@mysten-incubation/devstack 0.1.0 → 0.2.0

package/dist/runtime/docker/client.mjs

@@ -1,5 +1,8 @@
 import { capture } from "../../substrate/runtime/observability/subprocess-capture.mjs";
 import { Context, Effect, Layer } from "effect";
+import { existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir, tmpdir } from "node:os";
 import { ChildProcess } from "effect/unstable/process";
 //#region src/runtime/docker/client.ts
 var DockerHost = class extends Context.Service()("@devstack/runtime-docker/DockerHost") {};
@@ -8,11 +11,52 @@ const layerDockerHostDefault = Layer.succeed(DockerHost)({});
 *  inject a stub. In production this is `ChildProcessSpawner.make()`
 *  from `effect/unstable/process` (provided via `@effect/platform-node`). */
 var DockerSpawner = class extends Context.Service()("@devstack/runtime-docker/DockerSpawner") {};
-const buildEnv = (host) => {
-	const env = {};
+let sanitizedDockerConfig = null;
+const sourceDockerConfigDir = () => process.env.DOCKER_CONFIG ?? join(homedir(), ".docker");
+const originalDockerConfig = (sourceDir) => {
+	try {
+		const parsed = JSON.parse(readFileSync(join(sourceDir, "config.json"), "utf8"));
+		if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) return { ...parsed };
+	} catch {}
+	return {};
+};
+const symlinkDockerConfigDir = (sourceDir, targetDir, name) => {
+	const source = join(sourceDir, name);
+	if (!existsSync(source)) return;
+	try {
+		symlinkSync(source, join(targetDir, name));
+	} catch {}
+};
+const dockerConfigDir = () => {
+	const source = sourceDockerConfigDir();
+	if (sanitizedDockerConfig !== null && sanitizedDockerConfig.sourceDir === source) return sanitizedDockerConfig.dir;
+	const dir = mkdtempSync(join(tmpdir(), "devstack-docker-config-"));
+	for (const name of [
+		"cli-plugins",
+		"buildx",
+		"contexts"
+	]) symlinkDockerConfigDir(source, dir, name);
+	const { credsStore: _credsStore, credHelpers: _credHelpers, ...config } = originalDockerConfig(source);
+	if (!("auths" in config)) config.auths = {};
+	writeFileSync(join(dir, "config.json"), `${JSON.stringify(config)}\n`, { mode: 384 });
+	process.once("exit", () => {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+	});
+	sanitizedDockerConfig = {
+		sourceDir: source,
+		dir
+	};
+	return dir;
+};
+const dockerCliEnv = (host = {}) => {
+	const env = { DOCKER_CONFIG: dockerConfigDir() };
 	if (host.dockerHost !== void 0) env.DOCKER_HOST = host.dockerHost;
 	return env;
 };
+const buildEnv = (host) => dockerCliEnv(host);
 /** Grace period between the scope-close SIGTERM and the escalation
 *  SIGKILL. Without `forceKillAfter` the Node spawner sends ONE SIGTERM
 *  on scope close and then waits indefinitely for the child to die — so
@@ -62,6 +106,6 @@ const dockerRunOk = (verb, args, opts) => Effect.gen(function* () {
 	});
 });
 //#endregion
-export { DockerHost, DockerSpawner, dockerCommand, dockerRun, dockerRunOk, layerDockerHostDefault };
+export { DockerHost, DockerSpawner, dockerCliEnv, dockerCommand, dockerRun, dockerRunOk, layerDockerHostDefault };
 
 //# sourceMappingURL=client.mjs.map

