        Dockerfile is a binary-fetch path (NOT a cargo compile) —\n *        the seal release workflow ships pre-built per-platform\n *        binaries (`seal-cli`, `key-server`) and we just fetch +\n *        package them. Build is content-addressed by docker; same\n *        Dockerfile + same SEAL_VERSION → same image hash. */\nexport const resolveSealCargoImage = (\n\truntime: ContainerRuntime,\n\tinputs: SealCargoImageInputs,\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst override = readEnv('SEAL_CARGO_IMAGE_OVERRIDE');\n\t\tif (override && override.length > 0) {\n\t\t\t// Trust-the-tag path. Compose the resolved shape from the\n\t\t\t// pinned tag — the digest is opaque (substrate's\n\t\t\t// content-addressed cache will re-resolve via `docker\n\t\t\t// inspect` when it materializes the image).\n\t\t\treturn { digest: override, tag: override } satisfies ImageRef;\n\t\t}\n\t\t// Vendored-Dockerfile path. Same shape as sui's `resolveImage`\n\t\t// (plugins/sui/mode/local.ts:resolveImage). Context is `images/`\n\t\t// (NOT `images/seal/`) so the Dockerfile can `COPY` the shared\n\t\t// `_shared/signal-forward.sh` snippet alongside the seal-specific\n\t\t// entrypoint. The Dockerfile builds in two stages: (1) ubuntu\n\t\t// base, fetch + chmod the per-arch binaries from the seal release\n\t\t// URL; (2) debian:bookworm-slim runtime with the signal-\n\t\t// forwarding entrypoint shell wrapped around `key-server`.\n\t\tconst buildCtx: ContainerBuildContext = {\n\t\t\t// `fileURLToPath` normalises across platforms (Windows\n\t\t\t// `file:///C:/...` → `C:\\...`; POSIX strips the scheme and\n\t\t\t// percent-decodes). Using `.pathname` directly leaves the\n\t\t\t// leading `/` on Windows drive paths.\n\t\t\tcontextPath: fileURLToPath(new URL('../../../../images/', import.meta.url)),\n\t\t\tdockerfile: 'seal/Dockerfile',\n\t\t\tfingerprintPaths: ['seal/Dockerfile', 'seal/entrypoint.sh', '_shared/signal-forward.sh'],\n\t\t\tbuildArgs: { SEAL_VERSION: inputs.sealRef },\n\t\t\towner: {\n\t\t\t\tapp: inputs.owner.app,\n\t\t\t\tstack: inputs.owner.stack,\n\t\t\t\tplugin: 'seal',\n\t\t\t\trole: 'key-server',\n\t\t\t},\n\t\t};\n\t\treturn yield* runtime.ensureImage(buildCtx).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal image build failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t`SEAL_VERSION=${inputs.sealRef} (from ${inputs.sealRepo}/releases). ` +\n\t\t\t\t\t\t`Set SEAL_CARGO_IMAGE_OVERRIDE=<tag> to bypass the build.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.cargoImage.resolve', {\n\t\t\tattributes: {\n\t\t\t\t[SealSpans.ref]: inputs.sealRef,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealCargoImage = (\n\truntime: ContainerRuntime,\n\towner: SealCargoImageInputs['owner'],\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tresolveSealCargoImage(runtime, {\n\t\tsealRepo: DEFAULT_SEAL_REPO,\n\t\tsealRef: DEFAULT_SEAL_VERSION,\n\t\towner,\n\t});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiEA,MAAa,yBACZ,SACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,QAAQ,4BAA4B;AACrD,KAAI,YAAY,SAAS,SAAS,EAKjC,QAAO;EAAE,QAAQ;EAAU,KAAK;EAAU;CAU3C,MAAM,WAAkC;EAKvC,aAAa,cAAc,IAAI,IAAI,uBAAuB,OAAO,KAAK,IAAI,CAAC;EAC3E,YAAY;EACZ,kBAAkB;GAAC;GAAmB;GAAsB;GAA4B;EACxF,WAAW,EAAE,cAAc,OAAO,SAAS;EAC3C,OAAO;GACN,KAAK,OAAO,MAAM;GAClB,OAAO,OAAO,MAAM;GACpB,QAAQ;GACR,MAAM;GACN;EACD;AACD,QAAO,OAAO,QAAQ,YAAY,SAAS,CAAC,KAC3C,OAAO,UAAU,UAChB,UAAU,SAAS;EAClB,MAAM;EACN,SACC,4BAA4B,MAAM,OAAO,IAAI,MAAM,OAAO,iBAC1C,OAAO,QAAQ,SAAS,OAAO,SAAS;EAEzD;EACA,CAAC,CACF,CACD;EACA,CAAC,KACF,OAAO,SAAS,2CAA2C,EAC1D,YAAY,GACV,UAAU,MAAM,OAAO,SACxB,EACD,CAAC,CACF;;AAGF,MAAa,gCACZ,SACA,UAEA,sBAAsB,SAAS;CAC9B,UAAU;CACV,SAAS;CACT;CACA,CAAC"}
+{"version":3,"file":"cargo-image.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/cargo-image.ts"],"sourcesContent":["// Seal vendored-Dockerfile docker image.\n//\n// The upstream seal release ships pre-built `seal-cli` + `key-server`\n// binaries per platform, and our vendored Dockerfile at\n// `images/seal/Dockerfile` just fetches and packages them.\n//\n// Resolution paths (mirror walrus's two-stage dispatch — distilled-doc\n// §\"Pinned upstream version\" + §\"Optional pre-built image tag override\"):\n//\n//   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env — points at a pre-baked\n//        registry tag (or a locally-tagged image like `seal-test-stub:latest`).\n//        Skips the docker build entirely. The on-disk image is\n//        content-addressed by the registry; we just thread it through.\n//\n//   (b) Real build via `runtime.ensureImage({ contextPath,\n//        dockerfile: 'Dockerfile', buildArgs: { SEAL_VERSION } })`\n//        against the vendored Dockerfile at `images/seal/`. Mirrors\n//        the sui plugin's `resolveImage` shape.\n\nimport { Effect, type Scope } from 'effect';\nimport { fileURLToPath } from 'node:url';\n\nimport type {\n\tContainerBuildContext,\n\tContainerRuntime,\n\tImageRef,\n} from '../../../contracts/container-runtime.ts';\nimport { readEnv } from '../../../substrate/runtime/typed-env.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { DEFAULT_SEAL_REPO, DEFAULT_SEAL_VERSION } from './source-fetch.ts';\n\n// ---------------------------------------------------------------------------\n/** Inputs to the seal image resolver. */\nexport interface SealCargoImageInputs<Ref extends string = string> {\n\treadonly sealRepo: typeof DEFAULT_SEAL_REPO;\n\treadonly sealRef: Ref;\n\t/** Owner identity stamped on the built image so label-driven prune\n\t *  finds it. */\n\treadonly owner: {\n\t\treadonly app: string;\n\t\treadonly stack: string;\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Resolve the seal image. Two staged paths:\n *\n *   (a) `SEAL_CARGO_IMAGE_OVERRIDE` env var — points at a pre-baked\n *        registry tag (or a locally-built fixture image like\n *        `seal-test-stub:latest`). Skips the docker build entirely\n *        and returns a bare `ImageRef` synthesized from the override\n *        tag. CI bakes the image once + pins the tag; the local-\n *        keygen boot just reads the env.