@mysten-incubation/devstack 0.1.0 → 0.2.0

package/dist/runtime/docker/render-run-args.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"render-run-args.mjs","names":[],"sources":["../../../src/runtime/docker/render-run-args.ts"],"sourcesContent":["// `docker run` / `docker create` argv assembly.\n//\n// `dockerRunOneShot` (one-shot `docker run --rm`) and `freshCreate`\n// (long-lived `docker run -d` from `container.ts`) both flatten a\n// structured spec into the same repeating argv patterns —\n// `--env K=V`, `--mount type=bind,...`, `--add-host h:ip`, etc. The\n// flag order differs between the two consumers and that order is\n// load-bearing for byte-identical migration (tests assert exact\n// argv strings), so this module exposes:\n//\n//   - `renderRunArgs` — argv shape used by `dockerRunOneShot`.\n//   - `renderCreateArgs` — argv shape used by `freshCreate`.\n//\n// Both share the internal per-flag emit helpers so the repeated\n// patterns live in one place. New Docker-run-style call sites should\n// pick whichever helper matches the order they want (or extend this\n// module rather than open-coding `args.push('--env', ...)` again).\n\n// -----------------------------------------------------------------------------\n// Shared flag shapes\n// -----------------------------------------------------------------------------\n\n/** `--mount type=bind,source=...,target=...[,readonly]`. */\nexport interface BindMountSpec {\n\treadonly source: string;\n\treadonly target: string;\n\treadonly readonly?: boolean;\n}\n\n/** `-p [hostIp:]hostPort:containerPort`. Mirrors `ContainerPortPublish`\n *  but kept independent so this module has no upward dep on\n *  `contracts/`. */\nexport interface PortPublishSpec {\n\treadonly containerPort: number;\n\treadonly hostPort: number;\n\treadonly hostIp?: string;\n}\n\n/** First-network attachment + optional per-network DNS aliases. */\nexport interface NetworkAttachSpec {\n\treadonly name: string;\n\treadonly aliases?: ReadonlyArray<string>;\n}\n\n// -----------------------------------------------------------------------------\n// Per-flag emit helpers — internal\n// -----------------------------------------------------------------------------\n\nconst pushEnv = (args: Array<string>, env: Readonly<Record<string, string>> | undefined): void => {\n\tif (env === undefined) return;\n\tfor (const [k, v] of Object.entries(env)) {\n\t\targs.push('--env', `${k}=${v}`);\n\t}\n};\n\nconst pushMounts = (\n\targs: Array<string>,\n\tmounts: ReadonlyArray<BindMountSpec> | undefined,\n): void => {\n\tif (mounts === undefined) return;\n\tfor (const m of mounts) {\n\t\tconst ro = m.readonly ? ',readonly' : '';\n\t\targs.push('--mount', `type=bind,source=${m.source},target=${m.target}${ro}`);\n\t}\n};\n\nconst pushAddHosts = (\n\targs: Array<string>,\n\taddHosts: Readonly<Record<string, string>> | undefined,\n): void => {\n\tif (addHosts === undefined) return;\n\tfor (const [host, ip] of Object.entries(addHosts)) {\n\t\targs.push('--add-host', `${host}:${ip}`);\n\t}\n};\n\nconst pushLabels = (args: Array<string>, labels: ReadonlyArray<string> | undefined): void => {\n\tif (labels === undefined) return;\n\tfor (const l of labels) args.push('--label', l);\n};\n\nconst pushPorts = (\n\targs: Array<string>,\n\tports: ReadonlyArray<PortPublishSpec> | undefined,\n): void => {\n\tif (ports === undefined) return;\n\tfor (const p of ports) {\n\t\tconst hostPrefix = p.hostIp === undefined ? '' : `${p.hostIp}:`;\n\t\targs.push('-p', `${hostPrefix}${p.hostPort}:${p.containerPort}`);\n\t}\n};\n\n// -----------------------------------------------------------------------------\n// `renderRunArgs` — one-shot `docker run --rm`\n// -----------------------------------------------------------------------------\n\n/** Spec for `renderRunArgs`. Mirrors what `dockerRunOneShot` already\n *  flattens. Order of the resulting argv is fixed by `renderRunArgs`. */\nexport interface RenderRunArgsSpec {\n\t/** Drop `--rm` when true (forensic-retention escape hatch). */\n\treadonly keep?: boolean;\n\treadonly name: string;\n\treadonly image: string;\n\t/** Positional argv appended after the image. */\n\treadonly argv?: ReadonlyArray<string>;\n\treadonly network?: string;\n\treadonly entrypoint?: string;\n\treadonly user?: string;\n\treadonly env?: Readonly<Record<string, string>>;\n\treadonly mounts?: ReadonlyArray<BindMountSpec>;\n\t/** Pre-rendered `key=value` strings. */\n\treadonly labels?: ReadonlyArray<string>;\n\treadonly addHosts?: Readonly<Record<string, string>>;\n}\n\n/** Render argv for `docker run --rm`-style one-shot invocations.\n *\n *  Output order:\n *    `[--rm?] --name N [--network …] [--entrypoint …] [--user …]\n *     env… mount… label… add-host… <image> [argv…]`\n *\n *  Order is load-bearing — callers' fake-docker tests assert against\n *  this exact sequence. */\nexport const renderRunArgs = (spec: RenderRunArgsSpec): ReadonlyArray<string> => {\n\tconst args: Array<string> = [];\n\tif (!spec.keep) args.push('--rm');\n\targs.push('--name', spec.name);\n\tif (spec.network) args.push('--network', spec.network);\n\tif (spec.entrypoint) args.push('--entrypoint', spec.entrypoint);\n\tif (spec.user) args.push('--user', spec.user);\n\tpushEnv(args, spec.env);\n\tpushMounts(args, spec.mounts);\n\tpushLabels(args, spec.labels);\n\tpushAddHosts(args, spec.addHosts);\n\targs.push(spec.image);\n\tif (spec.argv) args.push(...spec.argv);\n\treturn args;\n};\n\n// -----------------------------------------------------------------------------\n// `renderCreateArgs` — long-lived `docker run -d`\n// -----------------------------------------------------------------------------\n\n/** Spec for `renderCreateArgs`. Used by `freshCreate` in\n *  `container.ts`. Long-lived containers always run detached. */\nexport interface RenderCreateArgsSpec {\n\treadonly name: string;\n\treadonly image: string;\n\t/** Positional argv appended after the image. */\n\treadonly command?: ReadonlyArray<string>;\n\t/** First network attach — emitted via `--network`. Per-network\n\t *  aliases become `--network-alias` flags. Secondary attaches are\n\t *  done post-start by the caller (architecture §5). */\n\treadonly network?: NetworkAttachSpec;\n\treadonly entrypoint?: string;\n\treadonly env?: Readonly<Record<string, string>>;\n\treadonly mounts?: ReadonlyArray<BindMountSpec>;\n\treadonly ports?: ReadonlyArray<PortPublishSpec>;\n\t/** Pre-rendered `key=value` strings (typically from `renderContainerLabels`). */\n\treadonly labels?: ReadonlyArray<string>;\n\treadonly addHosts?: Readonly<Record<string, string>>;\n}\n\n/** Render argv for `docker run -d`-style long-lived container create.\n *\n *  Output order:\n *    `-d --name N label… env… -p… mount… [--network N --network-alias …]\n *     add-host… [--entrypoint …] <image> [command…]`\n *\n *  Order is load-bearing — tests that snapshot the create argv assert\n *  against this exact sequence. */\nexport const renderCreateArgs = (spec: RenderCreateArgsSpec): ReadonlyArray<string> => {\n\tconst args: Array<string> = ['-d', '--name', spec.name];\n\tpushLabels(args, spec.labels);\n\tpushEnv(args, spec.env);\n\tpushPorts(args, spec.ports);\n\tpushMounts(args, spec.mounts);\n\tif (spec.network !== undefined) {\n\t\targs.push('--network', spec.network.name);\n\t\tfor (const alias of spec.network.aliases ?? []) {\n\t\t\targs.push('--network-alias', alias);\n\t\t}\n\t}\n\tpushAddHosts(args, spec.addHosts);\n\tif (spec.entrypoint) args.push('--entrypoint', spec.entrypoint);\n\targs.push(spec.image);\n\tif (spec.command) args.push(...spec.command);\n\treturn args;\n};\n"],"mappings":";AAgDA,MAAM,WAAW,MAAqB,QAA4D;AACjG,KAAI,QAAQ,KAAA,EAAW;AACvB,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,IAAI,CACvC,MAAK,KAAK,SAAS,GAAG,EAAE,GAAG,IAAI;;AAIjC,MAAM,cACL,MACA,WACU;AACV,KAAI,WAAW,KAAA,EAAW;AAC1B,MAAK,MAAM,KAAK,QAAQ;EACvB,MAAM,KAAK,EAAE,WAAW,cAAc;AACtC,OAAK,KAAK,WAAW,oBAAoB,EAAE,OAAO,UAAU,EAAE,SAAS,KAAK;;;AAI9E,MAAM,gBACL,MACA,aACU;AACV,KAAI,aAAa,KAAA,EAAW;AAC5B,MAAK,MAAM,CAAC,MAAM,OAAO,OAAO,QAAQ,SAAS,CAChD,MAAK,KAAK,cAAc,GAAG,KAAK,GAAG,KAAK;;AAI1C,MAAM,cAAc,MAAqB,WAAoD;AAC5F,KAAI,WAAW,KAAA,EAAW;AAC1B,MAAK,MAAM,KAAK,OAAQ,MAAK,KAAK,WAAW,EAAE;;AAGhD,MAAM,aACL,MACA,UACU;AACV,KAAI,UAAU,KAAA,EAAW;AACzB,MAAK,MAAM,KAAK,OAAO;EACtB,MAAM,aAAa,EAAE,WAAW,KAAA,IAAY,KAAK,GAAG,EAAE,OAAO;AAC7D,OAAK,KAAK,MAAM,GAAG,aAAa,EAAE,SAAS,GAAG,EAAE,gBAAgB;;;;;;;;;;;AAmClE,MAAa,iBAAiB,SAAmD;CAChF,MAAM,OAAsB,EAAE;AAC9B,KAAI,CAAC,KAAK,KAAM,MAAK,KAAK,OAAO;AACjC,MAAK,KAAK,UAAU,KAAK,KAAK;AAC9B,KAAI,KAAK,QAAS,MAAK,KAAK,aAAa,KAAK,QAAQ;AACtD,KAAI,KAAK,WAAY,MAAK,KAAK,gBAAgB,KAAK,WAAW;AAC/D,KAAI,KAAK,KAAM,MAAK,KAAK,UAAU,KAAK,KAAK;AAC7C,SAAQ,MAAM,KAAK,IAAI;AACvB,YAAW,MAAM,KAAK,OAAO;AAC7B,YAAW,MAAM,KAAK,OAAO;AAC7B,cAAa,MAAM,KAAK,SAAS;AACjC,MAAK,KAAK,KAAK,MAAM;AACrB,KAAI,KAAK,KAAM,MAAK,KAAK,GAAG,KAAK,KAAK;AACtC,QAAO;;;;;;;;;;AAmCR,MAAa,oBAAoB,SAAsD;CACtF,MAAM,OAAsB;EAAC;EAAM;EAAU,KAAK;EAAK;AACvD,YAAW,MAAM,KAAK,OAAO;AAC7B,SAAQ,MAAM,KAAK,IAAI;AACvB,WAAU,MAAM,KAAK,MAAM;AAC3B,YAAW,MAAM,KAAK,OAAO;AAC7B,KAAI,KAAK,YAAY,KAAA,GAAW;AAC/B,OAAK,KAAK,aAAa,KAAK,QAAQ,KAAK;AACzC,OAAK,MAAM,SAAS,KAAK,QAAQ,WAAW,EAAE,CAC7C,MAAK,KAAK,mBAAmB,MAAM;;AAGrC,cAAa,MAAM,KAAK,SAAS;AACjC,KAAI,KAAK,WAAY,MAAK,KAAK,gBAAgB,KAAK,WAAW;AAC/D,MAAK,KAAK,KAAK,MAAM;AACrB,KAAI,KAAK,QAAS,MAAK,KAAK,GAAG,KAAK,QAAQ;AAC5C,QAAO"}
+{"version":3,"file":"render-run-args.mjs","names":[],"sources":["../../../src/runtime/docker/render-run-args.ts"],"sourcesContent":["// `docker run` / `docker create` argv assembly.\n//\n// `dockerRunOneShot` (one-shot `docker run --rm`) and `freshCreate`\n// (long-lived `docker run -d` from `container.ts`) both flatten a\n// structured spec into the same repeating argv patterns —\n// `--env K=V`, `--mount type=bind,...`, `--add-host h:ip`, etc. The\n// flag order differs between the two consumers and that order is\n// load-bearing for byte-identical migration (tests assert exact\n// argv strings), so this module exposes:\n//\n//   - `renderRunArgs` — argv shape used by `dockerRunOneShot`.\n//   - `renderCreateArgs` — argv shape used by `freshCreate`.\n//\n// Both share the internal per-flag emit helpers so the repeated\n// patterns live in one place. New Docker-run-style call sites should\n// pick whichever helper matches the order they want (or extend this\n// module rather than open-coding `args.push('--env', ...)` again).\n\n// -----------------------------------------------------------------------------\n// Shared flag shapes\n// -----------------------------------------------------------------------------\n\n/** `--mount type=bind,source=...,target=...[,readonly]`. */\nexport interface BindMountSpec {\n\treadonly source: string;\n\treadonly target: string;\n\treadonly readonly?: boolean;\n}\n\n/** `-p [hostIp:]hostPort:containerPort`. Mirrors `ContainerPortPublish`\n *  but kept independent so this module has no upward dep on\n *  `contracts/`. */\nexport interface PortPublishSpec {\n\treadonly containerPort: number;\n\treadonly hostPort: number;\n\treadonly hostIp?: string;\n}\n\n/** First-network attachment + optional per-network DNS aliases. */\nexport interface NetworkAttachSpec {\n\treadonly name: string;\n\treadonly aliases?: ReadonlyArray<string>;\n}\n\n// -----------------------------------------------------------------------------\n// Per-flag emit helpers — internal\n// -----------------------------------------------------------------------------\n\nconst pushEnv = (args: Array<string>, env: Readonly<Record<string, string>> | undefined): void => {\n\tif (env === undefined) return;\n\tfor (const [k, v] of Object.entries(env)) {\n\t\targs.push('--env', `${k}=${v}`);\n\t}\n};\n\nconst pushMounts = (\n\targs: Array<string>,\n\tmounts: ReadonlyArray<BindMountSpec> | undefined,\n): void => {\n\tif (mounts === undefined) return;\n\tfor (const m of mounts) {\n\t\tconst ro = m.readonly ? ',readonly' : '';\n\t\targs.push('--mount', `type=bind,source=${m.source},target=${m.target}${ro}`);\n\t}\n};\n\nconst pushAddHosts = (\n\targs: Array<string>,\n\taddHosts: Readonly<Record<string, string>> | undefined,\n): void => {\n\tif (addHosts === undefined) return;\n\tfor (const [host, ip] of Object.entries(addHosts)) {\n\t\targs.push('--add-host', `${host}:${ip}`);\n\t}\n};\n\nconst pushLabels = (args: Array<string>, labels: ReadonlyArray<string> | undefined): void => {\n\tif (labels === undefined) return;\n\tfor (const l of labels) args.push('--label', l);\n};\n\nconst pushPorts = (\n\targs: Array<string>,\n\tports: ReadonlyArray<PortPublishSpec> | undefined,\n): void => {\n\tif (ports === undefined) return;\n\tfor (const p of ports) {\n\t\tconst hostPrefix = p.hostIp === undefined ? '' : `${p.hostIp}:`;\n\t\targs.push('-p', `${hostPrefix}${p.hostPort}:${p.containerPort}`);\n\t}\n};\n\n// -----------------------------------------------------------------------------\n// `renderRunArgs` — one-shot `docker run --rm`\n// -----------------------------------------------------------------------------\n\n/** Spec for `renderRunArgs`. Mirrors what `dockerRunOneShot` already\n *  flattens. Order of the resulting argv is fixed by `renderRunArgs`. */\nexport interface RenderRunArgsSpec {\n\t/** Drop `--rm` when true (forensic-retention escape hatch). */\n\treadonly keep?: boolean;\n\treadonly name: string;\n\treadonly image: string;\n\t/** Positional argv appended after the image. */\n\treadonly argv?: ReadonlyArray<string>;\n\treadonly network?: string;\n\treadonly entrypoint?: string;\n\treadonly user?: string;\n\treadonly env?: Readonly<Record<string, string>>;\n\treadonly mounts?: ReadonlyArray<BindMountSpec>;\n\t/** Pre-rendered `key=value` strings. */\n\treadonly labels?: ReadonlyArray<string>;\n\treadonly addHosts?: Readonly<Record<string, string>>;\n}\n\n/** Render argv for `docker run --rm`-style one-shot invocations.