package/dist/runtime/docker/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../../../src/runtime/docker/client.ts"],"sourcesContent":["// Thin `docker` CLI wrapper.\n//\n// Every subprocess invocation flows through the L0 subprocess-capture\n// primitive (one capture function, one error class). This module owns:\n//\n//   - The argv constructor (`dockerArgv`).\n//   - The `DOCKER_HOST` env passthrough (architecture §7: one-daemon\n//     assumption, env override supported).\n//   - Two convenience verbs: `run` (capture-with-success-or-fail-by-exit)\n//     and `runOk` (capture, return CaptureResult regardless of exit so\n//     the caller can classify stderr). NO docker compose anywhere.\n//\n// No service names appear here. No stderr-pattern classification —\n// that's in `wrap.ts`. This file is mechanical argv + spawn.\n\nimport { Context, Effect, Layer } from 'effect';\nimport { ChildProcess } from 'effect/unstable/process';\nimport { ChildProcessSpawner } from 'effect/unstable/process';\n\nimport {\n\tcapture,\n\ttype CaptureError,\n\ttype CaptureOptions,\n\ttype CaptureResult,\n} from '../../substrate/runtime/observability/subprocess-capture.ts';\n\n// -----------------------------------------------------------------------------\n// Daemon-host configuration\n// -----------------------------------------------------------------------------\n\n/** Optional `DOCKER_HOST` override. When absent we let the docker CLI\n *  resolve its default socket (Unix: `/var/run/docker.sock`; macOS\n *  Desktop: `unix:///var/run/docker.sock`; remote daemon if the user\n *  set `DOCKER_HOST` in their own env). */\nexport interface DockerHostShape {\n\treadonly dockerHost?: string;\n\t/** Optional explicit binary path (default `docker`). Tests use\n\t *  this to point at a stub; otherwise we resolve via PATH. */\n\treadonly bin?: string;\n}\n\nexport class DockerHost extends Context.Service<DockerHost, DockerHostShape>()(\n\t'@devstack/runtime-docker/DockerHost',\n) {}\n\nexport const layerDockerHostDefault: Layer.Layer<DockerHost> = Layer.succeed(DockerHost)({});\n\nexport const layerDockerHost = (shape: DockerHostShape): Layer.Layer<DockerHost> =>\n\tLayer.succeed(DockerHost)(shape);\n\n// -----------------------------------------------------------------------------\n// Spawner injection\n// -----------------------------------------------------------------------------\n\n/** A spawner service exposing `spawn`. Held as a service so tests can\n *  inject a stub. In production this is `ChildProcessSpawner.make()`\n *  from `effect/unstable/process` (provided via `@effect/platform-node`). */\nexport class DockerSpawner extends Context.Service<\n\tDockerSpawner,\n\tReturnType<typeof ChildProcessSpawner.make>\n>()('@devstack/runtime-docker/DockerSpawner') {}\n\n// -----------------------------------------------------------------------------\n// Argv construction\n// -----------------------------------------------------------------------------\n\nconst buildEnv = (host: DockerHostShape): Record<string, string> => {\n\tconst env: Record<string, string> = {};\n\tif (host.dockerHost !== undefined) env.DOCKER_HOST = host.dockerHost;\n\treturn env;\n};\n\n/** Grace period between the scope-close SIGTERM and the escalation\n *  SIGKILL. Without `forceKillAfter` the Node spawner sends ONE SIGTERM\n *  on scope close and then waits indefinitely for the child to die — so\n *  a timeout-interrupt (see `exec.ts` / `dockerRunOneShot` `Effect.timeout`)\n *  blocks on scope-close if the docker CLI ignores SIGTERM. A few\n *  seconds lets a well-behaved CLI flush and exit cleanly before we\n *  force-kill the wedged case. */\nconst KILL_GRACE = '5 seconds';\n\n/** Build a `ChildProcess.Command` from `(verb, ...args)`. The verb is\n *  separate so observability span attributes can pin the\n *  high-cardinality `args` separately from the `devstack.op` tag.