@mysten-incubation/devstack 0.1.1 → 0.2.0

package/dist/plugins/postgres/service.mjs

@@ -1,179 +0,0 @@
-import { ensureManagedContainer } from "../../substrate/runtime/managed-container.mjs";
-import { credentialedUrl, plainUrl, withDatabase } from "./connection.mjs";
-import { postgresConfigError, postgresPluginError } from "./errors.mjs";
-import { PostgresSpans } from "./spans.mjs";
-import { awaitReady, ensureDatabases } from "./db-ensure.mjs";
-import { Effect } from "effect";
-import { createHash } from "node:crypto";
-import { fileURLToPath } from "node:url";
-//#region src/plugins/postgres/service.ts
-const DEFAULT_VERSION = "17-alpine";
-const DEFAULT_USER = "devstack";
-const DEFAULT_DATABASES = ["devstack"];
-const DEFAULT_READY_TIMEOUT_MS = 3e4;
-const DEFAULT_STOP_GRACE_SECONDS = 20;
-const POSTGRES_PORT = 5432;
-/** Deterministic dev password from `(app, stack, stackRoot)`. Tradeoff
-*  documented in the distilled doc § Postgres-specific concerns:
-*  fine for a single-user dev tool, foot-gun if `hostPort` is set in
-*  a multi-user environment. The user-supplied `password` override on
-*  `PostgresServiceOptions` is the escape hatch.
-*
-*  The short hash + separator disambiguate three collision classes:
-*  - (app, stack) pairs whose sanitized concatenation would collide
-*    (e.g. `("my-app", "dev")` vs `("my", "appdev")` both sanitize to
-*    the same body, but the hash binds the unambiguous boundary).
-*  - Two checkouts of the SAME `(app, stack)` on the same machine
-*    (different working directories) — folding `stackRoot` into the
-*    hash means each checkout's postgres password is distinct. (Note:
-*    the `pg_isready` liveness probe does NOT authenticate, so this
-*    does not gate the probe.) The benefit is that the per-checkout
-*    CREDENTIALED endpoint URL — and any `psql`/`createdb` that
-*    actually authenticates — differs per checkout, so one checkout's
-*    connection string cannot silently land on the other's container.
-*  - The `\x1f` (US, ASCII 31) separator between fields is unambiguous
-*    because identity strings and absolute paths cannot legally
-*    contain it. */
-const derivePassword = (app, stack, stackRoot) => {
-	return `pg-${(app + stack).replace(/[^a-zA-Z0-9]/g, "")}-${createHash("sha256").update(`${app}\x1f${stack}\x1f${stackRoot}`).digest("hex").slice(0, 8)}`;
-};
-const sanitizeAlias = (s) => s.replace(/[^a-zA-Z0-9-]/g, "-");
-/** Resolve user-supplied options against defaults + identity-derived
-*  values. Pure; safe to call before the Effect body runs. */
-const resolveOptions = (identity, stackRoot, opts) => {
-	const name = opts.name ?? "postgres";
-	const databases = opts.databases ?? DEFAULT_DATABASES;
-	if (!Array.isArray(databases) || databases.length === 0) throw postgresConfigError({
-		field: "databases",
-		message: "postgres(): `databases` must be non-empty"
-	});
-	return {
-		name,
-		version: opts.version ?? DEFAULT_VERSION,
-		user: opts.user ?? DEFAULT_USER,
-		password: opts.password ?? derivePassword(identity.app, identity.stack, stackRoot),
-		databases,
-		hostPort: opts.hostPort,
-		extraNetworks: opts.extraNetworks ?? [],
-		readyTimeoutMs: opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,
-		stopGraceSeconds: opts.stopGraceSeconds ?? DEFAULT_STOP_GRACE_SECONDS
-	};
-};
-/** Resolve the vendored Dockerfile context path for THIS package.
-*
-*  The build context is the directory containing the Dockerfile
-*  (`<package>/images/postgres/`). We resolve it relative to this
-*  source file via `import.meta.url`, which works in both source
-*  (tsx) and built (.js) form because the layout is preserved.
-*
-*  Distilled doc § Open questions: long-term, this should move to
-*  the substrate's L1 image-build helper so all plugins resolve
-*  their build contexts the same way. For now, the resolution is
-*  local to the plugin. */
-const resolveImageContextPath = () => {
-	const here = new URL(import.meta.url);
-	return fileURLToPath(new URL("../../../images/postgres/", here));
-};
-/** Build a `ContainerExec` view bound to a specific container handle.
-*  Thin adapter from the runtime's contract surface to the plugin's
-*  local exec seam. The runtime never promotes non-zero exit to
-*  failure here — the caller (pg_isready retry loop, createdb
-*  existence-check) decides.
-*
-*  Daemon-level failures (no such container, daemon unreachable)
-*  surface as a typed `PostgresPluginError({phase: 'container-start'})`
-*  rather than a fabricated `exitCode: 255` ExecResult. STYLE_GUIDE
-*  §16 — typed errors must carry the actual failure shape, not lie
-*  about it being a tx-level non-zero exit. The retry loops in
-*  `awaitReady` / `ensureDatabase` treat the typed failure as
-*  retryable via `waitForProbe`'s default retry behavior; the
-*  underlying cause is preserved on the timeout error's `lastError`
-*  field for the cause walker. */
-const containerExec = (runtime, handle) => ({ run: (argv) => runtime.exec(handle, argv).pipe(Effect.catch((err) => Effect.fail(postgresPluginError("container-start", `runtime.exec failed: ${err.reason} — ${err.detail}`, err)))) });
-/** Boot the postgres service. The barrel composes this with the
-*  capability decls. */
-const bootPostgresService = (runtime, identity, stackRoot, opts) => Effect.gen(function* () {
-	const resolved = yield* Effect.try({
-		try: () => resolveOptions(identity, stackRoot, opts),
-		catch: (cause) => cause
-	});
-	const networkAlias = sanitizeAlias(`${resolved.name}-${identity.stack}`);
-	const containerNetwork = sanitizeAlias(`devstack-${identity.app}-${identity.stack}-postgres`);
-	yield* runtime.ensureNetwork({
-		name: containerNetwork,
-		app: identity.app,
-		stack: identity.stack
-	}).pipe(Effect.catch((cause) => Effect.fail(postgresPluginError("network-create", `failed to ensure postgres network '${containerNetwork}'`, cause))));
-	const imageRef = yield* runtime.ensureImage({
-		contextPath: resolveImageContextPath(),
-		dockerfile: "Dockerfile",
-		buildArgs: { POSTGRES_VERSION: resolved.version },
-		owner: {
-			app: identity.app,
-			stack: identity.stack,
-			plugin: "postgres",
-			role: "db"
-		}
-	}).pipe(Effect.catch((cause) => Effect.fail(postgresPluginError("image-build", `failed to build postgres image (${resolved.version})`, cause))));
-	const containerHandle = yield* ensureManagedContainer({
-		runtime,
-		identity,
-		plugin: "postgres",
-		role: resolved.name,
-		spec: {
-			name: `${identity.app}-${identity.stack}-${resolved.name}`,
-			image: imageRef,
-			recreate: "on-config-change",
-			env: {
-				POSTGRES_USER: resolved.user,
-				POSTGRES_PASSWORD: resolved.password,
-				POSTGRES_DB: resolved.databases[0]
-			},
-			ports: resolved.hostPort !== void 0 ? [{
-				containerPort: POSTGRES_PORT,
-				hostPort: resolved.hostPort
-			}] : void 0,
-			stopGraceSeconds: resolved.stopGraceSeconds,
-			networkAttach: [{
-				name: containerNetwork,
-				aliases: [networkAlias]
-			}, ...resolved.extraNetworks]
-		},
-		mapError: (cause) => postgresPluginError("container-start", `failed to start postgres container '${resolved.name}'`, cause)
-	});
-	const exec = containerExec(runtime, containerHandle);
-	yield* awaitReady(exec, resolved.user, resolved.databases[0], resolved.readyTimeoutMs);
-	yield* ensureDatabases(exec, resolved.user, resolved.databases);
-	const dnsName = `${identity.app}-${identity.stack}-${resolved.name}`;
-	const endpoint = credentialedUrl({
-		user: resolved.user,
-		password: resolved.password,
-		host: dnsName,
-		port: POSTGRES_PORT
-	});
-	const plainEndpoint = plainUrl(dnsName, POSTGRES_PORT);
-	return {
-		resolved,
-		handle: {
-			name: resolved.name,
-			user: resolved.user,
-			password: resolved.password,
-			host: dnsName,
-			port: POSTGRES_PORT,
-			databases: resolved.databases,
-			endpoint,
-			plainEndpoint,
-			url: (db) => withDatabase(endpoint, db),
-			containerNetwork,
-			networkAlias
-		},
-		containerHandle
-	};
-}).pipe(Effect.withSpan("devstack.plugin.postgres.boot", { attributes: {
-	[PostgresSpans.name]: opts.name ?? "postgres",
-	[PostgresSpans.version]: opts.version ?? DEFAULT_VERSION
-} }));
-//#endregion
-export { bootPostgresService };
-
-//# sourceMappingURL=service.mjs.map