\n *\n *  Output order:\n *    `[--rm?] --name N [--network …] [--entrypoint …] [--user …]\n *     env… mount… label… add-host… <image> [argv…]`\n *\n *  Order is load-bearing — callers' fake-docker tests assert against\n *  this exact sequence. */\nexport const renderRunArgs = (spec: RenderRunArgsSpec): ReadonlyArray<string> => {\n\tconst args: Array<string> = [];\n\tif (!spec.keep) args.push('--rm');\n\targs.push('--name', spec.name);\n\tif (spec.network) args.push('--network', spec.network);\n\tif (spec.entrypoint) args.push('--entrypoint', spec.entrypoint);\n\tif (spec.user) args.push('--user', spec.user);\n\tpushEnv(args, spec.env);\n\tpushMounts(args, spec.mounts);\n\tpushLabels(args, spec.labels);\n\tpushAddHosts(args, spec.addHosts);\n\targs.push(spec.image);\n\tif (spec.argv) args.push(...spec.argv);\n\treturn args;\n};\n\n// -----------------------------------------------------------------------------\n// `renderCreateArgs` — long-lived `docker run -d`\n// -----------------------------------------------------------------------------\n\n/** Spec for `renderCreateArgs`. Used by `freshCreate` in\n *  `container.ts`. Long-lived containers always run detached. */\nexport interface RenderCreateArgsSpec {\n\treadonly name: string;\n\treadonly image: string;\n\t/** Positional argv appended after the image. */\n\treadonly command?: ReadonlyArray<string>;\n\t/** First network attach — emitted via `--network`. Per-network\n\t *  aliases become `--network-alias` flags. Secondary attaches are\n\t *  done post-start by the caller (architecture §5). */\n\treadonly network?: NetworkAttachSpec;\n\treadonly entrypoint?: string;\n\treadonly env?: Readonly<Record<string, string>>;\n\treadonly mounts?: ReadonlyArray<BindMountSpec>;\n\treadonly ports?: ReadonlyArray<PortPublishSpec>;\n\t/** Pre-rendered `key=value` strings (typically from `renderContainerLabels`). */\n\treadonly labels?: ReadonlyArray<string>;\n\treadonly addHosts?: Readonly<Record<string, string>>;\n}\n\n/** Render argv for `docker run -d`-style long-lived container create.\n *\n *  Output order:\n *    `-d --name N label… env… -p… mount… [--network N --network-alias …]\n *     add-host… [--entrypoint …] <image> [command…]`\n *\n *  Order is load-bearing — tests that snapshot the create argv assert\n *  against this exact sequence. */\nexport const renderCreateArgs = (spec: RenderCreateArgsSpec): ReadonlyArray<string> => {\n\tconst args: Array<string> = ['-d', '--name', spec.name];\n\tpushLabels(args, spec.labels);\n\tpushEnv(args, spec.env);\n\tpushPorts(args, spec.ports);\n\tpushMounts(args, spec.mounts);\n\tif (spec.network !== undefined) {\n\t\targs.push('--network', spec.network.name);\n\t\tfor (const alias of spec.network.aliases ?? []) {\n\t\t\targs.push('--network-alias', alias);\n\t\t}\n\t}\n\tpushAddHosts(args, spec.addHosts);\n\tif (spec.entrypoint) args.push('--entrypoint', spec.entrypoint);\n\targs.push(spec.image);\n\tif (spec.command) args.push(...spec.command);\n\treturn args;\n};\n"],"mappings":";AAgDA,MAAM,WAAW,MAAqB,QAA4D;CACjG,IAAI,QAAQ,KAAA,GAAW;CACvB,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,GAAG,GACtC,KAAK,KAAK,SAAS,GAAG,EAAE,GAAG,GAAG;AAEhC;AAEA,MAAM,cACL,MACA,WACU;CACV,IAAI,WAAW,KAAA,GAAW;CAC1B,KAAK,MAAM,KAAK,QAAQ;EACvB,MAAM,KAAK,EAAE,WAAW,cAAc;EACtC,KAAK,KAAK,WAAW,oBAAoB,EAAE,OAAO,UAAU,EAAE,SAAS,IAAI;CAC5E;AACD;AAEA,MAAM,gBACL,MACA,aACU;CACV,IAAI,aAAa,KAAA,GAAW;CAC5B,KAAK,MAAM,CAAC,MAAM,OAAO,OAAO,QAAQ,QAAQ,GAC/C,KAAK,KAAK,cAAc,GAAG,KAAK,GAAG,IAAI;AAEzC;AAEA,MAAM,cAAc,MAAqB,WAAoD;CAC5F,IAAI,WAAW,KAAA,GAAW;CAC1B,KAAK,MAAM,KAAK,QAAQ,KAAK,KAAK,WAAW,CAAC;AAC/C;AAEA,MAAM,aACL,MACA,UACU;CACV,IAAI,UAAU,KAAA,GAAW;CACzB,KAAK,MAAM,KAAK,OAAO;EACtB,MAAM,aAAa,EAAE,WAAW,KAAA,IAAY,KAAK,GAAG,EAAE,OAAO;EAC7D,KAAK,KAAK,MAAM,GAAG,aAAa,EAAE,SAAS,GAAG,EAAE,eAAe;CAChE;AACD;;;;;;;;;AAiCA,MAAa,iBAAiB,SAAmD;CAChF,MAAM,OAAsB,CAAC;CAC7B,IAAI,CAAC,KAAK,MAAM,KAAK,KAAK,MAAM;CAChC,KAAK,KAAK,UAAU,KAAK,IAAI;CAC7B,IAAI,KAAK,SAAS,KAAK,KAAK,aAAa,KAAK,OAAO;CACrD,IAAI,KAAK,YAAY,KAAK,KAAK,gBAAgB,KAAK,UAAU;CAC9D,IAAI,KAAK,MAAM,KAAK,KAAK,UAAU,KAAK,IAAI;CAC5C,QAAQ,MAAM,KAAK,GAAG;CACtB,WAAW,MAAM,KAAK,MAAM;CAC5B,WAAW,MAAM,KAAK,MAAM;CAC5B,aAAa,MAAM,KAAK,QAAQ;CAChC,KAAK,KAAK,KAAK,KAAK;CACpB,IAAI,KAAK,MAAM,KAAK,KAAK,GAAG,KAAK,IAAI;CACrC,OAAO;AACR;;;;;;;;;AAkCA,MAAa,oBAAoB,SAAsD;CACtF,MAAM,OAAsB;EAAC;EAAM;EAAU,KAAK;CAAI;CACtD,WAAW,MAAM,KAAK,MAAM;CAC5B,QAAQ,MAAM,KAAK,GAAG;CACtB,UAAU,MAAM,KAAK,KAAK;CAC1B,WAAW,MAAM,KAAK,MAAM;CAC5B,IAAI,KAAK,YAAY,KAAA,GAAW;EAC/B,KAAK,KAAK,aAAa,KAAK,QAAQ,IAAI;EACxC,KAAK,MAAM,SAAS,KAAK,QAAQ,WAAW,CAAC,GAC5C,KAAK,KAAK,mBAAmB,KAAK;CAEpC;CACA,aAAa,MAAM,KAAK,QAAQ;CAChC,IAAI,KAAK,YAAY,KAAK,KAAK,gBAAgB,KAAK,UAAU;CAC9D,KAAK,KAAK,KAAK,KAAK;CACpB,IAAI,KAAK,SAAS,KAAK,KAAK,GAAG,KAAK,OAAO;CAC3C,OAAO;AACR"}

package/dist/runtime/docker/service.mjs

@@ -1,22 +1,21 @@
-import { chainId, contentHash } from "../../substrate/brand.mjs";
-import { StackPathsService } from "../../substrate/runtime/paths.mjs";
+import { contentHash } from "../../substrate/brand.mjs";
 import { mintRandomSuffix } from "../../substrate/runtime/random-suffix.mjs";
+import { StackPathsService } from "../../substrate/runtime/paths.mjs";
 import { CacheService } from "../../substrate/runtime/cache/service.mjs";
 import "../../substrate/runtime/cache/index.mjs";
 import { DockerHost, DockerSpawner, dockerRunOk } from "./client.mjs";
 import { toContractError } from "./errors.mjs";
-import { expectedImageOwnershipLabels } from "./labels.mjs";
+import { expectedImageOwnershipLabels, sanitizeTagSegment } from "./labels.mjs";
 import { ensureNetwork } from "./network.mjs";
-import { assertContainerHandleOwned, commit, ensureContainer, inspectContainer, pause, stop, unpause } from "./container.mjs";
+import { assertContainerHandleOwned, commit, ensureContainer, inspectContainer, pause, stop } from "./container.mjs";
 import { dockerExec, dockerRunOneShot } from "./exec.mjs";
-import { ensureImageCached, loadImage, pull, refOf, removeImage, saveImage, saveImages, tagImage } from "./image.mjs";
+import { ensureImageCached, imageExists, loadImage, pull, refOf, removeImage, saveImages, tagImage } from "./image.mjs";
 import { listContainers } from "./inventory.mjs";
-import { followLogs } from "./logs.mjs";
-import { removeManagedContainers, removeManagedImages, removeManagedNetworks, removeManagedVolumes, sweepOrphans } from "./sweep.mjs";
+import { removeManagedContainers, removeManagedImages, removeManagedNetworks, removeManagedVolumes } from "./sweep.mjs";
 import { Context, Duration, Effect, Layer, Ref, Stream } from "effect";
 import { lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
-import { createHash } from "node:crypto";
 import { join, relative, sep } from "node:path";
+import { createHash } from "node:crypto";
 //#region src/runtime/docker/service.ts
 var ContainerRuntimeService = class extends Context.Service()("@devstack/runtime-docker/ContainerRuntime") {};
 var DockerCycle = class extends Context.Service()("@devstack/runtime-docker/Cycle") {};
@@ -127,7 +126,9 @@ const layerContainerRuntimeDocker = Layer.effect(ContainerRuntimeService, Effect
 			platform: inferredPlatform
 		} : ctx;
 		const hash = buildContentHash(effectiveCtx);
-		const tag = expected?.tag ?? `devstack-build:${hash.slice(0, 16)}`;
+		const owner = effectiveCtx.owner;
+		const scope = owner !== void 0 ? `${sanitizeTagSegment(owner.app)}-${sanitizeTagSegment(owner.stack)}-` : "";
+		const tag = expected?.tag ?? `devstack-build:${scope}${hash.slice(0, 16)}`;
 		const ownerLabels = effectiveCtx.owner !== void 0 ? expectedImageOwnershipLabels(effectiveCtx.owner) : void 0;
 		return yield* ensureImageCached({
 			contextPath: effectiveCtx.contextPath,
@@ -138,23 +139,23 @@ const layerContainerRuntimeDocker = Layer.effect(ContainerRuntimeService, Effect
 			...ownerLabels !== void 0 && { labels: ownerLabels }
 		}, {
 			namespace: "runtime-docker-build",
-			chain: chainId("n/a"),
+			chain: "n/a",
 			contentHash: contentHash(hash)
-		}).pipe(Effect.map((digest) => refOf(digest, tag)), mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.ensureImage"));
+		}).pipe(Effect.map((digest) => refOf(digest, tag)), mapToContractError, Effect.provide(baseCtx));
 	});
 	const ensureNetworkContractImpl = (spec) => ensureNetwork(spec.name, {
 		app: spec.app,
 		stack: spec.stack,
 		...spec.subnet === void 0 ? {} : { subnet: spec.subnet },
 		...spec.gateway === void 0 ? {} : { gateway: spec.gateway }
-	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.ensureNetwork"));
-	const pullImageContractImpl = (ref) => pull(ref).pipe(Effect.map((digest) => refOf(digest, ref)), mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.pullImage"));
+	}).pipe(mapToContractError, Effect.provide(baseCtx));
+	const pullImageContractImpl = (ref) => pull(ref).pipe(Effect.map((digest) => refOf(digest, ref)), mapToContractError, Effect.provide(baseCtx));
 	const ensureContainerImpl = (spec) => Effect.gen(function* () {
 		return yield* ensureContainer(spec, {
 			cycle: yield* Ref.get(cycleRef),
 			perNameLock
 		});
-	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.ensureContainer"));
+	}).pipe(mapToContractError, Effect.provide(baseCtx));
 	const inspectByLabels = (labels) => Effect.gen(function* () {
 		const summaries = yield* listContainers(labels);
 		return yield* Effect.forEach(summaries, (s) => inspectContainer(s.name).pipe(Effect.map((facts) => ({
@@ -164,10 +165,10 @@ const layerContainerRuntimeDocker = Layer.effect(ContainerRuntimeService, Effect
 			imageName: facts?.image ?? s.image,
 			status: facts?.paused ? "paused" : facts?.running ?? s.state === "running" ? "running" : s.state === "paused" ? "paused" : s.state === "created" ? "created" : "exited",
 			ips: [],
-			...facts?.ports !== void 0 ? { ports: facts.ports } : {}
+			...facts?.ports !== void 0 ? { ports: facts.ports } : {},
+			...facts?.exitCode != null ? { lastExitCode: facts.exitCode } : {}
 		}))), { concurrency: "unbounded" });
-	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.inspectByLabels"));
-	const followLogsImpl = (handle) => followLogs(handle.name).pipe(Stream.mapError(toContractError), Stream.provideContext(baseCtx));
+	}).pipe(mapToContractError, Effect.provide(baseCtx));
 	const pauseAndCommitImpl = (handle) => Effect.gen(function* () {
 		yield* assertContainerHandleOwned(handle);
 		if (handle.status === "running") {
@@ -179,27 +180,18 @@ const layerContainerRuntimeDocker = Layer.effect(ContainerRuntimeService, Effect
 			digest: yield* commit(handle.name, tag),
 			tag
 		};
-	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.pauseAndCommit"));
-	const pauseImpl = (handle) => Effect.gen(function* () {
-		yield* assertContainerHandleOwned(handle);
