npm - @mysten-incubation/devstack - Versions diffs - 0.4.0 → 0.6.0 - Mend

@mysten-incubation/devstack 0.4.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (61) hide show

package/README.md +9 -10
package/dashboard-ui/assets/{grpc-CpkDu4SA.js → grpc-s7Ztk9wv.js} +1 -1
package/dashboard-ui/assets/{index-jLPRmjst.js → index-DrOd0m4F.js} +2 -2
package/dashboard-ui/index.html +1 -1
package/dist/contracts/routable.d.mts +1 -1
package/dist/index.d.mts +3 -3
package/dist/orchestrators/boot.mjs +2 -1
package/dist/orchestrators/boot.mjs.map +1 -1
package/dist/orchestrators/router/file-provider.mjs +11 -8
package/dist/orchestrators/router/file-provider.mjs.map +1 -1
package/dist/orchestrators/router/service.mjs +2 -2
package/dist/orchestrators/router/service.mjs.map +1 -1
package/dist/plugins/deepbook/index.d.mts +36 -6
package/dist/plugins/deepbook/index.mjs +52 -16
package/dist/plugins/deepbook/index.mjs.map +1 -1
package/dist/plugins/seal/codegen.d.mts +5 -0
package/dist/plugins/seal/codegen.mjs +53 -10
package/dist/plugins/seal/codegen.mjs.map +1 -1
package/dist/plugins/seal/index.d.mts +64 -19
package/dist/plugins/seal/index.mjs +26 -36
package/dist/plugins/seal/index.mjs.map +1 -1
package/dist/plugins/seal/mode/fork-known.d.mts +0 -2
package/dist/plugins/seal/mode/fork-known.mjs +11 -22
package/dist/plugins/seal/mode/fork-known.mjs.map +1 -1
package/dist/plugins/seal/mode/live.d.mts +36 -13
package/dist/plugins/seal/mode/live.mjs +104 -43
package/dist/plugins/seal/mode/live.mjs.map +1 -1
package/dist/plugins/seal/mode/local-keygen.mjs +2 -1
package/dist/plugins/seal/mode/local-keygen.mjs.map +1 -1
package/dist/plugins/seal/registry-publish.d.mts +15 -3
package/dist/plugins/seal/registry-publish.mjs.map +1 -1
package/dist/plugins/sui/index.d.mts +10 -10
package/dist/plugins/walrus/client-services.d.mts +1 -0
package/dist/plugins/walrus/client-services.mjs +115 -0
package/dist/plugins/walrus/client-services.mjs.map +1 -0
package/dist/plugins/walrus/deploy.mjs +11 -5
package/dist/plugins/walrus/deploy.mjs.map +1 -1
package/dist/plugins/walrus/errors.d.mts +1 -1
package/dist/plugins/walrus/errors.mjs.map +1 -1
package/dist/plugins/walrus/index.d.mts +138 -9
package/dist/plugins/walrus/index.mjs +72 -20
package/dist/plugins/walrus/index.mjs.map +1 -1
package/dist/plugins/walrus/mode/known-deploy.d.mts +5 -1
package/dist/plugins/walrus/mode/known-deploy.mjs +14 -11
package/dist/plugins/walrus/mode/known-deploy.mjs.map +1 -1
package/dist/plugins/walrus/mode/local-cluster.d.mts +14 -1
package/dist/plugins/walrus/mode/local-cluster.mjs +54 -12
package/dist/plugins/walrus/mode/local-cluster.mjs.map +1 -1
package/dist/plugins/walrus/routable.mjs +12 -15
package/dist/plugins/walrus/routable.mjs.map +1 -1
package/dist/plugins/walrus/snapshot.mjs +3 -2
package/dist/plugins/walrus/snapshot.mjs.map +1 -1
package/dist/plugins/walrus/storage-nodes.mjs +31 -33
package/dist/plugins/walrus/storage-nodes.mjs.map +1 -1
package/dist/substrate/runtime/config-validation.mjs +1 -1
package/images/walrus/Dockerfile +17 -4
package/images/walrus/deploy-walrus.sh +7 -4
package/images/walrus/run-walrus-client-service.sh +103 -0
package/package.json +2 -2
package/dist/plugins/seal/service.mjs +0 -17
package/dist/plugins/seal/service.mjs.map +0 -1

package/dashboard-ui/index.html CHANGED Viewed

@@ -4,7 +4,7 @@
 		<meta charset="UTF-8" />
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<title>devstack dashboard</title>
-		<script type="module" crossorigin src="/assets/index-jLPRmjst.js"></script>
+		<script type="module" crossorigin src="/assets/index-DrOd0m4F.js"></script>
 		<link rel="stylesheet" crossorigin href="/assets/index-B82Bh84P.css">
 	</head>
 	<body>

package/dist/contracts/routable.d.mts CHANGED Viewed

@@ -40,7 +40,7 @@ interface RoutableBase {
 }
 /** HTTP variant — Host-header dispatched, CORS-aware. */
 interface RoutableHttpDecl extends RoutableBase {
-  readonly wireProtocol: 'http' | 'h2c';
+  readonly wireProtocol: 'http' | 'h2c' | 'https';
   readonly cors: boolean;
 }
 /** TCP variant — entrypoint-port dispatched, no Host header, no CORS.

package/dist/index.d.mts CHANGED Viewed

@@ -70,16 +70,16 @@ import { ActionBuildContext } from "./plugins/action/build-context.mjs";
 import { ActionOptions, ActionUpstreamRef, action } from "./plugins/action/index.mjs";
 import { WalrusConfigError, WalrusError, WalrusPhase, WalrusPluginError } from "./plugins/walrus/errors.mjs";
 import { WalrusStorageNode } from "./plugins/walrus/storage-nodes.mjs";
-import { WalrusLocalClusterOptions } from "./plugins/walrus/mode/local-cluster.mjs";
+import { WalrusLocalClusterOptions, WalrusLocalPublisherOptions, WalrusLocalServiceOptions } from "./plugins/walrus/mode/local-cluster.mjs";
 import { WalrusKnownDeploymentOptions, WalrusKnownNetwork } from "./plugins/walrus/mode/known-deploy.mjs";
 import { WalrusBindings, WalrusNodeBinding } from "./plugins/walrus/codegen.mjs";
 import { WalCoinValue, WalrusResolved, walCoin, walrus, walrusFor } from "./plugins/walrus/index.mjs";
-import { SealKeyServer, SealKeyServerEntry, SealKnownResolved, SealLocalKeygenResolved, SealResolved } from "./plugins/seal/registry-publish.mjs";
 import { SealAnyError, SealConfigError, SealError } from "./plugins/seal/errors.mjs";
+import { SealKeyServer, SealKeyServerEntry, SealKnownResolved, SealLocalKeygenResolved, SealResolved } from "./plugins/seal/registry-publish.mjs";
 import { SealBindings } from "./plugins/seal/codegen.mjs";
 import { SealCommonOptions, SealForkKnownOptions, SealLiveOptions, SealLocalKeygenOptions, SealOptions, seal, sealFor } from "./plugins/seal/index.mjs";
 import { DeepbookConfigError, DeepbookError, DeepbookPhase, DeepbookPluginError } from "./plugins/deepbook/errors.mjs";
 import { AccountMemberAlias, CoinMemberAlias, DEEP_PRICE_FEED_ID, DeepbookPackageMember, DeepbookPool, DeepbookPoolCoin, DeepbookPoolSeedLiquidity, DeepbookPoolSeedOrder, DeepbookPoolSpec, SUI_PRICE_FEED_ID, USDC_PRICE_FEED_ID, pythPriceFeedId } from "./plugins/deepbook/types.mjs";
 import { DeepbookBindings } from "./plugins/deepbook/codegen.mjs";
 import { DeepbookCommonOptions, DeepbookKnownNetwork, DeepbookKnownOptions, DeepbookOptions, DeepbookOverrideOptions, DeepbookResolved, deepbookCore, deepbookFor } from "./plugins/deepbook/index.mjs";
-export { type AccountAcquireError, type AccountAcquirePhase, type AccountBindings, type AccountError, type AccountFunding, type AccountFundingCoinValue, type AccountFundingEntry, type AccountFundingRequest, type AccountFundingResult, type AccountFundingStrategy, type AccountMemberAlias, type AccountOptions, type AccountSignError, type AccountSignPhase, type AccountValue, type AccountVariantKind, type ActionBuildContext, type ActionError, type ActionOptions, type ActionPhase, type ActionReceipt, type ActionUpstreamRef, type AnyPlugin, type AnyResourceRef, type AppName, BUILTIN_COINS, type BootError, type Brand, type BuildCtx, type BuiltinCoinName, type ChainProbe, type ChainProbeError, type ChainProbeMode, type CodegenEmitContext, type CodegenEmitDone, type CodegenableDecl, type CoinAddressForm, type CoinBindings, type CoinError, type CoinMember, type CoinMemberAlias, type CoinPhase, type CoinValue, config_validation_d_exports as ConfigValidation, type ContainerHandle, type ContainerLabelTuple, type ContainerRuntime, type ContainerRuntimeError, ContainerRuntimeService, type ContentHash, type CrossCuttingFundingEntry, type CrossCuttingFundingProvider, DEEP_PRICE_FEED_ID, DEFAULT_DEVSTACK_NETWORK, DEFAULT_EPHEMERAL_FUND_MIST, DEFAULT_STACK_NAME, DEVSTACK_NETWORK_NAMES, type DashboardOptions, type DashboardValue, type DeepbookBindings, type DeepbookCommonOptions, type DeepbookConfigError, type DeepbookError, type DeepbookKnownNetwork, type DeepbookKnownOptions, type DeepbookOptions, type DeepbookOverrideOptions, type DeepbookPackageMember, type DeepbookPhase, type DeepbookPluginError, type DeepbookPool, type DeepbookPoolCoin, type DeepbookPoolSeedLiquidity, type DeepbookPoolSeedOrder, type DeepbookPoolSpec, type DeepbookResolved, type DependencyInput, type DependencyList, type DevstackNetworkModeRegistry, type DevstackNetworkName, DevstackNetworkParseError, type DevstackOptions, type DevstackOptionsWith, type DevstackRoutableUpstreamRegistry, type DiscoveredCoin, type DispatchId, type EndpointKey, type EntrypointDecl, type FactoriesByMode, type FactoriesFor, type FaucetBodyError, type FaucetConfigError, type FaucetError, type FaucetExhausted, type FaucetStrategy, type FaucetStrategyContribution, type FaucetUnreachable, type ForkUnsupportedError, HOST_SERVICE_PORT_TOKEN, type HostServiceError, type HostServiceOptions, type HostServiceReadyProbe, type HostServiceValue, http_probe_d_exports as HttpProbes, IdentityContext, type ImageRef, type KnownPackageOptions, type KnownPackageResolved, LOCAL_NETWORK_NAME, type LifecycleStatus, type LoadedImageBundle, type LocalPackageOptions, type LocalPackageResolved, type LogLevel, type LogLine, type LogPayload, Logger, type LoggerShape, managed_container_d_exports as ManagedContainers, type ManifestExtras, type ManifestExtrasContext, type ManifestExtrasInput, ManifestExtrasInvalid, ManifestExtrasLookupError, type ModeNamespace, type NetworkConfig, type NetworkMode, type PackageBindings, type PackageCapture, type PackageMember, type PackageResolved, type ParsedDevstackNetwork, type PhaseNarration, type Plugin, PluginContext, type PluginCtx, type PluginRole, type PluginSpec, probes_d_exports as Probes, process_lines_d_exports as ProcessLines, process_supervisor_d_exports as ProcessSupervisor, type ProjectionDecl, type ProjectionEvent, type PublishError, type PublisherAccountMember, redaction_d_exports as Redaction, type RedactionRule, type Renderer, type RendererError, type ResolveNetworkOptions, type ResolveStateDirOptions, type ResolvedCoin, type ResolvedDependencies, type ResolvedDevstackNetwork, type ResolvedKeypair, type ResolvedKnownPackage, type ResolvedLocalPackage, type ResolvedSuiNetwork, type ResourceIdOf, type ResourceRef, type ResourceValueOf, retry_policy_d_exports as RetryPolicy, type RoutableDecl, type RoutableHttpDecl, type RoutableTcpDecl, type RoutableUpstream, type RoutableUpstreamKind, type RunHandle, type RunStackIdentityOptions, type RunStackOptions, runtime_decode_d_exports as RuntimeDecode, SUI_FULL_COIN_TYPE, SUI_PRICE_FEED_ID, type SealError as SealAcquireError, type SealAnyError, type SealBindings, type SealCommonOptions, type SealConfigError, type SealError, type SealForkKnownOptions, type SealKeyServer, type SealKeyServerEntry, type SealKnownResolved, type SealLiveOptions, type SealLocalKeygenOptions, type SealLocalKeygenResolved, type SealOptions, type SealResolved, type SignatureScheme, type SnapshotableDecl, type Stack, type StackName, type StrategyContributorDecl, type StrategyFor, type SuiCliError, type SuiConfigError, type SuiError, type SuiForkOptions, type SuiFundingEntry, type SuiLiveOptions, type SuiLocalOptions, type SuiLocalRpcOptions, type SuiNetworkConfigEntry, type SuiOptions, type SuiPluginError, type SyntheticImpersonationSigner, type TagBuffer, type TaggedImageRef, type TxResult, USDC_PRICE_FEED_ID, type WalCoinValue, type WalletAccountMember, type WalletBootError, type WalletBootPhase, type WalletError, type WalletOptions, type WalletRequestError, type WalletRequestPhase, type WalletValue, type WalrusBindings, type WalrusConfigError, type WalrusError, type WalrusKnownDeploymentOptions, type WalrusKnownNetwork, type WalrusLocalClusterOptions, type WalrusNodeBinding, type WalrusPhase, type WalrusPluginError, type WalrusResolved, type WalrusStorageNode, account, action, appName, chainIdForNetwork, coin, contentHash, dashboard, deepbookCore as deepbook, deepbookFor, defineDevstack, defineDevstackWith, defineFaucetStrategy, defineId, defineModeNamespace, definePlugin, endpointKey, hostService, isBareCoinType, knownPackage, localPackage, networkNameFromChain, parseDevstackNetwork, parseDevstackNetworkName, projection, pythPriceFeedId, resolveAppName, resolveNetwork, resolveNetworkSync, resolveStackName, resolveStateDir, resource, runStack, seal, sealFor, stackName, sui, suiFor, validateBareCoinType, walCoin, wallet, walrus, walrusFor };
+export { type AccountAcquireError, type AccountAcquirePhase, type AccountBindings, type AccountError, type AccountFunding, type AccountFundingCoinValue, type AccountFundingEntry, type AccountFundingRequest, type AccountFundingResult, type AccountFundingStrategy, type AccountMemberAlias, type AccountOptions, type AccountSignError, type AccountSignPhase, type AccountValue, type AccountVariantKind, type ActionBuildContext, type ActionError, type ActionOptions, type ActionPhase, type ActionReceipt, type ActionUpstreamRef, type AnyPlugin, type AnyResourceRef, type AppName, BUILTIN_COINS, type BootError, type Brand, type BuildCtx, type BuiltinCoinName, type ChainProbe, type ChainProbeError, type ChainProbeMode, type CodegenEmitContext, type CodegenEmitDone, type CodegenableDecl, type CoinAddressForm, type CoinBindings, type CoinError, type CoinMember, type CoinMemberAlias, type CoinPhase, type CoinValue, config_validation_d_exports as ConfigValidation, type ContainerHandle, type ContainerLabelTuple, type ContainerRuntime, type ContainerRuntimeError, ContainerRuntimeService, type ContentHash, type CrossCuttingFundingEntry, type CrossCuttingFundingProvider, DEEP_PRICE_FEED_ID, DEFAULT_DEVSTACK_NETWORK, DEFAULT_EPHEMERAL_FUND_MIST, DEFAULT_STACK_NAME, DEVSTACK_NETWORK_NAMES, type DashboardOptions, type DashboardValue, type DeepbookBindings, type DeepbookCommonOptions, type DeepbookConfigError, type DeepbookError, type DeepbookKnownNetwork, type DeepbookKnownOptions, type DeepbookOptions, type DeepbookOverrideOptions, type DeepbookPackageMember, type DeepbookPhase, type DeepbookPluginError, type DeepbookPool, type DeepbookPoolCoin, type DeepbookPoolSeedLiquidity, type DeepbookPoolSeedOrder, type DeepbookPoolSpec, type DeepbookResolved, type DependencyInput, type DependencyList, type DevstackNetworkModeRegistry, type DevstackNetworkName, DevstackNetworkParseError, type DevstackOptions, type DevstackOptionsWith, type DevstackRoutableUpstreamRegistry, type DiscoveredCoin, type DispatchId, type EndpointKey, type EntrypointDecl, type FactoriesByMode, type FactoriesFor, type FaucetBodyError, type FaucetConfigError, type FaucetError, type FaucetExhausted, type FaucetStrategy, type FaucetStrategyContribution, type FaucetUnreachable, type ForkUnsupportedError, HOST_SERVICE_PORT_TOKEN, type HostServiceError, type HostServiceOptions, type HostServiceReadyProbe, type HostServiceValue, http_probe_d_exports as HttpProbes, IdentityContext, type ImageRef, type KnownPackageOptions, type KnownPackageResolved, LOCAL_NETWORK_NAME, type LifecycleStatus, type LoadedImageBundle, type LocalPackageOptions, type LocalPackageResolved, type LogLevel, type LogLine, type LogPayload, Logger, type LoggerShape, managed_container_d_exports as ManagedContainers, type ManifestExtras, type ManifestExtrasContext, type ManifestExtrasInput, ManifestExtrasInvalid, ManifestExtrasLookupError, type ModeNamespace, type NetworkConfig, type NetworkMode, type PackageBindings, type PackageCapture, type PackageMember, type PackageResolved, type ParsedDevstackNetwork, type PhaseNarration, type Plugin, PluginContext, type PluginCtx, type PluginRole, type PluginSpec, probes_d_exports as Probes, process_lines_d_exports as ProcessLines, process_supervisor_d_exports as ProcessSupervisor, type ProjectionDecl, type ProjectionEvent, type PublishError, type PublisherAccountMember, redaction_d_exports as Redaction, type RedactionRule, type Renderer, type RendererError, type ResolveNetworkOptions, type ResolveStateDirOptions, type ResolvedCoin, type ResolvedDependencies, type ResolvedDevstackNetwork, type ResolvedKeypair, type ResolvedKnownPackage, type ResolvedLocalPackage, type ResolvedSuiNetwork, type ResourceIdOf, type ResourceRef, type ResourceValueOf, retry_policy_d_exports as RetryPolicy, type RoutableDecl, type RoutableHttpDecl, type RoutableTcpDecl, type RoutableUpstream, type RoutableUpstreamKind, type RunHandle, type RunStackIdentityOptions, type RunStackOptions, runtime_decode_d_exports as RuntimeDecode, SUI_FULL_COIN_TYPE, SUI_PRICE_FEED_ID, type SealError as SealAcquireError, type SealAnyError, type SealBindings, type SealCommonOptions, type SealConfigError, type SealError, type SealForkKnownOptions, type SealKeyServer, type SealKeyServerEntry, type SealKnownResolved, type SealLiveOptions, type SealLocalKeygenOptions, type SealLocalKeygenResolved, type SealOptions, type SealResolved, type SignatureScheme, type SnapshotableDecl, type Stack, type StackName, type StrategyContributorDecl, type StrategyFor, type SuiCliError, type SuiConfigError, type SuiError, type SuiForkOptions, type SuiFundingEntry, type SuiLiveOptions, type SuiLocalOptions, type SuiLocalRpcOptions, type SuiNetworkConfigEntry, type SuiOptions, type SuiPluginError, type SyntheticImpersonationSigner, type TagBuffer, type TaggedImageRef, type TxResult, USDC_PRICE_FEED_ID, type WalCoinValue, type WalletAccountMember, type WalletBootError, type WalletBootPhase, type WalletError, type WalletOptions, type WalletRequestError, type WalletRequestPhase, type WalletValue, type WalrusBindings, type WalrusConfigError, type WalrusError, type WalrusKnownDeploymentOptions, type WalrusKnownNetwork, type WalrusLocalClusterOptions, type WalrusLocalPublisherOptions, type WalrusLocalServiceOptions, type WalrusNodeBinding, type WalrusPhase, type WalrusPluginError, type WalrusResolved, type WalrusStorageNode, account, action, appName, chainIdForNetwork, coin, contentHash, dashboard, deepbookCore as deepbook, deepbookFor, defineDevstack, defineDevstackWith, defineFaucetStrategy, defineId, defineModeNamespace, definePlugin, endpointKey, hostService, isBareCoinType, knownPackage, localPackage, networkNameFromChain, parseDevstackNetwork, parseDevstackNetworkName, projection, pythPriceFeedId, resolveAppName, resolveNetwork, resolveNetworkSync, resolveStackName, resolveStateDir, resource, runStack, seal, sealFor, stackName, sui, suiFor, validateBareCoinType, walCoin, wallet, walrus, walrusFor };

package/dist/orchestrators/boot.mjs CHANGED Viewed

@@ -184,11 +184,12 @@ const layerProductionOrchestrators = (router = {}) => {
 *  schemas do not consume them. */
 const endpointSinksFromRoute = (decl, route, pluginKey, registeredAt = Date.now()) => {
 	const url = route.wireProtocol === "tcp" ? `tcp://127.0.0.1:${route.entrypointPort}` : `http://${route.hostname}:${route.entrypointPort}`;
+	const publicWireProtocol = route.wireProtocol === "https" ? "http" : route.wireProtocol;
 	const common = {
 		name: decl.endpointName,
 		url,
 		displayUrl: null,
-		wireProtocol: route.wireProtocol
+		wireProtocol: publicWireProtocol
 	};
 	const endpointKeyString = `${pluginKey}:${decl.endpointName}`;
 	const event = {

package/dist/orchestrators/boot.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"boot.mjs","names":["Logger"],"sources":["../../src/orchestrators/boot.ts"],"sourcesContent":["// Single L3 boot seam.\n//\n// Consumed by both the CLI verb wirings (`cli/wirings/`) and the\n// library-facing programmatic surface (`api/run-stack.ts`), plus the e2e\n// boot harness.\n//\n// Composes the substrate Layer stack (L0) + the Docker `ContainerRuntime`\n// adapter (L1), yields the substrate services into a `Context.Context<never>`\n// pluginContext, builds the projection ref, and runs `supervise()` inside a\n// scope. The production orchestrator assembly (Snapshot/Router/Codegen/\n// ManifestEndpoint) and the contribution-delivery dispatcher live here too —\n// the supervisor holds the dispatcher record opaquely (it never imports an\n// orchestrator service).\n//\n// Architecture: this is L3 (orchestrator-level). Layer composition that\n// assembles L0+L1 stacks belongs at L3/L4 — it can't live in `substrate/`\n// because it imports a concrete L1 adapter (Docker) by definition; and it\n// depends on L2 plugin internals (coin/package registries), so it can't live\n// at L1 runtime either. See ARCHITECTURE.md § \"Layer composition belongs at\n// L3/L4, not L0\" and § \"L1-never-imports-from-L2\".