package/dist/plugins/postgres/service.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"service.mjs","names":[],"sources":["../../../src/plugins/postgres/service.ts"],"sourcesContent":["// Postgres plugin — service body (real boot).\n//\n// Lifecycle (distilled doc § Lifecycle states):\n//   1. Pre-start: identity (app + stack) resolved, deterministic\n//      strings (network name, alias, default password) computed.\n//   2. Per-stack docker network ensured (idempotent; survives the\n//      cycle that creates it).\n//   3. Vendored image ensured. The Dockerfile at\n//      `<package>/images/postgres/Dockerfile` does ONE thing:\n//      `ENV PGDATA=/var/lib/postgresql/data-devstack` so writes land in\n//      the container's writable layer rather than the upstream\n//      `VOLUME /var/lib/postgresql/data` path (which `docker commit`\n//      excludes). This is the single load-bearing invariant for\n//      snapshot integrity.\n//   4. Container started with `POSTGRES_USER` / `POSTGRES_PASSWORD` /\n//      `POSTGRES_DB` env. Joined to the per-stack network under a\n//      deterministic alias. Optional host-port publication.\n//   5. `pg_isready` retry loop runs against the bootstrap database\n//      via `runtime.exec`, bounded by `readyTimeoutMs`.\n//   6. Subsequent databases ensured idempotently via `psql -tAc`\n//      existence-check + `createdb`.\n//   7. Resolved `Postgres` handle returned. The substrate's outer\n//      machinery publishes the manifest projection (plain URL only).\n//\n// What this file does NOT do:\n//   - Pause/unpause around `docker commit` — engine-level (snapshot\n//     orchestrator walks `managedContainers` labels emitted by\n//     `snapshot.ts` and pauses them).\n//   - Manage schema migrations or run init SQL — schema is plugin-\n//     owned by consumers (distilled doc § Generic database-service\n//     requirements: \"no migrations, no init SQL, no schema\n//     management\").\n//   - Register the stop finalizer — `ContainerRuntime.ensureContainer`\n//     owns the container's scope finalizer. The 20s WAL-flush grace is\n//     threaded into the container spec so Docker does not escalate busy\n//     databases at the runtime default.\n\nimport { Duration, Effect, type Scope } from 'effect';\nimport { createHash } from 'node:crypto';\nimport { fileURLToPath } from 'node:url';\n\nimport type { ContainerHandle, ContainerRuntime } from '../../contracts/container-runtime.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport { ensureManagedContainer } from '../../substrate/runtime/managed-container.ts';\nimport {\n\tcredentialedUrl,\n\tplainUrl,\n\twithDatabase,\n\ttype PostgresConnectionParts,\n} from './connection.ts';\nimport { awaitReady, ensureDatabases, type ContainerExec } from './db-ensure.ts';\nimport {\n\tpostgresPluginError,\n\tpostgresConfigError,\n\ttype DatabaseCreateFailed,\n\ttype PostgresConfigError,\n\ttype PostgresConnectionTimeout,\n\ttype PostgresPluginError,\n} from './errors.ts';\nimport { PostgresSpans } from './spans.ts';\n\n/** Resolved Postgres handle — the tag's resolved value.\n *\n *  Distilled doc § Outputs: consumers read this to compose\n *  `DATABASE_URL` strings. `url(db)` is the per-database composer;\n *  `endpoint` is the cluster-level credentialed URL; `plainEndpoint`\n *  is the manifest-safe URL (no password). */\nexport interface Postgres {\n\treadonly name: string;\n\treadonly user: string;\n\t/** Credential. Held in-memory on the resolved value; manifest\n\t *  projection strips it. Logging convention: never `console.log`\n\t *  the entire handle — log `plainEndpoint` instead. */\n\treadonly password: string;\n\treadonly host: string;\n\treadonly port: number;\n\treadonly databases: ReadonlyArray<string>;\n\t/** Cluster-level credentialed URL. */\n\treadonly endpoint: string;\n\t/** Cluster-level no-credentials URL. Manifest-safe. */\n\treadonly plainEndpoint: string;\n\t/** Per-database credentialed URL composer. */\n\treadonly url: (db: string) => string;\n\t/** Per-stack docker network the container is joined to. */\n\treadonly containerNetwork: string;\n\t/** In-network DNS alias siblings dial. */\n\treadonly networkAlias: string;\n}\n\n/** Service options. Defaults track distilled-doc recommendations:\n *  postgres 17-alpine is the latest LTS-stable at the time of writing\n *  (one major up from the v3 service's 16-alpine pin). */\nexport interface PostgresServiceOptions {\n\treadonly name?: string;\n\treadonly version?: string;\n\treadonly user?: string;\n\treadonly password?: string;\n\treadonly databases?: ReadonlyArray<string>;\n\treadonly hostPort?: number;\n\treadonly extraNetworks?: ReadonlyArray<string>;\n\treadonly readyTimeoutMs?: number;\n\t/** WAL-flush budget on `docker stop`. Default 20s (matches the\n\t *  sui-indexer-db sidecar in v3). 10s (docker default) risks\n\t *  SIGKILL on busy DBs → recovery mode on next boot. */\n\treadonly stopGraceSeconds?: number;\n}\n\n/** Internal canonicalised options after defaults applied. */\nexport interface ResolvedPostgresOptions {\n\treadonly name: string;\n\treadonly version: string;\n\treadonly user: string;\n\treadonly password: string;\n\treadonly databases: ReadonlyArray<string>;\n\treadonly hostPort: number | undefined;\n\treadonly extraNetworks: ReadonlyArray<string>;\n\treadonly readyTimeoutMs: number;\n\treadonly stopGraceSeconds: number;\n}\n\nconst DEFAULT_VERSION = '17-alpine';\nconst DEFAULT_USER = 'devstack';\nconst DEFAULT_DATABASES = ['devstack'] as const;\nconst DEFAULT_READY_TIMEOUT_MS = 30_000;\nconst DEFAULT_STOP_GRACE_SECONDS = 20;\nconst POSTGRES_PORT = 5432;\n\n/** Deterministic dev password from `(app, stack, stackRoot)`. Tradeoff\n *  documented in the distilled doc § Postgres-specific concerns:\n *  fine for a single-user dev tool, foot-gun if `hostPort` is set in\n *  a multi-user environment. The user-supplied `password` override on\n *  `PostgresServiceOptions` is the escape hatch.\n *\n *  The short hash + separator disambiguate three collision classes:\n *  - (app, stack) pairs whose sanitized concatenation would collide\n *    (e.g. `(\"my-app\", \"dev\")` vs `(\"my\", \"appdev\")` both sanitize to\n *    the same body, but the hash binds the unambiguous boundary).\n *  - Two checkouts of the SAME `(app, stack)` on the same machine\n *    (different working directories) — folding `stackRoot` into the\n *    hash means each checkout's postgres password is distinct. (Note:\n *    the `pg_isready` liveness probe does NOT authenticate, so this\n *    does not gate the probe.) The benefit is that the per-checkout\n *    CREDENTIALED endpoint URL — and any `psql`/`createdb` that\n *    actually authenticates — differs per checkout, so one checkout's\n *    connection string cannot silently land on the other's container.\n *  - The `\\x1f` (US, ASCII 31) separator between fields is unambiguous\n *    because identity strings and absolute paths cannot legally\n *    contain it. */\nexport const derivePassword = (app: string, stack: string, stackRoot: string): string => {\n\tconst body = (app + stack).replace(/[^a-zA-Z0-9]/g, '');\n\tconst fingerprint = createHash('sha256')\n\t\t.update(`${app}\\x1f${stack}\\x1f${stackRoot}`)\n\t\t.digest('hex')\n\t\t.slice(0, 8);\n\treturn `pg-${body}-${fingerprint}`;\n};\n\nconst sanitizeAlias = (s: string): string => s.replace(/[^a-zA-Z0-9-]/g, '-');\n\n/** Resolve user-supplied options against defaults + identity-derived\n *  values. Pure; safe to call before the Effect body runs. */\nexport const resolveOptions = (\n\tidentity: Identity,\n\tstackRoot: string,\n\topts: PostgresServiceOptions,\n): ResolvedPostgresOptions => {\n\tconst name = opts.name ?? 'postgres';\n\tconst databases = opts.databases ?? DEFAULT_DATABASES;\n\tif (!Array.isArray(databases) || databases.length === 0) {\n\t\tthrow postgresConfigError({\n\t\t\tfield: 'databases',\n\t\t\tmessage: 'postgres(): `databases` must be non-empty',\n\t\t});\n\t}\n\treturn {\n\t\tname,\n\t\tversion: opts.version ?? DEFAULT_VERSION,\n\t\tuser: opts.user ?? DEFAULT_USER,\n\t\tpassword: opts.password ?? derivePassword(identity.app, identity.stack, stackRoot),\n\t\tdatabases,\n\t\thostPort: opts.hostPort,\n\t\textraNetworks: opts.extraNetworks ?? [],\n\t\treadyTimeoutMs: opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,\n\t\tstopGraceSeconds: opts.stopGraceSeconds ?? DEFAULT_STOP_GRACE_SECONDS,\n\t};\n};\n\n/** Bundled boot result for the barrel. The dynamic-capability factory\n *  projects resolved options + identity-derived strings onto the\n *  snapshot + codegen decls. */\nexport interface PostgresBootResult {\n\treadonly resolved: ResolvedPostgresOptions;\n\treadonly handle: Postgres;\n\treadonly containerHandle: ContainerHandle;\n}\n\n/** Resolve the vendored Dockerfile context path for THIS package.\n *\n *  The build context is the directory containing the Dockerfile\n *  (`<package>/images/postgres/`). We resolve it relative to this\n *  source file via `import.meta.url`, which works in both source\n *  (tsx) and built (.js) form because the layout is preserved.\n *\n *  Distilled doc § Open questions: long-term, this should move to\n *  the substrate's L1 image-build helper so all plugins resolve\n *  their build contexts the same way. For now, the resolution is\n *  local to the plugin. */\nconst resolveImageContextPath = (): string => {\n\t// `import.meta.url` is the URL of this module file. From\n\t// `<pkg>/src/plugins/postgres/service.ts` we walk up three\n\t// directories (`plugins/`, `src/`, `<pkg>/`) and then down into\n\t// `images/postgres/`.\n\tconst here = new URL(import.meta.url);\n\tconst ctxUrl = new URL('../../../images/postgres/', here);\n\t// `fileURLToPath` handles the platform-specific decode (the\n\t// `file:///C:/...` → `C:\\...` round-trip on Windows, plus\n\t// percent-decoding everywhere). `decodeURIComponent(pathname)`\n\t// would leave the leading `/` on Windows paths.\n\treturn fileURLToPath(ctxUrl);\n};\n\n/** Build a `ContainerExec` view bound to a specific container handle.\n *  Thin adapter from the runtime's contract surface to the plugin's\n *  local exec seam. The runtime never promotes non-zero exit to\n *  failure here — the caller (pg_isready retry loop, createdb\n *  existence-check) decides.