\n *\n *   (b) Real build via `runtime.ensureImage` against the vendored\n *        Dockerfile at `packages/devstack/images/seal/`. The\n *        Dockerfile is a binary-fetch path (NOT a cargo compile) —\n *        the seal release workflow ships pre-built per-platform\n *        binaries (`seal-cli`, `key-server`) and we just fetch +\n *        package them. Build is content-addressed by docker; same\n *        Dockerfile + same SEAL_VERSION → same image hash. */\nexport const resolveSealCargoImage = (\n\truntime: ContainerRuntime,\n\tinputs: SealCargoImageInputs,\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tEffect.gen(function* () {\n\t\tconst override = readEnv('SEAL_CARGO_IMAGE_OVERRIDE');\n\t\tif (override && override.length > 0) {\n\t\t\t// Trust-the-tag path. Compose the resolved shape from the\n\t\t\t// pinned tag — the digest is opaque (substrate's\n\t\t\t// content-addressed cache will re-resolve via `docker\n\t\t\t// inspect` when it materializes the image).\n\t\t\treturn { digest: override, tag: override } satisfies ImageRef;\n\t\t}\n\t\t// Vendored-Dockerfile path. Same shape as sui's `resolveImage`\n\t\t// (plugins/sui/mode/local.ts:resolveImage). Context is `images/`\n\t\t// (NOT `images/seal/`) so the Dockerfile can `COPY` the shared\n\t\t// `_shared/signal-forward.sh` snippet alongside the seal-specific\n\t\t// entrypoint. The Dockerfile builds in two stages: (1) ubuntu\n\t\t// base, fetch + chmod the per-arch binaries from the seal release\n\t\t// URL; (2) debian:bookworm-slim runtime with the signal-\n\t\t// forwarding entrypoint shell wrapped around `key-server`.\n\t\tconst buildCtx: ContainerBuildContext = {\n\t\t\t// `fileURLToPath` normalises across platforms (Windows\n\t\t\t// `file:///C:/...` → `C:\\...`; POSIX strips the scheme and\n\t\t\t// percent-decodes). Using `.pathname` directly leaves the\n\t\t\t// leading `/` on Windows drive paths.\n\t\t\tcontextPath: fileURLToPath(new URL('../../../../images/', import.meta.url)),\n\t\t\tdockerfile: 'seal/Dockerfile',\n\t\t\tfingerprintPaths: ['seal/Dockerfile', 'seal/entrypoint.sh', '_shared/signal-forward.sh'],\n\t\t\tbuildArgs: { SEAL_VERSION: inputs.sealRef },\n\t\t\towner: {\n\t\t\t\tapp: inputs.owner.app,\n\t\t\t\tstack: inputs.owner.stack,\n\t\t\t\tplugin: 'seal',\n\t\t\t\trole: 'key-server',\n\t\t\t},\n\t\t};\n\t\treturn yield* runtime.ensureImage(buildCtx).pipe(\n\t\t\tEffect.mapError((cause) =>\n\t\t\t\tsealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`seal image build failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t`SEAL_VERSION=${inputs.sealRef} (from ${inputs.sealRepo}/releases). ` +\n\t\t\t\t\t\t`Set SEAL_CARGO_IMAGE_OVERRIDE=<tag> to bypass the build.`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t});\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealCargoImage = (\n\truntime: ContainerRuntime,\n\towner: SealCargoImageInputs['owner'],\n): Effect.Effect<ImageRef, SealError, Scope.Scope> =>\n\tresolveSealCargoImage(runtime, {\n\t\tsealRepo: DEFAULT_SEAL_REPO,\n\t\tsealRef: DEFAULT_SEAL_VERSION,\n\t\towner,\n\t});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgEA,MAAa,yBACZ,SACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,QAAQ,2BAA2B;CACpD,IAAI,YAAY,SAAS,SAAS,GAKjC,OAAO;EAAE,QAAQ;EAAU,KAAK;CAAS;CAU1C,MAAM,WAAkC;EAKvC,aAAa,cAAc,IAAI,IAAI,uBAAuB,OAAO,KAAK,GAAG,CAAC;EAC1E,YAAY;EACZ,kBAAkB;GAAC;GAAmB;GAAsB;EAA2B;EACvF,WAAW,EAAE,cAAc,OAAO,QAAQ;EAC1C,OAAO;GACN,KAAK,OAAO,MAAM;GAClB,OAAO,OAAO,MAAM;GACpB,QAAQ;GACR,MAAM;EACP;CACD;CACA,OAAO,OAAO,QAAQ,YAAY,QAAQ,CAAC,CAAC,KAC3C,OAAO,UAAU,UAChB,UAAU,SAAS;EAClB,MAAM;EACN,SACC,4BAA4B,MAAM,OAAO,IAAI,MAAM,OAAO,iBAC1C,OAAO,QAAQ,SAAS,OAAO,SAAS;EAEzD;CACD,CAAC,CACF,CACD;AACD,CAAC;;AAGF,MAAa,gCACZ,SACA,UAEA,sBAAsB,SAAS;CAC9B,UAAU;CACV,SAAS;CACT;AACD,CAAC"}

package/dist/plugins/seal/bootstrap-assets/source-fetch.mjs

@@ -5,7 +5,6 @@ import { stageAndSwap } from "../../../substrate/runtime/stage-and-swap/index.mj
 import { hostBindMountOwner } from "../../../substrate/runtime/host-bind-mount-owner.mjs";
 import { readEnv } from "../../../substrate/runtime/typed-env.mjs";
 import { sealError } from "../errors.mjs";
-import { SealSpans } from "../spans.mjs";
 import { Effect, FileSystem, Path } from "effect";
 //#region src/plugins/seal/bootstrap-assets/source-fetch.ts
 /** Default upstream repo URL — distilled doc §"External" reference. */
@@ -111,11 +110,7 @@ const resolveSealSource = (runtime, inputs) => Effect.gen(function* () {
 		subdir: inputs.subdir,
 		path: subdirPath
 	};
-}).pipe(Effect.withSpan("devstack.plugin.seal.moveSource.resolve", { attributes: {
-	[SealSpans.repo]: inputs.repo,
-	[SealSpans.ref]: inputs.ref,
-	[SealSpans.subdir]: inputs.subdir
-} }));
+});
 /** Convenience: resolve via the default inputs. */
 const resolveDefaultSealSource = (runtime) => resolveSealSource(runtime, {
 	repo: DEFAULT_SEAL_REPO,