-		yield* pause(handle.name);
-	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.pause"));
-	const unpauseImpl = (handle) => Effect.gen(function* () {
-		yield* assertContainerHandleOwned(handle);
-		yield* unpause(handle.name);
-	}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.unpause"));
+	}).pipe(mapToContractError, Effect.provide(baseCtx));
 	const stopImpl = (handle, grace) => {
 		const seconds = Math.max(0, Math.ceil(Duration.toMillis(grace) / 1e3));
 		return Effect.gen(function* () {
 			yield* assertContainerHandleOwned(handle);
 			yield* stop(handle.name, seconds);
-		}).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.stop"));
+		}).pipe(mapToContractError, Effect.provide(baseCtx));
 	};
-	const sweepOrphansImpl = (labelMatch) => sweepOrphans(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.sweepOrphans"));
-	const removeManagedContainersImpl = (labelMatch) => removeManagedContainers(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeManagedContainers"));
-	const removeManagedImagesImpl = (labelMatch) => removeManagedImages(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeManagedImages"));
-	const removeManagedNetworksImpl = (labelMatch) => removeManagedNetworks(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeManagedNetworks"));
-	const removeManagedVolumesImpl = (labelMatch) => removeManagedVolumes(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeManagedVolumes"));
+	const removeManagedContainersImpl = (labelMatch) => removeManagedContainers(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx));
+	const removeManagedImagesImpl = (labelMatch) => removeManagedImages(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx));
+	const removeManagedNetworksImpl = (labelMatch) => removeManagedNetworks(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx));
+	const removeManagedVolumesImpl = (labelMatch) => removeManagedVolumes(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx));
 	const execImpl = (handle, argv, opts) => Effect.gen(function* () {
 		yield* assertContainerHandleOwned(handle);
 		return yield* dockerExec(handle.name, argv, {
@@ -211,20 +203,18 @@ const layerContainerRuntimeDocker = Layer.effect(ContainerRuntimeService, Effect
 		exitCode: r.exitCode,
 		stdout: r.stdout,
 		stderr: r.stderr
-	})), mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.exec"));
-	const saveImageImpl = (ref, opts) => {
-		return saveImage(ref.tag ?? ref.digest, opts).pipe(Stream.mapError(toContractError), Stream.provideContext(baseCtx));
-	};
+	})), mapToContractError, Effect.provide(baseCtx));
 	const saveImagesImpl = (refs, opts) => {
 		return saveImages(refs.map((ref) => ref.tag ?? ref.digest), opts).pipe(Stream.mapError(toContractError), Stream.provideContext(baseCtx));
 	};
-	const loadImageContractImpl = (tar) => loadImage(tar).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.loadImage"));
+	const loadImageContractImpl = (tar) => loadImage(tar).pipe(mapToContractError, Effect.provide(baseCtx));
 	const tagImageContractImpl = (src, newTag, opts) => {
-		return tagImage(src.tag ?? src.digest, newTag, opts).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.tagImage"));
+		return tagImage(src.tag ?? src.digest, newTag, opts).pipe(mapToContractError, Effect.provide(baseCtx));
 	};
 	const removeImageContractImpl = (ref) => {
-		return removeImage(ref.tag ?? ref.digest).pipe(mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.removeImage"));
+		return removeImage(ref.tag ?? ref.digest).pipe(mapToContractError, Effect.provide(baseCtx));
 	};
+	const inspectImageDigestContractImpl = (ref) => imageExists(ref).pipe(mapToContractError, Effect.provide(baseCtx));
 	const runOneShotImpl = (spec) => dockerRunOneShot({
 		image: spec.image.tag ?? spec.image.digest,
 		argv: spec.argv,
@@ -239,7 +229,7 @@ const layerContainerRuntimeDocker = Layer.effect(ContainerRuntimeService, Effect
 		exitCode: r.exitCode,
 		stdout: r.stdout,
 		stderr: r.stderr
-	})), mapToContractError, Effect.provide(baseCtx), Effect.withSpan("runtime.docker.contract.runOneShot"));
+	})), mapToContractError, Effect.provide(baseCtx));
 	return ContainerRuntimeService.of({
 		ensureImage,
 		pullImage: pullImageContractImpl,
@@ -248,17 +238,13 @@ const layerContainerRuntimeDocker = Layer.effect(ContainerRuntimeService, Effect
 		exec: execImpl,
 		runOneShot: runOneShotImpl,
 		inspectByLabels,
-		followLogs: followLogsImpl,
-		pause: pauseImpl,
 		pauseAndCommit: pauseAndCommitImpl,
-		saveImage: saveImageImpl,
 		saveImages: saveImagesImpl,
 		loadImage: loadImageContractImpl,
 		tagImage: tagImageContractImpl,
 		removeImage: removeImageContractImpl,
-		unpause: unpauseImpl,
+		inspectImageDigest: inspectImageDigestContractImpl,
 		stop: stopImpl,
-		sweepOrphans: sweepOrphansImpl,
 		removeManagedContainers: removeManagedContainersImpl,
 		removeManagedImages: removeManagedImagesImpl,
 		removeManagedNetworks: removeManagedNetworksImpl,

package/dist/runtime/docker/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["ensureNetworkImpl","pullImageImpl","followLogsStream","stopContainer","saveImageStream","saveImagesStream","loadImageImpl","tagImageImpl","removeImageImpl"],"sources":["../../../src/runtime/docker/service.ts"],"sourcesContent":["// `ContainerRuntime` capability — Docker reference implementation.\n//\n// Composes the subsystems in this directory into the contract surface\n// declared in `contracts/container-runtime.ts`. Plugins consume the\n// `ContainerRuntime` interface through this service; the typed\n// docker-specific error variants are accessible to advanced consumers\n// via the underlying subsystems but the public surface projects to\n// the contract's narrow `ContainerRuntimeError`.\n\nimport { createHash } from 'node:crypto';\nimport { lstatSync, readdirSync, readFileSync, readlinkSync } from 'node:fs';\nimport { join, relative, sep } from 'node:path';\n\nimport { Context, Duration, Effect, Layer, Ref, Stream } from 'effect';\n\nimport type {\n\tContainerBuildContext,\n\tContainerHandle,\n\tContainerRuntime,\n\tContainerRuntimeError,\n\tEnsureContainerSpec,\n\tEnsureNetworkSpec,\n\tExecOptions,\n\tExecResult,\n\tImageRef,\n\tLoadedImageBundle,\n\tOneShotSpec,\n\tSaveImageOptions,\n\tTagImageOptions,\n\tTaggedImageRef,\n} from '../../contracts/container-runtime.ts';\nimport type { ContainerLabelTuple } from '../../contracts/snapshotable.ts';\nimport { chainId, contentHash } from '../../substrate/brand.ts';\nimport { mintRandomSuffix } from '../../substrate/runtime/random-suffix.ts';\nimport { CacheService } from '../../substrate/runtime/cache/index.ts';\nimport { StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { DockerHost, DockerSpawner, dockerRunOk } from './client.ts';\nimport {\n\tassertContainerHandleOwned,\n\tcommit,\n\tensureContainer,\n\tinspectContainer,\n\tpause,\n\ttype PerNameLockState,\n\tstop as stopContainer,\n\tunpause,\n} from './container.ts';\nimport { toContractError } from './errors.ts';\nimport { dockerExec, dockerRunOneShot } from './exec.ts';\nimport {\n\tensureImageCached,\n\tloadImage as loadImageImpl,\n\tpull as pullImageImpl,\n\trefOf,\n\tremoveImage as removeImageImpl,\n\tsaveImage as saveImageStream,\n\tsaveImages as saveImagesStream,\n\ttagImage as tagImageImpl,\n} from './image.ts';\nimport { listContainers } from './inventory.ts';\nimport { expectedImageOwnershipLabels } from './labels.ts';\nimport { followLogs as followLogsStream } from './logs.ts';\nimport { ensureNetwork as ensureNetworkImpl } from './network.ts';\nimport {\n\tremoveManagedContainers,\n\tremoveManagedImages,\n\tremoveManagedNetworks,\n\tremoveManagedVolumes,\n\tsweepOrphans,\n} from './sweep.ts';\n\n// -----------------------------------------------------------------------------\n// Service tag — `Context.Service` per Effect-v4 idioms\n// -----------------------------------------------------------------------------\n\nexport class ContainerRuntimeService extends Context.Service<\n\tContainerRuntimeService,\n\tContainerRuntime\n>()('@devstack/runtime-docker/ContainerRuntime') {}\n\n// -----------------------------------------------------------------------------\n// Cycle counter — stamped on container labels at create time\n// -----------------------------------------------------------------------------\n\nexport class DockerCycle extends Context.Service<DockerCycle, Ref.Ref<number>>()(\n\t'@devstack/runtime-docker/Cycle',\n) {}\n\nexport const layerDockerCycleInitial: Layer.Layer<DockerCycle> = Layer.effect(\n\tDockerCycle,\n\tEffect.gen(function* () {\n\t\tconst ref = yield* Ref.make(0);\n\t\treturn ref;\n\t}),\n);\n\n// -----------------------------------------------------------------------------\n// Layer — wire the subsystems into the contract interface\n// -----------------------------------------------------------------------------\n\nconst mapToContractError = <R, A>(\n\teff: Effect.Effect<A, import('./errors.ts').DockerRuntimeError, R>,\n): Effect.Effect<A, ContainerRuntimeError, R> => eff.pipe(Effect.mapError(toContractError));\n\nconst snapshotTempTag = (containerName: string): string => {\n\tconst safeName = containerName.replace(/[^A-Za-z0-9_.-]/g, '-');\n\tconst suffix = mintRandomSuffix(12);\n\treturn `devstack-snapshot:${safeName}-${suffix}`;\n};\n\nconst stableRelativePath = (root: string, path: string): string => {\n\tconst rel = relative(root, path);\n\treturn rel.length === 0 ? '.' : rel.split(sep).join('/');\n};\n\nconst updateContextEntryHash = (\n\thash: ReturnType<typeof createHash>,\n\troot: string,\n\tpath: string,\n): void => {\n\tconst stat = lstatSync(path);\n\tconst rel = stableRelativePath(root, path);\n\n\tif (stat.isDirectory()) {\n\t\thash.update('dir\\0');\n\t\thash.update(rel);\n\t\thash.update('\\0');\n\t\tfor (const child of readdirSync(path).sort((a, b) => a.localeCompare(b))) {\n\t\t\tupdateContextEntryHash(hash, root, join(path, child));\n\t\t}\n\t\treturn;\n\t}\n\n\tif (stat.isFile()) {\n\t\thash.update('file\\0');\n\t\thash.update(rel);\n\t\thash.update('\\0');\n\t\thash.update(String(stat.mode));\n\t\thash.update('\\0');\n\t\thash.update(readFileSync(path));\n\t\thash.update('\\0');\n\t\treturn;\n\t}\n\n\tif (stat.isSymbolicLink()) {\n\t\thash.update('symlink\\0');\n\t\thash.update(rel);\n\t\thash.update('\\0');\n\t\thash.update(readlinkSync(path));\n\t\thash.update('\\0');\n\t\treturn;\n\t}\n\n\thash.update('other\\0');\n\thash.update(rel);\n\thash.update('\\0');\n\thash.update(String(stat.mode));\n\thash.update('\\0');\n};\n\nconst normalizeFingerprintPath = (path: string): string =>\n\tpath\n\t\t.split(/[\\\\/]+/g)\n\t\t.filter((part) => part.length > 0)\n\t\t.join('/');\n\nconst normalizeFingerprintPaths = (\n\tpaths: ReadonlyArray<string> | undefined,\n): ReadonlyArray<string> =>\n\t[...new Set((paths ?? []).map(normalizeFingerprintPath).filter((path) => path.length > 0))].sort(\n\t\t(a, b) => a.localeCompare(b),\n\t);\n\nconst buildContextFingerprint = (\n\tcontextPath: string,\n\tfingerprintPaths?: ReadonlyArray<string>,\n): string => {\n\tconst hash = createHash('sha256');\n\tconst requestedPaths = normalizeFingerprintPaths(fingerprintPaths);\n\tconst paths = requestedPaths.length === 0 ? null : requestedPaths;\n\ttry {\n\t\tif (paths === null) {\n\t\t\tupdateContextEntryHash(hash, contextPath, contextPath);\n\t\t} else {\n\t\t\tfor (const relPath of paths) {\n\t\t\t\thash.update('fingerprint-path\\0');\n\t\t\t\thash.update(relPath);\n\t\t\t\thash.update('\\0');\n\t\t\t\tupdateContextEntryHash(hash, contextPath, join(contextPath, relPath));\n\t\t\t}\n\t\t}\n\t} catch (err) {\n\t\thash.update('unreadable\\0');\n\t\thash.update(String(err));\n\t\thash.update('\\0');\n\t}\n\treturn hash.digest('hex');\n};\n\n/** Stable content hash for the build context. Sorts build args so two\n *  equivalent specs whose key insertion order differs produce the same\n *  hash. The Docker build context's files are part of the key: changing\n *  a vendored entrypoint script must force a new managed image tag. */\nexport const buildContentHash = (ctx: ContainerBuildContext): string => {\n\tconst dockerfile = ctx.dockerfile ?? 