\n *\n *  Daemon-level failures (no such container, daemon unreachable)\n *  surface as a typed `PostgresPluginError({phase: 'container-start'})`\n *  rather than a fabricated `exitCode: 255` ExecResult. STYLE_GUIDE\n *  §16 — typed errors must carry the actual failure shape, not lie\n *  about it being a tx-level non-zero exit. The retry loops in\n *  `awaitReady` / `ensureDatabase` treat the typed failure as\n *  retryable via `waitForProbe`'s default retry behavior; the\n *  underlying cause is preserved on the timeout error's `lastError`\n *  field for the cause walker. */\nconst containerExec = (runtime: ContainerRuntime, handle: ContainerHandle): ContainerExec => ({\n\trun: (argv) =>\n\t\truntime.exec(handle, argv).pipe(\n\t\t\tEffect.catch((err) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tpostgresPluginError(\n\t\t\t\t\t\t'container-start',\n\t\t\t\t\t\t`runtime.exec failed: ${err.reason} — ${err.detail}`,\n\t\t\t\t\t\terr,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t),\n\t\t),\n});\n\n/** Boot the postgres service. The barrel composes this with the\n *  capability decls. */\nexport const bootPostgresService = (\n\truntime: ContainerRuntime,\n\tidentity: Identity,\n\tstackRoot: string,\n\topts: PostgresServiceOptions,\n): Effect.Effect<\n\tPostgresBootResult,\n\tPostgresPluginError | PostgresConfigError | PostgresConnectionTimeout | DatabaseCreateFailed,\n\tScope.Scope\n> =>\n\tEffect.gen(function* () {\n\t\tconst resolved = yield* Effect.try({\n\t\t\ttry: () => resolveOptions(identity, stackRoot, opts),\n\t\t\tcatch: (cause) => cause as PostgresConfigError,\n\t\t});\n\n\t\t// Identity-derived strings. The naming pattern must match what\n\t\t// snapshot label-discovery uses — both call sites converge on\n\t\t// `(app, stack, plugin='postgres', role=<name>)`.\n\t\tconst networkAlias = sanitizeAlias(`${resolved.name}-${identity.stack}`);\n\t\tconst containerNetwork = sanitizeAlias(`devstack-${identity.app}-${identity.stack}-postgres`);\n\n\t\t// 1. Ensure the per-stack docker network. Idempotent — no-op\n\t\t//    if the network already exists (warm resume).\n\t\tyield* runtime\n\t\t\t.ensureNetwork({\n\t\t\t\tname: containerNetwork,\n\t\t\t\tapp: identity.app,\n\t\t\t\tstack: identity.stack,\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\tpostgresPluginError(\n\t\t\t\t\t\t\t'network-create',\n\t\t\t\t\t\t\t`failed to ensure postgres network '${containerNetwork}'`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\n\t\t// 2. Ensure the vendored image. The Dockerfile sets PGDATA off\n\t\t//    the upstream VOLUME path so the writable layer captures\n\t\t//    PGDATA — the single load-bearing snapshot invariant\n\t\t//    (distilled doc § Postgres-specific concerns).\n\t\tconst imageRef = yield* runtime\n\t\t\t.ensureImage({\n\t\t\t\tcontextPath: resolveImageContextPath(),\n\t\t\t\tdockerfile: 'Dockerfile',\n\t\t\t\tbuildArgs: { POSTGRES_VERSION: resolved.version },\n\t\t\t\towner: { app: identity.app, stack: identity.stack, plugin: 'postgres', role: 'db' },\n\t\t\t})\n\t\t\t.pipe(\n\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\tEffect.fail(\n\t\t\t\t\t\tpostgresPluginError(\n\t\t\t\t\t\t\t'image-build',\n\t\t\t\t\t\t\t`failed to build postgres image (${resolved.version})`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\n\t\t// 3. Start container. `networkAttach`'s first entry becomes the\n\t\t//    `--network` flag on `docker run -d`; subsequent entries\n\t\t//    are attached post-start with IP-readback (runtime owns\n\t\t//    that detail). The first attach carries the per-network\n\t\t//    DNS alias (`networkAlias`) — Docker registers it as a\n\t\t//    secondary DNS name on the per-stack network so siblings\n\t\t//    can dial by the parallel-stack-stable alias rather than\n\t\t//    the per-stack container name.\n\t\tconst containerHandle = yield* ensureManagedContainer({\n\t\t\truntime,\n\t\t\tidentity,\n\t\t\tplugin: 'postgres',\n\t\t\trole: resolved.name,\n\t\t\tspec: {\n\t\t\t\tname: `${identity.app}-${identity.stack}-${resolved.name}`,\n\t\t\t\timage: imageRef,\n\t\t\t\trecreate: 'on-config-change',\n\t\t\t\tenv: {\n\t\t\t\t\tPOSTGRES_USER: resolved.user,\n\t\t\t\t\tPOSTGRES_PASSWORD: resolved.password,\n\t\t\t\t\tPOSTGRES_DB: resolved.databases[0]!,\n\t\t\t\t},\n\t\t\t\tports:\n\t\t\t\t\tresolved.hostPort !== undefined\n\t\t\t\t\t\t? [{ containerPort: POSTGRES_PORT, hostPort: resolved.hostPort }]\n\t\t\t\t\t\t: undefined,\n\t\t\t\tstopGraceSeconds: resolved.stopGraceSeconds,\n\t\t\t\tnetworkAttach: [\n\t\t\t\t\t{ name: containerNetwork, aliases: [networkAlias] },\n\t\t\t\t\t...resolved.extraNetworks,\n\t\t\t\t],\n\t\t\t},\n\t\t\tmapError: (cause) =>\n\t\t\t\tpostgresPluginError(\n\t\t\t\t\t'container-start',\n\t\t\t\t\t`failed to start postgres container '${resolved.name}'`,\n\t\t\t\t\tcause,\n\t\t\t\t),\n\t\t});\n\n\t\t// 4. Probe readiness via `pg_isready` against the bootstrap\n\t\t//    database. Server-aware probe — distilled doc § Postgres-\n\t\t//    specific concerns: TCP-listener readiness alone is\n\t\t//    insufficient (postgres opens the port before accepting\n\t\t//    queries).\n\t\tconst exec = containerExec(runtime, containerHandle);\n\t\tyield* awaitReady(exec, resolved.user, resolved.databases[0]!, resolved.readyTimeoutMs);\n\n\t\t// 5. Ensure subsequent databases idempotently. The bootstrap\n\t\t//    database (index 0) is image-entrypoint-created via\n\t\t//    POSTGRES_DB and skipped by `ensureDatabases`.\n\t\tyield* ensureDatabases(exec, resolved.user, resolved.databases);\n\n\t\t// 6. Resolve the handle. Host for in-stack siblings is the\n\t\t//    container DNS name (always resolves on the attached\n\t\t//    network). The per-stack `networkAlias` is registered via\n\t\t//    `--network-alias` on the primary attach (see step 3) and\n\t\t//    is the parallel-stack-portable DNS name; codegen consumes\n\t\t//    it through `index.ts`.\n\t\tconst dnsName = `${identity.app}-${identity.stack}-${resolved.name}`;\n\t\tconst parts: PostgresConnectionParts = {\n\t\t\tuser: resolved.user,\n\t\t\tpassword: resolved.password,\n\t\t\thost: dnsName,\n\t\t\tport: POSTGRES_PORT,\n\t\t};\n\t\tconst endpoint = credentialedUrl(parts);\n\t\tconst plainEndpoint = plainUrl(dnsName, POSTGRES_PORT);\n\n\t\tconst handle: Postgres = {\n\t\t\tname: resolved.name,\n\t\t\tuser: resolved.user,\n\t\t\tpassword: resolved.password,\n\t\t\thost: dnsName,\n\t\t\tport: POSTGRES_PORT,\n\t\t\tdatabases: resolved.databases,\n\t\t\tendpoint,\n\t\t\tplainEndpoint,\n\t\t\turl: (db) => withDatabase(endpoint, db),\n\t\t\tcontainerNetwork,\n\t\t\tnetworkAlias,\n\t\t};\n\n\t\treturn { resolved, handle, containerHandle };\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.postgres.boot', {\n\t\t\tattributes: {\n\t\t\t\t[PostgresSpans.name]: opts.name ?? 'postgres',\n\t\t\t\t[PostgresSpans.version]: opts.version ?? DEFAULT_VERSION,\n\t\t\t},\n\t\t}),\n\t);\n\n/** Stop-grace duration. The substrate's finalizer plumbing reads this\n *  to set the docker-stop SIGTERM→SIGKILL window. 20s default avoids\n *  busy-DB SIGKILL → recovery-mode on next boot. */\nexport const stopGrace = (resolved: ResolvedPostgresOptions): Duration.Duration =>\n\tDuration.seconds(resolved.stopGraceSeconds);\n"],"mappings":";;;;;;;;;AAwHA,MAAM,kBAAkB;AACxB,MAAM,eAAe;AACrB,MAAM,oBAAoB,CAAC,WAAW;AACtC,MAAM,2BAA2B;AACjC,MAAM,6BAA6B;AACnC,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;AAuBtB,MAAa,kBAAkB,KAAa,OAAe,cAA8B;AAMxF,QAAO,OALO,MAAM,OAAO,QAAQ,iBAAiB,GAKnC,CAAC,GAJE,WAAW,SAAS,CACtC,OAAO,GAAG,IAAI,MAAM,MAAM,MAAM,YAAY,CAC5C,OAAO,MAAM,CACb,MAAM,GAAG,EACqB;;AAGjC,MAAM,iBAAiB,MAAsB,EAAE,QAAQ,kBAAkB,IAAI;;;AAI7E,MAAa,kBACZ,UACA,WACA,SAC6B;CAC7B,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,YAAY,KAAK,aAAa;AACpC,KAAI,CAAC,MAAM,QAAQ,UAAU,IAAI,UAAU,WAAW,EACrD,OAAM,oBAAoB;EACzB,OAAO;EACP,SAAS;EACT,CAAC;AAEH,QAAO;EACN;EACA,SAAS,KAAK,WAAW;EACzB,MAAM,KAAK,QAAQ;EACnB,UAAU,KAAK,YAAY,eAAe,SAAS,KAAK,SAAS,OAAO,UAAU;EAClF;EACA,UAAU,KAAK;EACf,eAAe,KAAK,iBAAiB,EAAE;EACvC,gBAAgB,KAAK,kBAAkB;EACvC,kBAAkB,KAAK,oBAAoB;EAC3C;;;;;;;;;;;;;AAuBF,MAAM,gCAAwC;CAK7C,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,IAAI;AAMrC,QAAO,cAAc,IALF,IAAI,6BAA6B,KAKzB,CAAC;;;;;;;;;;;;;;;;;AAkB7B,MAAM,iBAAiB,SAA2B,YAA4C,EAC7F,MAAM,SACL,QAAQ,KAAK,QAAQ,KAAK,CAAC,KAC1B,OAAO,OAAO,QACb,OAAO,KACN,oBACC,mBACA,wBAAwB,IAAI,OAAO,KAAK,IAAI,UAC5C,IACA,CACD,CACD,CACD,EACF;;;AAID,MAAa,uBACZ,SACA,UACA,WACA,SAMA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,OAAO,OAAO,IAAI;EAClC,WAAW,eAAe,UAAU,WAAW,KAAK;EACpD,QAAQ,UAAU;EAClB,CAAC;CAKF,MAAM,eAAe,cAAc,GAAG,SAAS,KAAK,GAAG,SAAS,QAAQ;CACxE,MAAM,mBAAmB,cAAc,YAAY,SAAS,IAAI,GAAG,SAAS,MAAM,WAAW;AAI7F,QAAO,QACL,cAAc;EACd,MAAM;EACN,KAAK,SAAS;EACd,OAAO,SAAS;EAChB,CAAC,CACD,KACA,OAAO,OAAO,UACb,OAAO,KACN,oBACC,kBACA,sCAAsC,iBAAiB,IACvD,MACA,CACD,CACD,CACD;CAMF,MAAM,WAAW,OAAO,QACtB,YAAY;EACZ,aAAa,yBAAyB;EACtC,YAAY;EACZ,WAAW,EAAE,kBAAkB,SAAS,SAAS;EACjD,OAAO;GAAE,KAAK,SAAS;GAAK,OAAO,SAAS;GAAO,QAAQ;GAAY,MAAM;GAAM;EACnF,CAAC,CACD,KACA,OAAO,OAAO,UACb,OAAO,KACN,oBACC,eACA,mCAAmC,SAAS,QAAQ,IACpD,MACA,CACD,CACD,CACD;CAUF,MAAM,kBAAkB,OAAO,uBAAuB;EACrD;EACA;EACA,QAAQ;EACR,MAAM,SAAS;EACf,MAAM;GACL,MAAM,GAAG,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,SAAS;GACpD,OAAO;GACP,UAAU;GACV,KAAK;IACJ,eAAe,SAAS;IACxB,mBAAmB,SAAS;IAC5B,aAAa,SAAS,UAAU;IAChC;GACD,OACC,SAAS,aAAa,KAAA,IACnB,CAAC;IAAE,eAAe;IAAe,UAAU,SAAS;IAAU,CAAC,GAC/D,KAAA;GACJ,kBAAkB,SAAS;GAC3B,eAAe,CACd;IAAE,MAAM;IAAkB,SAAS,CAAC,aAAa;IAAE,EACnD,GAAG,SAAS,cACZ;GACD;EACD,WAAW,UACV,oBACC,mBACA,uCAAuC,SAAS,KAAK,IACrD,MACA;EACF,CAAC;CAOF,MAAM,OAAO,cAAc,SAAS,gBAAgB;AACpD,QAAO,WAAW,MAAM,SAAS,MAAM,SAAS,UAAU,IAAK,SAAS,eAAe;AAKvF,QAAO,gBAAgB,MAAM,SAAS,MAAM,SAAS,UAAU;CAQ/D,MAAM,UAAU,GAAG,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,SAAS;CAO9D,MAAM,WAAW,gBAAgB;EALhC,MAAM,SAAS;EACf,UAAU,SAAS;EACnB,MAAM;EACN,MAAM;EAE+B,CAAC;CACvC,MAAM,gBAAgB,SAAS,SAAS,cAAc;AAgBtD,QAAO;EAAE;EAAU,QAAA;GAblB,MAAM,SAAS;GACf,MAAM,SAAS;GACf,UAAU,SAAS;GACnB,MAAM;GACN,MAAM;GACN,WAAW,SAAS;GACpB;GACA;GACA,MAAM,OAAO,aAAa,UAAU,GAAG;GACvC;GACA;GAGwB;EAAE;EAAiB;EAC3C,CAAC,KACF,OAAO,SAAS,iCAAiC,EAChD,YAAY;EACV,cAAc,OAAO,KAAK,QAAQ;EAClC,cAAc,UAAU,KAAK,WAAW;CACzC,EACD,CAAC,CACF"}