package/dist/plugins/seal/bootstrap-assets/source-fetch.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"source-fetch.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/source-fetch.ts"],"sourcesContent":["// Seal git-fetched source tree.\n//\n// Resolution paths (mirror walrus's three-stage dispatch):\n//\n//   (a) Caller-pinned `movePackagePath` opt — local-keygen mode\n//        short-circuits before calling this resolver.\n//\n//   (b) `SEAL_MOVE_SOURCE_OVERRIDE` env var — points at a pre-fetched\n//        on-disk path. Trust-the-path; no I/O. Useful in CI where the\n//        repo is checked out once and reused.\n//\n//   (c) Real git fetch via `runtime.runOneShot({ image: 'alpine/git:2.52.0',\n//        mounts: [stagingDir→/out], argv: ['clone',...] })`, staged\n//        into the per-host source cache before returning the host\n//        `move/seal` subdir.\n\nimport { Effect, FileSystem, Path, type Scope } from 'effect';\n\nimport type { ContainerRuntime } from '../../../contracts/container-runtime.ts';\nimport { hostBindMountOwner } from '../../../substrate/runtime/host-bind-mount-owner.ts';\nimport { mintRandomSuffix } from '../../../substrate/runtime/random-suffix.ts';\nimport { tailOutput } from '../../../substrate/runtime/observability/index.ts';\nimport { stageAndSwap } from '../../../substrate/runtime/stage-and-swap/index.ts';\nimport { readEnv } from '../../../substrate/runtime/typed-env.ts';\nimport { sealError, type SealError } from '../errors.ts';\nimport { SealSpans } from '../spans.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — distilled-doc §\"External / upstream sources\"\n// ---------------------------------------------------------------------------\n\n/** Default upstream repo URL — distilled doc §\"External\" reference. */\nexport const DEFAULT_SEAL_REPO = 'https://github.com/MystenLabs/seal' as const;\n\n/** Pinned default ref. Distilled-doc invariant #11: this MUST match\n *  the cargo binary's version (the Dockerfile's `SEAL_VERSION` build\n *  arg). They move in lockstep. */\nexport const DEFAULT_SEAL_VERSION = 'seal-v0.6.6' as const;\n\n/** Subdirectory containing the Move package. */\nexport const DEFAULT_SEAL_MOVE_SUBDIR = 'move/seal' as const;\n\n/** Pinned helper image for the git clone one-shot. `alpine/git`\n *  uses `git` as its entrypoint, so the clone argv starts at\n *  `clone`. */\nexport const SEAL_SOURCE_FETCH_IMAGE = 'alpine/git:2.52.0' as const;\n\nconst SEAL_SOURCE_FETCH_TIMEOUT_MS = 5 * 60_000;\n\n// ---------------------------------------------------------------------------\n// Resolved value\n// ---------------------------------------------------------------------------\n\n/** Resolved value for the cloned `move/seal` subdir. The local-keygen\n *  mode's acquire body threads this into `publishSealPackage(...)`. */\nexport interface SealSourceFetchResolved {\n\treadonly repo: string;\n\treadonly ref: string;\n\treadonly subdir: string;\n\treadonly path: string;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Inputs to the source resolver. */\nexport interface SealSourceFetchInputs<Ref extends string = string> {\n\treadonly repo: typeof DEFAULT_SEAL_REPO;\n\treadonly ref: Ref;\n\treadonly subdir: typeof DEFAULT_SEAL_MOVE_SUBDIR;\n}\n\nconst nextScratchPaths = (\n\tcacheDir: string,\n): { readonly stagingPath: string; readonly backupPath: string } => {\n\t// 16-char crypto suffix (STYLE_GUIDE §17) — the old\n\t// `pid.counter` scheme collided across two concurrent PROCESSES\n\t// fetching the same ref (counters reset per-process, so pid A's\n\t// `.staging.1` and pid B's `.staging.1` differ only by pid, and\n\t// the staging tree corrupts if a pid is reused). A random suffix\n\t// makes overlap cryptographically negligible regardless of pid.\n\tconst suffix = mintRandomSuffix(16);\n\treturn {\n\t\tstagingPath: `${cacheDir}.staging.${suffix}`,\n\t\tbackupPath: `${cacheDir}.backup.${suffix}`,\n\t};\n};\n\nexport const sealSourceCacheDir = (ref: string): string => {\n\tconst home = readEnv('HOME') ?? '/tmp';\n\treturn `${home}/.cache/devstack/seal-src/${encodeURIComponent(ref)}`;\n};\n\nexport const sealSourcePublishLockPath = (ref: string): string =>\n\t`${sealSourceCacheDir(ref)}.publish.lock`;\n\nconst sourceImageRef = { digest: SEAL_SOURCE_FETCH_IMAGE, tag: SEAL_SOURCE_FETCH_IMAGE } as const;\n\nexport const resolveSealSource = (\n\truntime: ContainerRuntime,\n\tinputs: SealSourceFetchInputs,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\tconst override = readEnv('SEAL_MOVE_SOURCE_OVERRIDE');\n\t\tif (override && override.length > 0) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: override,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = yield* Path.Path;\n\t\tconst cacheDir = sealSourceCacheDir(inputs.ref);\n\t\tconst subdirPath = path.join(cacheDir, inputs.subdir);\n\t\tconst cached = yield* fs.exists(subdirPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (cached) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: subdirPath,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst { stagingPath, backupPath } = nextScratchPaths(cacheDir);\n\t\tyield* stageAndSwap({\n\t\t\ttargetPath: cacheDir,\n\t\t\tstagingPath,\n\t\t\tbackupPath,\n\t\t\tbuild: Effect.gen(function* () {\n\t\t\t\tconst result = yield* Effect.scoped(\n\t\t\t\t\truntime\n\t\t\t\t\t\t.runOneShot({\n\t\t\t\t\t\t\timage: sourceImageRef,\n\t\t\t\t\t\t\tentrypoint: 'git',\n\t\t\t\t\t\t\tuser: hostBindMountOwner(),\n\t\t\t\t\t\t\targv: ['clone', '--depth', '1', '--branch', inputs.ref, inputs.repo, '/out'],\n\t\t\t\t\t\t\tmounts: [{ source: stagingPath, target: '/out' }],\n\t\t\t\t\t\t\ttimeoutMillis: SEAL_SOURCE_FETCH_TIMEOUT_MS,\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\t`seal move-source: git clone one-shot failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tif (result.exitCode !