\n\nimport { Context, Effect, FileSystem, Layer, Ref, Scope, SubscriptionRef } from 'effect';\nimport { join, resolve } from 'node:path';\nimport as NodeFileSystem from '@effect/platform-node/NodeFileSystem';\nimport * as NodePath from '@effect/platform-node/NodePath';\nimport * as NodeChildProcessSpawner from '@effect/platform-node/NodeChildProcessSpawner';\nimport { ChildProcessSpawner } from 'effect/unstable/process/ChildProcessSpawner';\n\nimport type { Identity } from '../substrate/identity.ts';\nimport { CacheService, layerCache } from '../substrate/runtime/cache/index.ts';\nimport { LeaseBrokerService, layerLeaseBroker } from '../substrate/runtime/lease-broker/index.ts';\nimport {\n\tIdentityContext,\n\tRuntimeRoot,\n\tStackPathsService,\n\tlayerIdentity,\n\tlayerRuntimeRoot,\n\tlayerStackPaths,\n} from '../substrate/runtime/paths.ts';\nimport { PortBrokerService, layerPortBroker } from '../substrate/runtime/port-broker/index.ts';\nimport {\n\tStrategyRegistryService,\n\tlayerStrategyRegistry,\n} from '../substrate/runtime/strategy-registry/index.ts';\nimport {\n\tContainerRuntimeService,\n\tDockerSpawner,\n\tlayerContainerRuntimeDocker,\n\tlayerDockerCycleInitial,\n\tlayerDockerHostDefault,\n} from '../runtime/docker/index.ts';\nimport { readResolvedSync } from '../substrate/runtime/lifecycle/index.ts';\nimport { operationalEndpointEventsFromResolvedValue } from '../substrate/runtime/projection/operational-endpoints.ts';\nimport { Logger, layerLogger } from '../substrate/runtime/observability/index.ts';\nimport {\n\tPostAcquireTasksService,\n\tlayerPostAcquireTasks,\n} from '../substrate/runtime/post-acquire-tasks.ts';\nimport {\n\tallReadyOrTerminal,\n\tstartSupervisor,\n\ttype ContributionDispatcher,\n\ttype SupervisedStack,\n\ttype SupervisorCommandHandler,\n\ttype SupervisorHandle,\n\ttype SupervisorPostAcquireHook,\n} from '../substrate/runtime/supervisor/index.ts';\nimport type { ContributionDispatchContext } from '../substrate/runtime/supervisor/contribution-dispatcher.ts';\nimport type { SupervisorPostAcquireContext } from '../substrate/runtime/supervisor/index.ts';\n\nimport {\n\tlayerMystenMoveCodegen,\n\tMoveCodegenService,\n\tMoveSummaryRunnerService,\n} from './codegen/bindings.ts';\nimport { layerSuiMoveSummaryRunnerDocker } from '../plugins/sui/move-summary-runner.ts';\nimport { CodegenPathsService, layerCodegenPaths, layerCodegenRoot } from './codegen/paths.ts';\nimport {\n\tCodegenOrchestratorService,\n\tlayerCodegenOrchestrator,\n\ttype Codegenable,\n} from './codegen/service.ts';\nimport { CodegenWriteFailed } from './codegen/errors.ts';\nimport { DEPLOYMENT_FILENAME, writeDeployment } from './codegen/deployment.ts';\nimport {\n\tDEFAULT_TRAEFIK_IMAGE,\n\tlayerDockerUpstreamResolver,\n\tlayerEntrypointRegistry,\n\tlayerRouterConfigLiteral,\n\tlayerRouterService,\n\tlayerTraefikContainerOpsDocker,\n\tRouterService,\n\ttype ResolvedRoute,\n} from './router/index.ts';\nimport { BUILT_IN_ENTRYPOINTS } from '../plugins/router-entrypoints.ts';\nimport {\n\tmakeDefaultRouterProfile,\n\ttype DefaultRouterProfileOptions,\n\ttype RouterProfile,\n} from './router/profile.ts';\nimport { layerSnapshotOrchestrator, SnapshotOrchestratorService } from './snapshot/index.ts';\nimport type { ProjectionDecl } from '../contracts/projection.ts';\nimport type { RoutableDecl } from '../contracts/routable.ts';\nimport type { SnapshotableDecl } from '../contracts/snapshotable.ts';\nimport type { StrategyContributorDecl } from '../contracts/strategy-contributor.ts';\nimport { endpointKey, type PluginKey } from '../substrate/brand.ts';\nimport type { EngineEvent } from '../substrate/events.ts';\nimport {\n\tbuildEnvelope,\n\tCURRENT_MANIFEST_VERSION,\n\twriteManifest,\n} from '../substrate/runtime/manifest/index.ts';\nimport {\n\tManifestExtrasLookupError,\n\tresolveManifestExtras,\n\ttype EndpointEntry,\n\ttype ManifestExtrasInput,\n} from '../substrate/manifest.ts';\nimport { CoinRegistryService, layerCoinRegistry } from '../plugins/coin/registry.ts';\nimport { PackageRegistryService, layerPackageRegistry } from '../plugins/package/registry.ts';\n\n// ───────────────────────────────────────────────────────────────────────────\n// Substrate lifecycle\n// ───────────────────────────────────────────────────────────────────────────\n\n/** Substrate Layer stack for a single supervised run. Composes every L0\n * service the supervisor yields from its R-channel, plus the L1 Docker\n * `ContainerRuntime`. Built-in plugin services are layered outside\n * substrate and added through `extendContext`. /\nexport const buildSubstrateLayers = (identity: Identity, runtimeRoot: string) => {\n\t// DockerSpawner adapts platform-node's ChildProcessSpawner tag onto\n\t// the docker subsystem's local DockerSpawner tag (same shape; the\n\t// indirection only lets tests inject a stub).\n\tconst layerDockerSpawnerFromNode: Layer.Layer<DockerSpawner, never, ChildProcessSpawner> =\n\t\tLayer.effect(\n\t\t\tDockerSpawner,\n\t\t\tEffect.gen(function () {\n\t\t\t\treturn yield* ChildProcessSpawner;\n\t\t\t}),\n\t\t);\n\n\tconst platformBase = Layer.mergeAll(\n\t\tlayerIdentity(identity),\n\t\tlayerRuntimeRoot(runtimeRoot),\n\t\tNodePath.layer,\n\t\tNodeFileSystem.layer,\n\t\tlayerDockerHostDefault,\n\t\tlayerDockerCycleInitial,\n\t\tlayerStrategyRegistry,\n\t);\n\n\tconst childProcessSpawnerWired = NodeChildProcessSpawner.layer.pipe(\n\t\tLayer.provideMerge(platformBase),\n\t);\n\tconst withStackPaths = layerStackPaths.pipe(Layer.provideMerge(childProcessSpawnerWired));\n\tconst withCache = layerCache.pipe(Layer.provideMerge(withStackPaths));\n\tconst withPortBroker = layerPortBroker.pipe(Layer.provideMerge(withCache));\n\tconst withLeaseBroker = layerLeaseBroker.pipe(Layer.provideMerge(withPortBroker));\n\tconst withSpawnerAdapter = layerDockerSpawnerFromNode.pipe(Layer.provideMerge(withLeaseBroker));\n\tconst withContainerRuntime = layerContainerRuntimeDocker.pipe(\n\t\tLayer.provideMerge(withSpawnerAdapter),\n\t);\n\tconst withPostAcquireTasks = layerPostAcquireTasks.pipe(Layer.provideMerge(withContainerRuntime));\n\treturn layerLogger.pipe(Layer.provideMerge(withPostAcquireTasks));\n};\n\n/** Build the opaque `Context.Context<never>` the supervisor hands to\n * every plugin's `acquire` body. Yields every substrate service the\n * Docker-backed substrate layer stack provides; downstream callers\n * may extend the context (e.g. layering the built-in plugin registries\n * via `extendBuiltInPluginContext`) before passing it to `supervise()`. /\nconst buildPluginContext = (): Effect.Effect<\n\tContext.Context<never>,\n\tnever,\n\t\| IdentityContext\n\t\| RuntimeRoot\n\t\| StackPathsService\n\t\| CacheService\n\t\| StrategyRegistryService\n\t\| ContainerRuntimeService\n\t\| PortBrokerService\n\t\| LeaseBrokerService\n\t\| PostAcquireTasksService\n\t\| Logger\n> =>\n\tEffect.gen(function () {\n\t\tconst identityCtx = yield* IdentityContext;\n\t\tconst runtimeRootResolved = yield* RuntimeRoot;\n\t\tconst stackPaths = yield* StackPathsService;\n\t\tconst cache = yield* CacheService;\n\t\tconst registry = yield* StrategyRegistryService;\n\t\tconst containerRuntime = yield* ContainerRuntimeService;\n\t\tconst portBroker = yield* PortBrokerService;\n\t\tconst leaseBroker = yield* LeaseBrokerService;\n\t\tconst postAcquireTasks = yield* PostAcquireTasksService;\n\t\tconst logger = yield* Logger;\n\n\t\treturn Context.empty().pipe(\n\t\t\tContext.add(IdentityContext, identityCtx),\n\t\t\tContext.add(RuntimeRoot, runtimeRootResolved),\n\t\t\tContext.add(StackPathsService, stackPaths),\n\t\t\tContext.add(CacheService, cache),\n\t\t\tContext.add(StrategyRegistryService, registry),\n\t\t\tContext.add(ContainerRuntimeService, containerRuntime),\n\t\t\tContext.add(PortBrokerService, portBroker),\n\t\t\tContext.add(LeaseBrokerService, leaseBroker),\n\t\t\tContext.add(PostAcquireTasksService, postAcquireTasks),\n\t\t\tContext.add(Logger, logger),\n\t\t) as Context.Context<never>;\n\t});\n\n/** Options accepted by the supervised-run entrypoint. `lifetime`\n * selects long-running supervision versus a one-shot acquire/codegen\n * cycle. The `beforeInitialAcquire` hook runs inside the supervised\n * scope before the first acquire starts; live renderers use it to\n * subscribe to startup projection changes. The `withinScope` hook\n * runs after the first acquire completes.\n \n Generic `R` widens the hook R-channel so callers can yield\n * substrate services (e.g. `StackPathsService`) that are in scope at\n * the supervisor-boot site. /\nexport interface SuperviseStackOptions<R = Scope.Scope, ExtendR = never, HookE = never> {\n\treadonly lifetime?: 'long-running' \| 'one-shot';\n\treadonly devstackVersion?: string;\n\treadonly beforeInitialAcquire?: (handle: SupervisorHandle) => Effect.Effect<void, HookE, R>;\n\treadonly withinScope?: (handle: SupervisorHandle) => Effect.Effect<void, HookE, R>;\n\treadonly commandHandler?: SupervisorCommandHandler;\n\treadonly contributionDispatcher?: ContributionDispatcher;\n\treadonly postAcquireHook?: SupervisorPostAcquireHook;\n\t/* Caller-supplied extension layered into `pluginContext` after the\n\t * default substrate context is built. Used by plugin-author Layer\n\t * composition (ARCHITECTURE.md § Plugin-author extension) and by\n\t * the CLI when it wants to inject the built-in plugin registries or\n\t * a custom Logger override. /\n\treadonly extendContext?: (\n\t\tctx: Context.Context<never>,\n\t) => Effect.Effect<Context.Context<never>, never, ExtendR>;\n}\n\n/* Effect that boots the supervisor for `stack` and blocks on the\n * supervisor's shutdown latch. Returns the final `SubscribableState`\n * snapshot so callers (CLI, library handle) can inspect post-shutdown\n * state. /\nexport const superviseStackEffect = <R = Scope.Scope, ExtendR = never, HookE = never>(\n\tstack: SupervisedStack,\n\tidentity: Identity,\n\tstate: SubscriptionRef.SubscriptionRef<import('../substrate/projection.ts').SubscribableState>,\n\topts: SuperviseStackOptions<R, ExtendR, HookE> = {},\n) =>\n\tEffect.gen(function () {\n\t\treturn yield* Effect.scoped(\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst baseContext = yield* buildPluginContext();\n\t\t\t\tconst pluginContext =\n\t\t\t\t\topts.extendContext === undefined ? baseContext : yield* opts.extendContext(baseContext);\n\n\t\t\t\tconst startup = yield* startSupervisor(\n\t\t\t\t\tstack,\n\t\t\t\t\tidentity,\n\t\t\t\t\tstate,\n\t\t\t\t\tpluginContext,\n\t\t\t\t\topts.contributionDispatcher,\n\t\t\t\t\topts.commandHandler,\n\t\t\t\t\topts.postAcquireHook,\n\t\t\t\t\t{\n\t\t\t\t\t\tcommandLoop: opts.lifetime !== 'one-shot',\n\t\t\t\t\t\t...(opts.devstackVersion === undefined\n\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t: { devstackVersion: opts.devstackVersion }),\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t\tconst { handle } = startup;\n\t\t\t\tif (opts.beforeInitialAcquire !== undefined) {\n\t\t\t\t\tyield* opts.beforeInitialAcquire(handle);\n\t\t\t\t}\n\t\t\t\tif (opts.lifetime === 'one-shot') {\n\t\t\t\t\t// `runInitialAcquire` runs `acquireFullGraph` to completion (every\n\t\t\t\t\t// node reaches a terminal status) before it returns. Gate the\n\t\t\t\t\t// one-shot `withinScope` on the SUPERVISOR-OWNED readiness signal\n\t\t\t\t\t// — `allReadyOrTerminal` (`ready \|\| done`) — NOT a per-node\n\t\t\t\t\t// `awaitReady` watcher. A run-to-completion `task` node lands in\n\t\t\t\t\t// `done`; the registry contract admits a `done`-status node whose\n\t\t\t\t\t// `readyGate` is unresolved (only `markReady`/`markFailed` resolve\n\t\t\t\t\t// it), so a per-node gate HANGS on it. This is the SAME\n\t\t\t\t\t// `done`-tolerant gate S1 gave the long-running path; reading\n\t\t\t\t\t// statuses never suspends, so it is hang-free.\n\t\t\t\t\tyield* startup.runInitialAcquire;\n\t\t\t\t\tyield* allReadyOrTerminal(startup.handle.graph, startup.handle.registry);\n\t\t\t\t\tif (opts.withinScope !== undefined) {\n\t\t\t\t\t\tyield* opts.withinScope(handle);\n\t\t\t\t\t}\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst outcome = yield* Effect.raceFirst(\n\t\t\t\t\tstartup.runInitialAcquire.pipe(Effect.as('booted' as const)),\n\t\t\t\t\thandle.awaitShutdown.pipe(Effect.as('shutdown' as const)),\n\t\t\t\t);\n\t\t\t\tif (outcome === 'shutdown') {\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (opts.withinScope !== undefined) {\n\t\t\t\t\tyield* opts.withinScope(handle);\n\t\t\t\t}\n\t\t\t\tyield* handle.awaitShutdown;\n\t\t\t}),\n\t\t);\n\t});\n\n// ───────────────────────────────────────────────────────────────────────────\n// Production orchestrator assembly\n// ───────────────────────────────────────────────────────────────────────────\n\nexport interface ProductionCodegenOptions {\n\treadonly appRoot?: string;\n\t/** Forwarded verbatim to `@mysten/codegen`'s\n\t * `generateFromPackageSummary` via `layerMystenMoveCodegen` — see\n\t * `DevstackOptions['codegen']` for the full contract. Default `false`\n\t * (`@mysten/codegen`'s own default): phantom-only structs render as\n\t * consts with the phantom placeholder baked into `.name`; `true`\n\t * renders them as factories whose required type arguments compose a\n\t * fully-qualified type tag. /\n\treadonly includePhantomTypeParameters?: boolean;\n}\n\n/\n The ONE boot seam that maps a stack's codegen config to the production\n * codegen orchestrator options for a LIVE (`'ran'`) projection. Both\n * composition entry points (`api/run-stack.ts` and `orchestrators/layers.ts`)\n * call this. Boot writes no committed `src/generated` tree (owned solely by\n * the stack-free `codegen` verb), so there is no live dev-output dir to\n * resolve; only the app root + the pass-through phantom-type flag flow into\n * `layerProductionOrchestrators({ codegen })`.\n /\nexport const resolveProductionCodegenOptions = (input: {\n\treadonly appRoot: string;\n\treadonly codegen?:\n\t\t\| {\n\t\t\t\treadonly includePhantomTypeParameters?: boolean;\n\t\t }\n\t\t\| undefined;\n}): ProductionCodegenOptions => {\n\t// Boot never emits the committed `src/generated` tree (that is owned\n\t// solely by the stack-free `codegen` verb); its only codegen writes are\n\t// the deployment file (values-only) and the dev-`up` bindings refresh.\n\t// So there is no live dev-output dir to resolve — only the app root + the\n\t// pass-through phantom-type flag flow through.\n\treturn {\n\t\tappRoot: input.appRoot,\n\t\t// Pass-through verbatim — no resolution step; \"unset\" stays unset so\n\t\t// `@mysten/codegen`'s own default (false) applies at the call site.\n\t\t...(input.codegen?.includePhantomTypeParameters === undefined\n\t\t\t? {}\n\t\t\t: { includePhantomTypeParameters: input.codegen.includePhantomTypeParameters }),\n\t};\n};\n\nexport interface ProductionRouterOptions {\n\treadonly codegen?: ProductionCodegenOptions;\n\treadonly disabled?: boolean;\n}\n\nexport class ManifestEndpointRegistryService extends Context.Service<\n\tManifestEndpointRegistryService,\n\t{\n\t\treadonly register: (entry: EndpointEntry) => Effect.Effect<void, never, Scope.Scope>;\n\t\treadonly entries: Effect.Effect<ReadonlyArray<EndpointEntry>>;\n\t}\n>()('@devstack/orchestrators/ManifestEndpointRegistry') {}\n\nexport const layerManifestEndpointRegistry: Layer.Layer<ManifestEndpointRegistryService> =\n\tLayer.effect(\n\t\tManifestEndpointRegistryService,\n\t\tEffect.gen(function () {\n\t\t\tconst entriesRef = yield* Ref.make<ReadonlyArray<EndpointEntry & { readonly seq: number }>>(\n\t\t\t\t[],\n\t\t\t);\n\t\t\tconst seqRef = yield* Ref.make(0);\n\n\t\t\tconst register = (entry: EndpointEntry): Effect.Effect<void, never, Scope.Scope> =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst seq = yield* Ref.updateAndGet(seqRef, (n) => n + 1);\n\t\t\t\t\tyield* Ref.update(entriesRef, (entries) => [...entries, { ...entry, seq }]);\n\t\t\t\t\tyield* Effect.addFinalizer(() =>\n\t\t\t\t\t\tRef.update(entriesRef, (entries) =>\n\t\t\t\t\t\t\tentries.filter((candidate) => candidate.seq !== seq),\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\t});\n\n\t\t\treturn ManifestEndpointRegistryService.of({\n\t\t\t\tregister,\n\t\t\t\tentries: Ref.get(entriesRef).pipe(\n\t\t\t\t\tEffect.map((entries) =>\n\t\t\t\t\t\tentries.map((entryWithSeq) => {\n\t\t\t\t\t\t\tconst { seq, ...entry } = entryWithSeq;\n\t\t\t\t\t\t\tvoid seq;\n\t\t\t\t\t\t\treturn entry;\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t});\n\t\t}),\n\t);\n\nexport const productionRouterProfile = (options: DefaultRouterProfileOptions = {}): RouterProfile =>\n\tmakeDefaultRouterProfile(options);\n\n/** `outputDir` for the `CodegenRoot` of a `layerProductionOrchestrators`\n * composition — `<appRoot>/src/generated`. Boot's `assembleDeployment`\n * writes no file here; the dev-`up` `emitBindings` refresh DOES re-emit\n * this committed tree from the STATIC (id-free) contributions so an edited\n * Move package's new shapes reach the app. `apply` / `runStack` pass no\n * `emitBindings`, so they leave it untouched. The stack-free `codegen` verb\n * owns the canonical emit (wired separately, where it pins its own path). /\nconst productionCodegenOutputDir = (appRoot: string): string => resolve(appRoot, 'src/generated');\n\nexport const layerProductionOrchestrators = (router: ProductionRouterOptions = {}) => {\n\tconst profile = productionRouterProfile();\n\treturn Layer.mergeAll(\n\t\tlayerSnapshotOrchestrator,\n\t\tlayerManifestEndpointRegistry,\n\t\tlayerRouterService.pipe(\n\t\t\tLayer.provideMerge(\n\t\t\t\tLayer.mergeAll(\n\t\t\t\t\tlayerEntrypointRegistry(BUILT_IN_ENTRYPOINTS),\n\t\t\t\t\tlayerTraefikContainerOpsDocker,\n\t\t\t\t\tlayerDockerUpstreamResolver(profile),\n\t\t\t\t\tlayerRouterConfigLiteral({\n\t\t\t\t\t\tdisabled: router.disabled ?? false,\n\t\t\t\t\t\tprofile,\n\t\t\t\t\t\timage: DEFAULT_TRAEFIK_IMAGE,\n\t\t\t\t\t\trouteReadinessProbe: {\n\t\t\t\t\t\t\tenabled: router.disabled !== true,\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t),\n\t\tlayerCodegenOrchestrator,\n\t\tlayerCodegenPaths.pipe(\n\t\t\tLayer.provideMerge(\n\t\t\t\tlayerCodegenRoot({\n\t\t\t\t\toutputDir: productionCodegenOutputDir(router.codegen?.appRoot ?? process.cwd()),\n\t\t\t\t\tstackSubdir: null,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t\tlayerSuiMoveSummaryRunnerDocker,\n\t\tlayerMystenMoveCodegen({\n\t\t\tincludePhantomTypeParameters: router.codegen?.includePhantomTypeParameters,\n\t\t}),\n\t);\n};\n\n/* The single adapter for routable endpoints: ONE `ResolvedRoute` (the\n * router's post-mint source of truth) → ALL THREE sink-feeds at once —\n * the router's own `route`, the manifest `EndpointEntry`, and the\n * projection `endpoint.registered` event — derived from one shared\n * field-set so the three sinks can never diverge. The `routable`\n * dispatch body feeds each sink from the object this returns; there is\n * no second, third derivation off the route anywhere.\n \n It owns the url-derivation: `tcp` routes carry `tcp://127.0.0.1:port`,\n * everything else `http://hostname:port`. Consumers (codegen, manifest)\n * translate `tcp://` to their protocol-specific scheme (`postgres://`,\n * `redis://`, …).\n \n `ResolvedRoute` only carries `entrypointName`, so the endpoint name is\n * recovered from the original `decl.endpointName`; `pluginKey` is supplied\n * by the dispatcher (it is not in `ResolvedRoute`). Router-only fields\n * (`dispatchFileId`/`cors`/`upstreamUrl`) are kept ON `route` for the\n * router sink but discarded from the manifest/projection field-set — those\n * schemas do not consume them. /\nexport const endpointSinksFromRoute = (\n\tdecl: RoutableDecl,\n\troute: ResolvedRoute,\n\tpluginKey: PluginKey,\n\tregisteredAt = Date.now(),\n) => {\n\tconst url =\n\t\troute.wireProtocol === 'tcp'\n\t\t\t? `tcp://127.0.0.1:${route.entrypointPort}`\n\t\t\t: `http://${route.hostname}:${route.entrypointPort}`;\n\tconst common = {\n\t\tname: decl.endpointName,\n\t\turl,\n\t\tdisplayUrl: null,\n\t\twireProtocol: route.wireProtocol,\n\t} as const;\n\tconst endpointKeyString = `${pluginKey}:${decl.endpointName}`;\n\tconst event: Extract<EngineEvent, { readonly tag: 'endpoint.registered' }> = {\n\t\ttag: 'endpoint.registered',\n\t\tendpoint: {\n\t\t\t...common,\n\t\t\tendpointKey: endpointKey(endpointKeyString),\n\t\t\tpluginKey,\n\t\t\tregisteredAt,\n\t\t},\n\t};\n\treturn {\n\t\troute,\n\t\tmanifestEntry: {\n\t\t\t...common,\n\t\t\tendpointKey: endpointKeyString,\n\t\t\tpluginKey: String(pluginKey),\n\t\t},\n\t\tevent,\n\t};\n};\n\nconst manifestEndpointEntryFromOperationalEndpoint = (\n\tendpoint: Extract<EngineEvent, { readonly tag: 'endpoint.registered' }>['endpoint'],\n): EndpointEntry => ({\n\tendpointKey: String(endpoint.endpointKey),\n\tname: endpoint.name,\n\turl: endpoint.url,\n\tdisplayUrl: endpoint.displayUrl,\n\twireProtocol: endpoint.wireProtocol,\n\tpluginKey: String(endpoint.pluginKey),\n});\n\n/* Project a projection decl's `rowKey` (when absent) onto the\n * contributing plugin so projection consumers can attribute the row.\n * The payload stays opaque from the substrate's POV. /\nconst projectionDispatch = (\n\tdecl: ProjectionDecl,\n\tctx: ContributionDispatchContext,\n): Effect.Effect<void, never, never> => {\n\tconst payload = decl.event.payload;\n\tconst payloadWithRowKey =\n\t\tpayload !== null &&\n\t\ttypeof payload === 'object' &&\n\t\t'rowKey' in payload &&\n\t\t(payload as { rowKey: unknown }).rowKey === null\n\t\t\t? { ...payload, rowKey: ctx.pluginKey }\n\t\t\t: payload;\n\treturn ctx.publish({\n\t\t...decl.event,\n\t\tpayload: payloadWithRowKey,\n\t});\n};\n\n/* Register a strategy contribution on the scope-local registry, publish\n * `strategy.registered`, and arm a finalizer publishing\n * `strategy.unregistered`. /\nconst strategyContributorDispatch = (\n\tdecl: StrategyContributorDecl<string, unknown>,\n\tctx: ContributionDispatchContext,\n): Effect.Effect<void, never, Scope.Scope> =>\n\tEffect.gen(function () {\n\t\tyield* ctx.strategyRegistry.register(decl.capabilityKey, decl.strategy, {\n\t\t\tautoMounted: decl.autoMounted,\n\t\t\t...(decl.priority === undefined ? {} : { priority: decl.priority }),\n\t\t});\n\t\tyield* ctx.publish({\n\t\t\ttag: 'strategy.registered',\n\t\t\tcapabilityKey: decl.capabilityKey,\n\t\t\tautoMounted: decl.autoMounted,\n\t\t\tat: Date.now(),\n\t\t});\n\t\tyield* Effect.addFinalizer(() =>\n\t\t\tctx.publish({\n\t\t\t\ttag: 'strategy.unregistered',\n\t\t\t\tcapabilityKey: decl.capabilityKey,\n\t\t\t\tat: Date.now(),\n\t\t\t}),\n\t\t);\n\t});\n\n/*\n Build the production `ContributionDispatcher` — the closed seam the\n * supervisor replays each plugin's buffered contributions through after\n * a successful `start`. Each method's body reads its backing orchestrator\n * service (Snapshot/Router/Codegen/ManifestEndpoint) ONCE here and closes\n * over it; the substrate supervisor holds the resulting record opaquely\n * (it never imports an orchestrator service).\n /\nexport const buildProductionContributionDispatcher = (): Effect.Effect<\n\tContributionDispatcher,\n\tnever,\n\t\| SnapshotOrchestratorService\n\t\| RouterService\n\t\| CodegenOrchestratorService\n\t\| ManifestEndpointRegistryService\n> =>\n\tEffect.gen(function () {\n\t\tconst snapshot = yield* SnapshotOrchestratorService;\n\t\tconst router = yield* RouterService;\n\t\tconst codegen = yield* CodegenOrchestratorService;\n\t\tconst manifestEndpoints = yield* ManifestEndpointRegistryService;\n\t\treturn {\n\t\t\tsnapshotable: (decl: SnapshotableDecl, ctx) =>\n\t\t\t\tsnapshot.registerParticipant(ctx.pluginKey, decl),\n\t\t\troutable: (decl: RoutableDecl, ctx) =>\n\t\t\t\trouter.boot().pipe(\n\t\t\t\t\t// Router sink: `contributeRoute` writes the dispatch file +\n\t\t\t\t\t// publishes the route onto `applied`, returning the post-mint\n\t\t\t\t\t// `ResolvedRoute` — the ONE source of truth.\n\t\t\t\t\tEffect.andThen(router.contributeRoute(decl)),\n\t\t\t\t\tEffect.flatMap((route) => {\n\t\t\t\t\t\t// One adapter off that ResolvedRoute yields BOTH remaining\n\t\t\t\t\t\t// sink-feeds; feed manifest then projection. No second\n\t\t\t\t\t\t// derivation off the route lives anywhere.\n\t\t\t\t\t\tconst sinks = endpointSinksFromRoute(decl, route, ctx.pluginKey);\n\t\t\t\t\t\treturn manifestEndpoints\n\t\t\t\t\t\t\t.register(sinks.manifestEntry)\n\t\t\t\t\t\t\t.pipe(Effect.andThen(ctx.publish(sinks.event)));\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\tcodegenable: (decl: Codegenable, ctx) => codegen.registerContribution(ctx.pluginKey, decl),\n\t\t\tprojection: (decl: ProjectionDecl, ctx) => projectionDispatch(decl, ctx),\n\t\t\tstrategyContributor: (decl: StrategyContributorDecl<string, unknown>, ctx) =>\n\t\t\t\tstrategyContributorDispatch(decl, ctx),\n\t\t} satisfies ContributionDispatcher;\n\t});\n\nconst makeManifestExtrasContext = (ctx: SupervisorPostAcquireContext) => {\n\tconst resourceIdToKey = new Map<string, PluginKey>();\n\tfor (const [key, node] of ctx.graph.nodes) {\n\t\tresourceIdToKey.set(node.member.id, key);\n\t}\n\t// `lookup` throws `ManifestExtrasLookupError` synchronously from\n\t// inside the user-supplied `extras` factory.