\n *\n *  `forceKillAfter` makes scope-close termination escalate\n *  SIGTERM→SIGKILL so an interrupt (timeout) can't wedge on a docker CLI\n *  that ignores SIGTERM. */\nexport const dockerCommand = (\n\thost: DockerHostShape,\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\toverrideEnv: Readonly<Record<string, string>> = {},\n): ChildProcess.Command => {\n\tconst bin = host.bin ?? 'docker';\n\tconst env = { ...buildEnv(host), ...overrideEnv };\n\treturn ChildProcess.make(bin, [verb, ...args], {\n\t\tenv,\n\t\textendEnv: true,\n\t\tforceKillAfter: KILL_GRACE,\n\t});\n};\n\n// -----------------------------------------------------------------------------\n// Capture verbs\n// -----------------------------------------------------------------------------\n\n/** Capture a docker invocation, fail on non-zero exit. Use when any\n *  non-zero exit is a failure case (most write operations). */\nexport const dockerRun = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: true,\n\t\t});\n\t});\n\n/** Capture a docker invocation, return the `CaptureResult` regardless\n *  of exit. Use when the caller classifies stderr or wants the exit\n *  code (lifecycle state machine, inventory). */\nexport const dockerRunOk = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: false,\n\t\t});\n\t});\n"],"mappings":";;;;AAyCA,IAAa,aAAb,cAAgC,QAAQ,SAAsC,CAC7E,sCACA,CAAC;AAEF,MAAa,yBAAkD,MAAM,QAAQ,WAAW,CAAC,EAAE,CAAC;;;;AAY5F,IAAa,gBAAb,cAAmC,QAAQ,SAGxC,CAAC,yCAAyC,CAAC;AAM9C,MAAM,YAAY,SAAkD;CACnE,MAAM,MAA8B,EAAE;AACtC,KAAI,KAAK,eAAe,KAAA,EAAW,KAAI,cAAc,KAAK;AAC1D,QAAO;;;;;;;;;AAUR,MAAM,aAAa;;;;;;;;AASnB,MAAa,iBACZ,MACA,MACA,MACA,cAAgD,EAAE,KACxB;CAC1B,MAAM,MAAM,KAAK,OAAO;CACxB,MAAM,MAAM;EAAE,GAAG,SAAS,KAAK;EAAE,GAAG;EAAa;AACjD,QAAO,aAAa,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE;EAC9C;EACA,WAAW;EACX,gBAAgB;EAChB,CAAC;;;;AASH,MAAa,aACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;AAEpB,QAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,KAAK,EAAE;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;EAClB,CAAC;EACD;;;;AAKH,MAAa,eACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;AAEpB,QAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,KAAK,EAAE;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;EAClB,CAAC;EACD"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../../../src/runtime/docker/client.ts"],"sourcesContent":["// Thin `docker` CLI wrapper.\n//\n// Every subprocess invocation flows through the L0 subprocess-capture\n// primitive (one capture function, one error class). This module owns:\n//\n//   - The argv constructor (`dockerArgv`).\n//   - The `DOCKER_HOST` env passthrough (architecture §7: one-daemon\n//     assumption, env override supported).\n//   - Two convenience verbs: `run` (capture-with-success-or-fail-by-exit)\n//     and `runOk` (capture, return CaptureResult regardless of exit so\n//     the caller can classify stderr). NO docker compose anywhere.\n//\n// No service names appear here. No stderr-pattern classification —\n// that's in `wrap.ts`. This file is mechanical argv + spawn.