package/dist/plugins/postgres/snapshot.mjs

@@ -1,32 +0,0 @@
-import { Effect } from "effect";
-//#region src/plugins/postgres/snapshot.ts
-/** Build the Snapshotable contribution.
-*
-*  Container-bearing only; no host-side subtree. Postgres's entire
-*  state lives in the container's writable layer at the relocated
-*  `PGDATA` (see `service.ts` for the image build context). */
-const makeSnapshotable = (opts) => {
-	const labels = {
-		app: opts.app,
-		stack: opts.stack,
-		plugin: "postgres",
-		role: opts.name
-	};
-	const identity = {
-		kind: "postgres-server",
-		name: opts.name,
-		databases: Object.freeze([...opts.databases].sort())
-	};
-	return {
-		kind: "snapshotable",
-		subtrees: [],
-		managedContainers: [labels],
-		missingTolerance: "fine",
-		preRestore: Effect.succeed(identity),
-		postRestore: Effect.void
-	};
-};
-//#endregion
-export { makeSnapshotable };
-
-//# sourceMappingURL=snapshot.mjs.map

package/dist/plugins/postgres/snapshot.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"snapshot.mjs","names":[],"sources":["../../../src/plugins/postgres/snapshot.ts"],"sourcesContent":["// Postgres plugin — Snapshotable contribution.\n//\n// Architecture §3: the snapshot orchestrator captures and restores\n// without naming the plugin. Postgres's contribution is the\n// container's writable layer — image-commit captures PGDATA only\n// because the vendored image relocates `PGDATA` OFF the upstream\n// `VOLUME /var/lib/postgresql/data` (which docker commit excludes).\n//\n// Identity contribution (distilled doc § Postgres-specific concerns +\n// architecture identity-guard pattern): the postgres \"server\n// identifier\" doubles as a guard. On restore we compare the\n// snapshot's stored postgres identity (server name + the set of\n// requested databases) against the resolver's current answer; if\n// the user pointed at a different cluster shape mid-cycle, the\n// identity-guard refuses BEFORE any destructive mutation.\n//\n// Stop-grace (distilled doc § Postgres-specific concerns): the service\n// threads a 20s Docker stop grace into the container spec, matching the\n// sui-indexer-db sidecar for the same image. This file's `quiesce`\n// Effect is intentionally `Effect.void` (the substrate engine pauses the\n// container around `docker commit`); the plugin only contributes the\n// LABEL TUPLE that lets the engine find it.\n\nimport { Effect } from 'effect';\n\nimport type { ContainerLabelTuple, SnapshotableDecl } from '../../contracts/snapshotable.ts';\n\n/** Identity payload contributed to the substrate's identity-guard.\n *  The substrate's pre-restore hook reads this; identity mismatch\n *  refuses the restore. Server name + ordered database list is the\n *  smallest tuple that distinguishes a postgres instance for snapshot\n *  purposes — image tag / version is intentionally NOT part of\n *  identity (a minor-version bump should restore cleanly). */\nexport type PostgresIdentityPayload = {\n\treadonly kind: 'postgres-server';\n\treadonly name: string;\n\treadonly databases: ReadonlyArray<string>;\n};\n\nexport interface MakeSnapshotableOptions {\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly name: string;\n\treadonly databases: ReadonlyArray<string>;\n}\n\n/** Build the Snapshotable contribution.\n *\n *  Container-bearing only; no host-side subtree. Postgres's entire\n *  state lives in the container's writable layer at the relocated\n *  `PGDATA` (see `service.ts` for the image build context). */\nexport const makeSnapshotable = (opts: MakeSnapshotableOptions): SnapshotableDecl => {\n\tconst labels: ContainerLabelTuple = {\n\t\tapp: opts.app,\n\t\tstack: opts.stack,\n\t\tplugin: 'postgres',\n\t\trole: opts.name,\n\t};\n\n\tconst identity: PostgresIdentityPayload = {\n\t\tkind: 'postgres-server',\n\t\tname: opts.name,\n\t\t// Frozen list so the identity payload is structurally stable\n\t\t// across calls — the substrate hashes it for comparison.\n\t\tdatabases: Object.freeze([...opts.databases].sort()) as ReadonlyArray<string>,\n\t};\n\n\treturn {\n\t\tkind: 'snapshotable',\n\t\t// No host-tree subtree — all state lives in the container.\n\t\tsubtrees: [],\n\t\tmanagedContainers: [labels],\n\t\t// Engine-level pause-around-commit handles quiescence; the\n\t\t// plugin's contribution is just the label tuple above.\n\t\tmissingTolerance: 'fine',\n\t\tpreRestore: Effect.succeed(identity),\n\t\tpostRestore: Effect.void,\n\t};\n};\n"],"mappings":";;;;;;;AAmDA,MAAa,oBAAoB,SAAoD;CACpF,MAAM,SAA8B;EACnC,KAAK,KAAK;EACV,OAAO,KAAK;EACZ,QAAQ;EACR,MAAM,KAAK;EACX;CAED,MAAM,WAAoC;EACzC,MAAM;EACN,MAAM,KAAK;EAGX,WAAW,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,MAAM,CAAC;EACpD;AAED,QAAO;EACN,MAAM;EAEN,UAAU,EAAE;EACZ,mBAAmB,CAAC,OAAO;EAG3B,kBAAkB;EAClB,YAAY,OAAO,QAAQ,SAAS;EACpC,aAAa,OAAO;EACpB"}