\n\t// `resolveManifestExtras` invokes that factory under `Effect.try`\n\t// with a typed `catch` mapper, so the throw promotes to the typed\n\t// failure channel — callers `catchTag('ManifestExtrasLookupError',\n\t// ...)` rather than reading the die-cause. Non-tagged throws stay\n\t// defects, preserving the previous semantics for genuine\n\t// programmer errors inside the factory body.\n\tconst lookup = (resourceId: string): unknown => {\n\t\tconst key = resourceIdToKey.get(resourceId);\n\t\tif (key === undefined) {\n\t\t\tthrow new ManifestExtrasLookupError({\n\t\t\t\tkind: 'unknown-resource',\n\t\t\t\tresourceId,\n\t\t\t});\n\t\t}\n\t\tconst resolved = readResolvedSync(ctx.registry, key);\n\t\tif (resolved === undefined) {\n\t\t\tthrow new ManifestExtrasLookupError({\n\t\t\t\tkind: 'unresolved-resource',\n\t\t\t\tresourceId,\n\t\t\t});\n\t\t}\n\t\treturn resolved;\n\t};\n\treturn {\n\t\tvalue: (resource: { readonly id: string }) => lookup(resource.id),\n\t};\n};\n\nconst operationalManifestEndpointEntries = (\n\tctx: SupervisorPostAcquireContext,\n\troutableEntries: ReadonlyArray<EndpointEntry>,\n): ReadonlyArray<EndpointEntry> => {\n\tconst routablePluginKeys = new Set(routableEntries.map((entry) => entry.pluginKey));\n\tconst registeredAt = Date.now();\n\tconst entries: EndpointEntry[] = [];\n\tfor (const [key] of ctx.graph.nodes) {\n\t\tif (routablePluginKeys.has(String(key))) continue;\n\t\tconst resolved = readResolvedSync(ctx.registry, key);\n\t\tif (resolved === undefined) continue;\n\t\tfor (const event of operationalEndpointEventsFromResolvedValue(key, resolved, registeredAt)) {\n\t\t\tentries.push(manifestEndpointEntryFromOperationalEndpoint(event.endpoint));\n\t\t}\n\t}\n\treturn entries;\n};\n\nexport const buildProductionPostAcquireHook = (\n\toptions: {\n\t\treadonly extras?: ManifestExtrasInput;\n\t\t/** Dev-`up` only: the STATIC (id-free) codegen contributions to re-emit\n\t\t * the committed `src/generated` tree from when a Move-source edit\n\t\t * reacquires a package — the same decls the stack-free `codegen` verb\n\t\t * derives (`deriveContributions(stack.members)`), NOT the live ones\n\t\t * (which would bake on-chain ids into `config.ts`). Omitted for\n\t\t * `apply` / `runStack`, where the committed tree is an input. /\n\t\treadonly emitBindings?: ReadonlyArray<Codegenable>;\n\t} = {},\n): Effect.Effect<\n\tSupervisorPostAcquireHook,\n\tnever,\n\t\| CodegenOrchestratorService\n\t\| CodegenPathsService\n\t\| FileSystem.FileSystem\n\t\| StackPathsService\n\t\| PostAcquireTasksService\n\t\| ManifestEndpointRegistryService\n\t\| MoveSummaryRunnerService\n\t\| MoveCodegenService\n> =>\n\tEffect.gen(function () {\n\t\tconst codegen = yield* CodegenOrchestratorService;\n\t\tconst paths = yield* CodegenPathsService;\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst stackPaths = yield* StackPathsService;\n\t\tconst postAcquireTasks = yield* PostAcquireTasksService;\n\t\tconst manifestEndpoints = yield* ManifestEndpointRegistryService;\n\t\t// Yielded here (outside the per-ctx hook) so the dev-`up` bindings\n\t\t// refresh below can provide them to `emitBindings`.\n\t\tconst moveRunner = yield* MoveSummaryRunnerService;\n\t\tconst moveCodegen = yield* MoveCodegenService;\n\t\treturn (ctx) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst extras = yield* resolveManifestExtras(options.extras, makeManifestExtrasContext(ctx));\n\t\t\t\tconst routableEndpoints = yield* manifestEndpoints.entries;\n\t\t\t\tconst endpoints = [\n\t\t\t\t\t...routableEndpoints,\n\t\t\t\t\t...operationalManifestEndpointEntries(ctx, routableEndpoints),\n\t\t\t\t];\n\t\t\t\t// Boot no longer runs codegen. Its only job is to PRODUCE the\n\t\t\t\t// deployment (loadable on-chain ids), which the Vite plugin injects\n\t\t\t\t// via `__DEVSTACK_DEPLOYMENT__` in dev. The committed `src/generated` tree\n\t\t\t\t// is written ONLY by the stack-free `devstack codegen` verb.\n\t\t\t\t// Assemble the deployment from the SAME live-resolved contributions\n\t\t\t\t// that fed `config.ts` and write it to the gitignored\n\t\t\t\t// `.devstack/stacks/<stack>/`.\n\t\t\t\tconst deployment = yield* codegen.assembleDeployment(String(ctx.identity.network)).pipe(\n\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t(cause) =>\n\t\t\t\t\t\t\tnew CodegenWriteFailed({\n\t\t\t\t\t\t\t\toutputPath: DEPLOYMENT_FILENAME,\n\t\t\t\t\t\t\t\tstage: 'write',\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tconst deploymentFile = join(stackPaths.stackRoot, DEPLOYMENT_FILENAME);\n\t\t\t\tyield* writeDeployment(deploymentFile, deployment).pipe(\n\t\t\t\t\tEffect.provideService(FileSystem.FileSystem, fs),\n\t\t\t\t);\n\t\t\t\tconst envelope = yield* buildEnvelope({\n\t\t\t\t\tidentity: {\n\t\t\t\t\t\tapp: ctx.identity.app,\n\t\t\t\t\t\tstack: ctx.identity.stack,\n\t\t\t\t\t\tnetwork: ctx.identity.network,\n\t\t\t\t\t},\n\t\t\t\t\tendpoints,\n\t\t\t\t\textras,\n\t\t\t\t\t// Record the live `deploymentFile` the plugin injects as\n\t\t\t\t\t// `__DEVSTACK_DEPLOYMENT__`. Bindings are NOT recorded:\n\t\t\t\t\t// `@generated` always resolves to the committed `src/generated`\n\t\t\t\t\t// tree written by the stack-free `codegen` verb. The dev-wallet\n\t\t\t\t\t// connection + dev accounts ride the deployment envelope's\n\t\t\t\t\t// `values` / `accounts` channels (no separate dev tree).\n\t\t\t\t\tcodegen: { deploymentFile },\n\t\t\t\t});\n\t\t\t\tconst manifestPath = join(stackPaths.stackRoot, 'manifest.json');\n\t\t\t\tyield* writeManifest(envelope, manifestPath).pipe(\n\t\t\t\t\tEffect.provideService(FileSystem.FileSystem, fs),\n\t\t\t\t);\n\t\t\t\t// Dev-`up` only: regenerate the committed `src/generated` tree from\n\t\t\t\t// the STATIC (id-free) contributions so an edited Move package's new\n\t\t\t\t// struct/function shapes reach the app (Vite HMRs the changed TS)\n\t\t\t\t// WITHOUT baking the live on-chain id into `config.ts`.\n\t\t\t\t// `runEmitCycle` is content-addressed, so the initial boot and any\n\t\t\t\t// no-op reacquire leave the tree (and its mtimes) untouched.\n\t\t\t\tconst bindingFiles: string[] = [];\n\t\t\t\tif (options.emitBindings !== undefined) {\n\t\t\t\t\tconst emitted = yield* codegen\n\t\t\t\t\t\t.emitBindings(options.emitBindings)\n\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\tEffect.provideService(FileSystem.FileSystem, fs),\n\t\t\t\t\t\t\tEffect.provideService(CodegenPathsService, paths),\n\t\t\t\t\t\t\tEffect.provideService(MoveSummaryRunnerService, moveRunner),\n\t\t\t\t\t\t\tEffect.provideService(MoveCodegenService, moveCodegen),\n\t\t\t\t\t\t);\n\t\t\t\t\tbindingFiles.push(...emitted.filesWritten, ...emitted.filesChmod);\n\t\t\t\t}\n\t\t\t\tyield* postAcquireTasks.runAll;\n\t\t\t\treturn [\n\t\t\t\t\t{\n\t\t\t\t\t\ttag: 'manifest.flushed' as const,\n\t\t\t\t\t\tmanifestVersion: CURRENT_MANIFEST_VERSION,\n\t\t\t\t\t\tat: Date.now(),\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\ttag: 'codegen.emitted' as const,\n\t\t\t\t\t\tfiles: [deploymentFile, ...bindingFiles],\n\t\t\t\t\t\tat: Date.now(),\n\t\t\t\t\t},\n\t\t\t\t];\n\t\t\t});\n\t});\n\n// ───────────────────────────────────────────────────────────────────────────\n// Built-in plugin runtime composition\n//\n// Depends on L2 plugin internals (coin/package registries), so it can't live\n// at L1 runtime — hence its home in this L3 boot module.\n// ───────────────────────────────────────────────────────────────────────────\n\n/** Built-in plugin runtime: the per-stack coin + package registries.\n * Coin auto-discovery from a fresh package publish now runs DIRECTLY in\n * the package plugin's `start` (folding the publish output into the\n * CoinRegistry), so the registries are the whole surface. /\nexport const layerBuiltInPluginRuntime: Layer.Layer<CoinRegistryService \| PackageRegistryService> =\n\tLayer.mergeAll(layerCoinRegistry, layerPackageRegistry);\n\nexport const extendBuiltInPluginContext = (\n\tctx: Context.Context<never>,\n): Effect.Effect<\n\tContext.Context<never>,\n\tnever,\n\tCoinRegistryService \| PackageRegistryService \| SnapshotOrchestratorService \| FileSystem.FileSystem\n> =>\n\tEffect.gen(function () {\n\t\tconst coinRegistry = yield* CoinRegistryService;\n\t\tconst packageRegistry = yield* PackageRegistryService;\n\t\t// Thread the snapshot orchestrator + filesystem into the plugin\n\t\t// runtime context so the supervisor can populate the control-plane\n\t\t// `domain` surface (snapshot list/restore/delete, which never\n\t\t// round-trip through the void `publishCommand`). The\n\t\t// `ContainerRuntimeService` the domain also needs is already in the\n\t\t// base substrate plugin context.\n\t\tconst snapshotOrchestrator = yield* SnapshotOrchestratorService;\n\t\tconst fileSystem = yield* FileSystem.FileSystem;\n\t\treturn ctx.pipe(\n\t\t\tContext.add(CoinRegistryService, coinRegistry),\n\t\t\tContext.add(PackageRegistryService, packageRegistry),\n\t\t\tContext.add(SnapshotOrchestratorService, snapshotOrchestrator),\n\t\t\tContext.add(FileSystem.FileSystem, fileSystem),\n\t\t) as Context.Context<never>;\n\t});\n\n// ───────────────────────────────────────────────────────────────────────────\n// Production supervised-boot assembly — THE single dedup site\n// ───────────────────────────────────────────────────────────────────────────\n\n/** The per-caller inputs to {@link superviseStackWithProductionBoot} — the\n * fields that GENUINELY differ between the long-running programmatic seam\n * (`api/run-stack-internal.ts`) and the one-shot CLI verbs (`apply` /\n * `snapshot`). Everything else — the contribution dispatcher, the\n * post-acquire hook, and the built-in plugin-context extension — is\n * assembled identically by the helper, so it lives in ONE place. /\nexport interface ProductionBootOptions<HookR = Scope.Scope, HookE = never, ExtendR = never> {\n\t/* `'one-shot'` runs the acquire/codegen cycle then returns; the default\n\t * `'long-running'` supervises until shutdown. /\n\treadonly lifetime?: 'long-running' \| 'one-shot';\n\treadonly devstackVersion?: string;\n\t/* Threaded into `buildProductionPostAcquireHook` — the stack's manifest\n\t * `extras`. All three callers pass `stack.options.extras`. /\n\treadonly extras?: ManifestExtrasInput;\n\t/* Dev-`up` only: the STATIC (id-free) codegen contributions used to\n\t * regenerate the committed `src/generated` tree in the post-acquire hook\n\t * when a Move-source edit reacquires a package. Threaded from the `up`\n\t * seam (`deriveContributions(stack.members)`); `apply` / `snapshot` leave\n\t * it off so they never rewrite the committed tree. /\n\treadonly emitBindings?: ReadonlyArray<Codegenable>;\n\t/* The resolved supervisor command handler (run-stack's snapshot bridge).\n\t * One-shot verbs run no command loop, so they pass nothing. /\n\treadonly commandHandler?: SupervisorCommandHandler;\n\treadonly beforeInitialAcquire?: (handle: SupervisorHandle) => Effect.Effect<void, HookE, HookR>;\n\treadonly withinScope?: (handle: SupervisorHandle) => Effect.Effect<void, HookE, HookR>;\n\t/* Caller plugin-context extension layered AFTER the built-in\n\t * (`extendBuiltInPluginContext`). Only the programmatic seam uses it (to\n\t * honor the public `runStack({ extendContext })`); the CLI verbs omit it\n\t * and get the built-in extension alone. /\n\treadonly extendContextAfterBuiltIn?: (\n\t\tctx: Context.Context<never>,\n\t) => Effect.Effect<Context.Context<never>, never, ExtendR>;\n}\n\n/\n THE single site that assembles the production supervised body. It builds\n * the contribution dispatcher + post-acquire hook + built-in plugin-context\n * extension ONCE and hands them to {@link superviseStackEffect}, then\n * provides {@link layerBuiltInPluginRuntime}. Before this helper, the same\n * three-piece assembly was hand-rolled in three call sites\n * (`api/run-stack-internal.ts`, `cli/wirings/apply.ts`,\n * `cli/wirings/snapshot.ts`); now they all route through here and only\n * supply what genuinely differs ({@link ProductionBootOptions}).\n \n Each caller keeps its OWN lifetime-specific wrapping: the programmatic\n * seam wraps the returned effect in a `forkDetach` handle (long-running);\n * the CLI verbs run it to completion with their existing teardown + result\n * semantics (one-shot). This helper does NOT collapse those — it only\n * dedups the assembly the `superviseStackEffect` call sites shared.\n \n The return type is inferred (like `superviseStackEffect`): its R-channel\n * is the union of every substrate/orchestrator service the dispatcher /\n * hook / extension read, MINUS the built-in registries `layerBuiltInPluginRuntime`\n * supplies, PLUS the caller hook `HookR` / extend `ExtendR` channels.\n /\nexport const superviseStackWithProductionBoot = <\n\tHookR = Scope.Scope,\n\tHookE = never,\n\tExtendR = never,\n>(\n\tstack: SupervisedStack,\n\tidentity: Identity,\n\tstate: SubscriptionRef.SubscriptionRef<import('../substrate/projection.ts').SubscribableState>,\n\topts: ProductionBootOptions<HookR, HookE, ExtendR> = {},\n) =>\n\tEffect.gen(function () {\n\t\tconst contributionDispatcher = yield* buildProductionContributionDispatcher();\n\t\tconst postAcquireHook = yield* buildProductionPostAcquireHook({\n\t\t\t...(opts.extras === undefined ? {} : { extras: opts.extras }),\n\t\t\t...(opts.emitBindings === undefined ? {} : { emitBindings: opts.emitBindings }),\n\t\t});\n\t\tyield* superviseStackEffect(stack, identity, state, {\n\t\t\tcontributionDispatcher,\n\t\t\tpostAcquireHook,\n\t\t\t...(opts.lifetime === undefined ? {} : { lifetime: opts.lifetime }),\n\t\t\t...(opts.devstackVersion === undefined ? {} : { devstackVersion: opts.devstackVersion }),\n\t\t\t...(opts.commandHandler === undefined ? {} : { commandHandler: opts.commandHandler }),\n\t\t\t...(opts.beforeInitialAcquire === undefined\n\t\t\t\t? {}\n\t\t\t\t: { beforeInitialAcquire: opts.beforeInitialAcquire }),\n\t\t\t...(opts.withinScope === undefined ? {} : { withinScope: opts.withinScope }),\n\t\t\t// Built-in plugin-context extension ALWAYS runs; a caller extension\n\t\t\t// (the programmatic seam's `opts.extendContext`) chains AFTER it.\n\t\t\textendContext: (ctx) =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst builtInContext = yield* extendBuiltInPluginContext(ctx);\n\t\t\t\t\treturn opts.extendContextAfterBuiltIn === undefined\n\t\t\t\t\t\t? builtInContext\n\t\t\t\t\t\t: yield* opts.extendContextAfterBuiltIn(builtInContext);\n\t\t\t\t}),\n\t\t}).pipe(Effect.provide(layerBuiltInPluginRuntime));\n\t});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiIA,MAAa,wBAAwB,UAAoB,gBAAwB;CAIhF,MAAM,6BACL,MAAM,OACL,eACA,OAAO,IAAI,aAAa;EACvB,OAAO,OAAO;CACf,CAAC,CACF;CAED,MAAM,eAAe,MAAM,SAC1B,cAAc,QAAQ,GACtB,iBAAiB,WAAW,GAC5B,SAAS,OACT,eAAe,OACf,wBACA,yBACA,qBACD;CAEA,MAAM,2BAA2B,wBAAwB,MAAM,KAC9D,MAAM,aAAa,YAAY,CAChC;CACA,MAAM,iBAAiB,gBAAgB,KAAK,MAAM,aAAa,wBAAwB,CAAC;CACxF,MAAM,YAAY,WAAW,KAAK,MAAM,aAAa,cAAc,CAAC;CACpE,MAAM,iBAAiB,gBAAgB,KAAK,MAAM,aAAa,SAAS,CAAC;CACzE,MAAM,kBAAkB,iBAAiB,KAAK,MAAM,aAAa,cAAc,CAAC;CAChF,MAAM,qBAAqB,2BAA2B,KAAK,MAAM,aAAa,eAAe,CAAC;CAC9F,MAAM,uBAAuB,4BAA4B,KACxD,MAAM,aAAa,kBAAkB,CACtC;CACA,MAAM,uBAAuB,sBAAsB,KAAK,MAAM,aAAa,oBAAoB,CAAC;CAChG,OAAO,YAAY,KAAK,MAAM,aAAa,oBAAoB,CAAC;AACjE;;;;;;AAOA,MAAM,2BAcL,OAAO,IAAI,aAAa;CACvB,MAAM,cAAc,OAAO;CAC3B,MAAM,sBAAsB,OAAO;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,OAAO;CACxB,MAAM,mBAAmB,OAAO;CAChC,MAAM,aAAa,OAAO;CAC1B,MAAM,cAAc,OAAO;CAC3B,MAAM,mBAAmB,OAAO;CAChC,MAAM,SAAS,OAAOA;CAEtB,OAAO,QAAQ,MAAM,CAAC,CAAC,KACtB,QAAQ,IAAI,iBAAiB,WAAW,GACxC,QAAQ,IAAI,aAAa,mBAAmB,GAC5C,QAAQ,IAAI,mBAAmB,UAAU,GACzC,QAAQ,IAAI,cAAc,KAAK,GAC/B,QAAQ,IAAI,yBAAyB,QAAQ,GAC7C,QAAQ,IAAI,yBAAyB,gBAAgB,GACrD,QAAQ,IAAI,mBAAmB,UAAU,GACzC,QAAQ,IAAI,oBAAoB,WAAW,GAC3C,QAAQ,IAAI,yBAAyB,gBAAgB,GACrD,QAAQ,IAAIA,UAAQ,MAAM,CAC3B;AACD,CAAC;;;;;AAkCF,MAAa,wBACZ,OACA,UACA,OACA,OAAiD,CAAC,MAElD,OAAO,IAAI,aAAa;CACvB,OAAO,OAAO,OAAO,OACpB,OAAO,IAAI,aAAa;EACvB,MAAM,cAAc,OAAO,mBAAmB;EAI9C,MAAM,UAAU,OAAO,gBACtB,OACA,UACA,OALA,KAAK,kBAAkB,KAAA,IAAY,cAAc,OAAO,KAAK,cAAc,WAAW,GAOtF,KAAK,wBACL,KAAK,gBACL,KAAK,iBACL;GACC,aAAa,KAAK,aAAa;GAC/B,GAAI,KAAK,oBAAoB,KAAA,IAC1B,CAAC,IACD,EAAE,iBAAiB,KAAK,gBAAgB;EAC5C,CACD;EACA,MAAM,EAAE,WAAW;EACnB,IAAI,KAAK,yBAAyB,KAAA,GACjC,OAAO,KAAK,qBAAqB,MAAM;EAExC,IAAI,KAAK,aAAa,YAAY;GAWjC,OAAO,QAAQ;GACf,OAAO,mBAAmB,QAAQ,OAAO,OAAO,QAAQ,OAAO,QAAQ;GACvE,IAAI,KAAK,gBAAgB,KAAA,GACxB,OAAO,KAAK,YAAY,MAAM;GAE/B;EACD;EAKA,KAAI,OAJmB,OAAO,UAC7B,QAAQ,kBAAkB,KAAK,OAAO,GAAG,QAAiB,CAAC,GAC3D,OAAO,cAAc,KAAK,OAAO,GAAG,UAAmB,CAAC,CACzD,OACgB,YACf;EAED,IAAI,KAAK,gBAAgB,KAAA,GACxB,OAAO,KAAK,YAAY,MAAM;EAE/B,OAAO,OAAO;CACf,CAAC,CACF;AACD,CAAC;;;;;;;;;;AA2BF,MAAa,mCAAmC,UAOhB;CAM/B,OAAO;EACN,SAAS,MAAM;EAGf,GAAI,MAAM,SAAS,iCAAiC,KAAA,IACjD,CAAC,IACD,EAAE,8BAA8B,MAAM,QAAQ,6BAA6B;CAC/E;AACD;AAOA,IAAa,kCAAb,cAAqD,QAAQ,QAM3D,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC;AAEzD,MAAa,gCACZ,MAAM,OACL,iCACA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO,IAAI,KAC7B,CAAC,CACF;CACA,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;CAEhC,MAAM,YAAY,UACjB,OAAO,IAAI,aAAa;EACvB,MAAM,MAAM,OAAO,IAAI,aAAa,SAAS,MAAM,IAAI,CAAC;EACxD,OAAO,IAAI,OAAO,aAAa,YAAY,CAAC,GAAG,SAAS;GAAE,GAAG;GAAO;EAAI,CAAC,CAAC;EAC1E,OAAO,OAAO,mBACb,IAAI,OAAO,aAAa,YACvB,QAAQ,QAAQ,cAAc,UAAU,QAAQ,GAAG,CACpD,CACD;CACD,CAAC;CAEF,OAAO,gCAAgC,GAAG;EACzC;EACA,SAAS,IAAI,IAAI,UAAU,CAAC,CAAC,KAC5B,OAAO,KAAK,YACX,QAAQ,KAAK,iBAAiB;GAC7B,MAAM,EAAE,KAAK,GAAG,UAAU;GAE1B,OAAO;EACR,CAAC,CACF,CACD;CACD,CAAC;AACF,CAAC,CACF;AAED,MAAa,2BAA2B,UAAuC,CAAC,MAC/E,yBAAyB,OAAO;;;;;;;;AASjC,MAAM,8BAA8B,YAA4B,QAAQ,SAAS,eAAe;AAEhG,MAAa,gCAAgC,SAAkC,CAAC,MAAM;CACrF,MAAM,UAAU,wBAAwB;CACxC,OAAO,MAAM,SACZ,2BACA,+BACA,mBAAmB,KAClB,MAAM,aACL,MAAM,SACL,wBAAwB,oBAAoB,GAC5C,gCACA,4BAA4B,OAAO,GACnC,yBAAyB;EACxB,UAAU,OAAO,YAAY;EAC7B;EACA,OAAO;EACP,qBAAqB,EACpB,SAAS,OAAO,aAAa,KAC9B;CACD,CAAC,CACF,CACD,CACD,GACA,0BACA,kBAAkB,KACjB,MAAM,aACL,iBAAiB;EAChB,WAAW,2BAA2B,OAAO,SAAS,WAAW,QAAQ,IAAI,CAAC;EAC9E,aAAa;CACd,CAAC,CACF,CACD,GACA,iCACA,uBAAuB,EACtB,8BAA8B,OAAO,SAAS,6BAC/C,CAAC,CACF;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,0BACZ,MACA,OACA,WACA,eAAe,KAAK,IAAI,MACpB;CACJ,MAAM,MACL,MAAM,iBAAiB,QACpB,mBAAmB,MAAM,mBACzB,UAAU,MAAM,SAAS,GAAG,MAAM;CACtC,MAAM,SAAS;EACd,MAAM,KAAK;EACX;EACA,YAAY;EACZ,cAAc,MAAM;CACrB;CACA,MAAM,oBAAoB,GAAG,UAAU,GAAG,KAAK;CAC/C,MAAM,QAAuE;EAC5E,KAAK;EACL,UAAU;GACT,GAAG;GACH,aAAa,YAAY,iBAAiB;GAC1C;GACA;EACD;CACD;CACA,OAAO;EACN;EACA,eAAe;GACd,GAAG;GACH,aAAa;GACb,WAAW,OAAO,SAAS;EAC5B;EACA;CACD;AACD;AAEA,MAAM,gDACL,cACoB;CACpB,aAAa,OAAO,SAAS,WAAW;CACxC,MAAM,SAAS;CACf,KAAK,SAAS;CACd,YAAY,SAAS;CACrB,cAAc,SAAS;CACvB,WAAW,OAAO,SAAS,SAAS;AACrC;;;;AAKA,MAAM,sBACL,MACA,QACuC;CACvC,MAAM,UAAU,KAAK,MAAM;CAC3B,MAAM,oBACL,YAAY,QACZ,OAAO,YAAY,YACnB,YAAY,WACX,QAAgC,WAAW,OACzC;EAAE,GAAG;EAAS,QAAQ,IAAI;CAAU,IACpC;CACJ,OAAO,IAAI,QAAQ;EAClB,GAAG,KAAK;EACR,SAAS;CACV,CAAC;AACF;;;;AAKA,MAAM,+BACL,MACA,QAEA,OAAO,IAAI,aAAa;CACvB,OAAO,IAAI,iBAAiB,SAAS,KAAK,eAAe,KAAK,UAAU;EACvE,aAAa,KAAK;EAClB,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;CAClE,CAAC;CACD,OAAO,IAAI,QAAQ;EAClB,KAAK;EACL,eAAe,KAAK;EACpB,aAAa,KAAK;EAClB,IAAI,KAAK,IAAI;CACd,CAAC;CACD,OAAO,OAAO,mBACb,IAAI,QAAQ;EACX,KAAK;EACL,eAAe,KAAK;EACpB,IAAI,KAAK,IAAI;CACd,CAAC,CACF;AACD,CAAC;;;;;;;;;AAUF,MAAa,8CAQZ,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,OAAO;CACxB,MAAM,SAAS,OAAO;CACtB,MAAM,UAAU,OAAO;CACvB,MAAM,oBAAoB,OAAO;CACjC,OAAO;EACN,eAAe,MAAwB,QACtC,SAAS,oBAAoB,IAAI,WAAW,IAAI;EACjD,WAAW,MAAoB,QAC9B,OAAO,KAAK,CAAC,CAAC,KAIb,OAAO,QAAQ,OAAO,gBAAgB,IAAI,CAAC,GAC3C,OAAO,SAAS,UAAU;GAIzB,MAAM,QAAQ,uBAAuB,MAAM,OAAO,IAAI,SAAS;GAC/D,OAAO,kBACL,SAAS,MAAM,aAAa,CAAC,CAC7B,KAAK,OAAO,QAAQ,IAAI,QAAQ,MAAM,KAAK,CAAC,CAAC;EAChD,CAAC,CACF;EACD,cAAc,MAAmB,QAAQ,QAAQ,qBAAqB,IAAI,WAAW,IAAI;EACzF,aAAa,MAAsB,QAAQ,mBAAmB,MAAM,GAAG;EACvE,sBAAsB,MAAgD,QACrE,4BAA4B,MAAM,GAAG;CACvC;AACD,CAAC;AAEF,MAAM,6BAA6B,QAAsC;CACxE,MAAM,kCAAkB,IAAI,IAAuB;CACnD,KAAK,MAAM,CAAC,KAAK,SAAS,IAAI,MAAM,OACnC,gBAAgB,IAAI,KAAK,OAAO,IAAI,GAAG;CAUxC,MAAM,UAAU,eAAgC;EAC/C,MAAM,MAAM,gBAAgB,IAAI,UAAU;EAC1C,IAAI,QAAQ,KAAA,GACX,MAAM,IAAI,0BAA0B;GACnC,MAAM;GACN;EACD,CAAC;EAEF,MAAM,WAAW,iBAAiB,IAAI,UAAU,GAAG;EACnD,IAAI,aAAa,KAAA,GAChB,MAAM,IAAI,0BAA0B;GACnC,MAAM;GACN;EACD,CAAC;EAEF,OAAO;CACR;CACA,OAAO,EACN,QAAQ,aAAsC,OAAO,SAAS,EAAE,EACjE;AACD;AAEA,MAAM,sCACL,KACA,oBACkC;CAClC,MAAM,qBAAqB,IAAI,IAAI,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC;CAClF,MAAM,eAAe,KAAK,IAAI;CAC9B,MAAM,UAA2B,CAAC;CAClC,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,OAAO;EACpC,IAAI,mBAAmB,IAAI,OAAO,GAAG,CAAC,GAAG;EACzC,MAAM,WAAW,iBAAiB,IAAI,UAAU,GAAG;EACnD,IAAI,aAAa,KAAA,GAAW;EAC5B,KAAK,MAAM,SAAS,2CAA2C,KAAK,UAAU,YAAY,GACzF,QAAQ,KAAK,6CAA6C,MAAM,QAAQ,CAAC;CAE3E;CACA,OAAO;AACR;AAEA,MAAa,kCACZ,UASI,CAAC,MAaL,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO;CACvB,MAAM,QAAQ,OAAO;CACrB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,aAAa,OAAO;CAC1B,MAAM,mBAAmB,OAAO;CAChC,MAAM,oBAAoB,OAAO;CAGjC,MAAM,aAAa,OAAO;CAC1B,MAAM,cAAc,OAAO;CAC3B,QAAQ,QACP,OAAO,IAAI,aAAa;EACvB,MAAM,SAAS,OAAO,sBAAsB,QAAQ,QAAQ,0BAA0B,GAAG,CAAC;EAC1F,MAAM,oBAAoB,OAAO,kBAAkB;EACnD,MAAM,YAAY,CACjB,GAAG,mBACH,GAAG,mCAAmC,KAAK,iBAAiB,CAC7D;EAQA,MAAM,aAAa,OAAO,QAAQ,mBAAmB,OAAO,IAAI,SAAS,OAAO,CAAC,CAAC,CAAC,KAClF,OAAO,UACL,UACA,IAAI,mBAAmB;GACtB,YAAY;GACZ,OAAO;GACP;EACD,CAAC,CACH,CACD;EACA,MAAM,iBAAiB,KAAK,WAAW,WAAW,mBAAmB;EACrE,OAAO,gBAAgB,gBAAgB,UAAU,CAAC,CAAC,KAClD,OAAO,eAAe,WAAW,YAAY,EAAE,CAChD;EAkBA,OAAO,cAAc,OAjBG,cAAc;GACrC,UAAU;IACT,KAAK,IAAI,SAAS;IAClB,OAAO,IAAI,SAAS;IACpB,SAAS,IAAI,SAAS;GACvB;GACA;GACA;GAOA,SAAS,EAAE,eAAe;EAC3B,CAAC,GACoB,KAAK,WAAW,WAAW,eACN,CAAC,CAAC,CAAC,KAC5C,OAAO,eAAe,WAAW,YAAY,EAAE,CAChD;EAOA,MAAM,eAAyB,CAAC;EAChC,IAAI,QAAQ,iBAAiB,KAAA,GAAW;GACvC,MAAM,UAAU,OAAO,QACrB,aAAa,QAAQ,YAAY,CAAC,CAClC,KACA,OAAO,eAAe,WAAW,YAAY,EAAE,GAC/C,OAAO,eAAe,qBAAqB,KAAK,GAChD,OAAO,eAAe,0BAA0B,UAAU,GAC1D,OAAO,eAAe,oBAAoB,WAAW,CACtD;GACD,aAAa,KAAK,GAAG,QAAQ,cAAc,GAAG,QAAQ,UAAU;EACjE;EACA,OAAO,iBAAiB;EACxB,OAAO,CACN;GACC,KAAK;GACL,iBAAA;GACA,IAAI,KAAK,IAAI;EACd,GACA;GACC,KAAK;GACL,OAAO,CAAC,gBAAgB,GAAG,YAAY;GACvC,IAAI,KAAK,IAAI;EACd,CACD;CACD,CAAC;AACH,CAAC;;;;;AAaF,MAAa,4BACZ,MAAM,SAAS,mBAAmB,oBAAoB;AAEvD,MAAa,8BACZ,QAMA,OAAO,IAAI,aAAa;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,kBAAkB,OAAO;CAO/B,MAAM,uBAAuB,OAAO;CACpC,MAAM,aAAa,OAAO,WAAW;CACrC,OAAO,IAAI,KACV,QAAQ,IAAI,qBAAqB,YAAY,GAC7C,QAAQ,IAAI,wBAAwB,eAAe,GACnD,QAAQ,IAAI,6BAA6B,oBAAoB,GAC7D,QAAQ,IAAI,WAAW,YAAY,UAAU,CAC9C;AACD,CAAC;;;;;;;;;;;;;;;;;;;;;;AA6DF,MAAa,oCAKZ,OACA,UACA,OACA,OAAqD,CAAC,MAEtD,OAAO,IAAI,aAAa;CAMvB,OAAO,qBAAqB,OAAO,UAAU,OAAO;EACnD,wBAAA,OANqC,sCAAsC;EAO3E,iBAAA,OAN8B,+BAA+B;GAC7D,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;GAC3D,GAAI,KAAK,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,KAAK,aAAa;EAC9E,CAAC;EAIA,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;EACjE,GAAI,KAAK,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,gBAAgB;EACtF,GAAI,KAAK,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,eAAe;EACnF,GAAI,KAAK,yBAAyB,KAAA,IAC/B,CAAC,IACD,EAAE,sBAAsB,KAAK,qBAAqB;EACrD,GAAI,KAAK,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY;EAG1E,gBAAgB,QACf,OAAO,IAAI,aAAa;GACvB,MAAM,iBAAiB,OAAO,2BAA2B,GAAG;GAC5D,OAAO,KAAK,8BAA8B,KAAA,IACvC,iBACA,OAAO,KAAK,0BAA0B,cAAc;EACxD,CAAC;CACH,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,yBAAyB,CAAC;AAClD,CAAC"}