\n\nimport { existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';\nimport { homedir, tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\nimport { Context, Effect, Layer } from 'effect';\nimport { ChildProcess } from 'effect/unstable/process';\nimport { ChildProcessSpawner } from 'effect/unstable/process';\n\nimport {\n\tcapture,\n\ttype CaptureError,\n\ttype CaptureOptions,\n\ttype CaptureResult,\n} from '../../substrate/runtime/observability/subprocess-capture.ts';\n\n// -----------------------------------------------------------------------------\n// Daemon-host configuration\n// -----------------------------------------------------------------------------\n\n/** Optional `DOCKER_HOST` override. When absent we let the docker CLI\n *  resolve its default socket (Unix: `/var/run/docker.sock`; macOS\n *  Desktop: `unix:///var/run/docker.sock`; remote daemon if the user\n *  set `DOCKER_HOST` in their own env). */\nexport interface DockerHostShape {\n\treadonly dockerHost?: string;\n\t/** Optional explicit binary path (default `docker`). Tests use\n\t *  this to point at a stub; otherwise we resolve via PATH. */\n\treadonly bin?: string;\n}\n\nexport class DockerHost extends Context.Service<DockerHost, DockerHostShape>()(\n\t'@devstack/runtime-docker/DockerHost',\n) {}\n\nexport const layerDockerHostDefault: Layer.Layer<DockerHost> = Layer.succeed(DockerHost)({});\n\nexport const layerDockerHost = (shape: DockerHostShape): Layer.Layer<DockerHost> =>\n\tLayer.succeed(DockerHost)(shape);\n\n// -----------------------------------------------------------------------------\n// Spawner injection\n// -----------------------------------------------------------------------------\n\n/** A spawner service exposing `spawn`. Held as a service so tests can\n *  inject a stub. In production this is `ChildProcessSpawner.make()`\n *  from `effect/unstable/process` (provided via `@effect/platform-node`). */\nexport class DockerSpawner extends Context.Service<\n\tDockerSpawner,\n\tReturnType<typeof ChildProcessSpawner.make>\n>()('@devstack/runtime-docker/DockerSpawner') {}\n\n// -----------------------------------------------------------------------------\n// Argv construction\n// -----------------------------------------------------------------------------\n\nlet sanitizedDockerConfig: {\n\treadonly sourceDir: string;\n\treadonly dir: string;\n} | null = null;\n\nconst sourceDockerConfigDir = (): string => process.env.DOCKER_CONFIG ?? join(homedir(), '.docker');\n\nconst originalDockerConfig = (sourceDir: string): Record<string, unknown> => {\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(readFileSync(join(sourceDir, 'config.json'), 'utf8'));\n\t\tif (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {\n\t\t\treturn { ...(parsed as Record<string, unknown>) };\n\t\t}\n\t} catch {\n\t\t// Missing or malformed Docker config: let the CLI fall back to defaults.\n\t}\n\treturn {};\n};\n\nconst symlinkDockerConfigDir = (sourceDir: string, targetDir: string, name: string): void => {\n\tconst source = join(sourceDir, name);\n\tif (!existsSync(source)) return;\n\ttry {\n\t\tsymlinkSync(source, join(targetDir, name));\n\t} catch {\n\t\t// Best effort. Docker can still run without these; buildx/context\n\t\t// preservation only avoids changing behavior for Desktop/remote users.\n\t}\n};\n\nconst dockerConfigDir = (): string => {\n\tconst source = sourceDockerConfigDir();\n\tif (sanitizedDockerConfig !== null && sanitizedDockerConfig.sourceDir === source) {\n\t\treturn sanitizedDockerConfig.dir;\n\t}\n\tconst dir = mkdtempSync(join(tmpdir(), 'devstack-docker-config-'));\n\tfor (const name of ['cli-plugins', 'buildx', 'contexts']) {\n\t\tsymlinkDockerConfigDir(source, dir, name);\n\t}\n\t// Docker Desktop's `credsStore: \"desktop\"` helper can block forever on\n\t// public image metadata resolution. Give the CLI a process-local config with\n\t// credential helpers stripped while preserving static auth entries, proxies,\n\t// custom headers, contexts, and other non-helper Docker config.