package/dist/plugins/postgres/spans.mjs

@@ -1,11 +0,0 @@
-//#region src/plugins/postgres/spans.ts
-const PostgresSpans = {
-	database: "postgres.database",
-	name: "postgres.name",
-	timeoutMs: "postgres.timeoutMs",
-	version: "postgres.version"
-};
-//#endregion
-export { PostgresSpans };
-
-//# sourceMappingURL=spans.mjs.map

package/dist/plugins/postgres/spans.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"spans.mjs","names":[],"sources":["../../../src/plugins/postgres/spans.ts"],"sourcesContent":["// Postgres plugin span-attribute vocabulary. Plugin-local — substrate's\n// `SpanAttr` carries only engine-dimensional + http/process generic\n// keys; plugin-domain keys live next to the plugin that owns them.\n//\n// Callsite pattern: `Effect.annotateCurrentSpan({ [PostgresSpans.database]:\n// value })`. Free-form string literals are a STYLE_GUIDE §16 violation.\n\nexport const PostgresSpans = {\n\tdatabase: 'postgres.database',\n\tname: 'postgres.name',\n\ttimeoutMs: 'postgres.timeoutMs',\n\tversion: 'postgres.version',\n} as const;\n"],"mappings":";AAOA,MAAa,gBAAgB;CAC5B,UAAU;CACV,MAAM;CACN,WAAW;CACX,SAAS;CACT"}

package/dist/plugins/seal/spans.mjs

@@ -1,18 +0,0 @@
-//#region src/plugins/seal/spans.ts
-const SealSpans = {
-	chain: "seal.chain",
-	containerName: "seal.containerName",
-	name: "seal.name",
-	ref: "seal.ref",
-	repo: "seal.repo",
-	routedUrl: "seal.routedUrl",
-	servicePath: "seal.servicePath",
-	signer: "seal.signer",
-	subdir: "seal.subdir",
-	url: "seal.url",
-	version: "seal.version"
-};
-//#endregion
-export { SealSpans };
-
-//# sourceMappingURL=spans.mjs.map

package/dist/plugins/seal/spans.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"spans.mjs","names":[],"sources":["../../../src/plugins/seal/spans.ts"],"sourcesContent":["// Seal plugin span-attribute vocabulary. Plugin-local — substrate's\n// `SpanAttr` carries only engine-dimensional + http/process generic\n// keys; plugin-domain keys live next to the plugin that owns them.\n//\n// Callsite pattern: `Effect.annotateCurrentSpan({ [SealSpans.name]:\n// value })`. Free-form string literals are a STYLE_GUIDE §16 violation.\n\nexport const SealSpans = {\n\tchain: 'seal.chain',\n\tcontainerName: 'seal.containerName',\n\tname: 'seal.name',\n\tref: 'seal.ref',\n\trepo: 'seal.repo',\n\troutedUrl: 'seal.routedUrl',\n\tservicePath: 'seal.servicePath',\n\tsigner: 'seal.signer',\n\tsubdir: 'seal.subdir',\n\turl: 'seal.url',\n\tversion: 'seal.version',\n} as const;\n"],"mappings":";AAOA,MAAa,YAAY;CACxB,OAAO;CACP,eAAe;CACf,MAAM;CACN,KAAK;CACL,MAAM;CACN,WAAW;CACX,aAAa;CACb,QAAQ;CACR,QAAQ;CACR,KAAK;CACL,SAAS;CACT"}

package/dist/plugins/sui/spans.mjs

@@ -1,17 +0,0 @@
-//#region src/plugins/sui/spans.ts
-const SuiSpans = {
-	autoTickIntervalMs: "sui.autoTick.intervalMs",
-	chain: "sui.chain",
-	container: "sui.container",
-	localFaucetLeaseKey: "faucet.lease.key",
-	localFaucetLeaseOwner: "faucet.lease.owner",
-	forkFaucetWhale: "sui.fork.faucet.whale",
-	liveFaucetUrl: "sui.live.faucetUrl",
-	liveNetwork: "sui.live.network",
-	liveRpcUrl: "sui.live.rpcUrl",
-	mode: "sui.mode"
-};
-//#endregion
-export { SuiSpans };
-
-//# sourceMappingURL=spans.mjs.map

package/dist/plugins/sui/spans.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"spans.mjs","names":[],"sources":["../../../src/plugins/sui/spans.ts"],"sourcesContent":["// Sui plugin span-attribute vocabulary. Plugin-local — substrate's\n// `SpanAttr` carries only engine-dimensional + http/process generic\n// keys; plugin-domain keys live next to the plugin that owns them.\n//\n// Callsite pattern: `Effect.annotateCurrentSpan({ [SuiSpans.mode]:\n// value })`. Free-form string literals are a STYLE_GUIDE §16 violation.\n\nexport const SuiSpans = {\n\tautoTickIntervalMs: 'sui.autoTick.intervalMs',\n\tchain: 'sui.chain',\n\tcontainer: 'sui.container',\n\t// Local-faucet lease-broker serialization keys. Owned here because\n\t// the sui plugin owns the local-faucet container + its lease shape;\n\t// the faucet plugin only sees the strategy dispatch.\n\tlocalFaucetLeaseKey: 'faucet.lease.key',\n\tlocalFaucetLeaseOwner: 'faucet.lease.owner',\n\t// Fork-faucet impersonation source (the \"whale\" address).\n\tforkFaucetWhale: 'sui.fork.faucet.whale',\n\tliveFaucetUrl: 'sui.live.faucetUrl',\n\tliveNetwork: 'sui.live.network',\n\tliveRpcUrl: 'sui.live.rpcUrl',\n\tmode: 'sui.mode',\n} as const;\n"],"mappings":";AAOA,MAAa,WAAW;CACvB,oBAAoB;CACpB,OAAO;CACP,WAAW;CAIX,qBAAqB;CACrB,uBAAuB;CAEvB,iBAAiB;CACjB,eAAe;CACf,aAAa;CACb,YAAY;CACZ,MAAM;CACN"}

package/dist/plugins/wallet/spans.mjs

@@ -1,22 +0,0 @@
-//#region src/plugins/wallet/spans.ts
-const WalletSpans = {
-	accountCount: "wallet.accountCount",
-	app: "wallet.app",
-	bearerValid: "wallet.auth.bearerValid",
-	chain: "wallet.chain",
-	codegenPairUrl: "wallet.codegen.pairUrl",
-	codegenWalletUrl: "wallet.codegen.walletUrl",
-	localPort: "wallet.localPort",
-	origin: "wallet.origin",
-	requestId: "wallet.request.id",
-	requestMethod: "wallet.request.method",
-	requestUrl: "wallet.request.url",
-	stack: "wallet.stack",
-	token: "wallet.token",
-	tokenFile: "wallet.tokenFile",
-	url: "wallet.url"
-};
-//#endregion
-export { WalletSpans };
-
-//# sourceMappingURL=spans.mjs.map

package/dist/plugins/wallet/spans.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"spans.mjs","names":[],"sources":["../../../src/plugins/wallet/spans.ts"],"sourcesContent":["// Wallet plugin span-attribute vocabulary. Plugin-local — substrate's\n// `SpanAttr` carries only engine-dimensional + http/process generic\n// keys; plugin-domain keys live next to the plugin that owns them.\n//\n// Callsite pattern: `Effect.annotateCurrentSpan({ [WalletSpans.token]:\n// value })`. Free-form string literals are a STYLE_GUIDE §16 violation.\n\nexport const WalletSpans = {\n\taccountCount: 'wallet.accountCount',\n\tapp: 'wallet.app',\n\tbearerValid: 'wallet.auth.bearerValid',\n\tchain: 'wallet.chain',\n\tcodegenPairUrl: 'wallet.codegen.pairUrl',\n\tcodegenWalletUrl: 'wallet.codegen.walletUrl',\n\tlocalPort: 'wallet.localPort',\n\torigin: 'wallet.origin',\n\trequestId: 'wallet.request.id',\n\trequestMethod: 'wallet.request.method',\n\trequestUrl: 'wallet.request.url',\n\tstack: 'wallet.stack',\n\ttoken: 'wallet.token',\n\ttokenFile: 'wallet.tokenFile',\n\turl: 'wallet.url',\n} as const;\n"],"mappings":";AAOA,MAAa,cAAc;CAC1B,cAAc;CACd,KAAK;CACL,aAAa;CACb,OAAO;CACP,gBAAgB;CAChB,kBAAkB;CAClB,WAAW;CACX,QAAQ;CACR,WAAW;CACX,eAAe;CACf,YAAY;CACZ,OAAO;CACP,OAAO;CACP,WAAW;CACX,KAAK;CACL"}