'Dockerfile';\n\tconst sortedArgs = Object.entries(ctx.buildArgs ?? {}).sort(([a], [b]) => a.localeCompare(b));\n\tconst argsKey = sortedArgs.map(([k, v]) => `${k}=${v}`).join('\\x00');\n\tconst platform = ctx.platform ?? '';\n\tconst fingerprintPathsKey = normalizeFingerprintPaths(ctx.fingerprintPaths).join('\\x00');\n\treturn createHash('sha256')\n\t\t.update(ctx.contextPath)\n\t\t.update('\\x00')\n\t\t.update(dockerfile)\n\t\t.update('\\x00')\n\t\t.update(platform)\n\t\t.update('\\x00')\n\t\t.update(argsKey)\n\t\t.update('\\x00')\n\t\t.update(fingerprintPathsKey)\n\t\t.update('\\x00')\n\t\t.update(buildContextFingerprint(ctx.contextPath, ctx.fingerprintPaths))\n\t\t.digest('hex');\n};\n\nconst DOCKER_ARCH_ALIASES: Readonly<Record<string, string>> = {\n\taarch64: 'arm64',\n\tarm64: 'arm64',\n\tx86_64: 'amd64',\n\tamd64: 'amd64',\n};\n\nexport const normalizeDockerInfoPlatform = (raw: string): string | null => {\n\tconst trimmed = raw.trim();\n\tconst slash = trimmed.indexOf('/');\n\tif (slash <= 0 || slash === trimmed.length - 1) return null;\n\tconst os = trimmed.slice(0, slash);\n\tconst arch = trimmed.slice(slash + 1);\n\tconst normalizedArch = DOCKER_ARCH_ALIASES[arch] ?? arch;\n\treturn `${os}/${normalizedArch}`;\n};\n\nconst inferDockerBuildPlatform = (): Effect.Effect<\n\tstring | null,\n\tnever,\n\tDockerHost | DockerSpawner\n> =>\n\tdockerRunOk('info', ['--format', '{{.OSType}}/{{.Architecture}}']).pipe(\n\t\tEffect.map((result) =>\n\t\t\tresult.exitCode === 0 ? normalizeDockerInfoPlatform(result.stdout) : null,\n\t\t),\n\t\tEffect.catch(() => Effect.succeed(null)),\n\t);\n\nexport const layerContainerRuntimeDocker: Layer.Layer<\n\tContainerRuntimeService,\n\tnever,\n\tCacheService | DockerHost | DockerSpawner | DockerCycle | StackPathsService\n> = Layer.effect(\n\tContainerRuntimeService,\n\tEffect.gen(function* () {\n\t\tconst cycleRef = yield* DockerCycle;\n\t\t// Snapshot the substrate services so we can provide them to the\n\t\t// closures that implement the contract's R=never surface.\n\t\tconst dockerHost = yield* DockerHost;\n\t\tconst dockerSpawner = yield* DockerSpawner;\n\t\tconst stackPaths = yield* StackPathsService;\n\t\tconst cache = yield* CacheService;\n\t\tconst baseCtx = Context.empty().pipe(\n\t\t\tContext.add(DockerHost, dockerHost),\n\t\t\tContext.add(DockerSpawner, dockerSpawner),\n\t\t\tContext.add(StackPathsService, stackPaths),\n\t\t\tContext.add(CacheService, cache),\n\t\t);\n\t\t// Per-name in-process serialization. Architecture invariant:\n\t\t// two concurrent ensureContainer calls for the same name must\n\t\t// not interleave docker inspect/create/start. The cross-process\n\t\t// safety is the daemon's `--name` atomicity (see container.ts\n\t\t// collision recovery). The in-process side is this ref.\n\t\tconst perNameLock = yield* Ref.make<PerNameLockState>(new Map());\n\n\t\tconst ensureImage = (\n\t\t\tctx: ContainerBuildContext,\n\t\t\texpected?: ImageRef,\n\t\t): Effect.Effect<ImageRef, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst inferredPlatform =\n\t\t\t\t\tctx.platform === undefined\n\t\t\t\t\t\t? yield* inferDockerBuildPlatform().pipe(Effect.provide(baseCtx))\n\t\t\t\t\t\t: null;\n\t\t\t\tconst effectiveCtx =\n\t\t\t\t\tctx.platform === undefined && inferredPlatform !== null\n\t\t\t\t\t\t? { ...ctx, platform: inferredPlatform }\n\t\t\t\t\t\t: ctx;\n\t\t\t\t// Architecture §8: bring-your-own-image vs build is a closed sum.\n\t\t\t\t// The contract accepts `ContainerBuildContext` (build path);\n\t\t\t\t// pull is exposed via `image.ts::pull` directly to plugins\n\t\t\t\t// that need it (not through this contract entry point).\n\t\t\t\t//\n\t\t\t\t// Content-addressed cache: namespace is the constant\n\t\t\t\t// `runtime-docker-build` (one substrate-owned namespace);\n\t\t\t\t// chain is `n/a` (build artifacts are chain-independent);\n\t\t\t\t// contentHash is a hash of the build context's identifying\n\t\t\t\t// fields. The caller-supplied `expected.tag`, when present,\n\t\t\t\t// is honoured as the on-host tag; absent, we derive a tag\n\t\t\t\t// from the content hash so two unrelated contexts cannot\n\t\t\t\t// collide on the sanitized contextPath form.\n\t\t\t\tconst hash = buildContentHash(effectiveCtx);\n\t\t\t\tconst tag = expected?.tag ?? `devstack-build:${hash.slice(0, 16)}`;\n\t\t\t\t// Owner identity flows through as `--label` flags on\n\t\t\t\t// `docker build`, making the resulting image visible to\n\t\t\t\t// label-driven prune. Labels are metadata, NOT part of\n\t\t\t\t// the cache key — a previously-unlabelled cached image\n\t\t\t\t// stays a cache hit (the legacy cleanup script reaps it).\n\t\t\t\tconst ownerLabels =\n\t\t\t\t\teffectiveCtx.owner !== undefined\n\t\t\t\t\t\t? expectedImageOwnershipLabels(effectiveCtx.owner)\n\t\t\t\t\t\t: undefined;\n\t\t\t\treturn yield* ensureImageCached(\n\t\t\t\t\t{\n\t\t\t\t\t\tcontextPath: effectiveCtx.contextPath,\n\t\t\t\t\t\tdockerfile: effectiveCtx.dockerfile,\n\t\t\t\t\t\tplatform: effectiveCtx.platform,\n\t\t\t\t\t\tbuildArgs: effectiveCtx.buildArgs,\n\t\t\t\t\t\ttag,\n\t\t\t\t\t\t...(ownerLabels !== undefined && { labels: ownerLabels }),\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tnamespace: 'runtime-docker-build',\n\t\t\t\t\t\tchain: chainId('n/a'),\n\t\t\t\t\t\tcontentHash: contentHash(hash),\n\t\t\t\t\t},\n\t\t\t\t).pipe(\n\t\t\t\t\tEffect.map((digest) => refOf(digest, tag)),\n\t\t\t\t\tmapToContractError,\n\t\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\t\tEffect.withSpan('runtime.docker.contract.ensureImage'),\n\t\t\t\t);\n\t\t\t});\n\n\t\tconst ensureNetworkContractImpl = (\n\t\t\tspec: EnsureNetworkSpec,\n\t\t): Effect.Effect<string, ContainerRuntimeError> =>\n\t\t\tensureNetworkImpl(spec.name, {\n\t\t\t\tapp: spec.app,\n\t\t\t\tstack: spec.stack,\n\t\t\t\t...(spec.subnet === undefined ? {} : { subnet: spec.subnet }),\n\t\t\t\t...(spec.gateway === undefined ? {} : { gateway: spec.gateway }),\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.ensureNetwork'),\n\t\t\t);\n\n\t\tconst pullImageContractImpl = (ref: string): Effect.Effect<ImageRef, ContainerRuntimeError> =>\n\t\t\tpullImageImpl(ref).pipe(\n\t\t\t\tEffect.map((digest) => refOf(digest, ref)),\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.pullImage'),\n\t\t\t);\n\n\t\tconst ensureContainerImpl = (\n\t\t\tspec: EnsureContainerSpec,\n\t\t): Effect.Effect<ContainerHandle, ContainerRuntimeError, import('effect').Scope.Scope> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst cycle = yield* Ref.get(cycleRef);\n\t\t\t\treturn yield* ensureContainer(spec, { cycle, perNameLock });\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.ensureContainer'),\n\t\t\t);\n\n\t\tconst inspectByLabels = (\n\t\t\tlabels: ContainerLabelTuple,\n\t\t): Effect.Effect<ReadonlyArray<ContainerHandle>, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst summaries = yield* listContainers(labels);\n\t\t\t\treturn yield* Effect.forEach(\n\t\t\t\t\tsummaries,\n\t\t\t\t\t(s) =>\n\t\t\t\t\t\tinspectContainer(s.name).pipe(\n\t\t\t\t\t\t\tEffect.map(\n\t\t\t\t\t\t\t\t(facts): ContainerHandle => ({\n\t\t\t\t\t\t\t\t\tid: facts?.id ?? s.id,\n\t\t\t\t\t\t\t\t\tname: s.name,\n\t\t\t\t\t\t\t\t\tlabels,\n\t\t\t\t\t\t\t\t\timageName: facts?.image ?? s.image,\n\t\t\t\t\t\t\t\t\tstatus: (facts?.paused\n\t\t\t\t\t\t\t\t\t\t? 'paused'\n\t\t\t\t\t\t\t\t\t\t: (facts?.running ?? s.state === 'running')\n\t\t\t\t\t\t\t\t\t\t\t? 'running'\n\t\t\t\t\t\t\t\t\t\t\t: s.state === 'paused'\n\t\t\t\t\t\t\t\t\t\t\t\t? 'paused'\n\t\t\t\t\t\t\t\t\t\t\t\t: s.state === 'created'\n\t\t\t\t\t\t\t\t\t\t\t\t\t? 'created'\n\t\t\t\t\t\t\t\t\t\t\t\t\t: 'exited') as ContainerHandle['status'],\n\t\t\t\t\t\t\t\t\tips: [],\n\t\t\t\t\t\t\t\t\t...(facts?.ports !== undefined ? { ports: facts.ports } : {}),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t{ concurrency: 'unbounded' },\n\t\t\t\t);\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.inspectByLabels'),\n\t\t\t);\n\n\t\tconst followLogsImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t): Stream.Stream<string, ContainerRuntimeError> =>\n\t\t\tfollowLogsStream(handle.name).pipe(\n\t\t\t\tStream.mapError(toContractError),\n\t\t\t\t// R-channel: the underlying stream needs DockerHost +\n\t\t\t\t// DockerSpawner from the spawn step. Provide the\n\t\t\t\t// snapshotted base context so the contract surface is\n\t\t\t\t// `R = never`. `Stream.mapError` does NOT drop R; the\n\t\t\t\t// `as`-cast in the previous shape was a release-blocker\n\t\t\t\t// per runtime-docker review issue #3.\n\t\t\t\tStream.provideContext(baseCtx),\n\t\t\t);\n\n\t\tconst pauseAndCommitImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t): Effect.Effect<TaggedImageRef, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tif (handle.status === 'running') {\n\t\t\t\t\tyield* pause(handle.name);\n\t\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\t}\n\t\t\t\tconst tag = snapshotTempTag(handle.name);\n\t\t\t\tconst digest = yield* commit(handle.name, tag);\n\t\t\t\treturn { digest, tag };\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.pauseAndCommit'),\n\t\t\t);\n\n\t\tconst pauseImpl = (handle: ContainerHandle): Effect.Effect<void, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tyield* pause(handle.name);\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.pause'),\n\t\t\t);\n\n\t\tconst unpauseImpl = (handle: ContainerHandle): Effect.Effect<void, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tyield* unpause(handle.name);\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.unpause'),\n\t\t\t);\n\n\t\tconst stopImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t\tgrace: Duration.Duration,\n\t\t): Effect.Effect<void, ContainerRuntimeError> => {\n\t\t\tconst seconds = Math.max(0, Math.ceil(Duration.toMillis(grace) / 1000));\n\t\t\treturn Effect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tyield* stopContainer(handle.name, seconds);\n\t\t\t}).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.stop'),\n\t\t\t);\n\t\t};\n\n\t\tconst sweepOrphansImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tsweepOrphans(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.sweepOrphans'),\n\t\t\t);\n\n\t\tconst removeManagedContainersImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedContainers(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeManagedContainers'),\n\t\t\t);\n\n\t\tconst removeManagedImagesImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedImages(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeManagedImages'),\n\t\t\t);\n\n\t\tconst removeManagedNetworksImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedNetworks(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeManagedNetworks'),\n\t\t\t);\n\n\t\tconst removeManagedVolumesImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedVolumes(labelMatch).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeManagedVolumes'),\n\t\t\t);\n\n\t\tconst execImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t\targv: ReadonlyArray<string>,\n\t\t\topts?: ExecOptions,\n\t\t): Effect.Effect<ExecResult, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\treturn yield* dockerExec(handle.name, argv, {\n\t\t\t\t\tuser: opts?.user,\n\t\t\t\t\tenv: opts?.env,\n\t\t\t\t\tworkdir: opts?.workdir,\n\t\t\t\t});\n\t\t\t}).pipe(\n\t\t\t\t// Contract surface: NEVER promote non-zero exit to failure\n\t\t\t\t// here. The caller is the policy holder.\n\t\t\t\tEffect.map(\n\t\t\t\t\t(r): ExecResult => ({\n\t\t\t\t\t\texitCode: r.exitCode,\n\t\t\t\t\t\tstdout: r.stdout,\n\t\t\t\t\t\tstderr: r.stderr,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.exec'),\n\t\t\t);\n\n\t\tconst saveImageImpl = (\n\t\t\tref: ImageRef,\n\t\t\topts?: SaveImageOptions,\n\t\t): Stream.Stream<Uint8Array, ContainerRuntimeError> => {\n\t\t\tconst resolved = ref.tag ?? ref.digest;\n\t\t\treturn saveImageStream(resolved, opts).pipe(\n\t\t\t\tStream.mapError(toContractError),\n\t\t\t\tStream.provideContext(baseCtx),\n\t\t\t);\n\t\t};\n\t\tconst saveImagesImpl = (\n\t\t\trefs: ReadonlyArray<ImageRef>,\n\t\t\topts?: SaveImageOptions,\n\t\t): Stream.Stream<Uint8Array, ContainerRuntimeError> => {\n\t\t\tconst resolved = refs.map((ref) => ref.tag ?? ref.digest);\n\t\t\treturn saveImagesStream(resolved, opts).pipe(\n\t\t\t\tStream.mapError(toContractError),\n\t\t\t\tStream.provideContext(baseCtx),\n\t\t\t);\n\t\t};\n\n\t\tconst loadImageContractImpl = (\n\t\t\ttar: Stream.Stream<Uint8Array, unknown>,\n\t\t): Effect.Effect<LoadedImageBundle, ContainerRuntimeError> =>\n\t\t\tloadImageImpl(tar).