\n\tconst {\n\t\tcredsStore: _credsStore,\n\t\tcredHelpers: _credHelpers,\n\t\t...config\n\t} = originalDockerConfig(source);\n\tif (!('auths' in config)) config.auths = {};\n\twriteFileSync(join(dir, 'config.json'), `${JSON.stringify(config)}\\n`, {\n\t\tmode: 0o600,\n\t});\n\tprocess.once('exit', () => {\n\t\trmSync(dir, { recursive: true, force: true });\n\t});\n\tsanitizedDockerConfig = { sourceDir: source, dir };\n\treturn dir;\n};\n\nexport const dockerCliEnv = (host: DockerHostShape = {}): Record<string, string> => {\n\tconst env: Record<string, string> = { DOCKER_CONFIG: dockerConfigDir() };\n\tif (host.dockerHost !== undefined) env.DOCKER_HOST = host.dockerHost;\n\treturn env;\n};\n\nconst buildEnv = (host: DockerHostShape): Record<string, string> => dockerCliEnv(host);\n\n/** Grace period between the scope-close SIGTERM and the escalation\n *  SIGKILL. Without `forceKillAfter` the Node spawner sends ONE SIGTERM\n *  on scope close and then waits indefinitely for the child to die — so\n *  a timeout-interrupt (see `exec.ts` / `dockerRunOneShot` `Effect.timeout`)\n *  blocks on scope-close if the docker CLI ignores SIGTERM. A few\n *  seconds lets a well-behaved CLI flush and exit cleanly before we\n *  force-kill the wedged case. */\nconst KILL_GRACE = '5 seconds';\n\n/** Build a `ChildProcess.Command` from `(verb, ...args)`. The verb is\n *  separate so observability span attributes can pin the\n *  high-cardinality `args` separately from the `devstack.op` tag.\n *\n *  `forceKillAfter` makes scope-close termination escalate\n *  SIGTERM→SIGKILL so an interrupt (timeout) can't wedge on a docker CLI\n *  that ignores SIGTERM. */\nexport const dockerCommand = (\n\thost: DockerHostShape,\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\toverrideEnv: Readonly<Record<string, string>> = {},\n): ChildProcess.Command => {\n\tconst bin = host.bin ?? 'docker';\n\tconst env = { ...buildEnv(host), ...overrideEnv };\n\treturn ChildProcess.make(bin, [verb, ...args], {\n\t\tenv,\n\t\textendEnv: true,\n\t\tforceKillAfter: KILL_GRACE,\n\t});\n};\n\n// -----------------------------------------------------------------------------\n// Capture verbs\n// -----------------------------------------------------------------------------\n\n/** Capture a docker invocation, fail on non-zero exit. Use when any\n *  non-zero exit is a failure case (most write operations). */\nexport const dockerRun = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: true,\n\t\t});\n\t});\n\n/** Capture a docker invocation, return the `CaptureResult` regardless\n *  of exit. Use when the caller classifies stderr or wants the exit\n *  code (lifecycle state machine, inventory). */\nexport const dockerRunOk = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: false,\n\t\t});\n\t});\n"],"mappings":";;;;;;;AA6CA,IAAa,aAAb,cAAgC,QAAQ,QAAqC,CAAC,CAC7E,qCACD,CAAC,CAAC,CAAC;AAEH,MAAa,yBAAkD,MAAM,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC;;;;AAY3F,IAAa,gBAAb,cAAmC,QAAQ,QAGzC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC;AAM/C,IAAI,wBAGO;AAEX,MAAM,8BAAsC,QAAQ,IAAI,iBAAiB,KAAK,QAAQ,GAAG,SAAS;AAElG,MAAM,wBAAwB,cAA+C;CAC5E,IAAI;EACH,MAAM,SAAkB,KAAK,MAAM,aAAa,KAAK,WAAW,aAAa,GAAG,MAAM,CAAC;EACvF,IAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GACzE,OAAO,EAAE,GAAI,OAAmC;CAElD,QAAQ,CAER;CACA,OAAO,CAAC;AACT;AAEA,MAAM,0BAA0B,WAAmB,WAAmB,SAAuB;