== 0) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t`seal move-source: git clone exited ${result.exitCode}. ` +\n\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\t\t\tstdout: tailOutput(result.stdout),\n\t\t\t\t\t\t\tstderr: tailOutput(result.stderr),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst stagedSubdir = path.join(stagingPath, inputs.subdir);\n\t\t\t\tconst stagedSubdirExists = yield* fs\n\t\t\t\t\t.exists(stagedSubdir)\n\t\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\tif (!stagedSubdirExists) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage: `seal move-source: clone completed but ${inputs.subdir} was missing from ${inputs.repo}@${inputs.ref}.`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}),\n\t\t\tpublishLockPath: sealSourcePublishLockPath(inputs.ref),\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause): SealError => {\n\t\t\t\tif (cause._tag === 'SealError') return cause;\n\t\t\t\treturn sealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage: `seal move-source: cache publish failed at ${cause.stage}`,\n\t\t\t\t\tcause,\n\t\t\t\t});\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\trepo: inputs.repo,\n\t\t\tref: inputs.ref,\n\t\t\tsubdir: inputs.subdir,\n\t\t\tpath: subdirPath,\n\t\t} satisfies SealSourceFetchResolved;\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.seal.moveSource.resolve', {\n\t\t\tattributes: {\n\t\t\t\t[SealSpans.repo]: inputs.repo,\n\t\t\t\t[SealSpans.ref]: inputs.ref,\n\t\t\t\t[SealSpans.subdir]: inputs.subdir,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealSource = (\n\truntime: ContainerRuntime,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tresolveSealSource(runtime, {\n\t\trepo: DEFAULT_SEAL_REPO,\n\t\tref: DEFAULT_SEAL_VERSION,\n\t\tsubdir: DEFAULT_SEAL_MOVE_SUBDIR,\n\t});\n"],"mappings":";;;;;;;;;;;AAgCA,MAAa,oBAAoB;;;;AAKjC,MAAa,uBAAuB;;AAGpC,MAAa,2BAA2B;;;;AAKxC,MAAa,0BAA0B;AAEvC,MAAM,+BAA+B,IAAI;AA0BzC,MAAM,oBACL,aACmE;CAOnE,MAAM,SAAS,iBAAiB,GAAG;AACnC,QAAO;EACN,aAAa,GAAG,SAAS,WAAW;EACpC,YAAY,GAAG,SAAS,UAAU;EAClC;;AAGF,MAAa,sBAAsB,QAAwB;AAE1D,QAAO,GADM,QAAQ,OAAO,IAAI,OACjB,4BAA4B,mBAAmB,IAAI;;AAGnE,MAAa,6BAA6B,QACzC,GAAG,mBAAmB,IAAI,CAAC;AAE5B,MAAM,iBAAiB;CAAE,QAAQ;CAAyB,KAAK;CAAyB;AAExF,MAAa,qBACZ,SACA,WAMA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,QAAQ,4BAA4B;AACrD,KAAI,YAAY,SAAS,SAAS,EACjC,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;CAGF,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,WAAW,mBAAmB,OAAO,IAAI;CAC/C,MAAM,aAAa,KAAK,KAAK,UAAU,OAAO,OAAO;AAErD,KAAI,OADkB,GAAG,OAAO,WAAW,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,CAE1F,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;CAGF,MAAM,EAAE,aAAa,eAAe,iBAAiB,SAAS;AAC9D,QAAO,aAAa;EACnB,YAAY;EACZ;EACA;EACA,OAAO,OAAO,IAAI,aAAa;GAC9B,MAAM,SAAS,OAAO,OAAO,OAC5B,QACE,WAAW;IACX,OAAO;IACP,YAAY;IACZ,MAAM,oBAAoB;IAC1B,MAAM;KAAC;KAAS;KAAW;KAAK;KAAY,OAAO;KAAK,OAAO;KAAM;KAAO;IAC5E,QAAQ,CAAC;KAAE,QAAQ;KAAa,QAAQ;KAAQ,CAAC;IACjD,eAAe;IACf,CAAC,CACD,KACA,OAAO,UAAU,UAChB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,gDAAgD,MAAM,OAAO,IAAI,MAAM,OAAO;IAE/E;IACA,CAAC,CACF,CACD,CACF;AAED,OAAI,OAAO,aAAa,EACvB,QAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,sCAAsC,OAAO,SAAS;IAEvD,UAAU,OAAO;IACjB,QAAQ,WAAW,OAAO,OAAO;IACjC,QAAQ,WAAW,OAAO,OAAO;IACjC,CAAC,CACF;GAGF,MAAM,eAAe,KAAK,KAAK,aAAa,OAAO,OAAO;AAI1D,OAAI,EAAC,OAH6B,GAChC,OAAO,aAAa,CACpB,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEhD,QAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SAAS,yCAAyC,OAAO,OAAO,oBAAoB,OAAO,KAAK,GAAG,OAAO,IAAI;IAC9G,CAAC,CACF;IAED;EACF,iBAAiB,0BAA0B,OAAO,IAAI;EACtD,CAAC,CAAC,KACF,OAAO,UAAU,UAAqB;AACrC,MAAI,MAAM,SAAS,YAAa,QAAO;AACvC,SAAO,UAAU,SAAS;GACzB,MAAM;GACN,SAAS,6CAA6C,MAAM;GAC5D;GACA,CAAC;GACD,CACF;AAED,QAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;EACN;EACA,CAAC,KACF,OAAO,SAAS,2CAA2C,EAC1D,YAAY;EACV,UAAU,OAAO,OAAO;EACxB,UAAU,MAAM,OAAO;EACvB,UAAU,SAAS,OAAO;CAC3B,EACD,CAAC,CACF;;AAGF,MAAa,4BACZ,YAMA,kBAAkB,SAAS;CAC1B,MAAM;CACN,KAAK;CACL,QAAQ;CACR,CAAC"}
+{"version":3,"file":"source-fetch.mjs","names":[],"sources":["../../../../src/plugins/seal/bootstrap-assets/source-fetch.ts"],"sourcesContent":["// Seal git-fetched source tree.\n//\n// Resolution paths (mirror walrus's three-stage dispatch):\n//\n//   (a) Caller-pinned `movePackagePath` opt — local-keygen mode\n//        short-circuits before calling this resolver.\n//\n//   (b) `SEAL_MOVE_SOURCE_OVERRIDE` env var — points at a pre-fetched\n//        on-disk path. Trust-the-path; no I/O. Useful in CI where the\n//        repo is checked out once and reused.\n//\n//   (c) Real git fetch via `runtime.runOneShot({ image: 'alpine/git:2.52.0',\n//        mounts: [stagingDir→/out], argv: ['clone',...] })`, staged\n//        into the per-host source cache before returning the host\n//        `move/seal` subdir.