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.loadImage'),\n\t\t\t);\n\n\t\tconst tagImageContractImpl = (\n\t\t\tsrc: ImageRef,\n\t\t\tnewTag: string,\n\t\t\topts?: TagImageOptions,\n\t\t): Effect.Effect<void, ContainerRuntimeError> => {\n\t\t\tconst resolved = src.tag ?? src.digest;\n\t\t\treturn tagImageImpl(resolved, newTag, opts).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.tagImage'),\n\t\t\t);\n\t\t};\n\n\t\tconst removeImageContractImpl = (ref: ImageRef): Effect.Effect<void, ContainerRuntimeError> => {\n\t\t\tconst resolved = ref.tag ?? ref.digest;\n\t\t\treturn removeImageImpl(resolved).pipe(\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.removeImage'),\n\t\t\t);\n\t\t};\n\n\t\tconst runOneShotImpl = (\n\t\t\tspec: OneShotSpec,\n\t\t): Effect.Effect<ExecResult, ContainerRuntimeError, import('effect').Scope.Scope> =>\n\t\t\tdockerRunOneShot({\n\t\t\t\timage: spec.image.tag ?? spec.image.digest,\n\t\t\t\targv: spec.argv,\n\t\t\t\tenv: spec.env,\n\t\t\t\tmounts: spec.mounts,\n\t\t\t\tnetwork: spec.network,\n\t\t\t\tentrypoint: spec.entrypoint,\n\t\t\t\tuser: spec.user,\n\t\t\t\ttimeoutMillis: spec.timeoutMillis,\n\t\t\t\textraHosts: spec.extraHosts,\n\t\t\t}).pipe(\n\t\t\t\t// Same contract: never promote non-zero exit to failure.\n\t\t\t\tEffect.map(\n\t\t\t\t\t(r): ExecResult => ({\n\t\t\t\t\t\texitCode: r.exitCode,\n\t\t\t\t\t\tstdout: r.stdout,\n\t\t\t\t\t\tstderr: r.stderr,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\tEffect.withSpan('runtime.docker.contract.runOneShot'),\n\t\t\t);\n\n\t\treturn ContainerRuntimeService.of({\n\t\t\tensureImage,\n\t\t\tpullImage: pullImageContractImpl,\n\t\t\tensureNetwork: ensureNetworkContractImpl,\n\t\t\tensureContainer: ensureContainerImpl,\n\t\t\texec: execImpl,\n\t\t\trunOneShot: runOneShotImpl,\n\t\t\tinspectByLabels,\n\t\t\tfollowLogs: followLogsImpl,\n\t\t\tpause: pauseImpl,\n\t\t\tpauseAndCommit: pauseAndCommitImpl,\n\t\t\tsaveImage: saveImageImpl,\n\t\t\tsaveImages: saveImagesImpl,\n\t\t\tloadImage: loadImageContractImpl,\n\t\t\ttagImage: tagImageContractImpl,\n\t\t\tremoveImage: removeImageContractImpl,\n\t\t\tunpause: unpauseImpl,\n\t\t\tstop: stopImpl,\n\t\t\tsweepOrphans: sweepOrphansImpl,\n\t\t\tremoveManagedContainers: removeManagedContainersImpl,\n\t\t\tremoveManagedImages: removeManagedImagesImpl,\n\t\t\tremoveManagedNetworks: removeManagedNetworksImpl,\n\t\t\tremoveManagedVolumes: removeManagedVolumesImpl,\n\t\t});\n\t}),\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2EA,IAAa,0BAAb,cAA6C,QAAQ,SAGlD,CAAC,4CAA4C,CAAC;AAMjD,IAAa,cAAb,cAAiC,QAAQ,SAAuC,CAC/E,iCACA,CAAC;AAEF,MAAa,0BAAoD,MAAM,OACtE,aACA,OAAO,IAAI,aAAa;AAEvB,QAAO,OADY,IAAI,KAAK,EAAE;EAE7B,CACF;AAMD,MAAM,sBACL,QACgD,IAAI,KAAK,OAAO,SAAS,gBAAgB,CAAC;AAE3F,MAAM,mBAAmB,kBAAkC;AAG1D,QAAO,qBAFU,cAAc,QAAQ,oBAAoB,IAEvB,CAAC,GADtB,iBAAiB,GACc;;AAG/C,MAAM,sBAAsB,MAAc,SAAyB;CAClE,MAAM,MAAM,SAAS,MAAM,KAAK;AAChC,QAAO,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI;;AAGzD,MAAM,0BACL,MACA,MACA,SACU;CACV,MAAM,OAAO,UAAU,KAAK;CAC5B,MAAM,MAAM,mBAAmB,MAAM,KAAK;AAE1C,KAAI,KAAK,aAAa,EAAE;AACvB,OAAK,OAAO,QAAQ;AACpB,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,KAAK;AACjB,OAAK,MAAM,SAAS,YAAY,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,CACvE,wBAAuB,MAAM,MAAM,KAAK,MAAM,MAAM,CAAC;AAEtD;;AAGD,KAAI,KAAK,QAAQ,EAAE;AAClB,OAAK,OAAO,SAAS;AACrB,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,OAAO,KAAK,KAAK,CAAC;AAC9B,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,aAAa,KAAK,CAAC;AAC/B,OAAK,OAAO,KAAK;AACjB;;AAGD,KAAI,KAAK,gBAAgB,EAAE;AAC1B,OAAK,OAAO,YAAY;AACxB,OAAK,OAAO,IAAI;AAChB,OAAK,OAAO,KAAK;AACjB,OAAK,OAAO,aAAa,KAAK,CAAC;AAC/B,OAAK,OAAO,KAAK;AACjB;;AAGD,MAAK,OAAO,UAAU;AACtB,MAAK,OAAO,IAAI;AAChB,MAAK,OAAO,KAAK;AACjB,MAAK,OAAO,OAAO,KAAK,KAAK,CAAC;AAC9B,MAAK,OAAO,KAAK;;AAGlB,MAAM,4BAA4B,SACjC,KACE,MAAM,UAAU,CAChB,QAAQ,SAAS,KAAK,SAAS,EAAE,CACjC,KAAK,IAAI;AAEZ,MAAM,6BACL,UAEA,CAAC,GAAG,IAAI,KAAK,SAAS,EAAE,EAAE,IAAI,yBAAyB,CAAC,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,MAC1F,GAAG,MAAM,EAAE,cAAc,EAAE,CAC5B;AAEF,MAAM,2BACL,aACA,qBACY;CACZ,MAAM,OAAO,WAAW,SAAS;CACjC,MAAM,iBAAiB,0BAA0B,iBAAiB;CAClE,MAAM,QAAQ,eAAe,WAAW,IAAI,OAAO;AACnD,KAAI;AACH,MAAI,UAAU,KACb,wBAAuB,MAAM,aAAa,YAAY;MAEtD,MAAK,MAAM,WAAW,OAAO;AAC5B,QAAK,OAAO,qBAAqB;AACjC,QAAK,OAAO,QAAQ;AACpB,QAAK,OAAO,KAAK;AACjB,0BAAuB,MAAM,aAAa,KAAK,aAAa,QAAQ,CAAC;;UAG/D,KAAK;AACb,OAAK,OAAO,eAAe;AAC3B,OAAK,OAAO,OAAO,IAAI,CAAC;AACxB,OAAK,OAAO,KAAK;;AAElB,QAAO,KAAK,OAAO,MAAM;;;;;;AAO1B,MAAa,oBAAoB,QAAuC;CACvE,MAAM,aAAa,IAAI,cAAc;CAErC,MAAM,UADa,OAAO,QAAQ,IAAI,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,CAClE,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,KAAO;CACpE,MAAM,WAAW,IAAI,YAAY;CACjC,MAAM,sBAAsB,0BAA0B,IAAI,iBAAiB,CAAC,KAAK,KAAO;AACxF,QAAO,WAAW,SAAS,CACzB,OAAO,IAAI,YAAY,CACvB,OAAO,KAAO,CACd,OAAO,WAAW,CAClB,OAAO,KAAO,CACd,OAAO,SAAS,CAChB,OAAO,KAAO,CACd,OAAO,QAAQ,CACf,OAAO,KAAO,CACd,OAAO,oBAAoB,CAC3B,OAAO,KAAO,CACd,OAAO,wBAAwB,IAAI,aAAa,IAAI,iBAAiB,CAAC,CACtE,OAAO,MAAM;;AAGhB,MAAM,sBAAwD;CAC7D,SAAS;CACT,OAAO;CACP,QAAQ;CACR,OAAO;CACP;AAED,MAAa,+BAA+B,QAA+B;CAC1E,MAAM,UAAU,IAAI,MAAM;CAC1B,MAAM,QAAQ,QAAQ,QAAQ,IAAI;AAClC,KAAI,SAAS,KAAK,UAAU,QAAQ,SAAS,EAAG,QAAO;CACvD,MAAM,KAAK,QAAQ,MAAM,GAAG,MAAM;CAClC,MAAM,OAAO,QAAQ,MAAM,QAAQ,EAAE;AAErC,QAAO,GAAG,GAAG,GADU,oBAAoB,SAAS;;AAIrD,MAAM,iCAKL,YAAY,QAAQ,CAAC,YAAY,gCAAgC,CAAC,CAAC,KAClE,OAAO,KAAK,WACX,OAAO,aAAa,IAAI,4BAA4B,OAAO,OAAO,GAAG,KACrE,EACD,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CACxC;AAEF,MAAa,8BAIT,MAAM,OACT,yBACA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,OAAO;CAGxB,MAAM,aAAa,OAAO;CAC1B,MAAM,gBAAgB,OAAO;CAC7B,MAAM,aAAa,OAAO;CAC1B,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,QAAQ,OAAO,CAAC,KAC/B,QAAQ,IAAI,YAAY,WAAW,EACnC,QAAQ,IAAI,eAAe,cAAc,EACzC,QAAQ,IAAI,mBAAmB,WAAW,EAC1C,QAAQ,IAAI,cAAc,MAAM,CAChC;CAMD,MAAM,cAAc,OAAO,IAAI,qBAAuB,IAAI,KAAK,CAAC;CAEhE,MAAM,eACL,KACA,aAEA,OAAO,IAAI,aAAa;EACvB,MAAM,mBACL,IAAI,aAAa,KAAA,IACd,OAAO,0BAA0B,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC,GAC/D;EACJ,MAAM,eACL,IAAI,aAAa,KAAA,KAAa,qBAAqB,OAChD;GAAE,GAAG;GAAK,UAAU;GAAkB,GACtC;EAcJ,MAAM,OAAO,iBAAiB,aAAa;EAC3C,MAAM,MAAM,UAAU,OAAO,kBAAkB,KAAK,MAAM,GAAG,GAAG;EAMhE,MAAM,cACL,aAAa,UAAU,KAAA,IACpB,6BAA6B,aAAa,MAAM,GAChD,KAAA;AACJ,SAAO,OAAO,kBACb;GACC,aAAa,aAAa;GAC1B,YAAY,aAAa;GACzB,UAAU,aAAa;GACvB,WAAW,aAAa;GACxB;GACA,GAAI,gBAAgB,KAAA,KAAa,EAAE,QAAQ,aAAa;GACxD,EACD;GACC,WAAW;GACX,OAAO,QAAQ,MAAM;GACrB,aAAa,YAAY,KAAK;GAC9B,CACD,CAAC,KACD,OAAO,KAAK,WAAW,MAAM,QAAQ,IAAI,CAAC,EAC1C,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,sCAAsC,CACtD;GACA;CAEH,MAAM,6BACL,SAEAA,cAAkB,KAAK,MAAM;EAC5B,KAAK,KAAK;EACV,OAAO,KAAK;EACZ,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,QAAQ;EAC5D,GAAI,KAAK,YAAY,KAAA,IAAY,EAAE,GAAG,EAAE,SAAS,KAAK,SAAS;EAC/D,CAAC,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,wCAAwC,CACxD;CAEF,MAAM,yBAAyB,QAC9BC,KAAc,IAAI,CAAC,KAClB,OAAO,KAAK,WAAW,MAAM,QAAQ,IAAI,CAAC,EAC1C,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,oCAAoC,CACpD;CAEF,MAAM,uBACL,SAEA,OAAO,IAAI,aAAa;AAEvB,SAAO,OAAO,gBAAgB,MAAM;GAAE,OAAA,OADjB,IAAI,IAAI,SAAS;GACO;GAAa,CAAC;GAC1D,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,0CAA0C,CAC1D;CAEF,MAAM,mBACL,WAEA,OAAO,IAAI,aAAa;EACvB,MAAM,YAAY,OAAO,eAAe,OAAO;AAC/C,SAAO,OAAO,OAAO,QACpB,YACC,MACA,iBAAiB,EAAE,KAAK,CAAC,KACxB,OAAO,KACL,WAA4B;GAC5B,IAAI,OAAO,MAAM,EAAE;GACnB,MAAM,EAAE;GACR;GACA,WAAW,OAAO,SAAS,EAAE;GAC7B,QAAS,OAAO,SACb,WACC,OAAO,WAAW,EAAE,UAAU,YAC9B,YACA,EAAE,UAAU,WACX,WACA,EAAE,UAAU,YACX,YACA;GACN,KAAK,EAAE;GACP,GAAI,OAAO,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,OAAO,GAAG,EAAE;GAC5D,EACD,CACD,EACF,EAAE,aAAa,aAAa,CAC5B;GACA,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,0CAA0C,CAC1D;CAEF,MAAM,kBACL,WAEAC,WAAiB,OAAO,KAAK,CAAC,KAC7B,OAAO,SAAS,gBAAgB,EAOhC,OAAO,eAAe,QAAQ,CAC9B;CAEF,MAAM,sBACL,WAEA,OAAO,IAAI,aAAa;AACvB,SAAO,2BAA2B,OAAO;AACzC,MAAI,OAAO,WAAW,WAAW;AAChC,UAAO,MAAM,OAAO,KAAK;AACzB,UAAO,2BAA2B,OAAO;;EAE1C,MAAM,MAAM,gBAAgB,OAAO,KAAK;AAExC,SAAO;GAAE,QAAA,OADa,OAAO,OAAO,MAAM,IAAI;GAC7B;GAAK;GACrB,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,yCAAyC,CACzD;CAEF,MAAM,aAAa,WAClB,OAAO,IAAI,aAAa;AACvB,SAAO,2BAA2B,OAAO;AACzC,SAAO,MAAM,OAAO,KAAK;GACxB,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,gCAAgC,CAChD;CAEF,MAAM,eAAe,WACpB,OAAO,IAAI,aAAa;AACvB,SAAO,2BAA2B,OAAO;AACzC,SAAO,QAAQ,OAAO,KAAK;GAC1B,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,kCAAkC,CAClD;CAEF,MAAM,YACL,QACA,UACgD;EAChD,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,SAAS,MAAM,GAAG,IAAK,CAAC;AACvE,SAAO,OAAO,IAAI,aAAa;AAC9B,UAAO,2BAA2B,OAAO;AACzC,UAAOC,KAAc,OAAO,MAAM,QAAQ;IACzC,CAAC,KACF,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,+BAA+B,CAC/C;;CAGF,MAAM,oBACL,eAEA,aAAa,WAAW,CAAC,KACxB,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,uCAAuC,CACvD;CAEF,MAAM,+BACL,eAEA,wBAAwB,WAAW,CAAC,KACnC,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,kDAAkD,CAClE;CAEF,MAAM,2BACL,eAEA,oBAAoB,WAAW,CAAC,KAC/B,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,8CAA8C,CAC9D;CAEF,MAAM,6BACL,eAEA,sBAAsB,WAAW,CAAC,KACjC,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,gDAAgD,CAChE;CAEF,MAAM,4BACL,eAEA,qBAAqB,WAAW,CAAC,KAChC,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,+CAA+C,CAC/D;CAEF,MAAM,YACL,QACA,MACA,SAEA,OAAO,IAAI,aAAa;AACvB,SAAO,2BAA2B,OAAO;AACzC,SAAO,OAAO,WAAW,OAAO,MAAM,MAAM;GAC3C,MAAM,MAAM;GACZ,KAAK,MAAM;GACX,SAAS,MAAM;GACf,CAAC;GACD,CAAC,KAGF,OAAO,KACL,OAAmB;EACnB,UAAU,EAAE;EACZ,QAAQ,EAAE;EACV,QAAQ,EAAE;EACV,EACD,EACD,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,+BAA+B,CAC/C;CAEF,MAAM,iBACL,KACA,SACsD;AAEtD,SAAOC,UADU,IAAI,OAAO,IAAI,QACC,KAAK,CAAC,KACtC,OAAO,SAAS,gBAAgB,EAChC,OAAO,eAAe,QAAQ,CAC9B;;CAEF,MAAM,kBACL,MACA,SACsD;AAEtD,SAAOC,WADU,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,OAClB,EAAE,KAAK,CAAC,KACvC,OAAO,SAAS,gBAAgB,EAChC,OAAO,eAAe,QAAQ,CAC9B;;CAGF,MAAM,yBACL,QAEAC,UAAc,IAAI,CAAC,KAClB,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,oCAAoC,CACpD;CAEF,MAAM,wBACL,KACA,QACA,SACgD;AAEhD,SAAOC,SADU,IAAI,OAAO,IAAI,QACF,QAAQ,KAAK,CAAC,KAC3C,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,mCAAmC,CACnD;;CAGF,MAAM,2BAA2B,QAA8D;AAE9F,SAAOC,YADU,IAAI,OAAO,IAAI,OACA,CAAC,KAChC,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,sCAAsC,CACtD;;CAGF,MAAM,kBACL,SAEA,iBAAiB;EAChB,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM;EACpC,MAAM,KAAK;EACX,KAAK,KAAK;EACV,QAAQ,KAAK;EACb,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,MAAM,KAAK;EACX,eAAe,KAAK;EACpB,YAAY,KAAK;EACjB,CAAC,CAAC,KAEF,OAAO,KACL,OAAmB;EACnB,UAAU,EAAE;EACZ,QAAQ,EAAE;EACV,QAAQ,EAAE;EACV,EACD,EACD,oBACA,OAAO,QAAQ,QAAQ,EACvB,OAAO,SAAS,qCAAqC,CACrD;AAEF,QAAO,wBAAwB,GAAG;EACjC;EACA,WAAW;EACX,eAAe;EACf,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ;EACA,YAAY;EACZ,OAAO;EACP,gBAAgB;EAChB,WAAW;EACX,YAAY;EACZ,WAAW;EACX,UAAU;EACV,aAAa;EACb,SAAS;EACT,MAAM;EACN,cAAc;EACd,yBAAyB;EACzB,qBAAqB;EACrB,uBAAuB;EACvB,sBAAsB;EACtB,CAAC;EACD,CACF"}