CAC5F,MAAM,SAAS,KAAK,WAAW,IAAI;CACnC,IAAI,CAAC,WAAW,MAAM,GAAG;CACzB,IAAI;EACH,YAAY,QAAQ,KAAK,WAAW,IAAI,CAAC;CAC1C,QAAQ,CAGR;AACD;AAEA,MAAM,wBAAgC;CACrC,MAAM,SAAS,sBAAsB;CACrC,IAAI,0BAA0B,QAAQ,sBAAsB,cAAc,QACzE,OAAO,sBAAsB;CAE9B,MAAM,MAAM,YAAY,KAAK,OAAO,GAAG,yBAAyB,CAAC;CACjE,KAAK,MAAM,QAAQ;EAAC;EAAe;EAAU;CAAU,GACtD,uBAAuB,QAAQ,KAAK,IAAI;CAMzC,MAAM,EACL,YAAY,aACZ,aAAa,cACb,GAAG,WACA,qBAAqB,MAAM;CAC/B,IAAI,EAAE,WAAW,SAAS,OAAO,QAAQ,CAAC;CAC1C,cAAc,KAAK,KAAK,aAAa,GAAG,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,EACtE,MAAM,IACP,CAAC;CACD,QAAQ,KAAK,cAAc;EAC1B,OAAO,KAAK;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAC7C,CAAC;CACD,wBAAwB;EAAE,WAAW;EAAQ;CAAI;CACjD,OAAO;AACR;AAEA,MAAa,gBAAgB,OAAwB,CAAC,MAA8B;CACnF,MAAM,MAA8B,EAAE,eAAe,gBAAgB,EAAE;CACvE,IAAI,KAAK,eAAe,KAAA,GAAW,IAAI,cAAc,KAAK;CAC1D,OAAO;AACR;AAEA,MAAM,YAAY,SAAkD,aAAa,IAAI;;;;;;;;AASrF,MAAM,aAAa;;;;;;;;AASnB,MAAa,iBACZ,MACA,MACA,MACA,cAAgD,CAAC,MACvB;CAC1B,MAAM,MAAM,KAAK,OAAO;CACxB,MAAM,MAAM;EAAE,GAAG,SAAS,IAAI;EAAG,GAAG;CAAY;CAChD,OAAO,aAAa,KAAK,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG;EAC9C;EACA,WAAW;EACX,gBAAgB;CACjB,CAAC;AACF;;;AAQA,MAAa,aACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;CAEpB,OAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,IAAI,GAAG;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;CACnB,CAAC;AACF,CAAC;;;;AAKF,MAAa,eACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;CAEpB,OAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,IAAI,GAAG;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;CACnB,CAAC;AACF,CAAC"}

package/dist/runtime/docker/container.mjs

@@ -1,5 +1,3 @@
-import { StackPathsService } from "../../substrate/runtime/paths.mjs";
-import { addClaim, removeClaim } from "../../substrate/runtime/cross-process/roster.mjs";
 import { dockerRun, dockerRunOk } from "./client.mjs";
 import { ContainerCreateFailed, ContainerNameCollisionUnrecoverable, DaemonUnreachable, ForeignDockerResource, RecreateRefused } from "./errors.mjs";
 import { classifyExit, isDaemonUnreachableStderr, isNameCollisionStderr, isNoSuchContainerStderr, wrapCreateError, wrapGeneric } from "./wrap.mjs";
@@ -65,10 +63,6 @@ const decideRunAction = (facts, desiredImage, policy, desiredPortBindings = [],
 			kind: "refuse",
 			reason: "unclean-shutdown"
 		};
-		return {
-			kind: "resume",
-			id: facts.id
-		};
 	}
 	return {
 		kind: "resume",
@@ -234,7 +228,7 @@ const inspectContainer = (name) => Effect.gen(function* () {
 		networks,
 		networkAttachments
 	};
-}).pipe(Effect.withSpan("runtime.docker.container.inspect"));
+});
 const normalizeNetworkAttachment = (entry) => typeof entry === "string" ? { name: entry } : entry.aliases === void 0 || entry.aliases.length === 0 ? { name: entry.name } : {
 	name: entry.name,
 	aliases: entry.aliases
@@ -268,9 +262,8 @@ const handleOf = (id, name, imageName, status, ips, ports, labels) => ({
 /** Force-remove by name. Used by recreate. Idempotent on
 *  "no such container". */
 const forceRemove = (name) => Effect.gen(function* () {
-	const res = yield* dockerRunOk("rm", ["-f", name]).pipe(Effect.mapError(wrapGeneric("docker.rm")));
-	if (res.exitCode !== 0 && !isNoSuchContainerStderr(res.stderr)) yield* Effect.annotateCurrentSpan({ "docker.rm.warning": res.stderr });
-}).pipe(Effect.withSpan("runtime.docker.container.forceRemove"));
+	yield* dockerRunOk("rm", ["-f", name]).pipe(Effect.mapError(wrapGeneric("docker.rm")));
+});
 const ownershipFailure = (name, expected, actual, detail) => new ForeignDockerResource({