1	+ {"version":3,"file":"boot.mjs","names":["Logger"],"sources":["../../src/orchestrators/boot.ts"],"sourcesContent":["// Single L3 boot seam.\n//\n// Consumed by both the CLI verb wirings (`cli/wirings/`) and the\n// library-facing programmatic surface (`api/run-stack.ts`), plus the e2e\n// boot harness.\n//\n// Composes the substrate Layer stack (L0) + the Docker `ContainerRuntime`\n// adapter (L1), yields the substrate services into a `Context.Context<never>`\n// pluginContext, builds the projection ref, and runs `supervise()` inside a\n// scope. The production orchestrator assembly (Snapshot/Router/Codegen/\n// ManifestEndpoint) and the contribution-delivery dispatcher live here too —\n// the supervisor holds the dispatcher record opaquely (it never imports an\n// orchestrator service).\n//\n// Architecture: this is L3 (orchestrator-level). Layer composition that\n// assembles L0+L1 stacks belongs at L3/L4 — it can't live in `substrate/`\n// because it imports a concrete L1 adapter (Docker) by definition; and it\n// depends on L2 plugin internals (coin/package registries), so it can't live\n// at L1 runtime either. See ARCHITECTURE.md § \"Layer composition belongs at\n// L3/L4, not L0\" and § \"L1-never-imports-from-L2\".\n\nimport { Context, Effect, FileSystem, Layer, Ref, Scope, SubscriptionRef } from 'effect';\nimport { join, resolve } from 'node:path';\nimport as NodeFileSystem from '@effect/platform-node/NodeFileSystem';\nimport * as NodePath from '@effect/platform-node/NodePath';\nimport * as NodeChildProcessSpawner from '@effect/platform-node/NodeChildProcessSpawner';\nimport { ChildProcessSpawner } from 'effect/unstable/process/ChildProcessSpawner';\n\nimport type { Identity } from '../substrate/identity.ts';\nimport { CacheService, layerCache } from '../substrate/runtime/cache/index.ts';\nimport { LeaseBrokerService, layerLeaseBroker } from '../substrate/runtime/lease-broker/index.ts';\nimport {\n\tIdentityContext,\n\tRuntimeRoot,\n\tStackPathsService,\n\tlayerIdentity,\n\tlayerRuntimeRoot,\n\tlayerStackPaths,\n} from '../substrate/runtime/paths.ts';\nimport { PortBrokerService, layerPortBroker } from '../substrate/runtime/port-broker/index.ts';\nimport {\n\tStrategyRegistryService,\n\tlayerStrategyRegistry,\n} from '../substrate/runtime/strategy-registry/index.ts';\nimport {\n\tContainerRuntimeService,\n\tDockerSpawner,\n\tlayerContainerRuntimeDocker,\n\tlayerDockerCycleInitial,\n\tlayerDockerHostDefault,\n} from '../runtime/docker/index.ts';\nimport { readResolvedSync } from '../substrate/runtime/lifecycle/index.ts';\nimport { operationalEndpointEventsFromResolvedValue } from '../substrate/runtime/projection/operational-endpoints.ts';\nimport { Logger, layerLogger } from '../substrate/runtime/observability/index.ts';\nimport {\n\tPostAcquireTasksService,\n\tlayerPostAcquireTasks,\n} from '../substrate/runtime/post-acquire-tasks.ts';\nimport {\n\tallReadyOrTerminal,\n\tstartSupervisor,\n\ttype ContributionDispatcher,\n\ttype SupervisedStack,\n\ttype SupervisorCommandHandler,\n\ttype SupervisorHandle,\n\ttype SupervisorPostAcquireHook,\n} from '../substrate/runtime/supervisor/index.ts';\nimport type { ContributionDispatchContext } from '../substrate/runtime/supervisor/contribution-dispatcher.ts';\nimport type { SupervisorPostAcquireContext } from '../substrate/runtime/supervisor/index.ts';\n\nimport {\n\tlayerMystenMoveCodegen,\n\tMoveCodegenService,\n\tMoveSummaryRunnerService,\n} from './codegen/bindings.ts';\nimport { layerSuiMoveSummaryRunnerDocker } from '../plugins/sui/move-summary-runner.ts';\nimport { CodegenPathsService, layerCodegenPaths, layerCodegenRoot } from './codegen/paths.ts';\nimport {\n\tCodegenOrchestratorService,\n\tlayerCodegenOrchestrator,\n\ttype Codegenable,\n} from './codegen/service.ts';\nimport { CodegenWriteFailed } from './codegen/errors.ts';\nimport { DEPLOYMENT_FILENAME, writeDeployment } from './codegen/deployment.ts';\nimport {\n\tDEFAULT_TRAEFIK_IMAGE,\n\tlayerDockerUpstreamResolver,\n\tlayerEntrypointRegistry,\n\tlayerRouterConfigLiteral,\n\tlayerRouterService,\n\tlayerTraefikContainerOpsDocker,\n\tRouterService,\n\ttype ResolvedRoute,\n} from './router/index.ts';\nimport { BUILT_IN_ENTRYPOINTS } from '../plugins/router-entrypoints.ts';\nimport {\n\tmakeDefaultRouterProfile,\n\ttype DefaultRouterProfileOptions,\n\ttype RouterProfile,\n} from './router/profile.ts';\nimport { layerSnapshotOrchestrator, SnapshotOrchestratorService } from './snapshot/index.ts';\nimport type { ProjectionDecl } from '../contracts/projection.ts';\nimport type { RoutableDecl } from '../contracts/routable.ts';\nimport type { SnapshotableDecl } from '../contracts/snapshotable.ts';\nimport type { StrategyContributorDecl } from '../contracts/strategy-contributor.ts';\nimport { endpointKey, type PluginKey } from '../substrate/brand.ts';\nimport type { EngineEvent } from '../substrate/events.ts';\nimport {\n\tbuildEnvelope,\n\tCURRENT_MANIFEST_VERSION,\n\twriteManifest,\n} from '../substrate/runtime/manifest/index.ts';\nimport {\n\tManifestExtrasLookupError,\n\tresolveManifestExtras,\n\ttype EndpointEntry,\n\ttype ManifestExtrasInput,\n} from '../substrate/manifest.ts';\nimport { CoinRegistryService, layerCoinRegistry } from '../plugins/coin/registry.ts';\nimport { PackageRegistryService, layerPackageRegistry } from '../plugins/package/registry.ts';\n\n// ───────────────────────────────────────────────────────────────────────────\n// Substrate lifecycle\n// ───────────────────────────────────────────────────────────────────────────\n\n/** Substrate Layer stack for a single supervised run. Composes every L0\n * service the supervisor yields from its R-channel, plus the L1 Docker\n * `ContainerRuntime`. Built-in plugin services are layered outside\n * substrate and added through `extendContext`. /\nexport const buildSubstrateLayers = (identity: Identity, runtimeRoot: string) => {\n\t// DockerSpawner adapts platform-node's ChildProcessSpawner tag onto\n\t// the docker subsystem's local DockerSpawner tag (same shape; the\n\t// indirection only lets tests inject a stub).\n\tconst layerDockerSpawnerFromNode: Layer.Layer<DockerSpawner, never, ChildProcessSpawner> =\n\t\tLayer.effect(\n\t\t\tDockerSpawner,\n\t\t\tEffect.gen(function () {\n\t\t\t\treturn yield* ChildProcessSpawner;\n\t\t\t}),\n\t\t);\n\n\tconst platformBase = Layer.mergeAll(\n\t\tlayerIdentity(identity),\n\t\tlayerRuntimeRoot(runtimeRoot),\n\t\tNodePath.layer,\n\t\tNodeFileSystem.layer,\n\t\tlayerDockerHostDefault,\n\t\tlayerDockerCycleInitial,\n\t\tlayerStrategyRegistry,\n\t);\n\n\tconst childProcessSpawnerWired = NodeChildProcessSpawner.layer.pipe(\n\t\tLayer.provideMerge(platformBase),\n\t);\n\tconst withStackPaths = layerStackPaths.pipe(Layer.provideMerge(childProcessSpawnerWired));\n\tconst withCache = layerCache.pipe(Layer.provideMerge(withStackPaths));\n\tconst withPortBroker = layerPortBroker.pipe(Layer.provideMerge(withCache));\n\tconst withLeaseBroker = layerLeaseBroker.pipe(Layer.provideMerge(withPortBroker));\n\tconst withSpawnerAdapter = layerDockerSpawnerFromNode.pipe(Layer.provideMerge(withLeaseBroker));\n\tconst withContainerRuntime = layerContainerRuntimeDocker.pipe(\n\t\tLayer.provideMerge(withSpawnerAdapter),\n\t);\n\tconst withPostAcquireTasks = layerPostAcquireTasks.pipe(Layer.provideMerge(withContainerRuntime));\n\treturn layerLogger.pipe(Layer.provideMerge(withPostAcquireTasks));\n};\n\n/** Build the opaque `Context.Context<never>` the supervisor hands to\n * every plugin's `acquire` body. Yields every substrate service the\n * Docker-backed substrate layer stack provides; downstream callers\n * may extend the context (e.g. layering the built-in plugin registries\n * via `extendBuiltInPluginContext`) before passing it to `supervise()`. /\nconst buildPluginContext = (): Effect.Effect<\n\tContext.Context<never>,\n\tnever,\n\t\| IdentityContext\n\t\| RuntimeRoot\n\t\| StackPathsService\n\t\| CacheService\n\t\| StrategyRegistryService\n\t\| ContainerRuntimeService\n\t\| PortBrokerService\n\t\| LeaseBrokerService\n\t\| PostAcquireTasksService\n\t\| Logger\n> =>\n\tEffect.gen(function () {\n\t\tconst identityCtx = yield* IdentityContext;\n\t\tconst runtimeRootResolved = yield* RuntimeRoot;\n\t\tconst stackPaths = yield* StackPathsService;\n\t\tconst cache = yield* CacheService;\n\t\tconst registry = yield* StrategyRegistryService;\n\t\tconst containerRuntime = yield* ContainerRuntimeService;\n\t\tconst portBroker = yield* PortBrokerService;\n\t\tconst leaseBroker = yield* LeaseBrokerService;\n\t\tconst postAcquireTasks = yield* PostAcquireTasksService;\n\t\tconst logger = yield* Logger;\n\n\t\treturn Context.empty().pipe(\n\t\t\tContext.add(IdentityContext, identityCtx),\n\t\t\tContext.add(RuntimeRoot, runtimeRootResolved),\n\t\t\tContext.add(StackPathsService, stackPaths),\n\t\t\tContext.add(CacheService, cache),\n\t\t\tContext.add(StrategyRegistryService, registry),\n\t\t\tContext.add(ContainerRuntimeService, containerRuntime),\n\t\t\tContext.add(PortBrokerService, portBroker),\n\t\t\tContext.add(LeaseBrokerService, leaseBroker),\n\t\t\tContext.add(PostAcquireTasksService, postAcquireTasks),\n\t\t\tContext.add(Logger, logger),\n\t\t) as Context.Context<never>;\n\t});\n\n/** Options accepted by the supervised-run entrypoint. `lifetime`\n * selects long-running supervision versus a one-shot acquire/codegen\n * cycle. The `beforeInitialAcquire` hook runs inside the supervised\n * scope before the first acquire starts; live renderers use it to\n * subscribe to startup projection changes. The `withinScope` hook\n * runs after the first acquire completes.\n \n Generic `R` widens the hook R-channel so callers can yield\n * substrate services (e.g. `StackPathsService`) that are in scope at\n * the supervisor-boot site. /\nexport interface SuperviseStackOptions<R = Scope.Scope, ExtendR = never, HookE = never> {\n\treadonly lifetime?: 'long-running' \| 'one-shot';\n\treadonly devstackVersion?: string;\n\treadonly beforeInitialAcquire?: (handle: SupervisorHandle) => Effect.Effect<void, HookE, R>;\n\treadonly withinScope?: (handle: SupervisorHandle) => Effect.Effect<void, HookE, R>;\n\treadonly commandHandler?: SupervisorCommandHandler;\n\treadonly contributionDispatcher?: ContributionDispatcher;\n\treadonly postAcquireHook?: SupervisorPostAcquireHook;\n\t/* Caller-supplied extension layered into `pluginContext` after the\n\t * default substrate context is built. Used by plugin-author Layer\n\t * composition (ARCHITECTURE.md § Plugin-author extension) and by\n\t * the CLI when it wants to inject the built-in plugin registries or\n\t * a custom Logger override. /\n\treadonly extendContext?: (\n\t\tctx: Context.Context<never>,\n\t) => Effect.Effect<Context.Context<never>, never, ExtendR>;\n}\n\n/* Effect that boots the supervisor for `stack` and blocks on the\n * supervisor's shutdown latch. Returns the final `SubscribableState`\n * snapshot so callers (CLI, library handle) can inspect post-shutdown\n * state. /\nexport const superviseStackEffect = <R = Scope.Scope, ExtendR = never, HookE = never>(\n\tstack: SupervisedStack,\n\tidentity: Identity,\n\tstate: SubscriptionRef.SubscriptionRef<import('../substrate/projection.ts').SubscribableState>,\n\topts: SuperviseStackOptions<R, ExtendR, HookE> = {},\n) =>\n\tEffect.gen(function () {\n\t\treturn yield* Effect.scoped(\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst baseContext = yield* buildPluginContext();\n\t\t\t\tconst pluginContext =\n\t\t\t\t\topts.extendContext === undefined ? baseContext : yield* opts.extendContext(baseContext);\n\n\t\t\t\tconst startup = yield* startSupervisor(\n\t\t\t\t\tstack,\n\t\t\t\t\tidentity,\n\t\t\t\t\tstate,\n\t\t\t\t\tpluginContext,\n\t\t\t\t\topts.contributionDispatcher,\n\t\t\t\t\topts.commandHandler,\n\t\t\t\t\topts.postAcquireHook,\n\t\t\t\t\t{\n\t\t\t\t\t\tcommandLoop: opts.lifetime !== 'one-shot',\n\t\t\t\t\t\t...(opts.devstackVersion === undefined\n\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t: { devstackVersion: opts.devstackVersion }),\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t\tconst { handle } = startup;\n\t\t\t\tif (opts.beforeInitialAcquire !== undefined) {\n\t\t\t\t\tyield* opts.beforeInitialAcquire(handle);\n\t\t\t\t}\n\t\t\t\tif (opts.lifetime === 'one-shot') {\n\t\t\t\t\t// `runInitialAcquire` runs `acquireFullGraph` to completion (every\n\t\t\t\t\t// node reaches a terminal status) before it returns. Gate the\n\t\t\t\t\t// one-shot `withinScope` on the SUPERVISOR-OWNED readiness signal\n\t\t\t\t\t// — `allReadyOrTerminal` (`ready \|\| done`) — NOT a per-node\n\t\t\t\t\t// `awaitReady` watcher. A run-to-completion `task` node lands in\n\t\t\t\t\t// `done`; the registry contract admits a `done`-status node whose\n\t\t\t\t\t// `readyGate` is unresolved (only `markReady`/`markFailed` resolve\n\t\t\t\t\t// it), so a per-node gate HANGS on it. This is the SAME\n\t\t\t\t\t// `done`-tolerant gate S1 gave the long-running path; reading\n\t\t\t\t\t// statuses never suspends, so it is hang-free.\n\t\t\t\t\tyield* startup.runInitialAcquire;\n\t\t\t\t\tyield* allReadyOrTerminal(startup.handle.graph, startup.handle.registry);\n\t\t\t\t\tif (opts.withinScope !== undefined) {\n\t\t\t\t\t\tyield* opts.withinScope(handle);\n\t\t\t\t\t}\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst outcome = yield* Effect.raceFirst(\n\t\t\t\t\tstartup.runInitialAcquire.pipe(Effect.as('booted' as const)),\n\t\t\t\t\thandle.awaitShutdown.pipe(Effect.as('shutdown' as const)),\n\t\t\t\t);\n\t\t\t\tif (outcome === 'shutdown') {\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (opts.withinScope !== undefined) {\n\t\t\t\t\tyield* opts.withinScope(handle);\n\t\t\t\t}\n\t\t\t\tyield* handle.awaitShutdown;\n\t\t\t}),\n\t\t);\n\t});\n\n// ───────────────────────────────────────────────────────────────────────────\n// Production orchestrator assembly\n// ───────────────────────────────────────────────────────────────────────────\n\nexport interface ProductionCodegenOptions {\n\treadonly appRoot?: string;\n\t/** Forwarded verbatim to `@mysten/codegen`'s\n\t * `generateFromPackageSummary` via `layerMystenMoveCodegen` — see\n\t * `DevstackOptions['codegen']` for the full contract. Default `false`\n\t * (`@mysten/codegen`'s own default): phantom-only structs render as\n\t * consts with the phantom placeholder baked into `.name`; `true`\n\t * renders them as factories whose required type arguments compose a\n\t * fully-qualified type tag. /\n\treadonly includePhantomTypeParameters?: boolean;\n}\n\n/\n The ONE boot seam that maps a stack's codegen config to the production\n * codegen orchestrator options for a LIVE (`'ran'`) projection. Both\n * composition entry points (`api/run-stack.ts` and `orchestrators/layers.ts`)\n * call this. Boot writes no committed `src/generated` tree (owned solely by\n * the stack-free `codegen` verb), so there is no live dev-output dir to\n * resolve; only the app root + the pass-through phantom-type flag flow into\n * `layerProductionOrchestrators({ codegen })`.\n /\nexport const resolveProductionCodegenOptions = (input: {\n\treadonly appRoot: string;\n\treadonly codegen?:\n\t\t\| {\n\t\t\t\treadonly includePhantomTypeParameters?: boolean;\n\t\t }\n\t\t\| undefined;\n}): ProductionCodegenOptions => {\n\t// Boot never emits the committed `src/generated` tree (that is owned\n\t// solely by the stack-free `codegen` verb); its only codegen writes are\n\t// the deployment file (values-only) and the dev-`up` bindings refresh.\n\t// So there is no live dev-output dir to resolve — only the app root + the\n\t// pass-through phantom-type flag flow through.\n\treturn {\n\t\tappRoot: input.appRoot,\n\t\t// Pass-through verbatim — no resolution step; \"unset\" stays unset so\n\t\t// `@mysten/codegen`'s own default (false) applies at the call site.\n\t\t...(input.codegen?.includePhantomTypeParameters === undefined\n\t\t\t? {}\n\t\t\t: { includePhantomTypeParameters: input.codegen.includePhantomTypeParameters }),\n\t};\n};\n\nexport interface ProductionRouterOptions {\n\treadonly codegen?: ProductionCodegenOptions;\n\treadonly disabled?: boolean;\n}\n\nexport class ManifestEndpointRegistryService extends Context.Service<\n\tManifestEndpointRegistryService,\n\t{\n\t\treadonly register: (entry: EndpointEntry) => Effect.Effect<void, never, Scope.Scope>;\n\t\treadonly entries: Effect.Effect<ReadonlyArray<EndpointEntry>>;\n\t}\n>()('@devstack/orchestrators/ManifestEndpointRegistry') {}\n\nexport const layerManifestEndpointRegistry: Layer.Layer<ManifestEndpointRegistryService> =\n\tLayer.effect(\n\t\tManifestEndpointRegistryService,\n\t\tEffect.gen(function () {\n\t\t\tconst entriesRef = yield* Ref.make<ReadonlyArray<EndpointEntry & { readonly seq: number }>>(\n\t\t\t\t[],\n\t\t\t);\n\t\t\tconst seqRef = yield* Ref.make(0);\n\n\t\t\tconst register = (entry: EndpointEntry): Effect.Effect<void, never, Scope.Scope> =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst seq = yield* Ref.updateAndGet(seqRef, (n) => n + 1);\n\t\t\t\t\tyield* Ref.update(entriesRef, (entries) => [...entries, { ...entry, seq }]);\n\t\t\t\t\tyield* Effect.addFinalizer(() =>\n\t\t\t\t\t\tRef.update(entriesRef, (entries) =>\n\t\t\t\t\t\t\tentries.filter((candidate) => candidate.seq !== seq),\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\t});\n\n\t\t\treturn ManifestEndpointRegistryService.of({\n\t\t\t\tregister,\n\t\t\t\tentries: Ref.get(entriesRef).pipe(\n\t\t\t\t\tEffect.map((entries) =>\n\t\t\t\t\t\tentries.map((entryWithSeq) => {\n\t\t\t\t\t\t\tconst { seq, ...entry } = entryWithSeq;\n\t\t\t\t\t\t\tvoid seq;\n\t\t\t\t\t\t\treturn entry;\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t});\n\t\t}),\n\t);\n\nexport const productionRouterProfile = (options: DefaultRouterProfileOptions = {}): RouterProfile =>\n\tmakeDefaultRouterProfile(options);\n\n/** `outputDir` for the `CodegenRoot` of a `layerProductionOrchestrators`\n * composition — `<appRoot>/src/generated`. Boot's `assembleDeployment`\n * writes no file here; the dev-`up` `emitBindings` refresh DOES re-emit\n * this committed tree from the STATIC (id-free) contributions so an edited\n * Move package's new shapes reach the app. `apply` / `runStack` pass no\n * `emitBindings`, so they leave it untouched. The stack-free `codegen` verb\n * owns the canonical emit (wired separately, where it pins its own path). /\nconst productionCodegenOutputDir = (appRoot: string): string => resolve(appRoot, 'src/generated');\n\nexport const layerProductionOrchestrators = (router: ProductionRouterOptions = {}) => {\n\tconst profile = productionRouterProfile();\n\treturn Layer.mergeAll(\n\t\tlayerSnapshotOrchestrator,\n\t\tlayerManifestEndpointRegistry,\n\t\tlayerRouterService.pipe(\n\t\t\tLayer.provideMerge(\n\t\t\t\tLayer.mergeAll(\n\t\t\t\t\tlayerEntrypointRegistry(BUILT_IN_ENTRYPOINTS),\n\t\t\t\t\tlayerTraefikContainerOpsDocker,\n\t\t\t\t\tlayerDockerUpstreamResolver(profile),\n\t\t\t\t\tlayerRouterConfigLiteral({\n\t\t\t\t\t\tdisabled: router.disabled ?? false,\n\t\t\t\t\t\tprofile,\n\t\t\t\t\t\timage: DEFAULT_TRAEFIK_IMAGE,\n\t\t\t\t\t\trouteReadinessProbe: {\n\t\t\t\t\t\t\tenabled: router.disabled !== true,\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t),\n\t\tlayerCodegenOrchestrator,\n\t\tlayerCodegenPaths.pipe(\n\t\t\tLayer.provideMerge(\n\t\t\t\tlayerCodegenRoot({\n\t\t\t\t\toutputDir: productionCodegenOutputDir(router.codegen?.appRoot ?? process.cwd()),\n\t\t\t\t\tstackSubdir: null,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t\tlayerSuiMoveSummaryRunnerDocker,\n\t\tlayerMystenMoveCodegen({\n\t\t\tincludePhantomTypeParameters: router.codegen?.includePhantomTypeParameters,\n\t\t}),\n\t);\n};\n\n/* The single adapter for routable endpoints: ONE `ResolvedRoute` (the\n * router's post-mint source of truth) → ALL THREE sink-feeds at once —\n * the router's own `route`, the manifest `EndpointEntry`, and the\n * projection `endpoint.registered` event — derived from one shared\n * field-set so the three sinks can never diverge. The `routable`\n * dispatch body feeds each sink from the object this returns; there is\n * no second, third derivation off the route anywhere.\n \n It owns the url-derivation: `tcp` routes carry `tcp://127.0.0.1:port`,\n * everything else `http://hostname:port`. Consumers (codegen, manifest)\n * translate `tcp://` to their protocol-specific scheme (`postgres://`,\n * `redis://`, …).\n \n `ResolvedRoute` only carries `entrypointName`, so the endpoint name is\n * recovered from the original `decl.endpointName`; `pluginKey` is supplied\n * by the dispatcher (it is not in `ResolvedRoute`). Router-only fields\n * (`dispatchFileId`/`cors`/`upstreamUrl`) are kept ON `route` for the\n * router sink but discarded from the manifest/projection field-set — those\n * schemas do not consume them. /\nexport const endpointSinksFromRoute = (\n\tdecl: RoutableDecl,\n\troute: ResolvedRoute,\n\tpluginKey: PluginKey,\n\tregisteredAt = Date.now(),\n) => {\n\tconst url =\n\t\troute.wireProtocol === 'tcp'\n\t\t\t? `tcp://127.0.0.1:${route.entrypointPort}`\n\t\t\t: `http://${route.hostname}:${route.entrypointPort}`;\n\tconst publicWireProtocol = route.wireProtocol === 'https' ? 