\n\nimport { Effect, FileSystem, Path, type Scope } from 'effect';\n\nimport type { ContainerRuntime } from '../../../contracts/container-runtime.ts';\nimport { hostBindMountOwner } from '../../../substrate/runtime/host-bind-mount-owner.ts';\nimport { mintRandomSuffix } from '../../../substrate/runtime/random-suffix.ts';\nimport { tailOutput } from '../../../substrate/runtime/observability/index.ts';\nimport { stageAndSwap } from '../../../substrate/runtime/stage-and-swap/index.ts';\nimport { readEnv } from '../../../substrate/runtime/typed-env.ts';\nimport { sealError, type SealError } from '../errors.ts';\n\n// ---------------------------------------------------------------------------\n// Constants — distilled-doc §\"External / upstream sources\"\n// ---------------------------------------------------------------------------\n\n/** Default upstream repo URL — distilled doc §\"External\" reference. */\nexport const DEFAULT_SEAL_REPO = 'https://github.com/MystenLabs/seal' as const;\n\n/** Pinned default ref. Distilled-doc invariant #11: this MUST match\n *  the cargo binary's version (the Dockerfile's `SEAL_VERSION` build\n *  arg). They move in lockstep. */\nexport const DEFAULT_SEAL_VERSION = 'seal-v0.6.6' as const;\n\n/** Subdirectory containing the Move package. */\nexport const DEFAULT_SEAL_MOVE_SUBDIR = 'move/seal' as const;\n\n/** Pinned helper image for the git clone one-shot. `alpine/git`\n *  uses `git` as its entrypoint, so the clone argv starts at\n *  `clone`. */\nexport const SEAL_SOURCE_FETCH_IMAGE = 'alpine/git:2.52.0' as const;\n\nconst SEAL_SOURCE_FETCH_TIMEOUT_MS = 5 * 60_000;\n\n// ---------------------------------------------------------------------------\n// Resolved value\n// ---------------------------------------------------------------------------\n\n/** Resolved value for the cloned `move/seal` subdir. The local-keygen\n *  mode's acquire body threads this into `publishSealPackage(...)`. */\nexport interface SealSourceFetchResolved {\n\treadonly repo: string;\n\treadonly ref: string;\n\treadonly subdir: string;\n\treadonly path: string;\n}\n\n// ---------------------------------------------------------------------------\n// Runtime resolver\n// ---------------------------------------------------------------------------\n\n/** Inputs to the source resolver. */\nexport interface SealSourceFetchInputs<Ref extends string = string> {\n\treadonly repo: typeof DEFAULT_SEAL_REPO;\n\treadonly ref: Ref;\n\treadonly subdir: typeof DEFAULT_SEAL_MOVE_SUBDIR;\n}\n\nconst nextScratchPaths = (\n\tcacheDir: string,\n): { readonly stagingPath: string; readonly backupPath: string } => {\n\t// 16-char crypto suffix (STYLE_GUIDE §17) — the old\n\t// `pid.counter` scheme collided across two concurrent PROCESSES\n\t// fetching the same ref (counters reset per-process, so pid A's\n\t// `.staging.1` and pid B's `.staging.1` differ only by pid, and\n\t// the staging tree corrupts if a pid is reused). A random suffix\n\t// makes overlap cryptographically negligible regardless of pid.\n\tconst suffix = mintRandomSuffix(16);\n\treturn {\n\t\tstagingPath: `${cacheDir}.staging.${suffix}`,\n\t\tbackupPath: `${cacheDir}.backup.${suffix}`,\n\t};\n};\n\nexport const sealSourceCacheDir = (ref: string): string => {\n\tconst home = readEnv('HOME') ?? '/tmp';\n\treturn `${home}/.cache/devstack/seal-src/${encodeURIComponent(ref)}`;\n};\n\nexport const sealSourcePublishLockPath = (ref: string): string =>\n\t`${sealSourceCacheDir(ref)}.publish.lock`;\n\nconst sourceImageRef = { digest: SEAL_SOURCE_FETCH_IMAGE, tag: SEAL_SOURCE_FETCH_IMAGE } as const;\n\nexport const resolveSealSource = (\n\truntime: ContainerRuntime,\n\tinputs: SealSourceFetchInputs,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tEffect.gen(function* () {\n\t\tconst override = readEnv('SEAL_MOVE_SOURCE_OVERRIDE');\n\t\tif (override && override.length > 0) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: override,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = yield* Path.Path;\n\t\tconst cacheDir = sealSourceCacheDir(inputs.ref);\n\t\tconst subdirPath = path.join(cacheDir, inputs.subdir);\n\t\tconst cached = yield* fs.exists(subdirPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (cached) {\n\t\t\treturn {\n\t\t\t\trepo: inputs.repo,\n\t\t\t\tref: inputs.ref,\n\t\t\t\tsubdir: inputs.subdir,\n\t\t\t\tpath: subdirPath,\n\t\t\t} satisfies SealSourceFetchResolved;\n\t\t}\n\n\t\tconst { stagingPath, backupPath } = nextScratchPaths(cacheDir);\n\t\tyield* stageAndSwap({\n\t\t\ttargetPath: cacheDir,\n\t\t\tstagingPath,\n\t\t\tbackupPath,\n\t\t\tbuild: Effect.gen(function* () {\n\t\t\t\tconst result = yield* Effect.scoped(\n\t\t\t\t\truntime\n\t\t\t\t\t\t.runOneShot({\n\t\t\t\t\t\t\timage: sourceImageRef,\n\t\t\t\t\t\t\tentrypoint: 'git',\n\t\t\t\t\t\t\tuser: hostBindMountOwner(),\n\t\t\t\t\t\t\targv: ['clone', '--depth', '1', '--branch', inputs.ref, inputs.repo, '/out'],\n\t\t\t\t\t\t\tmounts: [{ source: stagingPath, target: '/out' }],\n\t\t\t\t\t\t\ttimeoutMillis: SEAL_SOURCE_FETCH_TIMEOUT_MS,\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\t`seal move-source: git clone one-shot failed: ${cause.reason}: ${cause.detail}. ` +\n\t\t\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\t\tif (result.exitCode !== 0) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t`seal move-source: git clone exited ${result.exitCode}. ` +\n\t\t\t\t\t\t\t\t`Set SEAL_MOVE_SOURCE_OVERRIDE=<path> or pass movePackagePath to bypass.`,\n\t\t\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\t\t\tstdout: tailOutput(result.stdout),\n\t\t\t\t\t\t\tstderr: tailOutput(result.stderr),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst stagedSubdir = path.join(stagingPath, inputs.subdir);\n\t\t\t\tconst stagedSubdirExists = yield* fs\n\t\t\t\t\t.exists(stagedSubdir)\n\t\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\tif (!stagedSubdirExists) {\n\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\tsealError('image', {\n\t\t\t\t\t\t\tname: 'seal',\n\t\t\t\t\t\t\tmessage: `seal move-source: clone completed but ${inputs.subdir} was missing from ${inputs.repo}@${inputs.ref}.