+{"version":3,"file":"service.mjs","names":["ensureNetworkImpl","pullImageImpl","stopContainer","saveImagesStream","loadImageImpl","tagImageImpl","removeImageImpl"],"sources":["../../../src/runtime/docker/service.ts"],"sourcesContent":["// `ContainerRuntime` capability — Docker reference implementation.\n//\n// Composes the subsystems in this directory into the contract surface\n// declared in `contracts/container-runtime.ts`. Plugins consume the\n// `ContainerRuntime` interface through this service; the typed\n// docker-specific error variants are accessible to advanced consumers\n// via the underlying subsystems but the public surface projects to\n// the contract's narrow `ContainerRuntimeError`.\n\nimport { createHash } from 'node:crypto';\nimport { lstatSync, readdirSync, readFileSync, readlinkSync } from 'node:fs';\nimport { join, relative, sep } from 'node:path';\n\nimport { Context, Duration, Effect, Layer, Ref, Stream } from 'effect';\n\nimport type {\n\tContainerBuildContext,\n\tContainerHandle,\n\tContainerRuntime,\n\tContainerRuntimeError,\n\tEnsureContainerSpec,\n\tEnsureNetworkSpec,\n\tExecOptions,\n\tExecResult,\n\tImageRef,\n\tLoadedImageBundle,\n\tOneShotSpec,\n\tSaveImageOptions,\n\tTagImageOptions,\n\tTaggedImageRef,\n} from '../../contracts/container-runtime.ts';\nimport type { ContainerLabelTuple } from '../../contracts/snapshotable.ts';\nimport { contentHash } from '../../substrate/brand.ts';\nimport { mintRandomSuffix } from '../../substrate/runtime/random-suffix.ts';\nimport { CacheService } from '../../substrate/runtime/cache/index.ts';\nimport { StackPathsService } from '../../substrate/runtime/paths.ts';\nimport { DockerHost, DockerSpawner, dockerRunOk } from './client.ts';\nimport {\n\tassertContainerHandleOwned,\n\tcommit,\n\tensureContainer,\n\tinspectContainer,\n\tpause,\n\ttype PerNameLockState,\n\tstop as stopContainer,\n} from './container.ts';\nimport { toContractError } from './errors.ts';\nimport { dockerExec, dockerRunOneShot } from './exec.ts';\nimport {\n\tensureImageCached,\n\timageExists,\n\tloadImage as loadImageImpl,\n\tpull as pullImageImpl,\n\trefOf,\n\tremoveImage as removeImageImpl,\n\tsaveImages as saveImagesStream,\n\ttagImage as tagImageImpl,\n} from './image.ts';\nimport { listContainers } from './inventory.ts';\nimport { expectedImageOwnershipLabels, sanitizeTagSegment } from './labels.ts';\nimport { ensureNetwork as ensureNetworkImpl } from './network.ts';\nimport {\n\tremoveManagedContainers,\n\tremoveManagedImages,\n\tremoveManagedNetworks,\n\tremoveManagedVolumes,\n} from './sweep.ts';\n\n// -----------------------------------------------------------------------------\n// Service tag — `Context.Service` per Effect-v4 idioms\n// -----------------------------------------------------------------------------\n\nexport class ContainerRuntimeService extends Context.Service<\n\tContainerRuntimeService,\n\tContainerRuntime\n>()('@devstack/runtime-docker/ContainerRuntime') {}\n\n// -----------------------------------------------------------------------------\n// Cycle counter — stamped on container labels at create time\n// -----------------------------------------------------------------------------\n\nexport class DockerCycle extends Context.Service<DockerCycle, Ref.Ref<number>>()(\n\t'@devstack/runtime-docker/Cycle',\n) {}\n\nexport const layerDockerCycleInitial: Layer.Layer<DockerCycle> = Layer.effect(\n\tDockerCycle,\n\tEffect.gen(function* () {\n\t\tconst ref = yield* Ref.make(0);\n\t\treturn ref;\n\t}),\n);\n\n// -----------------------------------------------------------------------------\n// Layer — wire the subsystems into the contract interface\n// -----------------------------------------------------------------------------\n\nconst mapToContractError = <R, A>(\n\teff: Effect.Effect<A, import('./errors.ts').DockerRuntimeError, R>,\n): Effect.Effect<A, ContainerRuntimeError, R> => eff.pipe(Effect.mapError(toContractError));\n\nconst snapshotTempTag = (containerName: string): string => {\n\tconst safeName = containerName.replace(/[^A-Za-z0-9_.-]/g, '-');\n\tconst suffix = mintRandomSuffix(12);\n\treturn `devstack-snapshot:${safeName}-${suffix}`;\n};\n\nconst stableRelativePath = (root: string, path: string): string => {\n\tconst rel = relative(root, path);\n\treturn rel.length === 0 ? '.' : rel.split(sep).join('/');\n};\n\nconst updateContextEntryHash = (\n\thash: ReturnType<typeof createHash>,\n\troot: string,\n\tpath: string,\n): void => {\n\tconst stat = lstatSync(path);\n\tconst rel = stableRelativePath(root, path);\n\n\tif (stat.isDirectory()) {\n\t\thash.update('dir\\0');\n\t\thash.update(rel);\n\t\thash.update('\\0');\n\t\tfor (const child of readdirSync(path).sort((a, b) => a.localeCompare(b))) {\n\t\t\tupdateContextEntryHash(hash, root, join(path, child));\n\t\t}\n\t\treturn;\n\t}\n\n\tif (stat.isFile()) {\n\t\thash.update('file\\0');\n\t\thash.update(rel);\n\t\thash.update('\\0');\n\t\thash.update(String(stat.mode));\n\t\thash.update('\\0');\n\t\thash.update(readFileSync(path));\n\t\thash.update('\\0');\n\t\treturn;\n\t}\n\n\tif (stat.isSymbolicLink()) {\n\t\thash.update('symlink\\0');\n\t\thash.update(rel);\n\t\thash.update('\\0');\n\t\thash.update(readlinkSync(path));\n\t\thash.update('\\0');\n\t\treturn;\n\t}\n\n\thash.update('other\\0');\n\thash.update(rel);\n\thash.update('\\0');\n\thash.update(String(stat.mode));\n\thash.update('\\0');\n};\n\nconst normalizeFingerprintPath = (path: string): string =>\n\tpath\n\t\t.split(/[\\\\/]+/g)\n\t\t.filter((part) => part.length > 0)\n\t\t.join('/');\n\nconst normalizeFingerprintPaths = (\n\tpaths: ReadonlyArray<string> | undefined,\n): ReadonlyArray<string> =>\n\t[...new Set((paths ?? []).map(normalizeFingerprintPath).filter((path) => path.length > 0))].sort(\n\t\t(a, b) => a.localeCompare(b),\n\t);\n\nconst buildContextFingerprint = (\n\tcontextPath: string,\n\tfingerprintPaths?: ReadonlyArray<string>,\n): string => {\n\tconst hash = createHash('sha256');\n\tconst requestedPaths = normalizeFingerprintPaths(fingerprintPaths);\n\tconst paths = requestedPaths.length === 0 ? null : requestedPaths;\n\ttry {\n\t\tif (paths === null) {\n\t\t\tupdateContextEntryHash(hash, contextPath, contextPath);\n\t\t} else {\n\t\t\tfor (const relPath of paths) {\n\t\t\t\thash.update('fingerprint-path\\0');\n\t\t\t\thash.update(relPath);\n\t\t\t\thash.update('\\0');\n\t\t\t\tupdateContextEntryHash(hash, contextPath, join(contextPath, relPath));\n\t\t\t}\n\t\t}\n\t} catch (err) {\n\t\thash.update('unreadable\\0');\n\t\thash.update(String(err));\n\t\thash.update('\\0');\n\t}\n\treturn hash.digest('hex');\n};\n\n/** Stable content hash for the build context. Sorts build args so two\n *  equivalent specs whose key insertion order differs produce the same\n *  hash. The Docker build context's files are part of the key: changing\n *  a vendored entrypoint script must force a new managed image tag. */\nexport const buildContentHash = (ctx: ContainerBuildContext): string => {\n\tconst dockerfile = ctx.dockerfile ?? 'Dockerfile';\n\tconst sortedArgs = Object.entries(ctx.buildArgs ?? {}).sort(([a], [b]) => a.localeCompare(b));\n\tconst argsKey = sortedArgs.map(([k, v]) => `${k}=${v}`).join('\\x00');\n\tconst platform = ctx.platform ?? '';\n\tconst fingerprintPathsKey = normalizeFingerprintPaths(ctx.fingerprintPaths).join('\\x00');\n\treturn createHash('sha256')\n\t\t.update(ctx.contextPath)\n\t\t.update('\\x00')\n\t\t.update(dockerfile)\n\t\t.update('\\x00')\n\t\t.update(platform)\n\t\t.update('\\x00')\n\t\t.update(argsKey)\n\t\t.update('\\x00')\n\t\t.update(fingerprintPathsKey)\n\t\t.update('\\x00')\n\t\t.update(buildContextFingerprint(ctx.contextPath, ctx.fingerprintPaths))\n\t\t.digest('hex');\n};\n\nconst DOCKER_ARCH_ALIASES: Readonly<Record<string, string>> = {\n\taarch64: 'arm64',\n\tarm64: 'arm64',\n\tx86_64: 'amd64',\n\tamd64: 'amd64',\n};\n\nexport const normalizeDockerInfoPlatform = (raw: string): string | null => {\n\tconst trimmed = raw.trim();\n\tconst slash = trimmed.indexOf('/');\n\tif (slash <= 0 || slash === trimmed.length - 1) return null;\n\tconst os = trimmed.slice(0, slash);\n\tconst arch = trimmed.slice(slash + 1);\n\tconst normalizedArch = DOCKER_ARCH_ALIASES[arch] ?? arch;\n\treturn `${os}/${normalizedArch}`;\n};\n\nconst inferDockerBuildPlatform = (): Effect.Effect<\n\tstring | null,\n\tnever,\n\tDockerHost | DockerSpawner\n> =>\n\tdockerRunOk('info', ['--format', '{{.OSType}}/{{.Architecture}}']).pipe(\n\t\tEffect.map((result) =>\n\t\t\tresult.exitCode === 0 ? normalizeDockerInfoPlatform(result.stdout) : null,\n\t\t),\n\t\tEffect.catch(() => Effect.succeed(null)),\n\t);\n\nexport const layerContainerRuntimeDocker: Layer.Layer<\n\tContainerRuntimeService,\n\tnever,\n\tCacheService | DockerHost | DockerSpawner | DockerCycle | StackPathsService\n> = Layer.effect(\n\tContainerRuntimeService,\n\tEffect.gen(function* () {\n\t\tconst cycleRef = yield* DockerCycle;\n\t\t// Snapshot the substrate services so we can provide them to the\n\t\t// closures that implement the contract's R=never surface.\n\t\tconst dockerHost = yield* DockerHost;\n\t\tconst dockerSpawner = yield* DockerSpawner;\n\t\tconst stackPaths = yield* StackPathsService;\n\t\tconst cache = yield* CacheService;\n\t\tconst baseCtx = Context.empty().pipe(\n\t\t\tContext.add(DockerHost, dockerHost),\n\t\t\tContext.add(DockerSpawner, dockerSpawner),\n\t\t\tContext.add(StackPathsService, stackPaths),\n\t\t\tContext.add(CacheService, cache),\n\t\t);\n\t\t// Per-name in-process serialization. Architecture invariant:\n\t\t// two concurrent ensureContainer calls for the same name must\n\t\t// not interleave docker inspect/create/start. The cross-process\n\t\t// safety is the daemon's `--name` atomicity (see container.ts\n\t\t// collision recovery). The in-process side is this ref.\n\t\tconst perNameLock = yield* Ref.make<PerNameLockState>(new Map());\n\n\t\tconst ensureImage = (\n\t\t\tctx: ContainerBuildContext,\n\t\t\texpected?: ImageRef,\n\t\t): Effect.Effect<ImageRef, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst inferredPlatform =\n\t\t\t\t\tctx.platform === undefined\n\t\t\t\t\t\t? yield* inferDockerBuildPlatform().pipe(Effect.provide(baseCtx))\n\t\t\t\t\t\t: null;\n\t\t\t\tconst effectiveCtx =\n\t\t\t\t\tctx.platform === undefined && inferredPlatform !== null\n\t\t\t\t\t\t? { ...ctx, platform: inferredPlatform }\n\t\t\t\t\t\t: ctx;\n\t\t\t\t// Architecture §8: bring-your-own-image vs build is a closed sum.\n\t\t\t\t// The contract accepts `ContainerBuildContext` (build path);\n\t\t\t\t// pull is exposed via `image.ts::pull` directly to plugins\n\t\t\t\t// that need it (not through this contract entry point).\n\t\t\t\t//\n\t\t\t\t// Content-addressed cache: namespace is the constant\n\t\t\t\t// `runtime-docker-build` (one substrate-owned namespace);\n\t\t\t\t// chain is `n/a` (build artifacts are chain-independent);\n\t\t\t\t// contentHash is a hash of the build context's identifying\n\t\t\t\t// fields. The caller-supplied `expected.tag`, when present,\n\t\t\t\t// is honoured as the on-host tag; absent, we derive a tag\n\t\t\t\t// from the content hash so two unrelated contexts cannot\n\t\t\t\t// collide on the sanitized contextPath form.\n\t\t\t\t//\n\t\t\t\t// (app, stack) TAG SCOPING. The derived tag is scoped by the\n\t\t\t\t// owner's `(app, stack)` — `devstack-build:<app>-<stack>-<hash16>`.\n\t\t\t\t// The CACHE KEY below stays content-only (`{namespace, chain,\n\t\t\t\t// contentHash}`), so two stacks with identical build context\n\t\t\t\t// still SHARE the build (no redundant rebuild) — only the on-host\n\t\t\t\t// TAG differs. This is load-bearing for snapshot/restore: each\n\t\t\t\t// running container commits its writable layer onto its own\n\t\t\t\t// `imageName` (this tag). Without scoping, two stacks whose build\n\t\t\t\t// context is byte-identical share ONE tag, so capture/restore's\n\t\t\t\t// per-container image-promote collapses their committed layers\n\t\t\t\t// onto that single name (last-write-wins) — e.g. app A's sui\n\t\t\t\t// indexer-db PGDATA gets aliased under app B's container and the\n\t\t\t\t// db rejects auth (\"FATAL: password authentication failed\").\n\t\t\t\t// Stays aligned with #23's sidecar-password fix\n\t\t\t\t// (`deriveSidecarPassword(app, stack, role)`): both keyed on\n\t\t\t\t// (app, stack). Label-free builds (no owner — e.g.\n\t\t\t\t// `move-summary-runner`) stay UNSCOPED.\n\t\t\t\t//\n\t\t\t\tconst hash = buildContentHash(effectiveCtx);\n\t\t\t\tconst owner = effectiveCtx.owner;\n\t\t\t\tconst scope =\n\t\t\t\t\towner !== undefined\n\t\t\t\t\t\t? `${sanitizeTagSegment(owner.app)}-${sanitizeTagSegment(owner.stack)}-`\n\t\t\t\t\t\t: '';\n\t\t\t\tconst tag = expected?.tag ?? `devstack-build:${scope}${hash.slice(0, 16)}`;\n\t\t\t\t// Owner identity flows through as `--label` flags on\n\t\t\t\t// `docker build`, making the resulting image visible to\n\t\t\t\t// label-driven prune. Labels are metadata, NOT part of\n\t\t\t\t// the cache key — an unlabelled cached image stays a cache\n\t\t\t\t// hit, and label-driven prune reaps it.\n\t\t\t\tconst ownerLabels =\n\t\t\t\t\teffectiveCtx.owner !== undefined\n\t\t\t\t\t\t? expectedImageOwnershipLabels(effectiveCtx.owner)\n\t\t\t\t\t\t: undefined;\n\t\t\t\treturn yield* ensureImageCached(\n\t\t\t\t\t{\n\t\t\t\t\t\tcontextPath: effectiveCtx.contextPath,\n\t\t\t\t\t\tdockerfile: effectiveCtx.dockerfile,\n\t\t\t\t\t\tplatform: effectiveCtx.platform,\n\t\t\t\t\t\tbuildArgs: effectiveCtx.buildArgs,\n\t\t\t\t\t\ttag,\n\t\t\t\t\t\t...