'http' : route.wireProtocol;\n\tconst common = {\n\t\tname: decl.endpointName,\n\t\turl,\n\t\tdisplayUrl: null,\n\t\twireProtocol: publicWireProtocol,\n\t} as const;\n\tconst endpointKeyString = `${pluginKey}:${decl.endpointName}`;\n\tconst event: Extract<EngineEvent, { readonly tag: 'endpoint.registered' }> = {\n\t\ttag: 'endpoint.registered',\n\t\tendpoint: {\n\t\t\t...common,\n\t\t\tendpointKey: endpointKey(endpointKeyString),\n\t\t\tpluginKey,\n\t\t\tregisteredAt,\n\t\t},\n\t};\n\treturn {\n\t\troute,\n\t\tmanifestEntry: {\n\t\t\t...common,\n\t\t\tendpointKey: endpointKeyString,\n\t\t\tpluginKey: String(pluginKey),\n\t\t},\n\t\tevent,\n\t};\n};\n\nconst manifestEndpointEntryFromOperationalEndpoint = (\n\tendpoint: Extract<EngineEvent, { readonly tag: 'endpoint.registered' }>['endpoint'],\n): EndpointEntry => ({\n\tendpointKey: String(endpoint.endpointKey),\n\tname: endpoint.name,\n\turl: endpoint.url,\n\tdisplayUrl: endpoint.displayUrl,\n\twireProtocol: endpoint.wireProtocol,\n\tpluginKey: String(endpoint.pluginKey),\n});\n\n/* Project a projection decl's `rowKey` (when absent) onto the\n * contributing plugin so projection consumers can attribute the row.\n * The payload stays opaque from the substrate's POV. /\nconst projectionDispatch = (\n\tdecl: ProjectionDecl,\n\tctx: ContributionDispatchContext,\n): Effect.Effect<void, never, never> => {\n\tconst payload = decl.event.payload;\n\tconst payloadWithRowKey =\n\t\tpayload !== null &&\n\t\ttypeof payload === 'object' &&\n\t\t'rowKey' in payload &&\n\t\t(payload as { rowKey: unknown }).rowKey === null\n\t\t\t? { ...payload, rowKey: ctx.pluginKey }\n\t\t\t: payload;\n\treturn ctx.publish({\n\t\t...decl.event,\n\t\tpayload: payloadWithRowKey,\n\t});\n};\n\n/* Register a strategy contribution on the scope-local registry, publish\n * `strategy.registered`, and arm a finalizer publishing\n * `strategy.unregistered`. /\nconst strategyContributorDispatch = (\n\tdecl: StrategyContributorDecl<string, unknown>,\n\tctx: ContributionDispatchContext,\n): Effect.Effect<void, never, Scope.Scope> =>\n\tEffect.gen(function () {\n\t\tyield* ctx.strategyRegistry.register(decl.capabilityKey, decl.strategy, {\n\t\t\tautoMounted: decl.autoMounted,\n\t\t\t...(decl.priority === undefined ? {} : { priority: decl.priority }),\n\t\t});\n\t\tyield* ctx.publish({\n\t\t\ttag: 'strategy.registered',\n\t\t\tcapabilityKey: decl.capabilityKey,\n\t\t\tautoMounted: decl.autoMounted,\n\t\t\tat: Date.now(),\n\t\t});\n\t\tyield* Effect.addFinalizer(() =>\n\t\t\tctx.publish({\n\t\t\t\ttag: 'strategy.unregistered',\n\t\t\t\tcapabilityKey: decl.capabilityKey,\n\t\t\t\tat: Date.now(),\n\t\t\t}),\n\t\t);\n\t});\n\n/*\n Build the production `ContributionDispatcher` — the closed seam the\n * supervisor replays each plugin's buffered contributions through after\n * a successful `start`. Each method's body reads its backing orchestrator\n * service (Snapshot/Router/Codegen/ManifestEndpoint) ONCE here and closes\n * over it; the substrate supervisor holds the resulting record opaquely\n * (it never imports an orchestrator service).\n /\nexport const buildProductionContributionDispatcher = (): Effect.Effect<\n\tContributionDispatcher,\n\tnever,\n\t\| SnapshotOrchestratorService\n\t\| RouterService\n\t\| CodegenOrchestratorService\n\t\| ManifestEndpointRegistryService\n> =>\n\tEffect.gen(function () {\n\t\tconst snapshot = yield* SnapshotOrchestratorService;\n\t\tconst router = yield* RouterService;\n\t\tconst codegen = yield* CodegenOrchestratorService;\n\t\tconst manifestEndpoints = yield* ManifestEndpointRegistryService;\n\t\treturn {\n\t\t\tsnapshotable: (decl: SnapshotableDecl, ctx) =>\n\t\t\t\tsnapshot.registerParticipant(ctx.pluginKey, decl),\n\t\t\troutable: (decl: RoutableDecl, ctx) =>\n\t\t\t\trouter.boot().pipe(\n\t\t\t\t\t// Router sink: `contributeRoute` writes the dispatch file +\n\t\t\t\t\t// publishes the route onto `applied`, returning the post-mint\n\t\t\t\t\t// `ResolvedRoute` — the ONE source of truth.\n\t\t\t\t\tEffect.andThen(router.contributeRoute(decl)),\n\t\t\t\t\tEffect.flatMap((route) => {\n\t\t\t\t\t\t// One adapter off that ResolvedRoute yields BOTH remaining\n\t\t\t\t\t\t// sink-feeds; feed manifest then projection. No second\n\t\t\t\t\t\t// derivation off the route lives anywhere.\n\t\t\t\t\t\tconst sinks = endpointSinksFromRoute(decl, route, ctx.pluginKey);\n\t\t\t\t\t\treturn manifestEndpoints\n\t\t\t\t\t\t\t.register(sinks.manifestEntry)\n\t\t\t\t\t\t\t.pipe(Effect.andThen(ctx.publish(sinks.event)));\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\tcodegenable: (decl: Codegenable, ctx) => codegen.registerContribution(ctx.pluginKey, decl),\n\t\t\tprojection: (decl: ProjectionDecl, ctx) => projectionDispatch(decl, ctx),\n\t\t\tstrategyContributor: (decl: StrategyContributorDecl<string, unknown>, ctx) =>\n\t\t\t\tstrategyContributorDispatch(decl, ctx),\n\t\t} satisfies ContributionDispatcher;\n\t});\n\nconst makeManifestExtrasContext = (ctx: SupervisorPostAcquireContext) => {\n\tconst resourceIdToKey = new Map<string, PluginKey>();\n\tfor (const [key, node] of ctx.graph.nodes) {\n\t\tresourceIdToKey.set(node.member.id, key);\n\t}\n\t// `lookup` throws `ManifestExtrasLookupError` synchronously from\n\t// inside the user-supplied `extras` factory.\n\t// `resolveManifestExtras` invokes that factory under `Effect.try`\n\t// with a typed `catch` mapper, so the throw promotes to the typed\n\t// failure channel — callers `catchTag('ManifestExtrasLookupError',\n\t// ...)` rather than reading the die-cause. Non-tagged throws stay\n\t// defects, preserving the previous semantics for genuine\n\t// programmer errors inside the factory body.\n\tconst lookup = (resourceId: string): unknown => {\n\t\tconst key = resourceIdToKey.get(resourceId);\n\t\tif (key === undefined) {\n\t\t\tthrow new ManifestExtrasLookupError({\n\t\t\t\tkind: 'unknown-resource',\n\t\t\t\tresourceId,\n\t\t\t});\n\t\t}\n\t\tconst resolved = readResolvedSync(ctx.registry, key);\n\t\tif (resolved === undefined) {\n\t\t\tthrow new ManifestExtrasLookupError({\n\t\t\t\tkind: 'unresolved-resource',\n\t\t\t\tresourceId,\n\t\t\t});\n\t\t}\n\t\treturn resolved;\n\t};\n\treturn {\n\t\tvalue: (resource: { readonly id: string }) => lookup(resource.id),\n\t};\n};\n\nconst operationalManifestEndpointEntries = (\n\tctx: SupervisorPostAcquireContext,\n\troutableEntries: ReadonlyArray<EndpointEntry>,\n): ReadonlyArray<EndpointEntry> => {\n\tconst routablePluginKeys = new Set(routableEntries.map((entry) => entry.pluginKey));\n\tconst registeredAt = Date.now();\n\tconst entries: EndpointEntry[] = [];\n\tfor (const [key] of ctx.graph.nodes) {\n\t\tif (routablePluginKeys.has(String(key))) continue;\n\t\tconst resolved = readResolvedSync(ctx.registry, key);\n\t\tif (resolved === undefined) continue;\n\t\tfor (const event of operationalEndpointEventsFromResolvedValue(key, resolved, registeredAt)) {\n\t\t\tentries.push(manifestEndpointEntryFromOperationalEndpoint(event.endpoint));\n\t\t}\n\t}\n\treturn entries;\n};\n\nexport const buildProductionPostAcquireHook = (\n\toptions: {\n\t\treadonly extras?: ManifestExtrasInput;\n\t\t/** Dev-`up` only: the STATIC (id-free) codegen contributions to re-emit\n\t\t * the committed `src/generated` tree from when a Move-source edit\n\t\t * reacquires a package — the same decls the stack-free `codegen` verb\n\t\t * derives (`deriveContributions(stack.members)`), NOT the live ones\n\t\t * (which would bake on-chain ids into `config.ts`). Omitted for\n\t\t * `apply` / `runStack`, where the committed tree is an input. /\n\t\treadonly emitBindings?: ReadonlyArray<Codegenable>;\n\t} = {},\n): Effect.Effect<\n\tSupervisorPostAcquireHook,\n\tnever,\n\t\| CodegenOrchestratorService\n\t\| CodegenPathsService\n\t\| FileSystem.FileSystem\n\t\| StackPathsService\n\t\| PostAcquireTasksService\n\t\| ManifestEndpointRegistryService\n\t\| MoveSummaryRunnerService\n\t\| MoveCodegenService\n> =>\n\tEffect.gen(function () {\n\t\tconst codegen = yield* CodegenOrchestratorService;\n\t\tconst paths = yield* CodegenPathsService;\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst stackPaths = yield* StackPathsService;\n\t\tconst postAcquireTasks = yield* PostAcquireTasksService;\n\t\tconst manifestEndpoints = yield* ManifestEndpointRegistryService;\n\t\t// Yielded here (outside the per-ctx hook) so the dev-`up` bindings\n\t\t// refresh below can provide them to `emitBindings`.\n\t\tconst moveRunner = yield* MoveSummaryRunnerService;\n\t\tconst moveCodegen = yield* MoveCodegenService;\n\t\treturn (ctx) =>\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst extras = yield* resolveManifestExtras(options.extras, makeManifestExtrasContext(ctx));\n\t\t\t\tconst routableEndpoints = yield* manifestEndpoints.entries;\n\t\t\t\tconst endpoints = [\n\t\t\t\t\t...routableEndpoints,\n\t\t\t\t\t...operationalManifestEndpointEntries(ctx, routableEndpoints),\n\t\t\t\t];\n\t\t\t\t// Boot no longer runs codegen. Its only job is to PRODUCE the\n\t\t\t\t// deployment (loadable on-chain ids), which the Vite plugin injects\n\t\t\t\t// via `__DEVSTACK_DEPLOYMENT__` in dev. The committed `src/generated` tree\n\t\t\t\t// is written ONLY by the stack-free `devstack codegen` verb.\n\t\t\t\t// Assemble the deployment from the SAME live-resolved contributions\n\t\t\t\t// that fed `config.ts` and write it to the gitignored\n\t\t\t\t// `.devstack/stacks/<stack>/`.\n\t\t\t\tconst deployment = yield* codegen.assembleDeployment(String(ctx.identity.network)).pipe(\n\t\t\t\t\tEffect.mapError(\n\t\t\t\t\t\t(cause) =>\n\t\t\t\t\t\t\tnew CodegenWriteFailed({\n\t\t\t\t\t\t\t\toutputPath: DEPLOYMENT_FILENAME,\n\t\t\t\t\t\t\t\tstage: 'write',\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tconst deploymentFile = join(stackPaths.stackRoot, DEPLOYMENT_FILENAME);\n\t\t\t\tyield* writeDeployment(deploymentFile, deployment).pipe(\n\t\t\t\t\tEffect.provideService(FileSystem.FileSystem, fs),\n\t\t\t\t);\n\t\t\t\tconst envelope = yield* buildEnvelope({\n\t\t\t\t\tidentity: {\n\t\t\t\t\t\tapp: ctx.identity.app,\n\t\t\t\t\t\tstack: ctx.identity.stack,\n\t\t\t\t\t\tnetwork: ctx.identity.network,\n\t\t\t\t\t},\n\t\t\t\t\tendpoints,\n\t\t\t\t\textras,\n\t\t\t\t\t// Record the live `deploymentFile` the plugin injects as\n\t\t\t\t\t// `__DEVSTACK_DEPLOYMENT__`. Bindings are NOT recorded:\n\t\t\t\t\t// `@generated` always resolves to the committed `src/generated`\n\t\t\t\t\t// tree written by the stack-free `codegen` verb. The dev-wallet\n\t\t\t\t\t// connection + dev accounts ride the deployment envelope's\n\t\t\t\t\t// `values` / `accounts` channels (no separate dev tree).\n\t\t\t\t\tcodegen: { deploymentFile },\n\t\t\t\t});\n\t\t\t\tconst manifestPath = join(stackPaths.stackRoot, 'manifest.json');\n\t\t\t\tyield* writeManifest(envelope, manifestPath).pipe(\n\t\t\t\t\tEffect.provideService(FileSystem.FileSystem, fs),\n\t\t\t\t);\n\t\t\t\t// Dev-`up` only: regenerate the committed `src/generated` tree from\n\t\t\t\t// the STATIC (id-free) contributions so an edited Move package's new\n\t\t\t\t// struct/function shapes reach the app (Vite HMRs the changed TS)\n\t\t\t\t// WITHOUT baking the live on-chain id into `config.ts`.\n\t\t\t\t// `runEmitCycle` is content-addressed, so the initial boot and any\n\t\t\t\t// no-op reacquire leave the tree (and its mtimes) untouched.\n\t\t\t\tconst bindingFiles: string[] = [];\n\t\t\t\tif (options.emitBindings !== undefined) {\n\t\t\t\t\tconst emitted = yield* codegen\n\t\t\t\t\t\t.emitBindings(options.emitBindings)\n\t\t\t\t\t\t.pipe(\n\t\t\t\t\t\t\tEffect.provideService(FileSystem.FileSystem, fs),\n\t\t\t\t\t\t\tEffect.provideService(CodegenPathsService, paths),\n\t\t\t\t\t\t\tEffect.provideService(MoveSummaryRunnerService, moveRunner),\n\t\t\t\t\t\t\tEffect.provideService(MoveCodegenService, moveCodegen),\n\t\t\t\t\t\t);\n\t\t\t\t\tbindingFiles.push(...emitted.filesWritten, ...emitted.filesChmod);\n\t\t\t\t}\n\t\t\t\tyield* postAcquireTasks.runAll;\n\t\t\t\treturn [\n\t\t\t\t\t{\n\t\t\t\t\t\ttag: 'manifest.flushed' as const,\n\t\t\t\t\t\tmanifestVersion: CURRENT_MANIFEST_VERSION,\n\t\t\t\t\t\tat: Date.now(),\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\ttag: 'codegen.emitted' as const,\n\t\t\t\t\t\tfiles: [deploymentFile, ...bindingFiles],\n\t\t\t\t\t\tat: Date.now(),\n\t\t\t\t\t},\n\t\t\t\t];\n\t\t\t});\n\t});\n\n// ───────────────────────────────────────────────────────────────────────────\n// Built-in plugin runtime composition\n//\n// Depends on L2 plugin internals (coin/package registries), so it can't live\n// at L1 runtime — hence its home in this L3 boot module.\n// ───────────────────────────────────────────────────────────────────────────\n\n/** Built-in plugin runtime: the per-stack coin + package registries.\n * Coin auto-discovery from a fresh package publish now runs DIRECTLY in\n * the package plugin's `start` (folding the publish output into the\n * CoinRegistry), so the registries are the whole surface. /\nexport const layerBuiltInPluginRuntime: Layer.Layer<CoinRegistryService \| PackageRegistryService> =\n\tLayer.mergeAll(layerCoinRegistry, layerPackageRegistry);\n\nexport const extendBuiltInPluginContext = (\n\tctx: Context.Context<never>,\n): Effect.Effect<\n\tContext.Context<never>,\n\tnever,\n\tCoinRegistryService \| PackageRegistryService \| SnapshotOrchestratorService \| FileSystem.FileSystem\n> =>\n\tEffect.gen(function () {\n\t\tconst coinRegistry = yield* CoinRegistryService;\n\t\tconst packageRegistry = yield* PackageRegistryService;\n\t\t// Thread the snapshot orchestrator + filesystem into the plugin\n\t\t// runtime context so the supervisor can populate the control-plane\n\t\t// `domain` surface (snapshot list/restore/delete, which never\n\t\t// round-trip through the void `publishCommand`). The\n\t\t// `ContainerRuntimeService` the domain also needs is already in the\n\t\t// base substrate plugin context.\n\t\tconst snapshotOrchestrator = yield* SnapshotOrchestratorService;\n\t\tconst fileSystem = yield* FileSystem.FileSystem;\n\t\treturn ctx.pipe(\n\t\t\tContext.add(CoinRegistryService, coinRegistry),\n\t\t\tContext.add(PackageRegistryService, packageRegistry),\n\t\t\tContext.add(SnapshotOrchestratorService, snapshotOrchestrator),\n\t\t\tContext.add(FileSystem.FileSystem, fileSystem),\n\t\t) as Context.Context<never>;\n\t});\n\n// ───────────────────────────────────────────────────────────────────────────\n// Production supervised-boot assembly — THE single dedup site\n// ───────────────────────────────────────────────────────────────────────────\n\n/** The per-caller inputs to {@link superviseStackWithProductionBoot} — the\n * fields that GENUINELY differ between the long-running programmatic seam\n * (`api/run-stack-internal.ts`) and the one-shot CLI verbs (`apply` /\n * `snapshot`). Everything else — the contribution dispatcher, the\n * post-acquire hook, and the built-in plugin-context extension — is\n * assembled identically by the helper, so it lives in ONE place. /\nexport interface ProductionBootOptions<HookR = Scope.Scope, HookE = never, ExtendR = never> {\n\t/* `'one-shot'` runs the acquire/codegen cycle then returns; the default\n\t * `'long-running'` supervises until shutdown. /\n\treadonly lifetime?: 'long-running' \| 'one-shot';\n\treadonly devstackVersion?: string;\n\t/* Threaded into `buildProductionPostAcquireHook` — the stack's manifest\n\t * `extras`. All three callers pass `stack.options.extras`. /\n\treadonly extras?: ManifestExtrasInput;\n\t/* Dev-`up` only: the STATIC (id-free) codegen contributions used to\n\t * regenerate the committed `src/generated` tree in the post-acquire hook\n\t * when a Move-source edit reacquires a package. Threaded from the `up`\n\t * seam (`deriveContributions(stack.members)`); `apply` / `snapshot` leave\n\t * it off so they never rewrite the committed tree. /\n\treadonly emitBindings?: ReadonlyArray<Codegenable>;\n\t/* The resolved supervisor command handler (run-stack's snapshot bridge).\n\t * One-shot verbs run no command loop, so they pass nothing. /\n\treadonly commandHandler?: SupervisorCommandHandler;\n\treadonly beforeInitialAcquire?: (handle: SupervisorHandle) => Effect.Effect<void, HookE, HookR>;\n\treadonly withinScope?: (handle: SupervisorHandle) => Effect.Effect<void, HookE, HookR>;\n\t/* Caller plugin-context extension layered AFTER the built-in\n\t * (`extendBuiltInPluginContext`). Only the programmatic seam uses it (to\n\t * honor the public `runStack({ extendContext })`); the CLI verbs omit it\n\t * and get the built-in extension alone. /\n\treadonly extendContextAfterBuiltIn?: (\n\t\tctx: Context.Context<never>,\n\t) => Effect.Effect<Context.Context<never>, never, ExtendR>;\n}\n\n/\n THE single site that assembles the production supervised body. It builds\n * the contribution dispatcher + post-acquire hook + built-in plugin-context\n * extension ONCE and hands them to {@link superviseStackEffect}, then\n * provides {@link layerBuiltInPluginRuntime}. Before this helper, the same\n * three-piece assembly was hand-rolled in three call sites\n * (`api/run-stack-internal.ts`, `cli/wirings/apply.ts`,\n * `cli/wirings/snapshot.ts`); now they all route through here and only\n * supply what genuinely differs ({@link ProductionBootOptions}).\n \n Each caller keeps its OWN lifetime-specific wrapping: the programmatic\n * seam wraps the returned effect in a `forkDetach` handle (long-running);\n * the CLI verbs run it to completion with their existing teardown + result\n * semantics (one-shot). This helper does NOT collapse those — it only\n * dedups the assembly the `superviseStackEffect` call sites shared.\n \n The return type is inferred (like `superviseStackEffect`): its R-channel\n * is the union of every substrate/orchestrator service the dispatcher /\n * hook / extension read, MINUS the built-in registries `layerBuiltInPluginRuntime`\n * supplies, PLUS the caller hook `HookR` / extend `ExtendR` channels.\n /\nexport const superviseStackWithProductionBoot = <\n\tHookR = Scope.Scope,\n\tHookE = never,\n\tExtendR = never,\n>(\n\tstack: SupervisedStack,\n\tidentity: Identity,\n\tstate: SubscriptionRef.SubscriptionRef<import('../substrate/projection.ts').SubscribableState>,\n\topts: ProductionBootOptions<HookR, HookE, ExtendR> = {},\n) =>\n\tEffect.gen(function () {\n\t\tconst contributionDispatcher = yield* buildProductionContributionDispatcher();\n\t\tconst postAcquireHook = yield* buildProductionPostAcquireHook({\n\t\t\t...(opts.extras === undefined ? {} : { extras: opts.extras }),\n\t\t\t...(opts.emitBindings === undefined ? {} : { emitBindings: opts.emitBindings }),\n\t\t});\n\t\tyield* superviseStackEffect(stack, identity, state, {\n\t\t\tcontributionDispatcher,\n\t\t\tpostAcquireHook,\n\t\t\t...(opts.lifetime === undefined ? {} : { lifetime: opts.lifetime }),\n\t\t\t...(opts.devstackVersion === undefined ? {} : { devstackVersion: opts.devstackVersion }),\n\t\t\t...(opts.commandHandler === undefined ? {} : { commandHandler: opts.commandHandler }),\n\t\t\t...(opts.beforeInitialAcquire === undefined\n\t\t\t\t? {}\n\t\t\t\t: { beforeInitialAcquire: opts.beforeInitialAcquire }),\n\t\t\t...(opts.withinScope === undefined ? {} : { withinScope: opts.withinScope }),\n\t\t\t// Built-in plugin-context extension ALWAYS runs; a caller extension\n\t\t\t// (the programmatic seam's `opts.extendContext`) chains AFTER it.