 	resource: "container",
 	name,
@@ -295,7 +288,7 @@ const assertContainerHandleOwned = (handle) => Effect.gen(function* () {
 	if (facts === null) return yield* Effect.fail(ownershipFailure(handle.name, expected, {}, "container is missing"));
 	if (facts.id !== handle.id) return yield* Effect.fail(ownershipFailure(handle.name, expected, facts.labels ?? {}, `id changed to ${facts.id}`));
 	yield* assertOwnedFacts(handle.name, facts, handle.labels);
-}).pipe(Effect.withSpan("runtime.docker.container.assertOwned"));
+});
 const forceRemoveOwned = (name, id, labels) => Effect.gen(function* () {
 	const current = yield* inspectContainer(name);
 	if (current === null) return;
@@ -337,9 +330,34 @@ const startAndAdopt = (name, labels) => Effect.gen(function* () {
 		detail: `start-and-adopt failed: ${cls.stderr}`
 	}));
 });
+/** `docker run` create with a single `imageRef`. The typed
+*  `ImageNotFound` (from `wrapCreateError`) is propagated as-is so the
+*  caller can decide whether a digest fallback is available. */
+const createWithImageRef = (spec, cycle, imageRef) => Effect.gen(function* () {
+	return (yield* dockerRun("run", createArgv(spec, cycle, imageRef)).pipe(Effect.mapError(wrapCreateError(spec.name)))).stdout.trim();
+});
 const freshCreate = (spec, cycle) => Effect.gen(function* () {
-	return (yield* dockerRun("run", createArgv(spec, cycle, spec.image.tag ?? spec.image.digest)).pipe(Effect.mapError(wrapCreateError(spec.name)))).stdout.trim();
+	const taggedRef = spec.image.tag ?? spec.image.digest;
+	const digestRef = spec.image.digest;
+	return yield* createWithImageRef(spec, cycle, taggedRef).pipe(Effect.catchTag("ImageNotFound", (notFound) => {
+		if (digestRef === taggedRef) return Effect.fail(missingImageError(spec, taggedRef));
+		return createWithImageRef(spec, cycle, digestRef).pipe(Effect.catchTag("ImageNotFound", () => Effect.fail(missingImageError(spec, taggedRef, digestRef, notFound))));
+	}));
 });
+/** Clear, actionable failure when neither the tagged nor digest ref
+*  could be created because the image is absent locally. Names the
+*  missing image and points at restore so an operator knows the fix is
+*  re-running restore (which re-promotes / re-loads the image) rather
+*  than a generic create failure. */
+const missingImageError = (spec, taggedRef, digestRef, cause) => {
+	const tried = digestRef !== void 0 && digestRef !== taggedRef ? `tag '${taggedRef}' and digest '${digestRef}'` : `image '${taggedRef}'`;
+	const causeDetail = cause === void 0 ? "" : ` (${cause.detail})`;
+	return new ContainerCreateFailed({
+		name: spec.name,
+		stderr: `required image is not present locally — tried ${tried}${causeDetail}. Re-run restore to re-promote / re-load the target image before booting.`,
+		exitCode: void 0
+	});
+};
 const resumeStart = (name) => Effect.gen(function* () {
 	const res = yield* dockerRunOk("start", [name]).pipe(Effect.mapError(wrapGeneric("docker.start")));
 	if (res.exitCode === 0) return { ok: true };
@@ -462,48 +480,16 @@ const releasePerNameLock = (lock, name) => Effect.gen(function* () {
 *  helper releases the lock. */
 const withSerializedContainerOp = (name, lock, body) => Effect.acquireUseRelease(acquirePerNameLock(lock, name), () => body, () => releasePerNameLock(lock, name));
 /** Idempotent ensure: apply the state machine, register a scope
-*  finalizer that stops the container + releases the cross-process
-*  claim.
+*  finalizer that stops the container.