(ownerLabels !== undefined && { labels: ownerLabels }),\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\tnamespace: 'runtime-docker-build',\n\t\t\t\t\t\tchain: 'n/a',\n\t\t\t\t\t\tcontentHash: contentHash(hash),\n\t\t\t\t\t},\n\t\t\t\t).pipe(\n\t\t\t\t\tEffect.map((digest) => refOf(digest, tag)),\n\t\t\t\t\tmapToContractError,\n\t\t\t\t\tEffect.provide(baseCtx),\n\t\t\t\t);\n\t\t\t});\n\n\t\tconst ensureNetworkContractImpl = (\n\t\t\tspec: EnsureNetworkSpec,\n\t\t): Effect.Effect<string, ContainerRuntimeError> =>\n\t\t\tensureNetworkImpl(spec.name, {\n\t\t\t\tapp: spec.app,\n\t\t\t\tstack: spec.stack,\n\t\t\t\t...(spec.subnet === undefined ? {} : { subnet: spec.subnet }),\n\t\t\t\t...(spec.gateway === undefined ? {} : { gateway: spec.gateway }),\n\t\t\t}).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst pullImageContractImpl = (ref: string): Effect.Effect<ImageRef, ContainerRuntimeError> =>\n\t\t\tpullImageImpl(ref).pipe(\n\t\t\t\tEffect.map((digest) => refOf(digest, ref)),\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t);\n\n\t\tconst ensureContainerImpl = (\n\t\t\tspec: EnsureContainerSpec,\n\t\t): Effect.Effect<ContainerHandle, ContainerRuntimeError, import('effect').Scope.Scope> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst cycle = yield* Ref.get(cycleRef);\n\t\t\t\treturn yield* ensureContainer(spec, { cycle, perNameLock });\n\t\t\t}).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst inspectByLabels = (\n\t\t\tlabels: ContainerLabelTuple,\n\t\t): Effect.Effect<ReadonlyArray<ContainerHandle>, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst summaries = yield* listContainers(labels);\n\t\t\t\treturn yield* Effect.forEach(\n\t\t\t\t\tsummaries,\n\t\t\t\t\t(s) =>\n\t\t\t\t\t\tinspectContainer(s.name).pipe(\n\t\t\t\t\t\t\tEffect.map(\n\t\t\t\t\t\t\t\t(facts): ContainerHandle => ({\n\t\t\t\t\t\t\t\t\tid: facts?.id ?? s.id,\n\t\t\t\t\t\t\t\t\tname: s.name,\n\t\t\t\t\t\t\t\t\tlabels,\n\t\t\t\t\t\t\t\t\timageName: facts?.image ?? s.image,\n\t\t\t\t\t\t\t\t\tstatus: (facts?.paused\n\t\t\t\t\t\t\t\t\t\t? 'paused'\n\t\t\t\t\t\t\t\t\t\t: (facts?.running ?? s.state === 'running')\n\t\t\t\t\t\t\t\t\t\t\t? 'running'\n\t\t\t\t\t\t\t\t\t\t\t: s.state === 'paused'\n\t\t\t\t\t\t\t\t\t\t\t\t? 'paused'\n\t\t\t\t\t\t\t\t\t\t\t\t: s.state === 'created'\n\t\t\t\t\t\t\t\t\t\t\t\t\t? 'created'\n\t\t\t\t\t\t\t\t\t\t\t\t\t: 'exited') as ContainerHandle['status'],\n\t\t\t\t\t\t\t\t\tips: [],\n\t\t\t\t\t\t\t\t\t...(facts?.ports !== undefined ? { ports: facts.ports } : {}),\n\t\t\t\t\t\t\t\t\t// Surface the inspected exit code whenever Docker\n\t\t\t\t\t\t\t\t\t// supplied a `State` (running / exited-0 → `0`; only an\n\t\t\t\t\t\t\t\t\t// omitted-`State` inspect leaves `exitCode` null →\n\t\t\t\t\t\t\t\t\t// `lastExitCode` absent) so callers can gate on a\n\t\t\t\t\t\t\t\t\t// SIGKILL/OOM `137` crash-recreate — the signal sui's\n\t\t\t\t\t\t\t\t\t// indexer-db sidecar resets on.\n\t\t\t\t\t\t\t\t\t...(facts?.exitCode != null ? { lastExitCode: facts.exitCode } : {}),\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t{ concurrency: 'unbounded' },\n\t\t\t\t);\n\t\t\t}).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst pauseAndCommitImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t): Effect.Effect<TaggedImageRef, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tif (handle.status === 'running') {\n\t\t\t\t\tyield* pause(handle.name);\n\t\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\t}\n\t\t\t\tconst tag = snapshotTempTag(handle.name);\n\t\t\t\tconst digest = yield* commit(handle.name, tag);\n\t\t\t\treturn { digest, tag };\n\t\t\t}).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst stopImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t\tgrace: Duration.Duration,\n\t\t): Effect.Effect<void, ContainerRuntimeError> => {\n\t\t\tconst seconds = Math.max(0, Math.ceil(Duration.toMillis(grace) / 1000));\n\t\t\treturn Effect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\tyield* stopContainer(handle.name, seconds);\n\t\t\t}).pipe(mapToContractError, Effect.provide(baseCtx));\n\t\t};\n\n\t\tconst removeManagedContainersImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedContainers(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst removeManagedImagesImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedImages(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst removeManagedNetworksImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedNetworks(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst removeManagedVolumesImpl = (\n\t\t\tlabelMatch: Partial<ContainerLabelTuple>,\n\t\t): Effect.Effect<number, ContainerRuntimeError> =>\n\t\t\tremoveManagedVolumes(labelMatch).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst execImpl = (\n\t\t\thandle: ContainerHandle,\n\t\t\targv: ReadonlyArray<string>,\n\t\t\topts?: ExecOptions,\n\t\t): Effect.Effect<ExecResult, ContainerRuntimeError> =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tyield* assertContainerHandleOwned(handle);\n\t\t\t\treturn yield* dockerExec(handle.name, argv, {\n\t\t\t\t\tuser: opts?.user,\n\t\t\t\t\tenv: opts?.env,\n\t\t\t\t\tworkdir: opts?.workdir,\n\t\t\t\t});\n\t\t\t}).pipe(\n\t\t\t\t// Contract surface: NEVER promote non-zero exit to failure\n\t\t\t\t// here. The caller is the policy holder.\n\t\t\t\tEffect.map(\n\t\t\t\t\t(r): ExecResult => ({\n\t\t\t\t\t\texitCode: r.exitCode,\n\t\t\t\t\t\tstdout: r.stdout,\n\t\t\t\t\t\tstderr: r.stderr,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t);\n\n\t\tconst saveImagesImpl = (\n\t\t\trefs: ReadonlyArray<ImageRef>,\n\t\t\topts?: SaveImageOptions,\n\t\t): Stream.Stream<Uint8Array, ContainerRuntimeError> => {\n\t\t\tconst resolved = refs.map((ref) => ref.tag ?? ref.digest);\n\t\t\treturn saveImagesStream(resolved, opts).pipe(\n\t\t\t\tStream.mapError(toContractError),\n\t\t\t\tStream.provideContext(baseCtx),\n\t\t\t);\n\t\t};\n\n\t\tconst loadImageContractImpl = (\n\t\t\ttar: Stream.Stream<Uint8Array, unknown>,\n\t\t): Effect.Effect<LoadedImageBundle, ContainerRuntimeError> =>\n\t\t\tloadImageImpl(tar).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst tagImageContractImpl = (\n\t\t\tsrc: ImageRef,\n\t\t\tnewTag: string,\n\t\t\topts?: TagImageOptions,\n\t\t): Effect.Effect<void, ContainerRuntimeError> => {\n\t\t\tconst resolved = src.tag ?? src.digest;\n\t\t\treturn tagImageImpl(resolved, newTag, opts).pipe(mapToContractError, Effect.provide(baseCtx));\n\t\t};\n\n\t\tconst removeImageContractImpl = (ref: ImageRef): Effect.Effect<void, ContainerRuntimeError> => {\n\t\t\tconst resolved = ref.tag ?? ref.digest;\n\t\t\treturn removeImageImpl(resolved).pipe(mapToContractError, Effect.provide(baseCtx));\n\t\t};\n\n\t\t// Reuse `image.ts::imageExists` — `docker image inspect --format\n\t\t// {{.Id}}`, returning the resolved id or null. No new docker\n\t\t// invocation logic; the contract entry point just projects the\n\t\t// subsystem's narrow error to the contract error.\n\t\tconst inspectImageDigestContractImpl = (\n\t\t\tref: string,\n\t\t): Effect.Effect<string | null, ContainerRuntimeError> =>\n\t\t\timageExists(ref).pipe(mapToContractError, Effect.provide(baseCtx));\n\n\t\tconst runOneShotImpl = (\n\t\t\tspec: OneShotSpec,\n\t\t): Effect.Effect<ExecResult, ContainerRuntimeError, import('effect').Scope.Scope> =>\n\t\t\tdockerRunOneShot({\n\t\t\t\timage: spec.image.tag ?? spec.image.digest,\n\t\t\t\targv: spec.argv,\n\t\t\t\tenv: spec.env,\n\t\t\t\tmounts: spec.mounts,\n\t\t\t\tnetwork: spec.network,\n\t\t\t\tentrypoint: spec.entrypoint,\n\t\t\t\tuser: spec.user,\n\t\t\t\ttimeoutMillis: spec.timeoutMillis,\n\t\t\t\textraHosts: spec.extraHosts,\n\t\t\t}).pipe(\n\t\t\t\t// Same contract: never promote non-zero exit to failure.\n\t\t\t\tEffect.map(\n\t\t\t\t\t(r): ExecResult => ({\n\t\t\t\t\t\texitCode: r.exitCode,\n\t\t\t\t\t\tstdout: r.stdout,\n\t\t\t\t\t\tstderr: r.stderr,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t\tmapToContractError,\n\t\t\t\tEffect.provide(baseCtx),\n\t\t\t);\n\n\t\treturn ContainerRuntimeService.of({\n\t\t\tensureImage,\n\t\t\tpullImage: pullImageContractImpl,\n\t\t\tensureNetwork: ensureNetworkContractImpl,\n\t\t\tensureContainer: ensureContainerImpl,\n\t\t\texec: execImpl,\n\t\t\trunOneShot: runOneShotImpl,\n\t\t\tinspectByLabels,\n\t\t\tpauseAndCommit: pauseAndCommitImpl,\n\t\t\tsaveImages: saveImagesImpl,\n\t\t\tloadImage: loadImageContractImpl,\n\t\t\ttagImage: tagImageContractImpl,\n\t\t\tremoveImage: removeImageContractImpl,\n\t\t\tinspectImageDigest: inspectImageDigestContractImpl,\n\t\t\tstop: stopImpl,\n\t\t\tremoveManagedContainers: removeManagedContainersImpl,\n\t\t\tremoveManagedImages: removeManagedImagesImpl,\n\t\t\tremoveManagedNetworks: removeManagedNetworksImpl,\n\t\t\tremoveManagedVolumes: removeManagedVolumesImpl,\n\t\t});\n\t}),\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAwEA,IAAa,0BAAb,cAA6C,QAAQ,QAGnD,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC;AAMlD,IAAa,cAAb,cAAiC,QAAQ,QAAsC,CAAC,CAC/E,gCACD,CAAC,CAAC,CAAC;AAEH,MAAa,0BAAoD,MAAM,OACtE,aACA,OAAO,IAAI,aAAa;CAEvB,OAAO,OADY,IAAI,KAAK,CAAC;AAE9B,CAAC,CACF;AAMA,MAAM,sBACL,QACgD,IAAI,KAAK,OAAO,SAAS,eAAe,CAAC;AAE1F,MAAM,mBAAmB,kBAAkC;CAG1D,OAAO,qBAFU,cAAc,QAAQ,oBAAoB,GAExB,EAAE,GADtB,iBAAiB,EACa;AAC9C;AAEA,MAAM,sBAAsB,MAAc,SAAyB;CAClE,MAAM,MAAM,SAAS,MAAM,IAAI;CAC/B,OAAO,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;AACxD;AAEA,MAAM,0BACL,MACA,MACA,SACU;CACV,MAAM,OAAO,UAAU,IAAI;CAC3B,MAAM,MAAM,mBAAmB,MAAM,IAAI;CAEzC,IAAI,KAAK,YAAY,GAAG;EACvB,KAAK,OAAO,OAAO;EACnB,KAAK,OAAO,GAAG;EACf,KAAK,OAAO,IAAI;EAChB,KAAK,MAAM,SAAS,YAAY,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,GACtE,uBAAuB,MAAM,MAAM,KAAK,MAAM,KAAK,CAAC;EAErD;CACD;CAEA,IAAI,KAAK,OAAO,GAAG;EAClB,KAAK,OAAO,QAAQ;EACpB,KAAK,OAAO,GAAG;EACf,KAAK,OAAO,IAAI;EAChB,KAAK,OAAO,OAAO,KAAK,IAAI,CAAC;EAC7B,KAAK,OAAO,IAAI;EAChB,KAAK,OAAO,aAAa,IAAI,CAAC;EAC9B,KAAK,OAAO,IAAI;EAChB;CACD;CAEA,IAAI,KAAK,eAAe,GAAG;EAC1B,KAAK,OAAO,WAAW;EACvB,KAAK,OAAO,GAAG;EACf,KAAK,OAAO,IAAI;EAChB,KAAK,OAAO,aAAa,IAAI,CAAC;EAC9B,KAAK,OAAO,IAAI;EAChB;CACD;CAEA,KAAK,OAAO,SAAS;CACrB,KAAK,OAAO,GAAG;CACf,KAAK,OAAO,IAAI;CAChB,KAAK,OAAO,OAAO,KAAK,IAAI,CAAC;CAC7B,KAAK,OAAO,IAAI;AACjB;AAEA,MAAM,4BAA4B,SACjC,KACE,MAAM,SAAS,CAAC,CAChB,QAAQ,SAAS,KAAK,SAAS,CAAC,CAAC,CACjC,KAAK,GAAG;AAEX,MAAM,6BACL,UAEA,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,EAAA,CAAG,IAAI,wBAAwB,CAAC,CAAC,QAAQ,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAC1F,GAAG,MAAM,EAAE,cAAc,CAAC,CAC5B;AAED,MAAM,2BACL,aACA,qBACY;CACZ,MAAM,OAAO,WAAW,QAAQ;CAChC,MAAM,iBAAiB,0BAA0B,gBAAgB;CACjE,MAAM,QAAQ,eAAe,WAAW,IAAI,OAAO;CACnD,IAAI;EACH,IAAI,UAAU,MACb,uBAAuB,MAAM,aAAa,WAAW;OAErD,KAAK,MAAM,WAAW,OAAO;GAC5B,KAAK,OAAO,oBAAoB;GAChC,KAAK,OAAO,OAAO;GACnB,KAAK,OAAO,IAAI;GAChB,uBAAuB,MAAM,aAAa,KAAK,aAAa,OAAO,CAAC;EACrE;CAEF,SAAS,KAAK;EACb,KAAK,OAAO,cAAc;EAC1B,KAAK,OAAO,OAAO,GAAG,CAAC;EACvB,KAAK,OAAO,IAAI;CACjB;CACA,OAAO,KAAK,OAAO,KAAK;AACzB;;;;;AAMA,MAAa,oBAAoB,QAAuC;CACvE,MAAM,aAAa,IAAI,cAAc;CAErC,MAAM,UADa,OAAO,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAClE,CAAC,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,KAAK,IAAM;CACnE,MAAM,WAAW,IAAI,YAAY;CACjC,MAAM,sBAAsB,0BAA0B,IAAI,gBAAgB,CAAC,CAAC,KAAK,IAAM;CACvF,OAAO,WAAW,QAAQ,CAAC,CACzB,OAAO,IAAI,WAAW,CAAC,CACvB,OAAO,IAAM,CAAC,CACd,OAAO,UAAU,CAAC,CAClB,OAAO,IAAM,CAAC,CACd,OAAO,QAAQ,CAAC,CAChB,OAAO,IAAM,CAAC,CACd,OAAO,OAAO,CAAC,CACf,OAAO,IAAM,CAAC,CACd,OAAO,mBAAmB,CAAC,CAC3B,OAAO,IAAM,CAAC,CACd,OAAO,wBAAwB,IAAI,aAAa,IAAI,gBAAgB,CAAC,CAAC,CACtE,OAAO,KAAK;AACf;AAEA,MAAM,sBAAwD;CAC7D,SAAS;CACT,OAAO;CACP,QAAQ;CACR,OAAO;AACR;AAEA,MAAa,+BAA+B,QAA+B;CAC1E,MAAM,UAAU,IAAI,KAAK;CACzB,MAAM,QAAQ,QAAQ,QAAQ,GAAG;CACjC,IAAI,SAAS,KAAK,UAAU,QAAQ,SAAS,GAAG,OAAO;CACvD,MAAM,KAAK,QAAQ,MAAM,GAAG,KAAK;CACjC,MAAM,OAAO,QAAQ,MAAM,QAAQ,CAAC;CAEpC,OAAO,GAAG,GAAG,GADU,oBAAoB,SAAS;AAErD;AAEA,MAAM,iCAKL,YAAY,QAAQ,CAAC,YAAY,+BAA+B,CAAC,CAAC,CAAC,KAClE,OAAO,KAAK,WACX,OAAO,aAAa,IAAI,4BAA4B,OAAO,MAAM,IAAI,IACtE,GACA,OAAO,YAAY,OAAO,QAAQ,IAAI,CAAC,CACxC;AAED,MAAa,8BAIT,MAAM,OACT,yBACA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,OAAO;CAGxB,MAAM,aAAa,OAAO;CAC1B,MAAM,gBAAgB,OAAO;CAC7B,MAAM,aAAa,OAAO;CAC1B,