\n\t\t\textendContext: (ctx) =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst builtInContext = yield* extendBuiltInPluginContext(ctx);\n\t\t\t\t\treturn opts.extendContextAfterBuiltIn === undefined\n\t\t\t\t\t\t? builtInContext\n\t\t\t\t\t\t: yield* opts.extendContextAfterBuiltIn(builtInContext);\n\t\t\t\t}),\n\t\t}).pipe(Effect.provide(layerBuiltInPluginRuntime));\n\t});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiIA,MAAa,wBAAwB,UAAoB,gBAAwB;CAIhF,MAAM,6BACL,MAAM,OACL,eACA,OAAO,IAAI,aAAa;EACvB,OAAO,OAAO;CACf,CAAC,CACF;CAED,MAAM,eAAe,MAAM,SAC1B,cAAc,QAAQ,GACtB,iBAAiB,WAAW,GAC5B,SAAS,OACT,eAAe,OACf,wBACA,yBACA,qBACD;CAEA,MAAM,2BAA2B,wBAAwB,MAAM,KAC9D,MAAM,aAAa,YAAY,CAChC;CACA,MAAM,iBAAiB,gBAAgB,KAAK,MAAM,aAAa,wBAAwB,CAAC;CACxF,MAAM,YAAY,WAAW,KAAK,MAAM,aAAa,cAAc,CAAC;CACpE,MAAM,iBAAiB,gBAAgB,KAAK,MAAM,aAAa,SAAS,CAAC;CACzE,MAAM,kBAAkB,iBAAiB,KAAK,MAAM,aAAa,cAAc,CAAC;CAChF,MAAM,qBAAqB,2BAA2B,KAAK,MAAM,aAAa,eAAe,CAAC;CAC9F,MAAM,uBAAuB,4BAA4B,KACxD,MAAM,aAAa,kBAAkB,CACtC;CACA,MAAM,uBAAuB,sBAAsB,KAAK,MAAM,aAAa,oBAAoB,CAAC;CAChG,OAAO,YAAY,KAAK,MAAM,aAAa,oBAAoB,CAAC;AACjE;;;;;;AAOA,MAAM,2BAcL,OAAO,IAAI,aAAa;CACvB,MAAM,cAAc,OAAO;CAC3B,MAAM,sBAAsB,OAAO;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,OAAO;CACxB,MAAM,mBAAmB,OAAO;CAChC,MAAM,aAAa,OAAO;CAC1B,MAAM,cAAc,OAAO;CAC3B,MAAM,mBAAmB,OAAO;CAChC,MAAM,SAAS,OAAOA;CAEtB,OAAO,QAAQ,MAAM,CAAC,CAAC,KACtB,QAAQ,IAAI,iBAAiB,WAAW,GACxC,QAAQ,IAAI,aAAa,mBAAmB,GAC5C,QAAQ,IAAI,mBAAmB,UAAU,GACzC,QAAQ,IAAI,cAAc,KAAK,GAC/B,QAAQ,IAAI,yBAAyB,QAAQ,GAC7C,QAAQ,IAAI,yBAAyB,gBAAgB,GACrD,QAAQ,IAAI,mBAAmB,UAAU,GACzC,QAAQ,IAAI,oBAAoB,WAAW,GAC3C,QAAQ,IAAI,yBAAyB,gBAAgB,GACrD,QAAQ,IAAIA,UAAQ,MAAM,CAC3B;AACD,CAAC;;;;;AAkCF,MAAa,wBACZ,OACA,UACA,OACA,OAAiD,CAAC,MAElD,OAAO,IAAI,aAAa;CACvB,OAAO,OAAO,OAAO,OACpB,OAAO,IAAI,aAAa;EACvB,MAAM,cAAc,OAAO,mBAAmB;EAI9C,MAAM,UAAU,OAAO,gBACtB,OACA,UACA,OALA,KAAK,kBAAkB,KAAA,IAAY,cAAc,OAAO,KAAK,cAAc,WAAW,GAOtF,KAAK,wBACL,KAAK,gBACL,KAAK,iBACL;GACC,aAAa,KAAK,aAAa;GAC/B,GAAI,KAAK,oBAAoB,KAAA,IAC1B,CAAC,IACD,EAAE,iBAAiB,KAAK,gBAAgB;EAC5C,CACD;EACA,MAAM,EAAE,WAAW;EACnB,IAAI,KAAK,yBAAyB,KAAA,GACjC,OAAO,KAAK,qBAAqB,MAAM;EAExC,IAAI,KAAK,aAAa,YAAY;GAWjC,OAAO,QAAQ;GACf,OAAO,mBAAmB,QAAQ,OAAO,OAAO,QAAQ,OAAO,QAAQ;GACvE,IAAI,KAAK,gBAAgB,KAAA,GACxB,OAAO,KAAK,YAAY,MAAM;GAE/B;EACD;EAKA,KAAI,OAJmB,OAAO,UAC7B,QAAQ,kBAAkB,KAAK,OAAO,GAAG,QAAiB,CAAC,GAC3D,OAAO,cAAc,KAAK,OAAO,GAAG,UAAmB,CAAC,CACzD,OACgB,YACf;EAED,IAAI,KAAK,gBAAgB,KAAA,GACxB,OAAO,KAAK,YAAY,MAAM;EAE/B,OAAO,OAAO;CACf,CAAC,CACF;AACD,CAAC;;;;;;;;;;AA2BF,MAAa,mCAAmC,UAOhB;CAM/B,OAAO;EACN,SAAS,MAAM;EAGf,GAAI,MAAM,SAAS,iCAAiC,KAAA,IACjD,CAAC,IACD,EAAE,8BAA8B,MAAM,QAAQ,6BAA6B;CAC/E;AACD;AAOA,IAAa,kCAAb,cAAqD,QAAQ,QAM3D,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC;AAEzD,MAAa,gCACZ,MAAM,OACL,iCACA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO,IAAI,KAC7B,CAAC,CACF;CACA,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;CAEhC,MAAM,YAAY,UACjB,OAAO,IAAI,aAAa;EACvB,MAAM,MAAM,OAAO,IAAI,aAAa,SAAS,MAAM,IAAI,CAAC;EACxD,OAAO,IAAI,OAAO,aAAa,YAAY,CAAC,GAAG,SAAS;GAAE,GAAG;GAAO;EAAI,CAAC,CAAC;EAC1E,OAAO,OAAO,mBACb,IAAI,OAAO,aAAa,YACvB,QAAQ,QAAQ,cAAc,UAAU,QAAQ,GAAG,CACpD,CACD;CACD,CAAC;CAEF,OAAO,gCAAgC,GAAG;EACzC;EACA,SAAS,IAAI,IAAI,UAAU,CAAC,CAAC,KAC5B,OAAO,KAAK,YACX,QAAQ,KAAK,iBAAiB;GAC7B,MAAM,EAAE,KAAK,GAAG,UAAU;GAE1B,OAAO;EACR,CAAC,CACF,CACD;CACD,CAAC;AACF,CAAC,CACF;AAED,MAAa,2BAA2B,UAAuC,CAAC,MAC/E,yBAAyB,OAAO;;;;;;;;AASjC,MAAM,8BAA8B,YAA4B,QAAQ,SAAS,eAAe;AAEhG,MAAa,gCAAgC,SAAkC,CAAC,MAAM;CACrF,MAAM,UAAU,wBAAwB;CACxC,OAAO,MAAM,SACZ,2BACA,+BACA,mBAAmB,KAClB,MAAM,aACL,MAAM,SACL,wBAAwB,oBAAoB,GAC5C,gCACA,4BAA4B,OAAO,GACnC,yBAAyB;EACxB,UAAU,OAAO,YAAY;EAC7B;EACA,OAAO;EACP,qBAAqB,EACpB,SAAS,OAAO,aAAa,KAC9B;CACD,CAAC,CACF,CACD,CACD,GACA,0BACA,kBAAkB,KACjB,MAAM,aACL,iBAAiB;EAChB,WAAW,2BAA2B,OAAO,SAAS,WAAW,QAAQ,IAAI,CAAC;EAC9E,aAAa;CACd,CAAC,CACF,CACD,GACA,iCACA,uBAAuB,EACtB,8BAA8B,OAAO,SAAS,6BAC/C,CAAC,CACF;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,0BACZ,MACA,OACA,WACA,eAAe,KAAK,IAAI,MACpB;CACJ,MAAM,MACL,MAAM,iBAAiB,QACpB,mBAAmB,MAAM,mBACzB,UAAU,MAAM,SAAS,GAAG,MAAM;CACtC,MAAM,qBAAqB,MAAM,iBAAiB,UAAU,SAAS,MAAM;CAC3E,MAAM,SAAS;EACd,MAAM,KAAK;EACX;EACA,YAAY;EACZ,cAAc;CACf;CACA,MAAM,oBAAoB,GAAG,UAAU,GAAG,KAAK;CAC/C,MAAM,QAAuE;EAC5E,KAAK;EACL,UAAU;GACT,GAAG;GACH,aAAa,YAAY,iBAAiB;GAC1C;GACA;EACD;CACD;CACA,OAAO;EACN;EACA,eAAe;GACd,GAAG;GACH,aAAa;GACb,WAAW,OAAO,SAAS;EAC5B;EACA;CACD;AACD;AAEA,MAAM,gDACL,cACoB;CACpB,aAAa,OAAO,SAAS,WAAW;CACxC,MAAM,SAAS;CACf,KAAK,SAAS;CACd,YAAY,SAAS;CACrB,cAAc,SAAS;CACvB,WAAW,OAAO,SAAS,SAAS;AACrC;;;;AAKA,MAAM,sBACL,MACA,QACuC;CACvC,MAAM,UAAU,KAAK,MAAM;CAC3B,MAAM,oBACL,YAAY,QACZ,OAAO,YAAY,YACnB,YAAY,WACX,QAAgC,WAAW,OACzC;EAAE,GAAG;EAAS,QAAQ,IAAI;CAAU,IACpC;CACJ,OAAO,IAAI,QAAQ;EAClB,GAAG,KAAK;EACR,SAAS;CACV,CAAC;AACF;;;;AAKA,MAAM,+BACL,MACA,QAEA,OAAO,IAAI,aAAa;CACvB,OAAO,IAAI,iBAAiB,SAAS,KAAK,eAAe,KAAK,UAAU;EACvE,aAAa,KAAK;EAClB,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;CAClE,CAAC;CACD,OAAO,IAAI,QAAQ;EAClB,KAAK;EACL,eAAe,KAAK;EACpB,aAAa,KAAK;EAClB,IAAI,KAAK,IAAI;CACd,CAAC;CACD,OAAO,OAAO,mBACb,IAAI,QAAQ;EACX,KAAK;EACL,eAAe,KAAK;EACpB,IAAI,KAAK,IAAI;CACd,CAAC,CACF;AACD,CAAC;;;;;;;;;AAUF,MAAa,8CAQZ,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,OAAO;CACxB,MAAM,SAAS,OAAO;CACtB,MAAM,UAAU,OAAO;CACvB,MAAM,oBAAoB,OAAO;CACjC,OAAO;EACN,eAAe,MAAwB,QACtC,SAAS,oBAAoB,IAAI,WAAW,IAAI;EACjD,WAAW,MAAoB,QAC9B,OAAO,KAAK,CAAC,CAAC,KAIb,OAAO,QAAQ,OAAO,gBAAgB,IAAI,CAAC,GAC3C,OAAO,SAAS,UAAU;GAIzB,MAAM,QAAQ,uBAAuB,MAAM,OAAO,IAAI,SAAS;GAC/D,OAAO,kBACL,SAAS,MAAM,aAAa,CAAC,CAC7B,KAAK,OAAO,QAAQ,IAAI,QAAQ,MAAM,KAAK,CAAC,CAAC;EAChD,CAAC,CACF;EACD,cAAc,MAAmB,QAAQ,QAAQ,qBAAqB,IAAI,WAAW,IAAI;EACzF,aAAa,MAAsB,QAAQ,mBAAmB,MAAM,GAAG;EACvE,sBAAsB,MAAgD,QACrE,4BAA4B,MAAM,GAAG;CACvC;AACD,CAAC;AAEF,MAAM,6BAA6B,QAAsC;CACxE,MAAM,kCAAkB,IAAI,IAAuB;CACnD,KAAK,MAAM,CAAC,KAAK,SAAS,IAAI,MAAM,OACnC,gBAAgB,IAAI,KAAK,OAAO,IAAI,GAAG;CAUxC,MAAM,UAAU,eAAgC;EAC/C,MAAM,MAAM,gBAAgB,IAAI,UAAU;EAC1C,IAAI,QAAQ,KAAA,GACX,MAAM,IAAI,0BAA0B;GACnC,MAAM;GACN;EACD,CAAC;EAEF,MAAM,WAAW,iBAAiB,IAAI,UAAU,GAAG;EACnD,IAAI,aAAa,KAAA,GAChB,MAAM,IAAI,0BAA0B;GACnC,MAAM;GACN;EACD,CAAC;EAEF,OAAO;CACR;CACA,OAAO,EACN,QAAQ,aAAsC,OAAO,SAAS,EAAE,EACjE;AACD;AAEA,MAAM,sCACL,KACA,oBACkC;CAClC,MAAM,qBAAqB,IAAI,IAAI,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC;CAClF,MAAM,eAAe,KAAK,IAAI;CAC9B,MAAM,UAA2B,CAAC;CAClC,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,OAAO;EACpC,IAAI,mBAAmB,IAAI,OAAO,GAAG,CAAC,GAAG;EACzC,MAAM,WAAW,iBAAiB,IAAI,UAAU,GAAG;EACnD,IAAI,aAAa,KAAA,GAAW;EAC5B,KAAK,MAAM,SAAS,2CAA2C,KAAK,UAAU,YAAY,GACzF,QAAQ,KAAK,6CAA6C,MAAM,QAAQ,CAAC;CAE3E;CACA,OAAO;AACR;AAEA,MAAa,kCACZ,UASI,CAAC,MAaL,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO;CACvB,MAAM,QAAQ,OAAO;CACrB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,aAAa,OAAO;CAC1B,MAAM,mBAAmB,OAAO;CAChC,MAAM,oBAAoB,OAAO;CAGjC,MAAM,aAAa,OAAO;CAC1B,MAAM,cAAc,OAAO;CAC3B,QAAQ,QACP,OAAO,IAAI,aAAa;EACvB,MAAM,SAAS,OAAO,sBAAsB,QAAQ,QAAQ,0BAA0B,GAAG,CAAC;EAC1F,MAAM,oBAAoB,OAAO,kBAAkB;EACnD,MAAM,YAAY,CACjB,GAAG,mBACH,GAAG,mCAAmC,KAAK,iBAAiB,CAC7D;EAQA,MAAM,aAAa,OAAO,QAAQ,mBAAmB,OAAO,IAAI,SAAS,OAAO,CAAC,CAAC,CAAC,KAClF,OAAO,UACL,UACA,IAAI,mBAAmB;GACtB,YAAY;GACZ,OAAO;GACP;EACD,CAAC,CACH,CACD;EACA,MAAM,iBAAiB,KAAK,WAAW,WAAW,mBAAmB;EACrE,OAAO,gBAAgB,gBAAgB,UAAU,CAAC,CAAC,KAClD,OAAO,eAAe,WAAW,YAAY,EAAE,CAChD;EAkBA,OAAO,cAAc,OAjBG,cAAc;GACrC,UAAU;IACT,KAAK,IAAI,SAAS;IAClB,OAAO,IAAI,SAAS;IACpB,SAAS,IAAI,SAAS;GACvB;GACA;GACA;GAOA,SAAS,EAAE,eAAe;EAC3B,CAAC,GACoB,KAAK,WAAW,WAAW,eACN,CAAC,CAAC,CAAC,KAC5C,OAAO,eAAe,WAAW,YAAY,EAAE,CAChD;EAOA,MAAM,eAAyB,CAAC;EAChC,IAAI,QAAQ,iBAAiB,KAAA,GAAW;GACvC,MAAM,UAAU,OAAO,QACrB,aAAa,QAAQ,YAAY,CAAC,CAClC,KACA,OAAO,eAAe,WAAW,YAAY,EAAE,GAC/C,OAAO,eAAe,qBAAqB,KAAK,GAChD,OAAO,eAAe,0BAA0B,UAAU,GAC1D,OAAO,eAAe,oBAAoB,WAAW,CACtD;GACD,aAAa,KAAK,GAAG,QAAQ,cAAc,GAAG,QAAQ,UAAU;EACjE;EACA,OAAO,iBAAiB;EACxB,OAAO,CACN;GACC,KAAK;GACL,iBAAA;GACA,IAAI,KAAK,IAAI;EACd,GACA;GACC,KAAK;GACL,OAAO,CAAC,gBAAgB,GAAG,YAAY;GACvC,IAAI,KAAK,IAAI;EACd,CACD;CACD,CAAC;AACH,CAAC;;;;;AAaF,MAAa,4BACZ,MAAM,SAAS,mBAAmB,oBAAoB;AAEvD,MAAa,8BACZ,QAMA,OAAO,IAAI,aAAa;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,kBAAkB,OAAO;CAO/B,MAAM,uBAAuB,OAAO;CACpC,MAAM,aAAa,OAAO,WAAW;CACrC,OAAO,IAAI,KACV,QAAQ,IAAI,qBAAqB,YAAY,GAC7C,QAAQ,IAAI,wBAAwB,eAAe,GACnD,QAAQ,IAAI,6BAA6B,oBAAoB,GAC7D,QAAQ,IAAI,WAAW,YAAY,UAAU,CAC9C;AACD,CAAC;;;;;;;;;;;;;;;;;;;;;;AA6DF,MAAa,oCAKZ,OACA,UACA,OACA,OAAqD,CAAC,MAEtD,OAAO,IAAI,aAAa;CAMvB,OAAO,qBAAqB,OAAO,UAAU,OAAO;EACnD,wBAAA,OANqC,sCAAsC;EAO3E,iBAAA,OAN8B,+BAA+B;GAC7D,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;GAC3D,GAAI,KAAK,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,KAAK,aAAa;EAC9E,CAAC;EAIA,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;EACjE,GAAI,KAAK,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,gBAAgB;EACtF,GAAI,KAAK,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,eAAe;EACnF,GAAI,KAAK,yBAAyB,KAAA,IAC/B,CAAC,IACD,EAAE,sBAAsB,KAAK,qBAAqB;EACrD,GAAI,KAAK,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY;EAG1E,gBAAgB,QACf,OAAO,IAAI,aAAa;GACvB,MAAM,iBAAiB,OAAO,2BAA2B,GAAG;GAC5D,OAAO,KAAK,8BAA8B,KAAA,IACvC,iBACA,OAAO,KAAK,0BAA0B,cAAc;EACxD,CAAC;CACH,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,yBAAyB,CAAC;AAClD,CAAC"}

package/dist/orchestrators/router/file-provider.mjs CHANGED Viewed

@@ -35,21 +35,21 @@ const resolveRoute = (identity, decl, registry, upstreams) => Effect.gen(functio
 		containerName: decl.upstream.containerName,
 		containerPort: decl.upstream.containerPort
 	}) : yield* upstreams.resolveHostLoopback({ port: decl.upstream.port });
-	const wireProtocol = decl.wireProtocol === "tcp" ? "tcp" : decl.wireProtocol === "h2c" ? "h2c" : "http";
+	const wireProtocol = decl.wireProtocol === "tcp" ? "tcp" : decl.wireProtocol === "h2c" ? "h2c" : decl.wireProtocol === "https" ? "https" : "http";
 	if ((wireProtocol === "tcp" ? "tcp" : "http") !== (entrypoint.protocol === "tcp" ? "tcp" : "http")) return yield* Effect.fail(new RouterValidationError({
 		field: "entrypointName",
 		value: entrypoint.name,
 		detail: `wireProtocol family mismatch: decl is '${wireProtocol}' but entrypoint '${entrypoint.name}' is '${entrypoint.protocol}'`
 	}));
 	const upstreamUrl = renderUrl({
-		protocol: wireProtocol === "tcp" ? "tcp" : "http",
+		protocol: wireProtocol === "tcp" ? "tcp" : wireProtocol === "https" ? "https" : "http",
 		hostname: upstream.host,
 		port: upstream.port
 	});
-	if (!/^(?:http|tcp):\/\/[A-Za-z0-9_.:-]+:\d+$/.test(upstreamUrl)) return yield* Effect.fail(new RouterValidationError({
+	if (!/^(?:http|https|tcp):\/\/[A-Za-z0-9_.:-]+:\d+$/.test(upstreamUrl)) return yield* Effect.fail(new RouterValidationError({
 		field: "upstreamUrl",
 		value: upstreamUrl,
-		detail: "expected http://<host>:<port> or tcp://<host>:<port>"
+		detail: "expected http(s)://<host>:<port> or tcp://<host>:<port>"
 	}));
 	const cors = decl.wireProtocol === "tcp" ? false : decl.cors;
 	return {
@@ -66,7 +66,7 @@ const resolveRoute = (identity, decl, registry, upstreams) => Effect.gen(functio
 *  TCP renderer to write the `address:` field. Safe because
 *  `resolveRoute` validates the URL shape before we get here. */
 const splitUpstream = (url) => {
-	const stripped = url.replace(/^(?:http|tcp):\/\//, "");
+	const stripped = url.replace(/^(?:http|https|tcp):\/\//, "");
 	const lastColon = stripped.lastIndexOf(":");
 	return {
 		host: stripped.slice(0, lastColon),
@@ -95,7 +95,8 @@ const renderRouteYaml = (route, lease) => {
 const routeReadinessMiddlewareName = (route) => `${route.dispatchFileId}-route-ready`;
 const renderHttpRouteYaml = (route, lease) => {
 	const middlewares = [routeReadinessMiddlewareName(route), ...route.cors ? [CORS_MIDDLEWARE_NAME] : []];
-	const schemeHint = route.wireProtocol === "h2c" ? `        # h2c upstream — gRPC-friendly cleartext HTTP/2.\n` : "";
+	const schemeHint = route.wireProtocol === "h2c" ? `        # h2c upstream — gRPC-friendly cleartext HTTP/2.\n` : route.wireProtocol === "https" ? `        # HTTPS upstream — local self-signed backend TLS.\n` : "";
+	const serversTransport = route.wireProtocol === "https" ? "devstack-insecure-local-tls" : null;
 	return [
 		`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,
 		`# dispatchFileId: ${route.dispatchFileId}`,
@@ -119,9 +120,11 @@ const renderHttpRouteYaml = (route, lease) => {
 		`  services:`,
 		`    ${route.dispatchFileId}-svc:`,
 		`      loadBalancer:`,
+		serversTransport === null ? null : `        serversTransport: "${serversTransport}"`,
 		schemeHint.length > 0 ? schemeHint.trimEnd() : null,
 		`        servers:`,
 		`          - url: "${route.upstreamUrl}"`,
+		serversTransport === null ? null : `  serversTransports:\n    ${serversTransport}:\n      insecureSkipVerify: true`,
 		``
 	].filter((line) => line !== null).join("\n");
 };
@@ -166,7 +169,7 @@ const commentNumber = (body, key) => {
 };
 const parseWireProtocol = (body) => {
 	const fromComment = commentValue(body, "wireProtocol");
-	if (fromComment === "http" || fromComment === "h2c" || fromComment === "tcp") return fromComment;
+	if (fromComment === "http" || fromComment === "h2c" || fromComment === "https" || fromComment === "tcp") return fromComment;
 	if (/^tcp:/m.test(body)) return "tcp";
 	if (/^http:/m.test(body)) return "http";
 	return null;
@@ -251,7 +254,7 @@ const parseDispatchRouteFile = (body, fallbackDispatchFileId = null) => {
 				_tag: "DispatchRouteDecodeDiagnostic",
 				dispatchFileId: protectedDispatchFileId,
 				reason: "missing-required-route-metadata",
-				detail: "route file is missing dispatchFileId, wireProtocol/http|tcp block, entrypointName, or hostname metadata"
+				detail: "route file is missing dispatchFileId, wireProtocol/http|https|tcp block, entrypointName, or hostname metadata"
 			}]
 		};
 	}

package/dist/orchestrators/router/file-provider.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"file-provider.mjs","names":[],"sources":["../../../src/orchestrators/router/file-provider.ts"],"sourcesContent":["// File-provider config generator.\n//\n// Architecture invariant #1: file-provider ONLY, never docker-provider.\n// We materialize per-backend dispatch entries as YAML files in a\n// watched directory; Traefik's file-provider polls + reloads on\n// change. The docker-provider was rejected because the container IP\n// we need is the shared-network IP that lands AFTER `network connect`,\n// and the docker-provider captures the per-stack IP at first event\n// and never refreshes.\n//\n// One file per canonical route identity. Each file carries exactly\n// one router + one service (and references the shared CORS middleware\n// when `cors: true`). This layout means atomic add/remove of a route\n// is one file create/unlink — no merge step, no race.\n//\n// Two YAML shapes live under this renderer, discriminated by the\n// resolved route's `wireProtocol`:\n//\n// HTTP / h2c (Host-header dispatch on a shared port):\n//\n// http:\n// routers:\n// <id>-router:\n// rule: \"Host(`<hostname>`)\"\n// entryPoints: [\"<entrypointName>\"]\n// service: \"<id>-svc\"\n// middlewares: [\"devstack-cors\"] # when cors: true\n// services:\n// <id>-svc:\n// loadBalancer:\n// servers:\n// - url: \"http://<upstream-host>:<upstream-port>\"\n//\n// TCP (per-entrypoint-port dispatch; ONE backend per entrypoint):\n//\n// tcp:\n// routers:\n// <id>-router:\n// rule: \"HostSNI(``)\"\n// entryPoints: [\"<entrypointName>\"]\n// service: \"<id>-svc\"\n// services:\n// <id>-svc:\n// loadBalancer:\n// servers:\n// - address: \"<upstream-host>:<upstream-port>\"\n//\n// HostSNI(``) matches any incoming TCP connection on the entrypoint\n// (Traefik requires every TCP router to have a rule; `` is the wildcard\n// that means \"any client\"). No CORS section — TCP isn't HTTP and the\n// shared CORS middleware lives under `http.middlewares`.\n\nimport { Effect } from 'effect';\n\nimport type { RoutableDecl } from '../../contracts/routable.ts';\nimport type { RosterHolder } from '../../substrate/cross-process.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport { CORS_MIDDLEWARE_NAME } from './cors.ts';\nimport type { EntrypointRegistryShape } from './entrypoints.ts';\nimport { RouteCollision, RouterValidationError, type UnknownEntrypoint } from './errors.ts';\nimport { dispatchFileId, renderUrl, routerHostname } from './hostname.ts';\n\nexport const ROUTE_READINESS_HEADER = 'X-Devstack-Route-Id';\n\n/* Dispatch-file filename prefix. `10-` sorts behind the shared CORS\n * middleware (`00-`) so Traefik's file-provider loads the middleware\n * before any router that references it. Single source of truth for\n * the file-write side (`dispatchFilename`) and the file-read side\n * (`dispatchFileIdFromFilename`) — keep them in lockstep here. /\nconst DISPATCH_FILENAME_PREFIX = '10-';\n\n// ---------------------------------------------------------------------------\n// Resolved-route data structure\n// ---------------------------------------------------------------------------\n\n/* Resolved wire-protocol. `'tcp'` carries no hostname matcher and no\n * CORS. The router orchestrator's renderer + collision-detector branch\n * on this. /\nexport type ResolvedWireProtocol = 'http' \| 'h2c' \| 'tcp';\n\n/* A `RoutableDecl` resolved by the orchestrator: hostname minted,\n * dispatch-id stringified, entrypoint port resolved, upstream URL\n * resolved. This is the shape the file-provider renderer consumes —\n * decoupled from the resolution path so testing the renderer is\n * pure. /\nexport interface ResolvedRoute {\n\treadonly dispatchFileId: string;\n\t/* Minted hostname for HTTP routes. For TCP routes this is still\n\t * computed (it's the host string the URL surfaces to consumers),\n\t * but the Traefik router rule is `HostSNI(\\`\\`)` — TCP dispatches\n\t by entrypoint port, not Host. /\n\treadonly hostname: string;\n\treadonly entrypointName: string;\n\treadonly entrypointPort: number;\n\t/* Upstream URL string. For HTTP this is `http://<host>:<port>`; for\n\t * TCP it's still rendered as `tcp://<host>:<port>` so the renderer\n\t * can pull host+port back out for the `address:` field. /\n\treadonly upstreamUrl: string;\n\treadonly cors: boolean;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}\n\nexport interface RouteCollisionMetadata {\n\treadonly dispatchFileId: string;\n\treadonly hostname: string;\n\treadonly entrypointName: string;\n\treadonly entrypointPort: number \| null;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}\n\nexport const ROUTER_ROUTE_LEASE_VERSION = 1;\n\nexport interface RouteLeaseMetadata {\n\treadonly version: typeof ROUTER_ROUTE_LEASE_VERSION;\n\treadonly routerProfileId: string;\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly owner: RosterHolder;\n}\n\nexport interface DispatchRouteMetadata extends RouteCollisionMetadata {\n\treadonly lease: RouteLeaseMetadata \| null;\n}\n\nexport type DispatchRouteDecodeReason =\n\t\| 'missing-required-route-metadata'\n\t\| 'unknown-route-lease-version'\n\t\| 'invalid-route-lease-metadata';\n\nexport interface DispatchRouteDecodeDiagnostic {\n\treadonly _tag: 'DispatchRouteDecodeDiagnostic';\n\treadonly dispatchFileId: string;\n\treadonly reason: DispatchRouteDecodeReason;\n\treadonly detail: string;\n}\n\nexport type DispatchRouteParseResult =\n\t\| {\n\t\t\treadonly _tag: 'valid';\n\t\t\treadonly route: DispatchRouteMetadata;\n\t\t\treadonly diagnostics: ReadonlyArray<DispatchRouteDecodeDiagnostic>;\n\t }\n\t\| {\n\t\t\treadonly _tag: 'invalid';\n\t\t\treadonly dispatchFileId: string;\n\t\t\treadonly diagnostics: ReadonlyArray<DispatchRouteDecodeDiagnostic>;\n\t };\n\n/* Filename within the dispatch directory for a given file-id. The\n * prefix (`DISPATCH_FILENAME_PREFIX`) sorts behind the shared CORS\n * middleware (`00-`) so Traefik picks up the middleware before any\n * router referencing it. /\nexport const dispatchFilename = (fileId: string): string =>\n\t`${DISPATCH_FILENAME_PREFIX}${fileId}.yml`;\n\n// ---------------------------------------------------------------------------\n// Resolution — Routable + Identity + EntrypointRegistry + upstream → ResolvedRoute\n// ---------------------------------------------------------------------------\n\n/* Upstream-resolution interface the file-provider needs. The\n * orchestrator threads in concrete resolvers (`runtime/docker` for\n * containers, the port broker for host-loopback) without leaking\n * service knowledge. Architecture: \"router has no compiled-in\n * awareness of which services exist.\" /\nexport interface UpstreamResolver {\n\t/* For a container-kind upstream, return `(host, port)` where host\n\t * is the container's shared-network IP and port is the container\n\t * port from the plugin. Bounded retry lives inside the resolver\n\t * (architecture invariant #3). /\n\treadonly resolveContainer: (target: {\n\t\treadonly containerName: string;\n\t\treadonly containerPort: number;\n\t}) => Effect.Effect<{ readonly host: string; readonly port: number }, RouterValidationError>;\n\t/* For a host-loopback-kind upstream, return the bound loopback\n\t * port. The plugin owns port allocation and stamps the resolved\n\t * port into its Routable decl after acquire. /\n\treadonly resolveHostLoopback: (target: {\n\t\treadonly port: number;\n\t}) => Effect.Effect<{ readonly host: string; readonly port: number }, RouterValidationError>;\n}\n\n/* Resolve a single Routable into a ResolvedRoute. Pure-ish: the only\n * effectful bit is the upstream resolver (which talks to docker /\n * the port broker) and the entrypoint lookup.\n \n Takes the registry as a parameter rather than yielding the service\n * tag so the calling orchestrator can pre-bind it once at layer-\n * construction time, keeping the per-Routable hot path free of\n * Context lookups. /\nexport const resolveRoute = (\n\tidentity: Identity,\n\tdecl: RoutableDecl,\n\tregistry: EntrypointRegistryShape,\n\tupstreams: UpstreamResolver,\n): Effect.Effect<ResolvedRoute, RouterValidationError \| UnknownEntrypoint> =>\n\tEffect.gen(function () {\n\t\tconst entrypoint = yield* registry.byName(decl.endpointName);\n\t\tconst hostname = yield* routerHostname(identity, decl.dispatchId.role);\n\t\tconst fileId = yield* dispatchFileId({ identity, dispatch: decl.dispatchId });\n\t\tconst upstream =\n\t\t\tdecl.upstream.type === 'container'\n\t\t\t\t? yield* upstreams.resolveContainer({\n\t\t\t\t\t\tcontainerName: decl.upstream.containerName,\n\t\t\t\t\t\tcontainerPort: decl.upstream.containerPort,\n\t\t\t\t\t})\n\t\t\t\t: yield* upstreams.resolveHostLoopback({ port: decl.upstream.port });\n\t\tconst wireProtocol: ResolvedWireProtocol =\n\t\t\tdecl.wireProtocol === 'tcp' ? 'tcp' : decl.wireProtocol === 'h2c' ? 'h2c' : 'http';\n\t\t// The router contract says: a `wireProtocol: 'tcp'` decl MUST\n\t\t// reference an entrypoint whose protocol is also `'tcp'`. The\n\t\t// converse holds — HTTP/h2c decls must reference HTTP-family\n\t\t// entrypoints. Mismatch is a programming error in the plugin\n\t\t// author (caught here once, not at every render).\n\t\tconst expectFamily: 'tcp' \| 'http' = wireProtocol === 'tcp' ? 'tcp' : 'http';\n\t\tconst entrypointFamily: 'tcp' \| 'http' = entrypoint.protocol === 'tcp' ? 'tcp' : 'http';\n\t\tif (expectFamily !== entrypointFamily) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'entrypointName',\n\t\t\t\t\tvalue: entrypoint.name,\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t`wireProtocol family mismatch: decl is '${wireProtocol}' but ` +\n\t\t\t\t\t\t`entrypoint '${entrypoint.name}' is '${entrypoint.protocol}'`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\t// Validate the upstream URL — defense in depth (the resolvers\n\t\t// already produce safe values, but this stops a future resolver\n\t\t// that returns junk from corrupting the YAML). TCP carries the\n\t\t// `tcp://` scheme so we differentiate from the HTTP path; the\n\t\t// renderer pulls host+port back out either way.\n\t\tconst upstreamUrl = renderUrl({\n\t\t\tprotocol: wireProtocol === 'tcp' ? 'tcp' : 'http',\n\t\t\thostname: upstream.host,\n\t\t\tport: upstream.port,\n\t\t});\n\t\tif (!/^(?:http\|tcp):\\/\\/[A-Za-z0-9_.:-]+:\\d+$/.test(upstreamUrl)) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'upstreamUrl',\n\t\t\t\t\tvalue: upstreamUrl,\n\t\t\t\t\tdetail: 'expected http://<host>:<port> or tcp://<host>:<port>',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\t// CORS is HTTP-only — TCP decls don't carry the field. Render\n\t\t// uses this; the resolved shape carries `false` for TCP.\n\t\tconst cors = decl.wireProtocol === 'tcp' ? false : decl.cors;\n\t\treturn {\n\t\t\tdispatchFileId: fileId,\n\t\t\thostname,\n\t\t\tentrypointName: entrypoint.name,\n\t\t\tentrypointPort: entrypoint.port,\n\t\t\tupstreamUrl,\n\t\t\tcors,\n\t\t\twireProtocol,\n\t\t};\n\t});\n\n// ---------------------------------------------------------------------------\n// Render — ResolvedRoute → YAML body\n// ---------------------------------------------------------------------------\n\n/** Pull host+port out of an `<scheme>://<host>:<port>` URL. Used by the\n * TCP renderer to write the `address:` field. Safe because\n * `resolveRoute` validates the URL shape before we get here. /\nconst splitUpstream = (url: string): { host: string; port: string } => {\n\tconst stripped = url.replace(/^(?:http\|tcp):\\/\\//, '');\n\tconst lastColon = stripped.lastIndexOf(':');\n\treturn {\n\t\thost: stripped.slice(0, lastColon),\n\t\tport: stripped.slice(lastColon + 1),\n\t};\n};\n\nconst renderLeaseHeader = (lease: RouteLeaseMetadata): ReadonlyArray<string> => [\n\t`# routeLeaseVersion: ${lease.version}`,\n\t`# routerProfileId: ${lease.routerProfileId}`,\n\t`# ownerApp: ${lease.app}`,\n\t`# ownerStack: ${lease.stack}`,\n\t`# ownerPid: ${lease.owner.pid}`,\n\t`# ownerStartTime: ${lease.owner.startTime}`,\n\t`# ownerHostname: ${lease.owner.hostname}`,\n\t`# ownerClaimedAt: ${lease.owner.claimedAt}`,\n\t`# ownerHeartbeatAt: ${lease.owner.heartbeatAt}`,\n\t`# ownerIntent: ${lease.owner.intent}`,\n];\n\n/* Render the YAML body for a single resolved route. Hand-rolled\n * (same rationale as `cors.ts`): static, controlled, byte-stable so\n * no-op rewrites don't wake the watcher. /\nexport const renderRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tif (route.wireProtocol === 'tcp') return renderTcpRouteYaml(route, lease);\n\treturn renderHttpRouteYaml(route, lease);\n};\n\nconst routeReadinessMiddlewareName = (route: ResolvedRoute): string =>\n\t`${route.dispatchFileId}-route-ready`;\n\nconst renderHttpRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tconst middlewares = [\n\t\trouteReadinessMiddlewareName(route),\n\t\t...