`,\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}),\n\t\t\tpublishLockPath: sealSourcePublishLockPath(inputs.ref),\n\t\t}).pipe(\n\t\t\tEffect.mapError((cause): SealError => {\n\t\t\t\tif (cause._tag === 'SealError') return cause;\n\t\t\t\treturn sealError('image', {\n\t\t\t\t\tname: 'seal',\n\t\t\t\t\tmessage: `seal move-source: cache publish failed at ${cause.stage}`,\n\t\t\t\t\tcause,\n\t\t\t\t});\n\t\t\t}),\n\t\t);\n\n\t\treturn {\n\t\t\trepo: inputs.repo,\n\t\t\tref: inputs.ref,\n\t\t\tsubdir: inputs.subdir,\n\t\t\tpath: subdirPath,\n\t\t} satisfies SealSourceFetchResolved;\n\t});\n\n/** Convenience: resolve via the default inputs. */\nexport const resolveDefaultSealSource = (\n\truntime: ContainerRuntime,\n): Effect.Effect<\n\tSealSourceFetchResolved,\n\tSealError,\n\tScope.Scope | FileSystem.FileSystem | Path.Path\n> =>\n\tresolveSealSource(runtime, {\n\t\trepo: DEFAULT_SEAL_REPO,\n\t\tref: DEFAULT_SEAL_VERSION,\n\t\tsubdir: DEFAULT_SEAL_MOVE_SUBDIR,\n\t});\n"],"mappings":";;;;;;;;;;AA+BA,MAAa,oBAAoB;;;;AAKjC,MAAa,uBAAuB;;AAGpC,MAAa,2BAA2B;;;;AAKxC,MAAa,0BAA0B;AAEvC,MAAM,+BAA+B,IAAI;AA0BzC,MAAM,oBACL,aACmE;CAOnE,MAAM,SAAS,iBAAiB,EAAE;CAClC,OAAO;EACN,aAAa,GAAG,SAAS,WAAW;EACpC,YAAY,GAAG,SAAS,UAAU;CACnC;AACD;AAEA,MAAa,sBAAsB,QAAwB;CAE1D,OAAO,GADM,QAAQ,MAAM,KAAK,OACjB,4BAA4B,mBAAmB,GAAG;AAClE;AAEA,MAAa,6BAA6B,QACzC,GAAG,mBAAmB,GAAG,EAAE;AAE5B,MAAM,iBAAiB;CAAE,QAAQ;CAAyB,KAAK;AAAwB;AAEvF,MAAa,qBACZ,SACA,WAMA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,QAAQ,2BAA2B;CACpD,IAAI,YAAY,SAAS,SAAS,GACjC,OAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;CACP;CAGD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,WAAW,mBAAmB,OAAO,GAAG;CAC9C,MAAM,aAAa,KAAK,KAAK,UAAU,OAAO,MAAM;CAEpD,IAAI,OADkB,GAAG,OAAO,UAAU,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,GAEzF,OAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;CACP;CAGD,MAAM,EAAE,aAAa,eAAe,iBAAiB,QAAQ;CAC7D,OAAO,aAAa;EACnB,YAAY;EACZ;EACA;EACA,OAAO,OAAO,IAAI,aAAa;GAC9B,MAAM,SAAS,OAAO,OAAO,OAC5B,QACE,WAAW;IACX,OAAO;IACP,YAAY;IACZ,MAAM,mBAAmB;IACzB,MAAM;KAAC;KAAS;KAAW;KAAK;KAAY,OAAO;KAAK,OAAO;KAAM;IAAM;IAC3E,QAAQ,CAAC;KAAE,QAAQ;KAAa,QAAQ;IAAO,CAAC;IAChD,eAAe;GAChB,CAAC,CAAC,CACD,KACA,OAAO,UAAU,UAChB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,gDAAgD,MAAM,OAAO,IAAI,MAAM,OAAO;IAE/E;GACD,CAAC,CACF,CACD,CACF;GAEA,IAAI,OAAO,aAAa,GACvB,OAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SACC,sCAAsC,OAAO,SAAS;IAEvD,UAAU,OAAO;IACjB,QAAQ,WAAW,OAAO,MAAM;IAChC,QAAQ,WAAW,OAAO,MAAM;GACjC,CAAC,CACF;GAGD,MAAM,eAAe,KAAK,KAAK,aAAa,OAAO,MAAM;GAIzD,IAAI,EAAC,OAH6B,GAChC,OAAO,YAAY,CAAC,CACpB,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,IAE/C,OAAO,OAAO,OAAO,KACpB,UAAU,SAAS;IAClB,MAAM;IACN,SAAS,yCAAyC,OAAO,OAAO,oBAAoB,OAAO,KAAK,GAAG,OAAO,IAAI;GAC/G,CAAC,CACF;EAEF,CAAC;EACD,iBAAiB,0BAA0B,OAAO,GAAG;CACtD,CAAC,CAAC,CAAC,KACF,OAAO,UAAU,UAAqB;EACrC,IAAI,MAAM,SAAS,aAAa,OAAO;EACvC,OAAO,UAAU,SAAS;GACzB,MAAM;GACN,SAAS,6CAA6C,MAAM;GAC5D;EACD,CAAC;CACF,CAAC,CACF;CAEA,OAAO;EACN,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,QAAQ,OAAO;EACf,MAAM;CACP;AACD,CAAC;;AAGF,MAAa,4BACZ,YAMA,kBAAkB,SAAS;CAC1B,MAAM;CACN,KAAK;CACL,QAAQ;AACT,CAAC"}

package/dist/plugins/seal/codegen.d.mts

@@ -1,16 +1,12 @@
 import { SealKeyServerEntry } from "./registry-publish.mjs";
 
 //#region src/plugins/seal/codegen.d.ts
-/** Codegen-emitted shape for seal. Mirrors the read-side resolved
- *  value (sans the per-instance defaults like `weight`). The
- *  bindings emitter writes a TypeScript file exporting these. */
+/** Codegen-emitted shape for seal. */
 interface SealBindings {
   readonly name: string;
   readonly objectId: string;
   readonly keyServerUrl: string;
   readonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;
-  /** Mode marker for consumers that branch between local-keygen and
-   *  known-deployment surfaces. */
   readonly mode: 'local-keygen' | 'live' | 'fork-known';
 }
 //#endregion

package/dist/plugins/seal/codegen.mjs

@@ -1,16 +1,87 @@
-import { Effect } from "effect";
+import { keyedBucketSpec, liveBucketCodegen, staticBucketCodegen } from "../../contracts/config-bindings.mjs";
 //#region src/plugins/seal/codegen.ts
-/** Build the Codegenable contribution for a seal instance. */
-const makeSealCodegenable = (bindings) => ({
-	kind: "codegenable",
-	emitterName: "seal-key-server",
-	outputPath: `seal/${bindings.name}.ts`,
-	emit: (ctx) => Effect.sync(() => {
-		ctx.exportConst("sealBindings", bindings);
-		return ctx.done();
-	})
-});
+/** Build the seal instance's config-binding spec for `name`. `name` / `mode`
+*  are structural literals. For a `local-keygen` instance the object id / URL
+*  are dynamically-deployed (`resolveValue`) and `serverConfigs` is a runtime
+*  committee blob; for a `live` / `fork-known` instance these are DECLARED
+*  config, baked as literals. */
+const sealBucketSpec = (structural) => {
+	const known = structural.known;
+	const fields = known !== void 0 ? [
+		{
+			key: "name",
+			variant: "literal",
+			value: structural.name
+		},
+		{
+			key: "mode",
+			variant: "literal",
+			value: structural.mode
+		},
+		{
+			key: "objectId",
+			variant: "literal",
+			value: known.objectId
+		},
+		{
+			key: "keyServerUrl",
+			variant: "literal",
+			value: known.keyServerUrl
+		},
+		{
+			key: "serverConfigs",
+			variant: "literal",
+			value: known.serverConfigs
+		}
+	] : [
+		{
+			key: "name",
+			variant: "literal",
+			value: structural.name
+		},
+		{
+			key: "mode",
+			variant: "literal",
+			value: structural.mode
+		},
+		{
+			key: "objectId",
+			variant: "resolved",
+			tsType: "string",
+			live: (s) => s.objectId
+		},
+		{
+			key: "keyServerUrl",
+			variant: "resolved",