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,KAC/B,QAAQ,IAAI,YAAY,UAAU,GAClC,QAAQ,IAAI,eAAe,aAAa,GACxC,QAAQ,IAAI,mBAAmB,UAAU,GACzC,QAAQ,IAAI,cAAc,KAAK,CAChC;CAMA,MAAM,cAAc,OAAO,IAAI,qBAAuB,IAAI,IAAI,CAAC;CAE/D,MAAM,eACL,KACA,aAEA,OAAO,IAAI,aAAa;EACvB,MAAM,mBACL,IAAI,aAAa,KAAA,IACd,OAAO,yBAAyB,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,CAAC,IAC9D;EACJ,MAAM,eACL,IAAI,aAAa,KAAA,KAAa,qBAAqB,OAChD;GAAE,GAAG;GAAK,UAAU;EAAiB,IACrC;EAiCJ,MAAM,OAAO,iBAAiB,YAAY;EAC1C,MAAM,QAAQ,aAAa;EAC3B,MAAM,QACL,UAAU,KAAA,IACP,GAAG,mBAAmB,MAAM,GAAG,EAAE,GAAG,mBAAmB,MAAM,KAAK,EAAE,KACpE;EACJ,MAAM,MAAM,UAAU,OAAO,kBAAkB,QAAQ,KAAK,MAAM,GAAG,EAAE;EAMvE,MAAM,cACL,aAAa,UAAU,KAAA,IACpB,6BAA6B,aAAa,KAAK,IAC/C,KAAA;EACJ,OAAO,OAAO,kBACb;GACC,aAAa,aAAa;GAC1B,YAAY,aAAa;GACzB,UAAU,aAAa;GACvB,WAAW,aAAa;GACxB;GACA,GAAI,gBAAgB,KAAA,KAAa,EAAE,QAAQ,YAAY;EACxD,GACA;GACC,WAAW;GACX,OAAO;GACP,aAAa,YAAY,IAAI;EAC9B,CACD,CAAC,CAAC,KACD,OAAO,KAAK,WAAW,MAAM,QAAQ,GAAG,CAAC,GACzC,oBACA,OAAO,QAAQ,OAAO,CACvB;CACD,CAAC;CAEF,MAAM,6BACL,SAEAA,cAAkB,KAAK,MAAM;EAC5B,KAAK,KAAK;EACV,OAAO,KAAK;EACZ,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;EAC3D,GAAI,KAAK,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ;CAC/D,CAAC,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAEpD,MAAM,yBAAyB,QAC9BC,KAAc,GAAG,CAAC,CAAC,KAClB,OAAO,KAAK,WAAW,MAAM,QAAQ,GAAG,CAAC,GACzC,oBACA,OAAO,QAAQ,OAAO,CACvB;CAED,MAAM,uBACL,SAEA,OAAO,IAAI,aAAa;EAEvB,OAAO,OAAO,gBAAgB,MAAM;GAAE,OAAA,OADjB,IAAI,IAAI,QAAQ;GACQ;EAAY,CAAC;CAC3D,CAAC,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAEpD,MAAM,mBACL,WAEA,OAAO,IAAI,aAAa;EACvB,MAAM,YAAY,OAAO,eAAe,MAAM;EAC9C,OAAO,OAAO,OAAO,QACpB,YACC,MACA,iBAAiB,EAAE,IAAI,CAAC,CAAC,KACxB,OAAO,KACL,WAA4B;GAC5B,IAAI,OAAO,MAAM,EAAE;GACnB,MAAM,EAAE;GACR;GACA,WAAW,OAAO,SAAS,EAAE;GAC7B,QAAS,OAAO,SACb,WACC,OAAO,WAAW,EAAE,UAAU,YAC9B,YACA,EAAE,UAAU,WACX,WACA,EAAE,UAAU,YACX,YACA;GACN,KAAK,CAAC;GACN,GAAI,OAAO,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;GAO3D,GAAI,OAAO,YAAY,OAAO,EAAE,cAAc,MAAM,SAAS,IAAI,CAAC;EACnE,EACD,CACD,GACD,EAAE,aAAa,YAAY,CAC5B;CACD,CAAC,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAEpD,MAAM,sBACL,WAEA,OAAO,IAAI,aAAa;EACvB,OAAO,2BAA2B,MAAM;EACxC,IAAI,OAAO,WAAW,WAAW;GAChC,OAAO,MAAM,OAAO,IAAI;GACxB,OAAO,2BAA2B,MAAM;EACzC;EACA,MAAM,MAAM,gBAAgB,OAAO,IAAI;EAEvC,OAAO;GAAE,QAAA,OADa,OAAO,OAAO,MAAM,GAAG;GAC5B;EAAI;CACtB,CAAC,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAEpD,MAAM,YACL,QACA,UACgD;EAChD,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,SAAS,KAAK,IAAI,GAAI,CAAC;EACtE,OAAO,OAAO,IAAI,aAAa;GAC9B,OAAO,2BAA2B,MAAM;GACxC,OAAOC,KAAc,OAAO,MAAM,OAAO;EAC1C,CAAC,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CACpD;CAEA,MAAM,+BACL,eAEA,wBAAwB,UAAU,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAErF,MAAM,2BACL,eAEA,oBAAoB,UAAU,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAEjF,MAAM,6BACL,eAEA,sBAAsB,UAAU,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAEnF,MAAM,4BACL,eAEA,qBAAqB,UAAU,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAElF,MAAM,YACL,QACA,MACA,SAEA,OAAO,IAAI,aAAa;EACvB,OAAO,2BAA2B,MAAM;EACxC,OAAO,OAAO,WAAW,OAAO,MAAM,MAAM;GAC3C,MAAM,MAAM;GACZ,KAAK,MAAM;GACX,SAAS,MAAM;EAChB,CAAC;CACF,CAAC,CAAC,CAAC,KAGF,OAAO,KACL,OAAmB;EACnB,UAAU,EAAE;EACZ,QAAQ,EAAE;EACV,QAAQ,EAAE;CACX,EACD,GACA,oBACA,OAAO,QAAQ,OAAO,CACvB;CAED,MAAM,kBACL,MACA,SACsD;EAEtD,OAAOC,WADU,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,MACnB,GAAG,IAAI,CAAC,CAAC,KACvC,OAAO,SAAS,eAAe,GAC/B,OAAO,eAAe,OAAO,CAC9B;CACD;CAEA,MAAM,yBACL,QAEAC,UAAc,GAAG,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAEpE,MAAM,wBACL,KACA,QACA,SACgD;EAEhD,OAAOC,SADU,IAAI,OAAO,IAAI,QACF,QAAQ,IAAI,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAC7F;CAEA,MAAM,2BAA2B,QAA8D;EAE9F,OAAOC,YADU,IAAI,OAAO,IAAI,MACD,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAClF;CAMA,MAAM,kCACL,QAEA,YAAY,GAAG,CAAC,CAAC,KAAK,oBAAoB,OAAO,QAAQ,OAAO,CAAC;CAElE,MAAM,kBACL,SAEA,iBAAiB;EAChB,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM;EACpC,MAAM,KAAK;EACX,KAAK,KAAK;EACV,QAAQ,KAAK;EACb,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,MAAM,KAAK;EACX,eAAe,KAAK;EACpB,YAAY,KAAK;CAClB,CAAC,CAAC,CAAC,KAEF,OAAO,KACL,OAAmB;EACnB,UAAU,EAAE;EACZ,QAAQ,EAAE;EACV,QAAQ,EAAE;CACX,EACD,GACA,oBACA,OAAO,QAAQ,OAAO,CACvB;CAED,OAAO,wBAAwB,GAAG;EACjC;EACA,WAAW;EACX,eAAe;EACf,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ;EACA,gBAAgB;EAChB,YAAY;EACZ,WAAW;EACX,UAAU;EACV,aAAa;EACb,oBAAoB;EACpB,MAAM;EACN,yBAAyB;EACzB,qBAAqB;EACrB,uBAAuB;EACvB,sBAAsB;CACvB,CAAC;AACF,CAAC,CACF"}

package/dist/runtime/docker/sweep.mjs

@@ -1,8 +1,5 @@
-import { StackPathsService } from "../../substrate/runtime/paths.mjs";
-import { acquireStackLock } from "../../substrate/runtime/cross-process/stack-lock.mjs";
-import { readClaims } from "../../substrate/runtime/cross-process/roster.mjs";
 import { dockerRunOk } from "./client.mjs";
-import { ContainerRemoveFailed, DaemonUnreachable, ImageRemoveFailed, NetworkOperationFailed } from "./errors.mjs";
+import { ContainerRemoveFailed, ImageRemoveFailed, NetworkOperationFailed } from "./errors.mjs";
 import { isMissingImageStderr, isMissingNetworkStderr, isNetworkInUseStderr, isNoSuchContainerStderr, wrapGeneric } from "./wrap.mjs";
 import { LabelKey } from "./labels.mjs";
 import { forceDisconnect, listAttachedContainers } from "./network.mjs";
@@ -21,62 +18,15 @@ const removeManagedContainer = (name) => Effect.gen(function* () {
 		exitCode: res.exitCode
 	}));
 });
-/** Sweep orphan containers matching the partial label tuple. Returns
-*  the number of containers removed.
-*
-*  The sweep:
-*
-*    1. Lists all containers with the canonical `devstack.managed=true`
-*       + caller-supplied partial tuple (typically `{app, stack}`).
-*    2. Reads the container-claim ledger (the file held alongside
-*       roster.json; mutated only under stack.lock).
-*    3. Under stack.lock, removes any container whose name is NOT in
-*       the ledger.
-*
-*  Concurrent sweepers are serialized by stack.lock. The architecture
-*  says briefly here — we hold the lock only across the read + the
-*  remove decision; we DON'T hold it across the individual `docker
-*  rm` calls (which can be slow). The cost: a peer that registered a
-*  claim between our decision and our rm gets its container rm'd
-*  anyway. The mitigation: this only fires on the BOOT path before
-*  any plugin acquires, so the steady-state "peer just claimed" race
-*  is not in the picture. */
-const sweepOrphans = (labelMatch) => Effect.gen(function* () {
-	const paths = yield* StackPathsService;
-	const containers = yield* listContainers(labelMatch);
-	if (containers.length === 0) return 0;
-	const mapSubstrateError = (cause) => new DaemonUnreachable({
-		op: "cross-process.sweep",
-		detail: `sweep substrate read failed: ${String(cause)}`,
-		cause
-	});
-	const claimNames = yield* Effect.scoped(Effect.gen(function* () {
-		yield* acquireStackLock(paths.stackLockFile).pipe(Effect.mapError(mapSubstrateError));
-		const doc = yield* readClaims({
-			stackLockFile: paths.stackLockFile,
-			rosterFile: paths.rosterFile,
-			containerClaimsFile: paths.containerClaimsFile
-		}).pipe(Effect.mapError(mapSubstrateError));
-		return new Set(doc.claims.map((c) => c.containerKey));
-	}));
-	let removed = 0;
-	for (const c of containers) {
-		if (claimNames.has(c.name)) continue;
-		if (yield* removeManagedContainer(c.name).pipe(Effect.tapCause((cause) => Effect.logWarning("sweep: docker rm -f failed", {
-			name: c.name,
-			cause
-		})), Effect.catch(() => Effect.succeed(false)))) removed += 1;
-	}
-	return removed;
-}).pipe(Effect.withSpan("runtime.docker.sweep"));
-/** Explicit teardown. Unlike `sweepOrphans`, this does not consult the
-*  claim ledger; wipe/restore are intentional destructive operations. */
+/** Explicit teardown — force-removes managed containers matching the
+*  partial label tuple, regardless of claim-ledger entries. Wipe/restore
+*  are intentional destructive operations. */
 const removeManagedContainers = (labelMatch) => Effect.gen(function* () {
 	const containers = yield* listContainers(labelMatch);
 	let removed = 0;
 	for (const c of containers) if (yield* removeManagedContainer(c.name)) removed += 1;
 	return removed;
-}).pipe(Effect.withSpan("runtime.docker.removeManagedContainers"));
+});
 const labelsMatchAppStack = (labels, match) => labels[LabelKey.app] === match.app && labels[LabelKey.stack] === match.stack;
 const removeDevstackContainers = (labelMatch) => Effect.gen(function* () {
 	const containers = yield* listDevstackContainers();
@@ -86,7 +36,7 @@ const removeDevstackContainers = (labelMatch) => Effect.gen(function* () {
 		if (yield* removeManagedContainer(c.name)) removed += 1;
 	}
 	return removed;
-}).pipe(Effect.withSpan("runtime.docker.removeDevstackContainers"));
+});
 /** Remove devstack-managed containers whose generic `kind` label matches
 *  AND whose name matches. The L1 helper is plugin-blind: orchestrators
 *  pass the kind value they themselves stamp at create time. */
@@ -98,7 +48,7 @@ const removeDevstackContainersByKindAndName = (kind, containerName) => Effect.ge
 		if (yield* removeManagedContainer(c.name)) removed += 1;
 	}
 	return removed;
-}).pipe(Effect.withSpan("runtime.docker.removeDevstackContainersByKindAndName"));
+});
 const removeManagedImage = (ref) => Effect.gen(function* () {
 	const res = yield* dockerRunOk("image", [
 		"rm",
@@ -125,7 +75,7 @@ const removeManagedImages = (labelMatch) => Effect.gen(function* () {
 		if (yield* removeManagedImage(ref)) removed += 1;
 	}
 	return removed;
-}).pipe(Effect.withSpan("runtime.docker.removeManagedImages"));
+});
 const removeDevstackImages = (labelMatch) => Effect.gen(function* () {
 	const images = yield* listDevstackImages();
 	let removed = 0;
@@ -139,7 +89,7 @@ const removeDevstackImages = (labelMatch) => Effect.gen(function* () {
 		if (yield* removeManagedImage(ref)) removed += 1;
 	}
 	return removed;
-}).pipe(Effect.withSpan("runtime.docker.removeDevstackImages"));
+});
 const removeManagedNetwork = (name) => Effect.gen(function* () {
 	const res = yield* dockerRunOk("network", ["rm", name]).pipe(Effect.mapError(wrapGeneric("docker.network.rm")));
 	if (res.exitCode === 0) return true;
@@ -158,7 +108,7 @@ const removeManagedNetworks = (labelMatch) => Effect.gen(function* () {
 		if (yield* removeManagedNetwork(network.name)) removed += 1;
 	}
 	return removed;
-}).pipe(Effect.withSpan("runtime.docker.removeManagedNetworks"));
+});
 /** Parse `network X has active endpoints (name:"A" id:"B")` stderr —
 *  Docker enumerates each blocking endpoint as a `(name:"…" id:"…")`
 *  tuple. Returns an empty array on non-matching stderr. */
@@ -264,7 +214,7 @@ const removeDevstackNetworksBestEffort = (labelMatch, options = {}) => Effect.ge
 		foreignHolders,
 		staleEndpoints
 	};
-}).pipe(Effect.withSpan("runtime.docker.removeDevstackNetworksBestEffort"));
+});
 const removeManagedVolumes = (labelMatch) => Effect.gen(function* () {
 	const volumes = yield* listVolumes(labelMatch);
 	let removed = 0;
@@ -276,7 +226,7 @@ const removeManagedVolumes = (labelMatch) => Effect.gen(function* () {
 		})), Effect.as(true), Effect.catch(() => Effect.succeed(false)))) removed += 1;
 	}
 	return removed;
-}).pipe(Effect.withSpan("runtime.docker.removeManagedVolumes"));
+});
 const removeDevstackVolumes = (labelMatch) => Effect.gen(function* () {
 	const volumes = yield* listDevstackVolumes();
 	let removed = 0;
@@ -288,8 +238,8 @@ const removeDevstackVolumes = (labelMatch) => Effect.gen(function* () {
 		})), Effect.as(true), Effect.catch(() => Effect.succeed(false)))) removed += 1;
 	}
 	return removed;
-}).pipe(Effect.withSpan("runtime.docker.removeDevstackVolumes"));
+});
 //#endregion
-export { removeDevstackContainers, removeDevstackContainersByKindAndName, removeDevstackImages, removeDevstackNetworksBestEffort, removeDevstackVolumes, removeManagedContainers, removeManagedImages, removeManagedNetworks, removeManagedVolumes, sweepOrphans };
+export { removeDevstackContainers, removeDevstackContainersByKindAndName, removeDevstackImages, removeDevstackNetworksBestEffort, removeDevstackVolumes, removeManagedContainers, removeManagedImages, removeManagedNetworks, removeManagedVolumes };
 
 //# sourceMappingURL=sweep.mjs.map