package/dist/plugins/walrus/registry-publish.d.mts

@@ -1,24 +0,0 @@
-//#region src/plugins/walrus/registry-publish.d.ts
-/** Local-cluster's state registry entry. The `name` field is the
- *  factory's `name` option (default: `'walrus'`); two walrus
- *  instances in one stack publish under disjoint names. */
-interface WalrusLocalStateEntry {
-  readonly name: string;
-  readonly systemObjectId: string;
-  readonly stakingObjectId: string;
-  readonly walrusPackageId: string;
-  readonly exchangeObjectId?: string;
-}
-/** Known-deployment's state registry entry. The `name` is always
- *  `'walrusKnownDeployment'` (distilled-doc invariant: this factory
- *  does not vary by user-supplied name). */
-interface WalrusKnownStateEntry {
-  readonly name: 'walrusKnownDeployment';
-  readonly systemObjectId: string;
-  readonly stakingObjectId: string;
-  readonly chain: string;
-}
-type WalrusStateEntry = WalrusLocalStateEntry | WalrusKnownStateEntry;
-//#endregion
-export { WalrusKnownStateEntry, WalrusLocalStateEntry, WalrusStateEntry };
-//# sourceMappingURL=registry-publish.d.mts.map

package/dist/plugins/walrus/spans.mjs

@@ -1,18 +0,0 @@
-//#region src/plugins/walrus/spans.ts
-const WalrusSpans = {
-	chain: "walrus.chain",
-	committeeSize: "walrus.committeeSize",
-	fundAccount: "walrus.fund.account",
-	fundAddress: "walrus.fund.address",
-	fundExchange: "walrus.fund.exchange",
-	name: "walrus.name",
-	node: "walrus.node",
-	nodeCount: "walrus.nodeCount",
-	ref: "walrus.ref",
-	shards: "walrus.shards",
-	suiVersion: "walrus.suiVersion"
-};
-//#endregion
-export { WalrusSpans };
-
-//# sourceMappingURL=spans.mjs.map

package/dist/plugins/walrus/spans.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"spans.mjs","names":[],"sources":["../../../src/plugins/walrus/spans.ts"],"sourcesContent":["// Walrus plugin span-attribute vocabulary. Plugin-local — substrate's\n// `SpanAttr` carries only engine-dimensional + http/process generic\n// keys; plugin-domain keys live next to the plugin that owns them.\n//\n// Callsite pattern: `Effect.annotateCurrentSpan({ [WalrusSpans.name]:\n// value })`. Free-form string literals are a STYLE_GUIDE §16 violation.\n\nexport const WalrusSpans = {\n\tchain: 'walrus.chain',\n\tcommitteeSize: 'walrus.committeeSize',\n\tfundAccount: 'walrus.fund.account',\n\tfundAddress: 'walrus.fund.address',\n\tfundExchange: 'walrus.fund.exchange',\n\tname: 'walrus.name',\n\tnode: 'walrus.node',\n\tnodeCount: 'walrus.nodeCount',\n\tref: 'walrus.ref',\n\tshards: 'walrus.shards',\n\tsuiVersion: 'walrus.suiVersion',\n} as const;\n"],"mappings":";AAOA,MAAa,cAAc;CAC1B,OAAO;CACP,eAAe;CACf,aAAa;CACb,aAAa;CACb,cAAc;CACd,MAAM;CACN,MAAM;CACN,WAAW;CACX,KAAK;CACL,QAAQ;CACR,YAAY;CACZ"}

package/dist/runtime/docker/logs.d.mts

@@ -1 +0,0 @@
-import { Stream } from "effect";

package/dist/runtime/docker/logs.mjs

@@ -1,34 +0,0 @@
-import { splitUtf8Lines } from "../../substrate/runtime/observability/process-lines.mjs";
-import { DockerHost, DockerSpawner, dockerCommand } from "./client.mjs";
-import { DaemonUnreachable } from "./errors.mjs";
-import { Effect, Stream } from "effect";
-//#region src/runtime/docker/logs.ts
-/** `docker logs --follow --timestamps <id>` projected to a per-line
-*  Stream. Combined stdout+stderr (docker writes both to the same
-*  follow stream).
-*
-*  IMPORTANT: the stream completes when the container exits (docker
-*  closes the pipe). Consumers that want to re-follow after a restart
-*  must re-call this. */
-const followLogs = (containerNameOrId, opts = {}) => {
-	const args = ["--follow", "--timestamps"];
-	if (opts.since !== void 0) args.push("--since", opts.since);
-	if (opts.tail !== void 0) args.push("--tail", String(opts.tail));
-	args.push(containerNameOrId);
-	const mapSpawnError = (cause) => new DaemonUnreachable({
-		op: "docker.logs",
-		detail: "logs follow stream failed",
-		cause
-	});
-	return Stream.unwrap(Effect.gen(function* () {
-		const host = yield* DockerHost;
-		const spawner = yield* DockerSpawner;
-		const cmd = dockerCommand(host, "logs", args);
-		const handle = yield* spawner.spawn(cmd).pipe(Effect.mapError(mapSpawnError));
-		return splitUtf8Lines(Stream.merge(handle.stdout, handle.stderr)).pipe(Stream.mapError(mapSpawnError));
-	}));
-};
-//#endregion
-export { followLogs };
-
-//# sourceMappingURL=logs.mjs.map

package/dist/runtime/docker/logs.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"logs.mjs","names":[],"sources":["../../../src/runtime/docker/logs.ts"],"sourcesContent":["// `docker logs --follow` as an Effect Stream.\n//\n// Architecture invariant: per-line `Stream<string, …>` so consumers\n// can filter / promote levels / dedupe followers across hot-restart\n// cycles via the L1 per-line sink.\n//\n// We DON'T solve the process-global follower-dedupe problem here; the\n// supervisor's per-container-key registry is where dedupe lives.\n// This stream is the raw substrate.\n\nimport { Effect, Stream } from 'effect';\n\nimport { splitUtf8Lines } from '../../substrate/runtime/observability/process-lines.ts';\nimport { DockerHost, DockerSpawner } from './client.ts';\nimport { DaemonUnreachable, type DockerRuntimeError } from './errors.ts';\nimport { dockerCommand } from './client.ts';\n\nexport interface FollowLogsOptions {\n\treadonly since?: string;\n\treadonly tail?: number;\n}\n\n/** `docker logs --follow --timestamps <id>` projected to a per-line\n *  Stream. Combined stdout+stderr (docker writes both to the same\n *  follow stream).\n *\n *  IMPORTANT: the stream completes when the container exits (docker\n *  closes the pipe). Consumers that want to re-follow after a restart\n *  must re-call this. */\nexport const followLogs = (\n\tcontainerNameOrId: string,\n\topts: FollowLogsOptions = {},\n): Stream.Stream<string, DockerRuntimeError, DockerHost | DockerSpawner> => {\n\tconst args: Array<string> = ['--follow', '--timestamps'];\n\tif (opts.since !== undefined) args.push('--since', opts.since);\n\tif (opts.tail !== undefined) args.push('--tail', String(opts.tail));\n\targs.push(containerNameOrId);\n\tconst mapSpawnError = (cause: unknown): DockerRuntimeError =>\n\t\tnew DaemonUnreachable({ op: 'docker.logs', detail: 'logs follow stream failed', cause });\n\treturn Stream.unwrap(\n\t\tEffect.gen(function* () {\n\t\t\tconst host = yield* DockerHost;\n\t\t\tconst spawner = yield* DockerSpawner;\n\t\t\tconst cmd = dockerCommand(host, 'logs', args);\n\t\t\tconst handle = yield* spawner.spawn(cmd).pipe(Effect.mapError(mapSpawnError));\n\t\t\t// Merge stdout + stderr so caller sees the unified follow stream;\n\t\t\t// docker prefixes each line with its source via --timestamps.\n\t\t\tconst lineStream = splitUtf8Lines(Stream.merge(handle.stdout, handle.stderr)).pipe(\n\t\t\t\tStream.mapError(mapSpawnError),\n\t\t\t);\n\t\t\treturn lineStream;\n\t\t}),\n\t);\n};\n\n"],"mappings":";;;;;;;;;;;;AA6BA,MAAa,cACZ,mBACA,OAA0B,EAAE,KAC+C;CAC3E,MAAM,OAAsB,CAAC,YAAY,eAAe;AACxD,KAAI,KAAK,UAAU,KAAA,EAAW,MAAK,KAAK,WAAW,KAAK,MAAM;AAC9D,KAAI,KAAK,SAAS,KAAA,EAAW,MAAK,KAAK,UAAU,OAAO,KAAK,KAAK,CAAC;AACnE,MAAK,KAAK,kBAAkB;CAC5B,MAAM,iBAAiB,UACtB,IAAI,kBAAkB;EAAE,IAAI;EAAe,QAAQ;EAA6B;EAAO,CAAC;AACzF,QAAO,OAAO,OACb,OAAO,IAAI,aAAa;EACvB,MAAM,OAAO,OAAO;EACpB,MAAM,UAAU,OAAO;EACvB,MAAM,MAAM,cAAc,MAAM,QAAQ,KAAK;EAC7C,MAAM,SAAS,OAAO,QAAQ,MAAM,IAAI,CAAC,KAAK,OAAO,SAAS,cAAc,CAAC;AAM7E,SAHmB,eAAe,OAAO,MAAM,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC,KAC7E,OAAO,SAAS,cAAc,CAEd;GAChB,CACF"}