(route.cors ? [CORS_MIDDLEWARE_NAME] : []),\n\t];\n\tconst schemeHint =\n\t\troute.wireProtocol === 'h2c'\n\t\t\t? ` # h2c upstream — gRPC-friendly cleartext HTTP/2.\\n`\n\t\t\t: '';\n\treturn [\n\t\t`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,\n\t\t`# dispatchFileId: ${route.dispatchFileId}`,\n\t\t`# wireProtocol: ${route.wireProtocol}`,\n\t\t`# entrypointName: ${route.entrypointName}`,\n\t\t`# entrypointPort: ${route.entrypointPort}`,\n\t\t`# hostname: ${route.hostname}`,\n\t\t...renderLeaseHeader(lease),\n\t\t`http:`,\n\t\t` routers:`,\n\t\t` ${route.dispatchFileId}-router:`,\n\t\t` rule: \"Host(\\`${route.hostname}\\`)\"`,\n\t\t` entryPoints: [\"${route.entrypointName}\"]`,\n\t\t` service: \"${route.dispatchFileId}-svc\"`,\n\t\t` middlewares: [${middlewares.map((name) => `\"${name}\"`).join(', ')}]`,\n\t\t` middlewares:`,\n\t\t` ${routeReadinessMiddlewareName(route)}:`,\n\t\t` headers:`,\n\t\t` customResponseHeaders:`,\n\t\t` ${ROUTE_READINESS_HEADER}: \"${route.dispatchFileId}\"`,\n\t\t` services:`,\n\t\t` ${route.dispatchFileId}-svc:`,\n\t\t` loadBalancer:`,\n\t\tschemeHint.length > 0 ? schemeHint.trimEnd() : null,\n\t\t` servers:`,\n\t\t` - url: \"${route.upstreamUrl}\"`,\n\t\t``,\n\t]\n\t\t.filter((line): line is string => line !== null)\n\t\t.join('\\n');\n};\n\nconst renderTcpRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tconst { host, port } = splitUpstream(route.upstreamUrl);\n\treturn [\n\t\t`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,\n\t\t`# dispatchFileId: ${route.dispatchFileId}`,\n\t\t`# wireProtocol: tcp`,\n\t\t`# entrypointName: ${route.entrypointName}`,\n\t\t`# entrypointPort: ${route.entrypointPort}`,\n\t\t`# hostname: ${route.hostname}`,\n\t\t`# tcpDispatch: entrypoint-port dispatch; HostSNI wildcard`,\n\t\t...renderLeaseHeader(lease),\n\t\t`tcp:`,\n\t\t` routers:`,\n\t\t` ${route.dispatchFileId}-router:`,\n\t\t` rule: \"HostSNI(\\`\\`)\"`,\n\t\t` entryPoints: [\"${route.entrypointName}\"]`,\n\t\t` service: \"${route.dispatchFileId}-svc\"`,\n\t\t` services:`,\n\t\t` ${route.dispatchFileId}-svc:`,\n\t\t` loadBalancer:`,\n\t\t` servers:`,\n\t\t` - address: \"${host}:${port}\"`,\n\t\t``,\n\t].join('\\n');\n};\n\nexport const dispatchFileIdFromFilename = (filename: string): string \| null => {\n\t// Escape `DISPATCH_FILENAME_PREFIX` for use inside a RegExp literal —\n\t// today it's a plain `10-` so no regex metacharacters are at play,\n\t// but the escape makes the read side robust to future prefix changes.\n\tconst escapedPrefix = DISPATCH_FILENAME_PREFIX.replace(/[.+?^${}()\|[\\]\\\\]/g, '\\\\$&');\n\tconst match = new RegExp(`^${escapedPrefix}(.+)\\\\.yml$`).exec(filename);\n\treturn match?.[1] ?? null;\n};\n\nconst commentValue = (body: string, key: string): string \| null => {\n\tconst escaped = key.replace(/[.+?^${}()\|[\\]\\\\]/g, '\\\\$&');\n\tconst match = new RegExp(`^# ${escaped}: (.)$`, 'm').exec(body);\n\treturn match?.[1]?.trim() ?? null;\n};\n\nconst matchValue = (body: string, pattern: RegExp): string \| null =>\n\tpattern.exec(body)?.[1]?.trim() ?? null;\n\nconst commentNumber = (body: string, key: string): number \| null => {\n\tconst raw = commentValue(body, key);\n\tif (raw === null \|\| !/^\\d+$/.test(raw)) return null;\n\treturn Number.parseInt(raw, 10);\n};\n\nconst parseWireProtocol = (body: string): ResolvedWireProtocol \| null => {\n\tconst fromComment = commentValue(body, 'wireProtocol');\n\tif (fromComment === 'http' \|\| fromComment === 'h2c' \|\| fromComment === 'tcp') {\n\t\treturn fromComment;\n\t}\n\tif (/^tcp:/m.test(body)) return 'tcp';\n\tif (/^http:/m.test(body)) return 'http';\n\treturn null;\n};\n\nconst hasRouteLeaseMetadata = (body: string): boolean =>\n\t[\n\t\t'routeLeaseVersion',\n\t\t'routerProfileId',\n\t\t'ownerApp',\n\t\t'ownerStack',\n\t\t'ownerPid',\n\t\t'ownerStartTime',\n\t\t'ownerHostname',\n\t\t'ownerClaimedAt',\n\t\t'ownerHeartbeatAt',\n\t\t'ownerIntent',\n\t].some((key) => commentValue(body, key) !== null);\n\nconst parseRouteLeaseMetadata = (\n\tbody: string,\n\tdispatchFileId: string,\n): {\n\treadonly lease: RouteLeaseMetadata \| null;\n\treadonly diagnostic: DispatchRouteDecodeDiagnostic \| null;\n} => {\n\tif (!hasRouteLeaseMetadata(body)) return { lease: null, diagnostic: null };\n\tconst rawVersion = commentValue(body, 'routeLeaseVersion');\n\tconst version = commentNumber(body, 'routeLeaseVersion');\n\tconst routerProfileId = commentValue(body, 'routerProfileId');\n\tconst app = commentValue(body, 'ownerApp');\n\tconst stack = commentValue(body, 'ownerStack');\n\tconst pid = commentNumber(body, 'ownerPid');\n\tconst startTime = commentNumber(body, 'ownerStartTime');\n\tconst hostname = commentValue(body, 'ownerHostname');\n\tconst claimedAt = commentNumber(body, 'ownerClaimedAt');\n\tconst heartbeatAt = commentNumber(body, 'ownerHeartbeatAt');\n\tconst intent = commentValue(body, 'ownerIntent');\n\tif (version !== ROUTER_ROUTE_LEASE_VERSION) {\n\t\treturn {\n\t\t\tlease: null,\n\t\t\tdiagnostic: {\n\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\tdispatchFileId,\n\t\t\t\treason: 'unknown-route-lease-version',\n\t\t\t\tdetail: `expected routeLeaseVersion ${ROUTER_ROUTE_LEASE_VERSION}, got ${rawVersion ?? '<missing>'}`,\n\t\t\t},\n\t\t};\n\t}\n\tif (\n\t\trouterProfileId === null \|\|\n\t\tapp === null \|\|\n\t\tstack === null \|\|\n\t\tpid === null \|\|\n\t\tstartTime === null \|\|\n\t\thostname === null \|\|\n\t\tclaimedAt === null \|\|\n\t\theartbeatAt === null \|\|\n\t\t(intent !== 'normal' && intent !== 'snapshot')\n\t) {\n\t\treturn {\n\t\t\tlease: null,\n\t\t\tdiagnostic: {\n\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\tdispatchFileId,\n\t\t\t\treason: 'invalid-route-lease-metadata',\n\t\t\t\tdetail: 'route lease metadata is incomplete or malformed',\n\t\t\t},\n\t\t};\n\t}\n\treturn {\n\t\tlease: {\n\t\t\tversion: ROUTER_ROUTE_LEASE_VERSION,\n\t\t\trouterProfileId,\n\t\t\tapp,\n\t\t\tstack,\n\t\t\towner: {\n\t\t\t\tpid,\n\t\t\t\tstartTime,\n\t\t\t\thostname,\n\t\t\t\tclaimedAt,\n\t\t\t\theartbeatAt,\n\t\t\t\tintent,\n\t\t\t},\n\t\t},\n\t\tdiagnostic: null,\n\t};\n};\n\nexport const parseDispatchRouteFile = (\n\tbody: string,\n\tfallbackDispatchFileId: string \| null = null,\n): DispatchRouteParseResult => {\n\tconst dispatchFileId = commentValue(body, 'dispatchFileId') ?? fallbackDispatchFileId;\n\tconst wireProtocol = parseWireProtocol(body);\n\tconst entrypointName =\n\t\tcommentValue(body, 'entrypointName') ?? matchValue(body, /entryPoints: \\[\"([^\"]+)\"\\]/);\n\tconst hostname =\n\t\tcommentValue(body, 'hostname') ??\n\t\tmatchValue(body, /Host\$`([^`]+)`\$/) ??\n\t\t(wireProtocol === 'tcp' ? '' : null);\n\tconst portRaw = commentValue(body, 'entrypointPort');\n\tconst entrypointPort =\n\t\tportRaw === null \|\| !/^\\d+$/.test(portRaw) ? null : Number.parseInt(portRaw, 10);\n\n\tif (\n\t\tdispatchFileId === null \|\|\n\t\twireProtocol === null \|\|\n\t\tentrypointName === null \|\|\n\t\thostname === null\n\t) {\n\t\tconst protectedDispatchFileId = dispatchFileId ?? '<unknown>';\n\t\treturn {\n\t\t\t_tag: 'invalid',\n\t\t\tdispatchFileId: protectedDispatchFileId,\n\t\t\tdiagnostics: [\n\t\t\t\t{\n\t\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\t\tdispatchFileId: protectedDispatchFileId,\n\t\t\t\t\treason: 'missing-required-route-metadata',\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t'route file is missing dispatchFileId, wireProtocol/http\|tcp block, entrypointName, or hostname metadata',\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\t}\n\tconst leaseResult = parseRouteLeaseMetadata(body, dispatchFileId);\n\n\treturn {\n\t\t_tag: 'valid',\n\t\troute: {\n\t\t\tdispatchFileId,\n\t\t\thostname,\n\t\t\tentrypointName,\n\t\t\tentrypointPort,\n\t\t\twireProtocol,\n\t\t\tlease: leaseResult.lease,\n\t\t},\n\t\tdiagnostics: leaseResult.diagnostic === null ? [] : [leaseResult.diagnostic],\n\t};\n};\n\nexport const parseDispatchRouteMetadata = (\n\tbody: string,\n\tfallbackDispatchFileId: string \| null = null,\n): DispatchRouteMetadata \| null => {\n\tconst parsed = parseDispatchRouteFile(body, fallbackDispatchFileId);\n\treturn parsed._tag === 'valid' ? parsed.route : null;\n};\n\n// ---------------------------------------------------------------------------\n// Collision detection\n// ---------------------------------------------------------------------------\n\n/* Assert no two resolved routes share dispatch keys.\n \n - HTTP routes collide on `(entrypoint, hostname)` — two HTTP backends\n * on the same entrypoint port can coexist via different Host headers,\n * so the Host is part of the key.\n * - TCP routes collide on `entrypoint` alone — TCP has no Host header,\n * so an entrypoint can serve exactly ONE backend. Two TCP decls on\n * the same entrypoint are an unambiguous error (parallel stacks of\n * a TCP service share the host port and would clobber each other).\n \n Architecture invariant #7 — distinct identity → distinct dispatch\n * URL. The TCP arm is the new clause; HTTP arm unchanged. */\nexport const detectCollisions = (\n\troutes: ReadonlyArray<RouteCollisionMetadata>,\n): RouteCollision \| null => {\n\tconst seen = new Map<string, Array<RouteCollisionMetadata>>();\n\tfor (const r of routes) {\n\t\tconst portKey =\n\t\t\tr.entrypointPort === null ? `entrypoint:${r.entrypointName}` : `port:${r.entrypointPort}`;\n\t\tconst key = r.wireProtocol === 'tcp' ? `tcp@${portKey}` : `http@${portKey}@${r.hostname}`;\n\t\tconst acc = seen.get(key);\n\t\tif (acc) acc.push(r);\n\t\telse seen.set(key, [r]);\n\t}\n\tfor (const [key, colliding] of seen) {\n\t\tif (colliding.length > 1) {\n\t\t\tconst ids = colliding.map((route) => route.dispatchFileId);\n\t\t\tconst first = colliding[0];\n\t\t\tif (key.startsWith('tcp@')) {\n\t\t\t\treturn new RouteCollision({\n\t\t\t\t\tmessage: routeCollisionMessage({\n\t\t\t\t\t\thostname: '',\n\t\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t\t\twireProtocol: 'tcp',\n\t\t\t\t\t}),\n\t\t\t\t\thostname: '',\n\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new RouteCollision({\n\t\t\t\tmessage: routeCollisionMessage({\n\t\t\t\t\thostname: first?.hostname ?? '',\n\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t\twireProtocol: 'http',\n\t\t\t\t}),\n\t\t\t\thostname: first?.hostname ?? '',\n\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\tdispatchIds: ids,\n\t\t\t});\n\t\t}\n\t}\n\treturn null;\n};\n\nconst routeCollisionMessage = (collision: {\n\treadonly hostname: string;\n\treadonly entrypoint: string;\n\treadonly dispatchIds: ReadonlyArray<string>;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}): string => {\n\tconst ids = collision.dispatchIds.join(', ');\n\tif (collision.wireProtocol === 'tcp') {\n\t\treturn `router TCP route collision on entrypoint '${collision.entrypoint}' for dispatch ids: ${ids}`;\n\t}\n\treturn (\n\t\t`router route collision on entrypoint '${collision.entrypoint}' ` +\n\t\t`and hostname '${collision.hostname}' for dispatch ids: ${ids}`\n\t);\n};\n"],"mappings":";;;;;;AA8DA,MAAa,yBAAyB;;;;;;AAOtC,MAAM,2BAA2B;;;;;AAmFjC,MAAa,oBAAoB,WAChC,GAAG,2BAA2B,OAAO;;;;;;;;;AAoCtC,MAAa,gBACZ,UACA,MACA,UACA,cAEA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO,SAAS,OAAO,KAAK,YAAY;CAC3D,MAAM,WAAW,OAAO,eAAe,UAAU,KAAK,WAAW,IAAI;CACrE,MAAM,SAAS,OAAO,eAAe;EAAE;EAAU,UAAU,KAAK;CAAW,CAAC;CAC5E,MAAM,WACL,KAAK,SAAS,SAAS,cACpB,OAAO,UAAU,iBAAiB;EAClC,eAAe,KAAK,SAAS;EAC7B,eAAe,KAAK,SAAS;CAC9B,CAAC,IACA,OAAO,UAAU,oBAAoB,EAAE,MAAM,KAAK,SAAS,KAAK,CAAC;CACrE,MAAM,eACL,KAAK,iBAAiB,QAAQ,QAAQ,KAAK,iBAAiB,QAAQ,QAAQ;CAQ7E,KAFqC,iBAAiB,QAAQ,QAAQ,aAC7B,WAAW,aAAa,QAAQ,QAAQ,SAEhF,OAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO,WAAW;EAClB,QACC,0CAA0C,aAAa,oBACxC,WAAW,KAAK,QAAQ,WAAW,SAAS;CAC7D,CAAC,CACF;CAOD,MAAM,cAAc,UAAU;EAC7B,UAAU,iBAAiB,QAAQ,QAAQ;EAC3C,UAAU,SAAS;EACnB,MAAM,SAAS;CAChB,CAAC;CACD,IAAI,CAAC,0CAA0C,KAAK,WAAW,GAC9D,OAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO;EACP,QAAQ;CACT,CAAC,CACF;CAID,MAAM,OAAO,KAAK,iBAAiB,QAAQ,QAAQ,KAAK;CACxD,OAAO;EACN,gBAAgB;EAChB;EACA,gBAAgB,WAAW;EAC3B,gBAAgB,WAAW;EAC3B;EACA;EACA;CACD;AACD,CAAC;;;;AASF,MAAM,iBAAiB,QAAgD;CACtE,MAAM,WAAW,IAAI,QAAQ,sBAAsB,EAAE;CACrD,MAAM,YAAY,SAAS,YAAY,GAAG;CAC1C,OAAO;EACN,MAAM,SAAS,MAAM,GAAG,SAAS;EACjC,MAAM,SAAS,MAAM,YAAY,CAAC;CACnC;AACD;AAEA,MAAM,qBAAqB,UAAqD;CAC/E,wBAAwB,MAAM;CAC9B,sBAAsB,MAAM;CAC5B,eAAe,MAAM;CACrB,iBAAiB,MAAM;CACvB,eAAe,MAAM,MAAM;CAC3B,qBAAqB,MAAM,MAAM;CACjC,oBAAoB,MAAM,MAAM;CAChC,qBAAqB,MAAM,MAAM;CACjC,uBAAuB,MAAM,MAAM;CACnC,kBAAkB,MAAM,MAAM;AAC/B;;;;AAKA,MAAa,mBAAmB,OAAsB,UAAsC;CAC3F,IAAI,MAAM,iBAAiB,OAAO,OAAO,mBAAmB,OAAO,KAAK;CACxE,OAAO,oBAAoB,OAAO,KAAK;AACxC;AAEA,MAAM,gCAAgC,UACrC,GAAG,MAAM,eAAe;AAEzB,MAAM,uBAAuB,OAAsB,UAAsC;CACxF,MAAM,cAAc,CACnB,6BAA6B,KAAK,GAClC,GAAI,MAAM,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAC5C;CACA,MAAM,aACL,MAAM,iBAAiB,QACpB,+DACA;CACJ,OAAO;EACN;EACA,qBAAqB,MAAM;EAC3B,mBAAmB,MAAM;EACzB,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,eAAe,MAAM;EACrB,GAAG,kBAAkB,KAAK;EAC1B;EACA;EACA,OAAO,MAAM,eAAe;EAC5B,uBAAuB,MAAM,SAAS;EACtC,wBAAwB,MAAM,eAAe;EAC7C,mBAAmB,MAAM,eAAe;EACxC,uBAAuB,YAAY,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;EACzE;EACA,OAAO,6BAA6B,KAAK,EAAE;EAC3C;EACA;EACA,aAAa,uBAAuB,KAAK,MAAM,eAAe;EAC9D;EACA,OAAO,MAAM,eAAe;EAC5B;EACA,WAAW,SAAS,IAAI,WAAW,QAAQ,IAAI;EAC/C;EACA,qBAAqB,MAAM,YAAY;EACvC;CACD,CAAC,CACC,QAAQ,SAAyB,SAAS,IAAI,CAAC,CAC/C,KAAK,IAAI;AACZ;AAEA,MAAM,sBAAsB,OAAsB,UAAsC;CACvF,MAAM,EAAE,MAAM,SAAS,cAAc,MAAM,WAAW;CACtD,OAAO;EACN;EACA,qBAAqB,MAAM;EAC3B;EACA,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,eAAe,MAAM;EACrB;EACA,GAAG,kBAAkB,KAAK;EAC1B;EACA;EACA,OAAO,MAAM,eAAe;EAC5B;EACA,wBAAwB,MAAM,eAAe;EAC7C,mBAAmB,MAAM,eAAe;EACxC;EACA,OAAO,MAAM,eAAe;EAC5B;EACA;EACA,yBAAyB,KAAK,GAAG,KAAK;EACtC;CACD,CAAC,CAAC,KAAK,IAAI;AACZ;AAEA,MAAa,8BAA8B,aAAoC;CAI9E,MAAM,gBAAgB,yBAAyB,QAAQ,uBAAuB,MAAM;CAEpF,OADc,IAAI,OAAO,IAAI,cAAc,YAAY,CAAC,CAAC,KAAK,QACnD,CAAC,GAAG,MAAM;AACtB;AAEA,MAAM,gBAAgB,MAAc,QAA+B;CAClE,MAAM,UAAU,IAAI,QAAQ,uBAAuB,MAAM;CAEzD,OADc,IAAI,OAAO,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC,KAAK,IAChD,CAAC,GAAG,EAAE,EAAE,KAAK,KAAK;AAC9B;AAEA,MAAM,cAAc,MAAc,YACjC,QAAQ,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,KAAK;AAEpC,MAAM,iBAAiB,MAAc,QAA+B;CACnE,MAAM,MAAM,aAAa,MAAM,GAAG;CAClC,IAAI,QAAQ,QAAQ,CAAC,QAAQ,KAAK,GAAG,GAAG,OAAO;CAC/C,OAAO,OAAO,SAAS,KAAK,EAAE;AAC/B;AAEA,MAAM,qBAAqB,SAA8C;CACxE,MAAM,cAAc,aAAa,MAAM,cAAc;CACrD,IAAI,gBAAgB,UAAU,gBAAgB,SAAS,gBAAgB,OACtE,OAAO;CAER,IAAI,SAAS,KAAK,IAAI,GAAG,OAAO;CAChC,IAAI,UAAU,KAAK,IAAI,GAAG,OAAO;CACjC,OAAO;AACR;AAEA,MAAM,yBAAyB,SAC9B;CACC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC,CAAC,MAAM,QAAQ,aAAa,MAAM,GAAG,MAAM,IAAI;AAEjD,MAAM,2BACL,MACA,mBAII;CACJ,IAAI,CAAC,sBAAsB,IAAI,GAAG,OAAO;EAAE,OAAO;EAAM,YAAY;CAAK;CACzE,MAAM,aAAa,aAAa,MAAM,mBAAmB;CACzD,MAAM,UAAU,cAAc,MAAM,mBAAmB;CACvD,MAAM,kBAAkB,aAAa,MAAM,iBAAiB;CAC5D,MAAM,MAAM,aAAa,MAAM,UAAU;CACzC,MAAM,QAAQ,aAAa,MAAM,YAAY;CAC7C,MAAM,MAAM,cAAc,MAAM,UAAU;CAC1C,MAAM,YAAY,cAAc,MAAM,gBAAgB;CACtD,MAAM,WAAW,aAAa,MAAM,eAAe;CACnD,MAAM,YAAY,cAAc,MAAM,gBAAgB;CACtD,MAAM,cAAc,cAAc,MAAM,kBAAkB;CAC1D,MAAM,SAAS,aAAa,MAAM,aAAa;CAC/C,IAAI,YAAA,GACH,OAAO;EACN,OAAO;EACP,YAAY;GACX,MAAM;GACN;GACA,QAAQ;GACR,QAAQ,qCAAiE,cAAc;EACxF;CACD;CAED,IACC,oBAAoB,QACpB,QAAQ,QACR,UAAU,QACV,QAAQ,QACR,cAAc,QACd,aAAa,QACb,cAAc,QACd,gBAAgB,QACf,WAAW,YAAY,WAAW,YAEnC,OAAO;EACN,OAAO;EACP,YAAY;GACX,MAAM;GACN;GACA,QAAQ;GACR,QAAQ;EACT;CACD;CAED,OAAO;EACN,OAAO;GACN,SAAA;GACA;GACA;GACA;GACA,OAAO;IACN;IACA;IACA;IACA;IACA;IACA;GACD;EACD;EACA,YAAY;CACb;AACD;AAEA,MAAa,0BACZ,MACA,yBAAwC,SACV;CAC9B,MAAM,iBAAiB,aAAa,MAAM,gBAAgB,KAAK;CAC/D,MAAM,eAAe,kBAAkB,IAAI;CAC3C,MAAM,iBACL,aAAa,MAAM,gBAAgB,KAAK,WAAW,MAAM,4BAA4B;CACtF,MAAM,WACL,aAAa,MAAM,UAAU,KAC7B,WAAW,MAAM,mBAAmB,MACnC,iBAAiB,QAAQ,KAAK;CAChC,MAAM,UAAU,aAAa,MAAM,gBAAgB;CACnD,MAAM,iBACL,YAAY,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,OAAO,SAAS,SAAS,EAAE;CAEhF,IACC,mBAAmB,QACnB,iBAAiB,QACjB,mBAAmB,QACnB,aAAa,MACZ;EACD,MAAM,0BAA0B,kBAAkB;EAClD,OAAO;GACN,MAAM;GACN,gBAAgB;GAChB,aAAa,CACZ;IACC,MAAM;IACN,gBAAgB;IAChB,QAAQ;IACR,QACC;GACF,CACD;EACD;CACD;CACA,MAAM,cAAc,wBAAwB,MAAM,cAAc;CAEhE,OAAO;EACN,MAAM;EACN,OAAO;GACN;GACA;GACA;GACA;GACA;GACA,OAAO,YAAY;EACpB;EACA,aAAa,YAAY,eAAe,OAAO,CAAC,IAAI,CAAC,YAAY,UAAU;CAC5E;AACD;;;;;;;;;;;;;AA0BA,MAAa,oBACZ,WAC2B;CAC3B,MAAM,uBAAO,IAAI,IAA2C;CAC5D,KAAK,MAAM,KAAK,QAAQ;EACvB,MAAM,UACL,EAAE,mBAAmB,OAAO,cAAc,EAAE,mBAAmB,QAAQ,EAAE;EAC1E,MAAM,MAAM,EAAE,iBAAiB,QAAQ,OAAO,YAAY,QAAQ,QAAQ,GAAG,EAAE;EAC/E,MAAM,MAAM,KAAK,IAAI,GAAG;EACxB,IAAI,KAAK,IAAI,KAAK,CAAC;OACd,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;CACvB;CACA,KAAK,MAAM,CAAC,KAAK,cAAc,MAC9B,IAAI,UAAU,SAAS,GAAG;EACzB,MAAM,MAAM,UAAU,KAAK,UAAU,MAAM,cAAc;EACzD,MAAM,QAAQ,UAAU;EACxB,IAAI,IAAI,WAAW,MAAM,GACxB,OAAO,IAAI,eAAe;GACzB,SAAS,sBAAsB;IAC9B,UAAU;IACV,YAAY,OAAO,kBAAkB;IACrC,aAAa;IACb,cAAc;GACf,CAAC;GACD,UAAU;GACV,YAAY,OAAO,kBAAkB;GACrC,aAAa;EACd,CAAC;EAEF,OAAO,IAAI,eAAe;GACzB,SAAS,sBAAsB;IAC9B,UAAU,OAAO,YAAY;IAC7B,YAAY,OAAO,kBAAkB;IACrC,aAAa;IACb,cAAc;GACf,CAAC;GACD,UAAU,OAAO,YAAY;GAC7B,YAAY,OAAO,kBAAkB;GACrC,aAAa;EACd,CAAC;CACF;CAED,OAAO;AACR;AAEA,MAAM,yBAAyB,cAKjB;CACb,MAAM,MAAM,UAAU,YAAY,KAAK,IAAI;CAC3C,IAAI,UAAU,iBAAiB,OAC9B,OAAO,6CAA6C,UAAU,WAAW,sBAAsB;CAEhG,OACC,yCAAyC,UAAU,WAAW,kBAC7C,UAAU,SAAS,sBAAsB;AAE5D"}
1	+ {"version":3,"file":"file-provider.mjs","names":[],"sources":["../../../src/orchestrators/router/file-provider.ts"],"sourcesContent":["// File-provider config generator.\n//\n// Architecture invariant #1: file-provider ONLY, never docker-provider.\n// We materialize per-backend dispatch entries as YAML files in a\n// watched directory; Traefik's file-provider polls + reloads on\n// change. The docker-provider was rejected because the container IP\n// we need is the shared-network IP that lands AFTER `network connect`,\n// and the docker-provider captures the per-stack IP at first event\n// and never refreshes.\n//\n// One file per canonical route identity. Each file carries exactly\n// one router + one service (and references the shared CORS middleware\n// when `cors: true`). This layout means atomic add/remove of a route\n// is one file create/unlink — no merge step, no race.\n//\n// Two YAML shapes live under this renderer, discriminated by the\n// resolved route's `wireProtocol`:\n//\n// HTTP / h2c / HTTPS upstream (Host-header dispatch on a shared port):\n//\n// http:\n// routers:\n// <id>-router:\n// rule: \"Host(`<hostname>`)\"\n// entryPoints: [\"<entrypointName>\"]\n// service: \"<id>-svc\"\n// middlewares: [\"devstack-cors\"] # when cors: true\n// services:\n// <id>-svc:\n// loadBalancer:\n// servers:\n// - url: \"http://<upstream-host>:<upstream-port>\"\n//\n// TCP (per-entrypoint-port dispatch; ONE backend per entrypoint):\n//\n// tcp:\n// routers:\n// <id>-router:\n// rule: \"HostSNI(``)\"\n// entryPoints: [\"<entrypointName>\"]\n// service: \"<id>-svc\"\n// services:\n// <id>-svc:\n// loadBalancer:\n// servers:\n// - address: \"<upstream-host>:<upstream-port>\"\n//\n// HostSNI(``) matches any incoming TCP connection on the entrypoint\n// (Traefik requires every TCP router to have a rule; `` is the wildcard\n// that means \"any client\"). No CORS section — TCP isn't HTTP and the\n// shared CORS middleware lives under `http.middlewares`.\n\nimport { Effect } from 'effect';\n\nimport type { RoutableDecl } from '../../contracts/routable.ts';\nimport type { RosterHolder } from '../../substrate/cross-process.ts';\nimport type { Identity } from '../../substrate/identity.ts';\nimport { CORS_MIDDLEWARE_NAME } from './cors.ts';\nimport type { EntrypointRegistryShape } from './entrypoints.ts';\nimport { RouteCollision, RouterValidationError, type UnknownEntrypoint } from './errors.ts';\nimport { dispatchFileId, renderUrl, routerHostname } from './hostname.ts';\n\nexport const ROUTE_READINESS_HEADER = 'X-Devstack-Route-Id';\n\n/* Dispatch-file filename prefix. `10-` sorts behind the shared CORS\n * middleware (`00-`) so Traefik's file-provider loads the middleware\n * before any router that references it. Single source of truth for\n * the file-write side (`dispatchFilename`) and the file-read side\n * (`dispatchFileIdFromFilename`) — keep them in lockstep here. /\nconst DISPATCH_FILENAME_PREFIX = '10-';\n\n// ---------------------------------------------------------------------------\n// Resolved-route data structure\n// ---------------------------------------------------------------------------\n\n/* Resolved wire-protocol. `'tcp'` carries no hostname matcher and no\n * CORS. The router orchestrator's renderer + collision-detector branch\n * on this. /\nexport type ResolvedWireProtocol = 'http' \| 'h2c' \| 'https' \| 'tcp';\n\n/* A `RoutableDecl` resolved by the orchestrator: hostname minted,\n * dispatch-id stringified, entrypoint port resolved, upstream URL\n * resolved. This is the shape the file-provider renderer consumes —\n * decoupled from the resolution path so testing the renderer is\n * pure. /\nexport interface ResolvedRoute {\n\treadonly dispatchFileId: string;\n\t/* Minted hostname for HTTP routes. For TCP routes this is still\n\t * computed (it's the host string the URL surfaces to consumers),\n\t * but the Traefik router rule is `HostSNI(\\`\\`)` — TCP dispatches\n\t by entrypoint port, not Host. /\n\treadonly hostname: string;\n\treadonly entrypointName: string;\n\treadonly entrypointPort: number;\n\t/* Upstream URL string. For HTTP-family routes this is\n\t * `<scheme>://<host>:<port>`; for TCP it's still rendered as\n\t * `tcp://<host>:<port>` so the renderer can pull host+port back out\n\t * for the `address:` field. /\n\treadonly upstreamUrl: string;\n\treadonly cors: boolean;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}\n\nexport interface RouteCollisionMetadata {\n\treadonly dispatchFileId: string;\n\treadonly hostname: string;\n\treadonly entrypointName: string;\n\treadonly entrypointPort: number \| null;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}\n\nexport const ROUTER_ROUTE_LEASE_VERSION = 1;\n\nexport interface RouteLeaseMetadata {\n\treadonly version: typeof ROUTER_ROUTE_LEASE_VERSION;\n\treadonly routerProfileId: string;\n\treadonly app: string;\n\treadonly stack: string;\n\treadonly owner: RosterHolder;\n}\n\nexport interface DispatchRouteMetadata extends RouteCollisionMetadata {\n\treadonly lease: RouteLeaseMetadata \| null;\n}\n\nexport type DispatchRouteDecodeReason =\n\t\| 'missing-required-route-metadata'\n\t\| 'unknown-route-lease-version'\n\t\| 'invalid-route-lease-metadata';\n\nexport interface DispatchRouteDecodeDiagnostic {\n\treadonly _tag: 'DispatchRouteDecodeDiagnostic';\n\treadonly dispatchFileId: string;\n\treadonly reason: DispatchRouteDecodeReason;\n\treadonly detail: string;\n}\n\nexport type DispatchRouteParseResult =\n\t\| {\n\t\t\treadonly _tag: 'valid';\n\t\t\treadonly route: DispatchRouteMetadata;\n\t\t\treadonly diagnostics: ReadonlyArray<DispatchRouteDecodeDiagnostic>;\n\t }\n\t\| {\n\t\t\treadonly _tag: 'invalid';\n\t\t\treadonly dispatchFileId: string;\n\t\t\treadonly diagnostics: ReadonlyArray<DispatchRouteDecodeDiagnostic>;\n\t };\n\n/* Filename within the dispatch directory for a given file-id. The\n * prefix (`DISPATCH_FILENAME_PREFIX`) sorts behind the shared CORS\n * middleware (`00-`) so Traefik picks up the middleware before any\n * router referencing it. /\nexport const dispatchFilename = (fileId: string): string =>\n\t`${DISPATCH_FILENAME_PREFIX}${fileId}.yml`;\n\n// ---------------------------------------------------------------------------\n// Resolution — Routable + Identity + EntrypointRegistry + upstream → ResolvedRoute\n// ---------------------------------------------------------------------------\n\n/* Upstream-resolution interface the file-provider needs. The\n * orchestrator threads in concrete resolvers (`runtime/docker` for\n * containers, the port broker for host-loopback) without leaking\n * service knowledge. Architecture: \"router has no compiled-in\n * awareness of which services exist.