 *
 *  Returns the running container handle (id + name + status + ips). */
 const ensureContainer = (spec, deps) => Effect.gen(function* () {
 	const desiredImageRef = spec.image.tag ?? spec.image.digest;
-	const paths = yield* StackPathsService;
-	const mapSubstrateClaimError = (eff) => eff.pipe(Effect.catchTags({
-		RosterIoError: (cause) => Effect.fail(new DaemonUnreachable({
-			op: "cross-process.claim.roster-io",
-			detail: `roster IO failed at ${cause.path}`,
-			cause
-		})),
-		RosterCorruptError: (cause) => Effect.fail(new DaemonUnreachable({
-			op: "cross-process.claim.roster-corrupt",
-			detail: `roster ledger corrupt at ${cause.path}`,
-			cause
-		})),
-		StackLockTimeoutError: (cause) => Effect.fail(new DaemonUnreachable({
-			op: "cross-process.claim.stack-lock-timeout",
-			detail: `stack-lock acquire timed out after ${cause.waitedMillis}ms at ${cause.path}`,
-			cause
-		})),
-		StackLockIoError: (cause) => Effect.fail(new DaemonUnreachable({
-			op: "cross-process.claim.stack-lock-io",
-			detail: `stack-lock IO failed at ${cause.path}`,
-			cause
-		}))
-	}));
 	const registerStopFinalizer = (id) => Effect.addFinalizer(() => Effect.gen(function* () {
 		if ((yield* inspectContainer(spec.name).pipe(Effect.tapCause((cause) => Effect.logDebug("container inspect during scope-close failed", {
 			name: spec.name,
 			cause
-		})), Effect.catch(() => Effect.succeed(null))))?.id === id) yield* stopWithGrace(spec.name, spec.stopGraceSeconds ?? 10);
-		yield* removeClaim({
-			stackLockFile: paths.stackLockFile,
-			rosterFile: paths.rosterFile,
-			containerClaimsFile: paths.containerClaimsFile
-		}, spec.name).pipe(Effect.tapCause((cause) => Effect.logDebug("removeClaim during scope-close failed", {
-			name: spec.name,
-			cause
-		})), Effect.catch(() => Effect.succeed({ lastClaimReleased: false })));
+		})), Effect.catch(() => Effect.succeed(null))))?.id === id) yield* stopWithGrace(spec.name, spec.stopGraceSeconds ?? 10, spec.stopSignal);
 	}).pipe(Effect.uninterruptible));
 	const { id, ips, ports } = yield* withSerializedContainerOp(spec.name, deps.perNameLock, Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
 		const facts = yield* inspectContainer(spec.name);
@@ -526,15 +512,9 @@ const ensureContainer = (spec, deps) => Effect.gen(function* () {
 			}
 			const ips = yield* readIps(spec.name);
 			const refreshedFacts = yield* inspectContainer(spec.name);
-			const ports = refreshedFacts?.effectivePorts ?? refreshedFacts?.ports ?? spec.ports;
-			yield* mapSubstrateClaimError(addClaim({
-				stackLockFile: paths.stackLockFile,
-				rosterFile: paths.rosterFile,
-				containerClaimsFile: paths.containerClaimsFile
-			}, spec.name));
 			return {
 				ips,
-				ports
+				ports: refreshedFacts?.effectivePorts ?? refreshedFacts?.ports ?? spec.ports
 			};
 		}));
 		return {
@@ -544,7 +524,7 @@ const ensureContainer = (spec, deps) => Effect.gen(function* () {
 		};
 	})));
 	return handleOf(id, spec.name, spec.image.tag ?? spec.image.digest, "running", ips, ports, spec.labels);
-}).pipe(Effect.withSpan("runtime.docker.container.ensure"));
+});
 /** Apply the decided action. Recovers from name-collision via
 *  one-shot start-and-adopt; second collision surfaces typed. */
 const applyAction = (action, spec, deps) => Effect.gen(function* () {
@@ -588,10 +568,10 @@ const createWithCollisionRecovery = (spec, deps) => freshCreate(spec, deps.cycle
 const stop = (name, graceSeconds, signal) => stopWithGrace(name, graceSeconds, signal).pipe(Effect.asVoid);
 const pause = (name) => Effect.gen(function* () {
 	yield* dockerRun("pause", [name]).pipe(Effect.mapError(wrapGeneric("docker.pause")));
-}).pipe(Effect.withSpan("runtime.docker.container.pause"));
+});
 const unpause = (name) => Effect.gen(function* () {
 	yield* dockerRun("unpause", [name]).pipe(Effect.mapError(wrapGeneric("docker.unpause")));
-}).pipe(Effect.withSpan("runtime.docker.container.unpause"));
+});
 /** Reserved `devstack.role` value stamped on every committed snapshot
 *  byproduct image. Plugin BUILD images carry the source plugin's real
 *  role (`db`, `validator`, …) or no role at all; committed snapshot
@@ -642,7 +622,7 @@ const commit = (name, tag) => Effect.gen(function* () {
 		exitCode: 0
 	}));
 	return digest;
-}).pipe(Effect.withSpan("runtime.docker.container.commit"));
+});
 //#endregion
 export { SNAPSHOT_IMAGE_ROLE, assertContainerHandleOwned, commit, decideRunAction, ensureContainer, inspectContainer, pause, stop, unpause };