package/dist/substrate/runtime/artifact-publisher/index.mjs

@@ -1,86 +0,0 @@
-import { SpanAttr } from "../observability/spans.mjs";
-import { parseJsonTextSync } from "../runtime-decode.mjs";
-import { CacheService } from "../cache/service.mjs";
-import "../cache/index.mjs";
-import { setCurrentPluginPhase } from "../current-plugin.mjs";
-import { Context, Effect, Layer } from "effect";
-//#region src/substrate/runtime/artifact-publisher/index.ts
-/**
-* Substrate-level service projecting the
-* `ArtifactPublisher` primitive. Plugins yield this tag in
-* their acquire body; the supervisor's `pluginContext` carries it.
-*
-* The service is constructed once per stack (Layer-driven) and
-* closes over the per-stack Cache + StrategyRegistry. Parallel
-* stacks isolate by construction — each stack's Layer build is
-* independent.
-*/
-var ArtifactPublisherService = class extends Context.Service()("@devstack/substrate/ArtifactPublisher") {};
-const encode = (value) => new TextEncoder().encode(JSON.stringify(value));
-const decode = (bytes) => {
-	try {
-		return parseJsonTextSync(new TextDecoder().decode(bytes), {
-			source: "artifact-publisher cache payload",
-			mkError: (issue) => issue
-		});
-	} catch {
-		return null;
-	}
-};
-const makePublisher = (cache) => ({ publish: (spec) => Effect.gen(function* () {
-	yield* Effect.annotateCurrentSpan({
-		[SpanAttr.artifactPublisherNamespace]: spec.namespace,
-		[SpanAttr.artifactPublisherChain]: spec.chain,
-		[SpanAttr.artifactPublisherContentHash]: spec.contentHash
-	});
-	const hit = yield* cache.lookup({
-		namespace: spec.namespace,
-		chain: spec.chain,
-		contentHash: spec.contentHash
-	}).pipe(Effect.catch(() => Effect.succeed(null)));
-	if (hit !== null) {
-		const cached = decode(hit.bytes);
-		if (cached !== null) {
-			if ((yield* spec.verify(cached)) !== null) {
-				yield* spec.register(cached);
-				yield* Effect.annotateCurrentSpan({ [SpanAttr.artifactPublisherPath]: "hit" });
-				yield* Effect.logDebug(`artifact-publisher: reusing cached '${spec.namespace}' on chain ${spec.chain} (cache hit; no re-deploy).`);
-				return cached;
-			}
-		}
-	}
-	if (hit === null) {
-		yield* Effect.annotateCurrentSpan({ [SpanAttr.artifactPublisherPath]: "miss" });
-		yield* Effect.logInfo(`artifact-publisher: producing '${spec.namespace}' on chain ${spec.chain} — no cached artifact for this chain + content hash (first deploy on this chain, fresh genesis after a restart, or changed inputs).`);
-	} else {
-		yield* Effect.annotateCurrentSpan({ [SpanAttr.artifactPublisherPath]: "verify-failed" });
-		yield* Effect.logWarning(`artifact-publisher: re-deploying '${spec.namespace}' on chain ${spec.chain} — a cached artifact existed but failed on-chain verification (object missing, or RPC unavailable during restart); a new id will replace the prior deployment.`);
-		yield* setCurrentPluginPhase(`re-deploying ${spec.namespace} (cached artifact failed verification on restart)`);
-	}
-	const produced = yield* spec.produce;
-	yield* cache.write({
-		namespace: spec.namespace,
-		chain: spec.chain,
-		contentHash: spec.contentHash
-	}, encode(produced)).pipe(Effect.catch(() => Effect.void));
-	yield* spec.register(produced);
-	return produced;
-}).pipe(Effect.withSpan("substrate.artifactPublisher.publish")) });
-/**
-* Layer that materializes the publisher from the substrate's
-* Cache service. Plugins yield `ArtifactPublisherService`;
-* the supervisor provides it via `pluginContext`.
-*
-* The publisher is service-name-blind: it reaches `CacheService`
-* via the Context, NOT through a hard-coded import edge with any
-* plugin. Chain-probe lookup is the caller's concern — the spec's
-* `verify` Effect closes over the probe.
-*/
-const layerArtifactPublisher = Layer.effect(ArtifactPublisherService, Effect.gen(function* () {
-	const cache = yield* CacheService;
-	return ArtifactPublisherService.of(makePublisher(cache));
-}));
-//#endregion
-export { ArtifactPublisherService, layerArtifactPublisher };
-
-//# sourceMappingURL=index.mjs.map