+			tsType: "string",
+			live: (s) => s.keyServerUrl
+		},
+		{
+			key: "serverConfigs",
+			variant: "resolved",
+			tsType: "ReadonlyArray<{ readonly objectId: string; readonly weight: number; readonly aggregatorUrl?: string }>",
+			live: (s) => s.serverConfigs
+		}
+	];
+	return keyedBucketSpec({
+		bucket: "seal.ts",
+		kind: "seal",
+		key: structural.name,
+		fields
+	});
+};
+/** Build the LIVE Codegenable contribution for a seal instance. Bakes the
+*  resolved key-server fields + feeds the generic id-config `values`
+*  channel. */
+const makeSealCodegenable = (bindings) => liveBucketCodegen(sealBucketSpec({
+	name: bindings.name,
+	mode: bindings.mode
+}), bindings);
+/** Build the STATIC (stack-free) Codegenable contribution for a seal
+*  instance. Emits `resolveValue('seal:<name>', '<key>')` for the runtime
+*  fields; the committed `seal.ts` carries no baked object id / endpoint URL. */
+const makeSealStaticCodegen = (config) => staticBucketCodegen(sealBucketSpec(config));
 //#endregion
-export { makeSealCodegenable };
+export { makeSealCodegenable, makeSealStaticCodegen };
 
 //# sourceMappingURL=codegen.mjs.map

package/dist/plugins/seal/codegen.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/seal/codegen.ts"],"sourcesContent":["// Seal plugin — Codegenable contribution.\n//\n// Distilled-doc §\"Outputs\": the seal plugin contributes ONE codegen\n// emit shape — the `seal-key-server` config the user-facing\n// bindings consume to construct a `SealClient`. The orchestrator\n// reads this contribution + every other plugin's; the heavy\n// codegen substrate (file writing, type-export grouping) lives in\n// the codegen orchestrator (architecture §6).\n//\n// Tag id discipline:\n//\n//   - The emitter name `'seal-key-server'` is pinned here so the\n//     generated output and orchestrator attribution stay stable.\n\nimport { Effect } from 'effect';\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\nimport type { SealKeyServerEntry } from './registry-publish.ts';\n\n// ---------------------------------------------------------------------------\n// Bindings shape\n// ---------------------------------------------------------------------------\n\n/** Codegen-emitted shape for seal. Mirrors the read-side resolved\n *  value (sans the per-instance defaults like `weight`). The\n *  bindings emitter writes a TypeScript file exporting these. */\nexport interface SealBindings {\n\treadonly name: string;\n\treadonly objectId: string;\n\treadonly keyServerUrl: string;\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\t/** Mode marker for consumers that branch between local-keygen and\n\t *  known-deployment surfaces. */\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n}\n\n// ---------------------------------------------------------------------------\n// Decl builder\n// ---------------------------------------------------------------------------\n\n/** Build the Codegenable contribution for a seal instance. */\nexport const makeSealCodegenable = (\n\tbindings: SealBindings,\n): CodegenableDecl<'seal-key-server'> => ({\n\tkind: 'codegenable',\n\temitterName: 'seal-key-server',\n\toutputPath: `seal/${bindings.name}.ts`,\n\temit: (ctx) =>\n\t\tEffect.sync(() => {\n\t\t\tctx.exportConst('sealBindings', bindings satisfies SealBindings);\n\t\t\treturn ctx.done();\n\t\t}),\n});\n"],"mappings":";;;AAyCA,MAAa,uBACZ,cACyC;CACzC,MAAM;CACN,aAAa;CACb,YAAY,QAAQ,SAAS,KAAK;CAClC,OAAO,QACN,OAAO,WAAW;AACjB,MAAI,YAAY,gBAAgB,SAAgC;AAChE,SAAO,IAAI,MAAM;GAChB;CACH"}
+{"version":3,"file":"codegen.mjs","names":[],"sources":["../../../src/plugins/seal/codegen.ts"],"sourcesContent":["// Seal plugin — Codegenable contribution, via the UNIFIED config-binding\n// declaration.\n//\n// The seal plugin contributes ONE codegen shape — the `seal-key-server`\n// config the user-facing bindings consume to construct a `SealClient`.\n//\n// ONE declaration, TWO derivations (see `contracts/config-bindings.ts`). Every\n// seal instance folds into a single `generated/seal.ts` exporting\n// `export const seal = { <name>: SealBindings, ... }` (sibling-keyed bucket):\n//   - LIVE (boot): bakes the resolved key-server object id / URL / configs\n//     AND feeds the generic id-config `values` channel.\n//   - STATIC (committed tree): emits `resolveValue('seal:<name>', '<key>')`\n//     so the committed `seal.ts` carries NO baked object id / endpoint URL.\n//\n// STRUCTURAL fields (`name`, `mode`) stay literals; the object id, key-server\n// URL, and `serverConfigs` committee (an array blob) are RUNTIME (loaded\n// config data), resolved at app build/dev time.\n\nimport type { CodegenableDecl } from '../../contracts/codegenable.ts';\nimport {\n\tkeyedBucketSpec,\n\tliveBucketCodegen,\n\tstaticBucketCodegen,\n\ttype BucketField,\n\ttype SiblingBucketSpec,\n} from '../../contracts/config-bindings.ts';\nimport type { JsonValue } from '../../orchestrators/codegen/id-config.ts';\nimport type { SealKeyServerEntry } from './registry-publish.ts';\n\n/** Codegen-emitted shape for seal. */\nexport interface SealBindings {\n\treadonly name: string;\n\treadonly objectId: string;\n\treadonly keyServerUrl: string;\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n\treadonly mode: 'local-keygen' | 'live' | 'fork-known';\n}\n\n/** User-declared known seal ids, available at factory time. The `live` and\n *  `fork-known` modes resolve their `{objectId, keyServerUrl, serverConfigs}`\n *  tuple at factory time (DECLARED config), so the committed `seal.ts` bakes\n *  them as LITERALS. Absent for `local-keygen` (dev-deployed) whose key-server\n *  ids/URL are dynamic. */\nexport interface SealKnownIds {\n\treadonly objectId: string;\n\treadonly keyServerUrl: string;\n\treadonly serverConfigs: ReadonlyArray<SealKeyServerEntry>;\n}\n\n/** Static-config shape a seal instance knows BEFORE acquire — the\n *  structural names the stack-free `staticCodegen` hook needs. When `known`\n *  is present (live / fork-known), its declared ids are baked as literals;\n *  otherwise (local-keygen) every id resolves at app build/dev time. */\nexport interface SealStaticConfig {\n\treadonly name: string;\n\treadonly mode: SealBindings['mode'];\n\treadonly known?: SealKnownIds;\n}\n\ntype SealLiveState = SealBindings;\n\n/** Build the seal instance's config-binding spec for `name`. `name` / `mode`\n *  are structural literals. For a `local-keygen` instance the object id / URL\n *  are dynamically-deployed (`resolveValue`) and `serverConfigs` is a runtime\n *  committee blob; for a `live` / `fork-known` instance these are DECLARED\n *  config, baked as literals. */\nconst sealBucketSpec = (structural: SealStaticConfig): SiblingBucketSpec<SealLiveState> => {\n\tconst known = structural.known;\n\tconst fields: ReadonlyArray<BucketField<SealLiveState>> =\n\t\tknown !== undefined\n\t\t\t? [\n\t\t\t\t\t{ key: 'name', variant: 'literal', value: structural.name },\n\t\t\t\t\t{ key: 'mode', variant: 'literal', value: structural.mode },\n\t\t\t\t\t{ key: 'objectId', variant: 'literal', value: known.objectId },\n\t\t\t\t\t{ key: 'keyServerUrl', variant: 'literal', value: known.keyServerUrl },\n\t\t\t\t\t{\n\t\t\t\t\t\tkey: 'serverConfigs',\n\t\t\t\t\t\tvariant: 'literal',\n\t\t\t\t\t\tvalue: known.serverConfigs as unknown as JsonValue,\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t: [\n\t\t\t\t\t{ key: 'name', variant: 'literal', value: structural.name },\n\t\t\t\t\t{ key: 'mode', variant: 'literal', value: structural.mode },\n\t\t\t\t\t{ key: 'objectId', variant: 'resolved', tsType: 'string', live: (s) => s.objectId },\n\t\t\t\t\t{\n\t\t\t\t\t\tkey: 'keyServerUrl',\n\t\t\t\t\t\tvariant: 'resolved',\n\t\t\t\t\t\ttsType: 'string',\n\t\t\t\t\t\tlive: (s) => s.keyServerUrl,\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tkey: 'serverConfigs',\n\t\t\t\t\t\tvariant: 'resolved',\n\t\t\t\t\t\t// Inline structural literal mirroring `SealKeyServerEntry` so the\n\t\t\t\t\t\t// committed `seal.ts` carries the concrete type (no emitted import).\n\t\t\t\t\t\ttsType:\n\t\t\t\t\t\t\t'ReadonlyArray<{ readonly objectId: string; readonly weight: number; readonly aggregatorUrl?: string }>',\n\t\t\t\t\t\tlive: (s) => s.serverConfigs as unknown as JsonValue,\n\t\t\t\t\t},\n\t\t\t\t];\n\treturn keyedBucketSpec({ bucket: 'seal.ts', kind: 'seal', key: structural.name, fields });\n};\n\n/** Build the LIVE Codegenable contribution for a seal instance. Bakes the\n *  resolved key-server fields + feeds the generic id-config `values`\n *  channel. */\nexport const makeSealCodegenable = (bindings: SealBindings): CodegenableDecl =>\n\tliveBucketCodegen(sealBucketSpec({ name: bindings.name, mode: bindings.mode }), bindings);\n\n/** Build the STATIC (stack-free) Codegenable contribution for a seal\n *  instance. Emits `resolveValue('seal:<name>', '<key>')` for the runtime\n *  fields; the committed `seal.ts` carries no baked object id / endpoint URL. */\nexport const makeSealStaticCodegen = (config: SealStaticConfig): CodegenableDecl =>\n\tstaticBucketCodegen(sealBucketSpec(config));\n"],"mappings":";;;;;;;AAkEA,MAAM,kBAAkB,eAAmE;CAC1F,MAAM,QAAQ,WAAW;CACzB,MAAM,SACL,UAAU,KAAA,IACP;EACA;GAAE,KAAK;GAAQ,SAAS;GAAW,OAAO,WAAW;EAAK;EAC1D;GAAE,KAAK;GAAQ,SAAS;GAAW,OAAO,WAAW;EAAK;EAC1D;GAAE,KAAK;GAAY,SAAS;GAAW,OAAO,MAAM;EAAS;EAC7D;GAAE,KAAK;GAAgB,SAAS;GAAW,OAAO,MAAM;EAAa;EACrE;GACC,KAAK;GACL,SAAS;GACT,OAAO,MAAM;EACd;CACD,IACC;EACA;GAAE,KAAK;GAAQ,SAAS;GAAW,OAAO,WAAW;EAAK;EAC1D;GAAE,KAAK;GAAQ,SAAS;GAAW,OAAO,WAAW;EAAK;EAC1D;GAAE,KAAK;GAAY,SAAS;GAAY,QAAQ;GAAU,OAAO,MAAM,EAAE;EAAS;EAClF;GACC,KAAK;GACL,SAAS;GACT,QAAQ;GACR,OAAO,MAAM,EAAE;EAChB;EACA;GACC,KAAK;GACL,SAAS;GAGT,QACC;GACD,OAAO,MAAM,EAAE;EAChB;CACD;CACH,OAAO,gBAAgB;EAAE,QAAQ;EAAW,MAAM;EAAQ,KAAK,WAAW;EAAM;CAAO,CAAC;AACzF;;;;AAKA,MAAa,uBAAuB,aACnC,kBAAkB,eAAe;CAAE,MAAM,SAAS;CAAM,MAAM,SAAS;AAAK,CAAC,GAAG,QAAQ;;;;AAKzF,MAAa,yBAAyB,WACrC,oBAAoB,eAAe,MAAM,CAAC"}

package/dist/plugins/seal/config-render.mjs

@@ -1,6 +1,5 @@
 import { atomicWriteFile } from "../../substrate/runtime/atomic-write.mjs";
 import { sealConfigError, sealError } from "./errors.mjs";
-import { SealSpans } from "./spans.mjs";
 import { KEY_SERVER_CONFIG_BASENAME, MASTER_KEY_ENVFILE_BASENAME } from "./keygen.mjs";
 import { Effect } from "effect";
 //#region src/plugins/seal/config-render.ts
@@ -12,7 +11,7 @@ const DEFAULT_TS_SDK_REQUIREMENT = ">=0.4.5";
 *  alphanumerics, `:/_.-`, and `0x` — so the conservative whitelist is
 *  safe. The `ts_sdk_version_requirement` allows the SemVer comparator
 *  characters as well. */
-const YAML_INTERP_FIELD_RE = /^[0-9a-zA-Z:/_.\-]+$/;
+const YAML_INTERP_FIELD_RE = /^[0-9a-zA-Z:/_.-]+$/;
 const YAML_INTERP_SEMVER_RE = /^[0-9a-zA-Z:/_.\-<>=^~* |!]+$/;
 const assertYamlSafe = (field, value, pattern) => {
 	if (pattern.test(value)) return value;
@@ -99,10 +98,7 @@ const stageSealConfig = (yamlBody, masterKeyHex, servicePath, name) => Effect.ge
 		configPath,
 		masterKeyEnvFile
 	};
-}).pipe(Effect.withSpan("devstack.plugin.seal.config-render.stage", { attributes: {
-	[SealSpans.name]: name,
-	[SealSpans.servicePath]: servicePath
-} }));
+});
 //#endregion
 export { parseMasterKeyEnvFile, renderSealKeyServerConfig, stageSealConfig };