package/dist/substrate/runtime/artifact-publisher/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/substrate/runtime/artifact-publisher/index.ts"],"sourcesContent":["// ArtifactPublisher — substrate-level service.\n//\n// Architecture §10: substrate primitive that orchestrates the\n// `cache → verify → produce → register` cycle every on-chain\n// produce/verify plugin (package, coin, walrus deploy, seal deploy,\n// deepbook deploy, etc.) flows through.\n//\n// Plugins call `publisher.publish(spec)` with their per-cycle\n// `ArtifactSpec<Produced, Verified>` (namespace, chain,\n// contentHash, verify, produce, register). The\n// substrate handles:\n//\n//   1. `cache.lookup({namespace, chain, contentHash})`. Hit AND\n//      `spec.verify` returns a non-null value → `register`(decoded\n//      cached payload) and return.\n//   2. Miss OR verify-returned-null → run `spec.produce` under the\n//      caller's Scope; on success, write the produced payload to\n//      the cache (best-effort, errors logged but not propagated);\n//      then `register(produced)`.\n//\n// The substrate carries the cache + chain-probe seams via Layers\n// (CacheService, StrategyRegistryService). Plugins yield this\n// service from their acquire body; the supervisor injects it via\n// pluginContext.\n//\n// Cache payload codec: we serialize `Produced` as JSON. The artifact publisher\n// spec doesn't bake a codec in (`Produced` is generic); JSON\n// round-trip matches existing plugin call sites\n// (`CachedPackageEntry`, `CachedMint`, etc. are JSON-shaped).\n\nimport { Context, Effect, Layer, Scope } from 'effect';\n\nimport type {\n\tArtifactPublishError,\n\tArtifactPublisher,\n\tArtifactSpec,\n} from '../../../primitives/artifact-publisher.ts';\nimport { CacheService } from '../cache/index.ts';\nimport { setCurrentPluginPhase } from '../current-plugin.ts';\nimport { SpanAttr } from '../observability/spans.ts';\nimport { parseJsonTextSync } from '../runtime-decode.ts';\n\n// ---------------------------------------------------------------------------\n// Service tag\n// ---------------------------------------------------------------------------\n\n/**\n * Substrate-level service projecting the\n * `ArtifactPublisher` primitive. Plugins yield this tag in\n * their acquire body; the supervisor's `pluginContext` carries it.\n *\n * The service is constructed once per stack (Layer-driven) and\n * closes over the per-stack Cache + StrategyRegistry. Parallel\n * stacks isolate by construction — each stack's Layer build is\n * independent.\n */\nexport class ArtifactPublisherService extends Context.Service<\n\tArtifactPublisherService,\n\tArtifactPublisher\n>()('@devstack/substrate/ArtifactPublisher') {}\n\n// ---------------------------------------------------------------------------\n// Encode / decode the cached payload\n// ---------------------------------------------------------------------------\n\nconst encode = (value: unknown): Uint8Array => new TextEncoder().encode(JSON.stringify(value));\n\nconst decode = <Produced>(bytes: Uint8Array): Produced | null => {\n\ttry {\n\t\treturn parseJsonTextSync(new TextDecoder().decode(bytes), {\n\t\t\tsource: 'artifact-publisher cache payload',\n\t\t\tmkError: (issue) => issue,\n\t\t}) as Produced;\n\t} catch {\n\t\treturn null;\n\t}\n};\n\n// ---------------------------------------------------------------------------\n// Publish: cache → verify → produce → register\n// ---------------------------------------------------------------------------\n\nconst makePublisher = (cache: typeof CacheService.Service): ArtifactPublisher => ({\n\tpublish: <Produced, Verified>(\n\t\tspec: ArtifactSpec<Produced, Verified>,\n\t): Effect.Effect<Produced, ArtifactPublishError, Scope.Scope> =>\n\t\tEffect.gen(function* () {\n\t\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t\t[SpanAttr.artifactPublisherNamespace]: spec.namespace,\n\t\t\t\t[SpanAttr.artifactPublisherChain]: spec.chain,\n\t\t\t\t[SpanAttr.artifactPublisherContentHash]: spec.contentHash,\n\t\t\t});\n\n\t\t\t// 1. Cache lookup. Best-effort: a CacheError on lookup\n\t\t\t//    surfaces as `cache-corrupt`; the substrate's contract\n\t\t\t//    is \"re-produce is always safe\", so we coerce read\n\t\t\t//    failures to a miss rather than abort the cycle.\n\t\t\tconst hit = yield* cache\n\t\t\t\t.lookup({\n\t\t\t\t\tnamespace: spec.namespace,\n\t\t\t\t\tchain: spec.chain,\n\t\t\t\t\tcontentHash: spec.contentHash,\n\t\t\t\t})\n\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(null)));\n\n\t\t\tif (hit !== null) {\n\t\t\t\t// Decode the cached `Produced` BEFORE verify so the\n\t\t\t\t// plugin's verify Effect can key its on-chain probe\n\t\t\t\t// off a field of the cached payload (e.g. action's\n\t\t\t\t// `digest`, package's `packageId`). A decode failure\n\t\t\t\t// here is \"cache corruption\" — drop through to\n\t\t\t\t// re-produce so the cycle is still safe.\n\t\t\t\tconst cached = decode<Produced>(hit.bytes);\n\t\t\t\tif (cached !== null) {\n\t\t\t\t\t// 2. Verify (lenient — returns null on transient\n\t\t\t\t\t//    failure or not-found). Architecture §10:\n\t\t\t\t\t//    verify-on-hit covers chain-state drift.\n\t\t\t\t\tconst verified = yield* spec.verify(cached);\n\t\t\t\t\tif (verified !== null) {\n\t\t\t\t\t\t// The substrate always returns the decoded\n\t\t\t\t\t\t// `Produced` payload — the `Verified` shape is a\n\t\t\t\t\t\t// probe-only signal that never escapes. Callers\n\t\t\t\t\t\t// therefore type-narrow trivially against `Produced`.\n\t\t\t\t\t\tyield* spec.register(cached);\n\t\t\t\t\t\tyield* Effect.annotateCurrentSpan({ [SpanAttr.artifactPublisherPath]: 'hit' });\n\t\t\t\t\t\t// Reuse is the quiet, expected warm-restart path — debug\n\t\t\t\t\t\t// only. The interesting (and noisy) case is a *re-run*,\n\t\t\t\t\t\t// logged below.\n\t\t\t\t\t\tyield* Effect.logDebug(\n\t\t\t\t\t\t\t`artifact-publisher: reusing cached '${spec.namespace}' on chain ${spec.chain} ` +\n\t\t\t\t\t\t\t\t`(cache hit; no re-deploy).`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn cached;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// 3. Miss or verify-failed → produce. State WHEN and WHY loudly:\n\t\t\t//    on a restart this is the line that explains why an on-chain\n\t\t\t//    id is about to change. A fresh chain genesis misses every\n\t\t\t//    cache key (keyed by chain id), so packages / key servers /\n\t\t\t//    walrus all get brand-new ids, and content bound to the old\n\t\t\t//    ids (e.g. Seal-encrypted blobs) can no longer be resolved.\n\t\t\tif (hit === null) {\n\t\t\t\tyield* Effect.annotateCurrentSpan({ [SpanAttr.artifactPublisherPath]: 'miss' });\n\t\t\t\tyield* Effect.logInfo(\n\t\t\t\t\t`artifact-publisher: producing '${spec.namespace}' on chain ${spec.chain} — ` +\n\t\t\t\t\t\t`no cached artifact for this chain + content hash ` +\n\t\t\t\t\t\t`(first deploy on this chain, fresh genesis after a restart, or changed inputs).`,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t\t\t[SpanAttr.artifactPublisherPath]: 'verify-failed',\n\t\t\t\t});\n\t\t\t\tyield* Effect.logWarning(\n\t\t\t\t\t`artifact-publisher: re-deploying '${spec.namespace}' on chain ${spec.chain} — ` +\n\t\t\t\t\t\t`a cached artifact existed but failed on-chain verification ` +\n\t\t\t\t\t\t`(object missing, or RPC unavailable during restart); a new id will replace ` +\n\t\t\t\t\t\t`the prior deployment.`,\n\t\t\t\t);\n\t\t\t\t// Effect logs are dropped under the `up` TUI (Logger.layer([])).\n\t\t\t\t// The verify-failed re-deploy is the anomalous restart case — a\n\t\t\t\t// cached id existed but is no longer resolvable — so narrate it\n\t\t\t\t// on the supervised plugin's row, the channel the TUI renders.\n\t\t\t\t// (A plain cache miss stays quiet here: on a cold boot every\n\t\t\t\t// artifact misses, and the plugin narrates its own publish.)\n\t\t\t\tyield* setCurrentPluginPhase(\n\t\t\t\t\t`re-deploying ${spec.namespace} (cached artifact failed verification on restart)`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst produced = yield* spec.produce;\n\n\t\t\t// 4. Cache write — best-effort. Architecture: a write\n\t\t\t//    failure must NOT roll back the on-chain effect.\n\t\t\tyield* cache\n\t\t\t\t.write(\n\t\t\t\t\t{\n\t\t\t\t\t\tnamespace: spec.namespace,\n\t\t\t\t\t\tchain: spec.chain,\n\t\t\t\t\t\tcontentHash: spec.contentHash,\n\t\t\t\t\t},\n\t\t\t\t\tencode(produced),\n\t\t\t\t)\n\t\t\t\t.pipe(Effect.catch(() => Effect.void));\n\n\t\t\t// 5. Register — fires on EVERY cycle (architecture §10).\n\t\t\tyield* spec.register(produced);\n\t\t\treturn produced;\n\t\t}).pipe(Effect.withSpan('substrate.artifactPublisher.publish')),\n});\n\n// ---------------------------------------------------------------------------\n// Layer\n// ---------------------------------------------------------------------------\n\n/**\n * Layer that materializes the publisher from the substrate's\n * Cache service. Plugins yield `ArtifactPublisherService`;\n * the supervisor provides it via `pluginContext`.\n *\n * The publisher is service-name-blind: it reaches `CacheService`\n * via the Context, NOT through a hard-coded import edge with any\n * plugin. Chain-probe lookup is the caller's concern — the spec's\n * `verify` Effect closes over the probe.\n */\nexport const layerArtifactPublisher: Layer.Layer<ArtifactPublisherService, never, CacheService> =\n\tLayer.effect(\n\t\tArtifactPublisherService,\n\t\tEffect.gen(function* () {\n\t\t\tconst cache = yield* CacheService;\n\t\t\treturn ArtifactPublisherService.of(makePublisher(cache));\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;;;;;;;AAwDA,IAAa,2BAAb,cAA8C,QAAQ,SAGnD,CAAC,wCAAwC,CAAC;AAM7C,MAAM,UAAU,UAA+B,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,MAAM,CAAC;AAE9F,MAAM,UAAoB,UAAuC;AAChE,KAAI;AACH,SAAO,kBAAkB,IAAI,aAAa,CAAC,OAAO,MAAM,EAAE;GACzD,QAAQ;GACR,UAAU,UAAU;GACpB,CAAC;SACK;AACP,SAAO;;;AAQT,MAAM,iBAAiB,WAA2D,EACjF,UACC,SAEA,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,oBAAoB;GAChC,SAAS,6BAA6B,KAAK;GAC3C,SAAS,yBAAyB,KAAK;GACvC,SAAS,+BAA+B,KAAK;EAC9C,CAAC;CAMF,MAAM,MAAM,OAAO,MACjB,OAAO;EACP,WAAW,KAAK;EAChB,OAAO,KAAK;EACZ,aAAa,KAAK;EAClB,CAAC,CACD,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC;AAEhD,KAAI,QAAQ,MAAM;EAOjB,MAAM,SAAS,OAAiB,IAAI,MAAM;AAC1C,MAAI,WAAW;QAKV,OADoB,KAAK,OAAO,OAAO,MAC1B,MAAM;AAKtB,WAAO,KAAK,SAAS,OAAO;AAC5B,WAAO,OAAO,oBAAoB,GAAG,SAAS,wBAAwB,OAAO,CAAC;AAI9E,WAAO,OAAO,SACb,uCAAuC,KAAK,UAAU,aAAa,KAAK,MAAM,6BAE9E;AACD,WAAO;;;;AAWV,KAAI,QAAQ,MAAM;AACjB,SAAO,OAAO,oBAAoB,GAAG,SAAS,wBAAwB,QAAQ,CAAC;AAC/E,SAAO,OAAO,QACb,kCAAkC,KAAK,UAAU,aAAa,KAAK,MAAM,qIAGzE;QACK;AACN,SAAO,OAAO,oBAAoB,GAChC,SAAS,wBAAwB,iBAClC,CAAC;AACF,SAAO,OAAO,WACb,qCAAqC,KAAK,UAAU,aAAa,KAAK,MAAM,gKAI5E;AAOD,SAAO,sBACN,gBAAgB,KAAK,UAAU,mDAC/B;;CAEF,MAAM,WAAW,OAAO,KAAK;AAI7B,QAAO,MACL,MACA;EACC,WAAW,KAAK;EAChB,OAAO,KAAK;EACZ,aAAa,KAAK;EAClB,EACD,OAAO,SAAS,CAChB,CACA,KAAK,OAAO,YAAY,OAAO,KAAK,CAAC;AAGvC,QAAO,KAAK,SAAS,SAAS;AAC9B,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,sCAAsC,CAAC,EAChE;;;;;;;;;;;AAgBD,MAAa,yBACZ,MAAM,OACL,0BACA,OAAO,IAAI,aAAa;CACvB,MAAM,QAAQ,OAAO;AACrB,QAAO,yBAAyB,GAAG,cAAc,MAAM,CAAC;EACvD,CACF"}

package/dist/substrate/runtime/capability-sinks/index.d.mts

@@ -1 +0,0 @@
-import { AnyContribution, CapabilitySink, CapabilitySinksService, CapabilitySinksShape, ContributionKind, ContributionSinkFailed, HarvestContext, UnknownContributionKind } from "./service.mjs";

package/dist/substrate/runtime/capability-sinks/index.mjs

@@ -1,3 +0,0 @@
-import "./service.mjs";
-import "./layer.mjs";
-export {};

package/dist/substrate/runtime/capability-sinks/layer.d.mts

@@ -1 +0,0 @@
-import { Context, Layer } from "effect";

package/dist/substrate/runtime/capability-sinks/layer.mjs

@@ -1,31 +0,0 @@
-import { CapabilitySinksService, layerCapabilitySinks } from "./service.mjs";
-import { FormatterRegistryService, layerFormatterRegistry } from "../observability/formatter-registry.mjs";
-import { Effect, Layer } from "effect";
-//#region src/substrate/runtime/capability-sinks/layer.ts
-const errorContributionSink = (formatters) => ({
-	kind: "error-contribution",
-	accept: (contribution, _ctx) => formatters.register(contribution)
-});
-/**
-* Build the substrate's default CapabilitySinks layer. It supplies the
-* error-contribution sink and registers the caller's capability sinks
-* by kind. Unknown contribution kinds remain no-ops at the supervisor
-* call site unless a sink is registered.
-*
-* Plugin-author extension: provide an additional Layer that yields
-* `CapabilitySinksService` and calls `registerSink({ kind: 'my-kind', ... })`
-* before the supervisor starts harvesting. Last-write-wins on duplicate
-* kinds, with scope-bound restore — the built-in sink comes back when
-* the override's scope closes.
-*/
-const layerCapabilitySinksDefault = (orchestrator = []) => {
-	return Layer.effectDiscard(Effect.gen(function* () {
-		const sinks = yield* CapabilitySinksService;
-		const defaults = [errorContributionSink(yield* FormatterRegistryService), ...orchestrator];
-		for (const sink of defaults) yield* sinks.registerSink(sink);
-	})).pipe(Layer.provideMerge(layerCapabilitySinks), Layer.provideMerge(layerFormatterRegistry));
-};
-//#endregion
-export { layerCapabilitySinksDefault };
-
-//# sourceMappingURL=layer.mjs.map