\" /\nexport interface UpstreamResolver {\n\t/* For a container-kind upstream, return `(host, port)` where host\n\t * is the container's shared-network IP and port is the container\n\t * port from the plugin. Bounded retry lives inside the resolver\n\t * (architecture invariant #3). /\n\treadonly resolveContainer: (target: {\n\t\treadonly containerName: string;\n\t\treadonly containerPort: number;\n\t}) => Effect.Effect<{ readonly host: string; readonly port: number }, RouterValidationError>;\n\t/* For a host-loopback-kind upstream, return the bound loopback\n\t * port. The plugin owns port allocation and stamps the resolved\n\t * port into its Routable decl after acquire. /\n\treadonly resolveHostLoopback: (target: {\n\t\treadonly port: number;\n\t}) => Effect.Effect<{ readonly host: string; readonly port: number }, RouterValidationError>;\n}\n\n/* Resolve a single Routable into a ResolvedRoute. Pure-ish: the only\n * effectful bit is the upstream resolver (which talks to docker /\n * the port broker) and the entrypoint lookup.\n \n Takes the registry as a parameter rather than yielding the service\n * tag so the calling orchestrator can pre-bind it once at layer-\n * construction time, keeping the per-Routable hot path free of\n * Context lookups. /\nexport const resolveRoute = (\n\tidentity: Identity,\n\tdecl: RoutableDecl,\n\tregistry: EntrypointRegistryShape,\n\tupstreams: UpstreamResolver,\n): Effect.Effect<ResolvedRoute, RouterValidationError \| UnknownEntrypoint> =>\n\tEffect.gen(function () {\n\t\tconst entrypoint = yield* registry.byName(decl.endpointName);\n\t\tconst hostname = yield* routerHostname(identity, decl.dispatchId.role);\n\t\tconst fileId = yield* dispatchFileId({ identity, dispatch: decl.dispatchId });\n\t\tconst upstream =\n\t\t\tdecl.upstream.type === 'container'\n\t\t\t\t? yield* upstreams.resolveContainer({\n\t\t\t\t\t\tcontainerName: decl.upstream.containerName,\n\t\t\t\t\t\tcontainerPort: decl.upstream.containerPort,\n\t\t\t\t\t})\n\t\t\t\t: yield* upstreams.resolveHostLoopback({ port: decl.upstream.port });\n\t\tconst wireProtocol: ResolvedWireProtocol =\n\t\t\tdecl.wireProtocol === 'tcp'\n\t\t\t\t? 'tcp'\n\t\t\t\t: decl.wireProtocol === 'h2c'\n\t\t\t\t\t? 'h2c'\n\t\t\t\t\t: decl.wireProtocol === 'https'\n\t\t\t\t\t\t? 'https'\n\t\t\t\t\t\t: 'http';\n\t\t// The router contract says: a `wireProtocol: 'tcp'` decl MUST\n\t\t// reference an entrypoint whose protocol is also `'tcp'`. The\n\t\t// converse holds — HTTP/h2c decls must reference HTTP-family\n\t\t// entrypoints. Mismatch is a programming error in the plugin\n\t\t// author (caught here once, not at every render).\n\t\tconst expectFamily: 'tcp' \| 'http' = wireProtocol === 'tcp' ? 'tcp' : 'http';\n\t\tconst entrypointFamily: 'tcp' \| 'http' = entrypoint.protocol === 'tcp' ? 'tcp' : 'http';\n\t\tif (expectFamily !== entrypointFamily) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'entrypointName',\n\t\t\t\t\tvalue: entrypoint.name,\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t`wireProtocol family mismatch: decl is '${wireProtocol}' but ` +\n\t\t\t\t\t\t`entrypoint '${entrypoint.name}' is '${entrypoint.protocol}'`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\t// Validate the upstream URL — defense in depth (the resolvers\n\t\t// already produce safe values, but this stops a future resolver\n\t\t// that returns junk from corrupting the YAML). TCP carries the\n\t\t// `tcp://` scheme so we differentiate from the HTTP path; the\n\t\t// renderer pulls host+port back out either way.\n\t\tconst upstreamUrl = renderUrl({\n\t\t\tprotocol: wireProtocol === 'tcp' ? 'tcp' : wireProtocol === 'https' ? 'https' : 'http',\n\t\t\thostname: upstream.host,\n\t\t\tport: upstream.port,\n\t\t});\n\t\tif (!/^(?:http\|https\|tcp):\\/\\/[A-Za-z0-9_.:-]+:\\d+$/.test(upstreamUrl)) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RouterValidationError({\n\t\t\t\t\tfield: 'upstreamUrl',\n\t\t\t\t\tvalue: upstreamUrl,\n\t\t\t\t\tdetail: 'expected http(s)://<host>:<port> or tcp://<host>:<port>',\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\t// CORS is HTTP-only — TCP decls don't carry the field. Render\n\t\t// uses this; the resolved shape carries `false` for TCP.\n\t\tconst cors = decl.wireProtocol === 'tcp' ? false : decl.cors;\n\t\treturn {\n\t\t\tdispatchFileId: fileId,\n\t\t\thostname,\n\t\t\tentrypointName: entrypoint.name,\n\t\t\tentrypointPort: entrypoint.port,\n\t\t\tupstreamUrl,\n\t\t\tcors,\n\t\t\twireProtocol,\n\t\t};\n\t});\n\n// ---------------------------------------------------------------------------\n// Render — ResolvedRoute → YAML body\n// ---------------------------------------------------------------------------\n\n/** Pull host+port out of an `<scheme>://<host>:<port>` URL. Used by the\n * TCP renderer to write the `address:` field. Safe because\n * `resolveRoute` validates the URL shape before we get here. /\nconst splitUpstream = (url: string): { host: string; port: string } => {\n\tconst stripped = url.replace(/^(?:http\|https\|tcp):\\/\\//, '');\n\tconst lastColon = stripped.lastIndexOf(':');\n\treturn {\n\t\thost: stripped.slice(0, lastColon),\n\t\tport: stripped.slice(lastColon + 1),\n\t};\n};\n\nconst renderLeaseHeader = (lease: RouteLeaseMetadata): ReadonlyArray<string> => [\n\t`# routeLeaseVersion: ${lease.version}`,\n\t`# routerProfileId: ${lease.routerProfileId}`,\n\t`# ownerApp: ${lease.app}`,\n\t`# ownerStack: ${lease.stack}`,\n\t`# ownerPid: ${lease.owner.pid}`,\n\t`# ownerStartTime: ${lease.owner.startTime}`,\n\t`# ownerHostname: ${lease.owner.hostname}`,\n\t`# ownerClaimedAt: ${lease.owner.claimedAt}`,\n\t`# ownerHeartbeatAt: ${lease.owner.heartbeatAt}`,\n\t`# ownerIntent: ${lease.owner.intent}`,\n];\n\n/* Render the YAML body for a single resolved route. Hand-rolled\n * (same rationale as `cors.ts`): static, controlled, byte-stable so\n * no-op rewrites don't wake the watcher. /\nexport const renderRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tif (route.wireProtocol === 'tcp') return renderTcpRouteYaml(route, lease);\n\treturn renderHttpRouteYaml(route, lease);\n};\n\nconst routeReadinessMiddlewareName = (route: ResolvedRoute): string =>\n\t`${route.dispatchFileId}-route-ready`;\n\nconst renderHttpRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tconst middlewares = [\n\t\trouteReadinessMiddlewareName(route),\n\t\t...(route.cors ? [CORS_MIDDLEWARE_NAME] : []),\n\t];\n\tconst schemeHint =\n\t\troute.wireProtocol === 'h2c'\n\t\t\t? ` # h2c upstream — gRPC-friendly cleartext HTTP/2.\\n`\n\t\t\t: route.wireProtocol === 'https'\n\t\t\t\t? ` # HTTPS upstream — local self-signed backend TLS.\\n`\n\t\t\t\t: '';\n\tconst serversTransport = route.wireProtocol === 'https' ? 'devstack-insecure-local-tls' : null;\n\treturn [\n\t\t`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,\n\t\t`# dispatchFileId: ${route.dispatchFileId}`,\n\t\t`# wireProtocol: ${route.wireProtocol}`,\n\t\t`# entrypointName: ${route.entrypointName}`,\n\t\t`# entrypointPort: ${route.entrypointPort}`,\n\t\t`# hostname: ${route.hostname}`,\n\t\t...renderLeaseHeader(lease),\n\t\t`http:`,\n\t\t` routers:`,\n\t\t` ${route.dispatchFileId}-router:`,\n\t\t` rule: \"Host(\\`${route.hostname}\\`)\"`,\n\t\t` entryPoints: [\"${route.entrypointName}\"]`,\n\t\t` service: \"${route.dispatchFileId}-svc\"`,\n\t\t` middlewares: [${middlewares.map((name) => `\"${name}\"`).join(', ')}]`,\n\t\t` middlewares:`,\n\t\t` ${routeReadinessMiddlewareName(route)}:`,\n\t\t` headers:`,\n\t\t` customResponseHeaders:`,\n\t\t` ${ROUTE_READINESS_HEADER}: \"${route.dispatchFileId}\"`,\n\t\t` services:`,\n\t\t` ${route.dispatchFileId}-svc:`,\n\t\t` loadBalancer:`,\n\t\tserversTransport === null ? null : ` serversTransport: \"${serversTransport}\"`,\n\t\tschemeHint.length > 0 ? schemeHint.trimEnd() : null,\n\t\t` servers:`,\n\t\t` - url: \"${route.upstreamUrl}\"`,\n\t\tserversTransport === null\n\t\t\t? null\n\t\t\t: ` serversTransports:\\n ${serversTransport}:\\n insecureSkipVerify: true`,\n\t\t``,\n\t]\n\t\t.filter((line): line is string => line !== null)\n\t\t.join('\\n');\n};\n\nconst renderTcpRouteYaml = (route: ResolvedRoute, lease: RouteLeaseMetadata): string => {\n\tconst { host, port } = splitUpstream(route.upstreamUrl);\n\treturn [\n\t\t`# Auto-generated by devstack router orchestrator. Do not edit by hand.`,\n\t\t`# dispatchFileId: ${route.dispatchFileId}`,\n\t\t`# wireProtocol: tcp`,\n\t\t`# entrypointName: ${route.entrypointName}`,\n\t\t`# entrypointPort: ${route.entrypointPort}`,\n\t\t`# hostname: ${route.hostname}`,\n\t\t`# tcpDispatch: entrypoint-port dispatch; HostSNI wildcard`,\n\t\t...renderLeaseHeader(lease),\n\t\t`tcp:`,\n\t\t` routers:`,\n\t\t` ${route.dispatchFileId}-router:`,\n\t\t` rule: \"HostSNI(\\`\\`)\"`,\n\t\t` entryPoints: [\"${route.entrypointName}\"]`,\n\t\t` service: \"${route.dispatchFileId}-svc\"`,\n\t\t` services:`,\n\t\t` ${route.dispatchFileId}-svc:`,\n\t\t` loadBalancer:`,\n\t\t` servers:`,\n\t\t` - address: \"${host}:${port}\"`,\n\t\t``,\n\t].join('\\n');\n};\n\nexport const dispatchFileIdFromFilename = (filename: string): string \| null => {\n\t// Escape `DISPATCH_FILENAME_PREFIX` for use inside a RegExp literal —\n\t// today it's a plain `10-` so no regex metacharacters are at play,\n\t// but the escape makes the read side robust to future prefix changes.\n\tconst escapedPrefix = DISPATCH_FILENAME_PREFIX.replace(/[.+?^${}()\|[\\]\\\\]/g, '\\\\$&');\n\tconst match = new RegExp(`^${escapedPrefix}(.+)\\\\.yml$`).exec(filename);\n\treturn match?.[1] ?? null;\n};\n\nconst commentValue = (body: string, key: string): string \| null => {\n\tconst escaped = key.replace(/[.+?^${}()\|[\\]\\\\]/g, '\\\\$&');\n\tconst match = new RegExp(`^# ${escaped}: (.)$`, 'm').exec(body);\n\treturn match?.[1]?.trim() ?? null;\n};\n\nconst matchValue = (body: string, pattern: RegExp): string \| null =>\n\tpattern.exec(body)?.[1]?.trim() ?? null;\n\nconst commentNumber = (body: string, key: string): number \| null => {\n\tconst raw = commentValue(body, key);\n\tif (raw === null \|\| !/^\\d+$/.test(raw)) return null;\n\treturn Number.parseInt(raw, 10);\n};\n\nconst parseWireProtocol = (body: string): ResolvedWireProtocol \| null => {\n\tconst fromComment = commentValue(body, 'wireProtocol');\n\tif (\n\t\tfromComment === 'http' \|\|\n\t\tfromComment === 'h2c' \|\|\n\t\tfromComment === 'https' \|\|\n\t\tfromComment === 'tcp'\n\t) {\n\t\treturn fromComment;\n\t}\n\tif (/^tcp:/m.test(body)) return 'tcp';\n\tif (/^http:/m.test(body)) return 'http';\n\treturn null;\n};\n\nconst hasRouteLeaseMetadata = (body: string): boolean =>\n\t[\n\t\t'routeLeaseVersion',\n\t\t'routerProfileId',\n\t\t'ownerApp',\n\t\t'ownerStack',\n\t\t'ownerPid',\n\t\t'ownerStartTime',\n\t\t'ownerHostname',\n\t\t'ownerClaimedAt',\n\t\t'ownerHeartbeatAt',\n\t\t'ownerIntent',\n\t].some((key) => commentValue(body, key) !== null);\n\nconst parseRouteLeaseMetadata = (\n\tbody: string,\n\tdispatchFileId: string,\n): {\n\treadonly lease: RouteLeaseMetadata \| null;\n\treadonly diagnostic: DispatchRouteDecodeDiagnostic \| null;\n} => {\n\tif (!hasRouteLeaseMetadata(body)) return { lease: null, diagnostic: null };\n\tconst rawVersion = commentValue(body, 'routeLeaseVersion');\n\tconst version = commentNumber(body, 'routeLeaseVersion');\n\tconst routerProfileId = commentValue(body, 'routerProfileId');\n\tconst app = commentValue(body, 'ownerApp');\n\tconst stack = commentValue(body, 'ownerStack');\n\tconst pid = commentNumber(body, 'ownerPid');\n\tconst startTime = commentNumber(body, 'ownerStartTime');\n\tconst hostname = commentValue(body, 'ownerHostname');\n\tconst claimedAt = commentNumber(body, 'ownerClaimedAt');\n\tconst heartbeatAt = commentNumber(body, 'ownerHeartbeatAt');\n\tconst intent = commentValue(body, 'ownerIntent');\n\tif (version !== ROUTER_ROUTE_LEASE_VERSION) {\n\t\treturn {\n\t\t\tlease: null,\n\t\t\tdiagnostic: {\n\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\tdispatchFileId,\n\t\t\t\treason: 'unknown-route-lease-version',\n\t\t\t\tdetail: `expected routeLeaseVersion ${ROUTER_ROUTE_LEASE_VERSION}, got ${rawVersion ?? '<missing>'}`,\n\t\t\t},\n\t\t};\n\t}\n\tif (\n\t\trouterProfileId === null \|\|\n\t\tapp === null \|\|\n\t\tstack === null \|\|\n\t\tpid === null \|\|\n\t\tstartTime === null \|\|\n\t\thostname === null \|\|\n\t\tclaimedAt === null \|\|\n\t\theartbeatAt === null \|\|\n\t\t(intent !== 'normal' && intent !== 'snapshot')\n\t) {\n\t\treturn {\n\t\t\tlease: null,\n\t\t\tdiagnostic: {\n\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\tdispatchFileId,\n\t\t\t\treason: 'invalid-route-lease-metadata',\n\t\t\t\tdetail: 'route lease metadata is incomplete or malformed',\n\t\t\t},\n\t\t};\n\t}\n\treturn {\n\t\tlease: {\n\t\t\tversion: ROUTER_ROUTE_LEASE_VERSION,\n\t\t\trouterProfileId,\n\t\t\tapp,\n\t\t\tstack,\n\t\t\towner: {\n\t\t\t\tpid,\n\t\t\t\tstartTime,\n\t\t\t\thostname,\n\t\t\t\tclaimedAt,\n\t\t\t\theartbeatAt,\n\t\t\t\tintent,\n\t\t\t},\n\t\t},\n\t\tdiagnostic: null,\n\t};\n};\n\nexport const parseDispatchRouteFile = (\n\tbody: string,\n\tfallbackDispatchFileId: string \| null = null,\n): DispatchRouteParseResult => {\n\tconst dispatchFileId = commentValue(body, 'dispatchFileId') ?? fallbackDispatchFileId;\n\tconst wireProtocol = parseWireProtocol(body);\n\tconst entrypointName =\n\t\tcommentValue(body, 'entrypointName') ?? matchValue(body, /entryPoints: \\[\"([^\"]+)\"\\]/);\n\tconst hostname =\n\t\tcommentValue(body, 'hostname') ??\n\t\tmatchValue(body, /Host\$`([^`]+)`\$/) ??\n\t\t(wireProtocol === 'tcp' ? '' : null);\n\tconst portRaw = commentValue(body, 'entrypointPort');\n\tconst entrypointPort =\n\t\tportRaw === null \|\| !/^\\d+$/.test(portRaw) ? null : Number.parseInt(portRaw, 10);\n\n\tif (\n\t\tdispatchFileId === null \|\|\n\t\twireProtocol === null \|\|\n\t\tentrypointName === null \|\|\n\t\thostname === null\n\t) {\n\t\tconst protectedDispatchFileId = dispatchFileId ?? '<unknown>';\n\t\treturn {\n\t\t\t_tag: 'invalid',\n\t\t\tdispatchFileId: protectedDispatchFileId,\n\t\t\tdiagnostics: [\n\t\t\t\t{\n\t\t\t\t\t_tag: 'DispatchRouteDecodeDiagnostic',\n\t\t\t\t\tdispatchFileId: protectedDispatchFileId,\n\t\t\t\t\treason: 'missing-required-route-metadata',\n\t\t\t\t\tdetail:\n\t\t\t\t\t\t'route file is missing dispatchFileId, wireProtocol/http\|https\|tcp block, entrypointName, or hostname metadata',\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\t}\n\tconst leaseResult = parseRouteLeaseMetadata(body, dispatchFileId);\n\n\treturn {\n\t\t_tag: 'valid',\n\t\troute: {\n\t\t\tdispatchFileId,\n\t\t\thostname,\n\t\t\tentrypointName,\n\t\t\tentrypointPort,\n\t\t\twireProtocol,\n\t\t\tlease: leaseResult.lease,\n\t\t},\n\t\tdiagnostics: leaseResult.diagnostic === null ? [] : [leaseResult.diagnostic],\n\t};\n};\n\nexport const parseDispatchRouteMetadata = (\n\tbody: string,\n\tfallbackDispatchFileId: string \| null = null,\n): DispatchRouteMetadata \| null => {\n\tconst parsed = parseDispatchRouteFile(body, fallbackDispatchFileId);\n\treturn parsed._tag === 'valid' ? parsed.route : null;\n};\n\n// ---------------------------------------------------------------------------\n// Collision detection\n// ---------------------------------------------------------------------------\n\n/* Assert no two resolved routes share dispatch keys.\n \n - HTTP routes collide on `(entrypoint, hostname)` — two HTTP backends\n * on the same entrypoint port can coexist via different Host headers,\n * so the Host is part of the key.\n * - TCP routes collide on `entrypoint` alone — TCP has no Host header,\n * so an entrypoint can serve exactly ONE backend. Two TCP decls on\n * the same entrypoint are an unambiguous error (parallel stacks of\n * a TCP service share the host port and would clobber each other).\n \n Architecture invariant #7 — distinct identity → distinct dispatch\n * URL. The TCP arm is the new clause; HTTP arm unchanged. */\nexport const detectCollisions = (\n\troutes: ReadonlyArray<RouteCollisionMetadata>,\n): RouteCollision \| null => {\n\tconst seen = new Map<string, Array<RouteCollisionMetadata>>();\n\tfor (const r of routes) {\n\t\tconst portKey =\n\t\t\tr.entrypointPort === null ? `entrypoint:${r.entrypointName}` : `port:${r.entrypointPort}`;\n\t\tconst key = r.wireProtocol === 'tcp' ? `tcp@${portKey}` : `http@${portKey}@${r.hostname}`;\n\t\tconst acc = seen.get(key);\n\t\tif (acc) acc.push(r);\n\t\telse seen.set(key, [r]);\n\t}\n\tfor (const [key, colliding] of seen) {\n\t\tif (colliding.length > 1) {\n\t\t\tconst ids = colliding.map((route) => route.dispatchFileId);\n\t\t\tconst first = colliding[0];\n\t\t\tif (key.startsWith('tcp@')) {\n\t\t\t\treturn new RouteCollision({\n\t\t\t\t\tmessage: routeCollisionMessage({\n\t\t\t\t\t\thostname: '',\n\t\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t\t\twireProtocol: 'tcp',\n\t\t\t\t\t}),\n\t\t\t\t\thostname: '',\n\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new RouteCollision({\n\t\t\t\tmessage: routeCollisionMessage({\n\t\t\t\t\thostname: first?.hostname ?? '',\n\t\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\t\tdispatchIds: ids,\n\t\t\t\t\twireProtocol: 'http',\n\t\t\t\t}),\n\t\t\t\thostname: first?.hostname ?? '',\n\t\t\t\tentrypoint: first?.entrypointName ?? '',\n\t\t\t\tdispatchIds: ids,\n\t\t\t});\n\t\t}\n\t}\n\treturn null;\n};\n\nconst routeCollisionMessage = (collision: {\n\treadonly hostname: string;\n\treadonly entrypoint: string;\n\treadonly dispatchIds: ReadonlyArray<string>;\n\treadonly wireProtocol: ResolvedWireProtocol;\n}): string => {\n\tconst ids = collision.dispatchIds.join(', ');\n\tif (collision.wireProtocol === 'tcp') {\n\t\treturn `router TCP route collision on entrypoint '${collision.entrypoint}' for dispatch ids: ${ids}`;\n\t}\n\treturn (\n\t\t`router route collision on entrypoint '${collision.entrypoint}' ` +\n\t\t`and hostname '${collision.hostname}' for dispatch ids: ${ids}`\n\t);\n};\n"],"mappings":";;;;;;AA8DA,MAAa,yBAAyB;;;;;;AAOtC,MAAM,2BAA2B;;;;;AAoFjC,MAAa,oBAAoB,WAChC,GAAG,2BAA2B,OAAO;;;;;;;;;AAoCtC,MAAa,gBACZ,UACA,MACA,UACA,cAEA,OAAO,IAAI,aAAa;CACvB,MAAM,aAAa,OAAO,SAAS,OAAO,KAAK,YAAY;CAC3D,MAAM,WAAW,OAAO,eAAe,UAAU,KAAK,WAAW,IAAI;CACrE,MAAM,SAAS,OAAO,eAAe;EAAE;EAAU,UAAU,KAAK;CAAW,CAAC;CAC5E,MAAM,WACL,KAAK,SAAS,SAAS,cACpB,OAAO,UAAU,iBAAiB;EAClC,eAAe,KAAK,SAAS;EAC7B,eAAe,KAAK,SAAS;CAC9B,CAAC,IACA,OAAO,UAAU,oBAAoB,EAAE,MAAM,KAAK,SAAS,KAAK,CAAC;CACrE,MAAM,eACL,KAAK,iBAAiB,QACnB,QACA,KAAK,iBAAiB,QACrB,QACA,KAAK,iBAAiB,UACrB,UACA;CAQN,KAFqC,iBAAiB,QAAQ,QAAQ,aAC7B,WAAW,aAAa,QAAQ,QAAQ,SAEhF,OAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO,WAAW;EAClB,QACC,0CAA0C,aAAa,oBACxC,WAAW,KAAK,QAAQ,WAAW,SAAS;CAC7D,CAAC,CACF;CAOD,MAAM,cAAc,UAAU;EAC7B,UAAU,iBAAiB,QAAQ,QAAQ,iBAAiB,UAAU,UAAU;EAChF,UAAU,SAAS;EACnB,MAAM,SAAS;CAChB,CAAC;CACD,IAAI,CAAC,gDAAgD,KAAK,WAAW,GACpE,OAAO,OAAO,OAAO,KACpB,IAAI,sBAAsB;EACzB,OAAO;EACP,OAAO;EACP,QAAQ;CACT,CAAC,CACF;CAID,MAAM,OAAO,KAAK,iBAAiB,QAAQ,QAAQ,KAAK;CACxD,OAAO;EACN,gBAAgB;EAChB;EACA,gBAAgB,WAAW;EAC3B,gBAAgB,WAAW;EAC3B;EACA;EACA;CACD;AACD,CAAC;;;;AASF,MAAM,iBAAiB,QAAgD;CACtE,MAAM,WAAW,IAAI,QAAQ,4BAA4B,EAAE;CAC3D,MAAM,YAAY,SAAS,YAAY,GAAG;CAC1C,OAAO;EACN,MAAM,SAAS,MAAM,GAAG,SAAS;EACjC,MAAM,SAAS,MAAM,YAAY,CAAC;CACnC;AACD;AAEA,MAAM,qBAAqB,UAAqD;CAC/E,wBAAwB,MAAM;CAC9B,sBAAsB,MAAM;CAC5B,eAAe,MAAM;CACrB,iBAAiB,MAAM;CACvB,eAAe,MAAM,MAAM;CAC3B,qBAAqB,MAAM,MAAM;CACjC,oBAAoB,MAAM,MAAM;CAChC,qBAAqB,MAAM,MAAM;CACjC,uBAAuB,MAAM,MAAM;CACnC,kBAAkB,MAAM,MAAM;AAC/B;;;;AAKA,MAAa,mBAAmB,OAAsB,UAAsC;CAC3F,IAAI,MAAM,iBAAiB,OAAO,OAAO,mBAAmB,OAAO,KAAK;CACxE,OAAO,oBAAoB,OAAO,KAAK;AACxC;AAEA,MAAM,gCAAgC,UACrC,GAAG,MAAM,eAAe;AAEzB,MAAM,uBAAuB,OAAsB,UAAsC;CACxF,MAAM,cAAc,CACnB,6BAA6B,KAAK,GAClC,GAAI,MAAM,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAC5C;CACA,MAAM,aACL,MAAM,iBAAiB,QACpB,+DACA,MAAM,iBAAiB,UACtB,gEACA;CACL,MAAM,mBAAmB,MAAM,iBAAiB,UAAU,gCAAgC;CAC1F,OAAO;EACN;EACA,qBAAqB,MAAM;EAC3B,mBAAmB,MAAM;EACzB,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,eAAe,MAAM;EACrB,GAAG,kBAAkB,KAAK;EAC1B;EACA;EACA,OAAO,MAAM,eAAe;EAC5B,uBAAuB,MAAM,SAAS;EACtC,wBAAwB,MAAM,eAAe;EAC7C,mBAAmB,MAAM,eAAe;EACxC,uBAAuB,YAAY,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;EACzE;EACA,OAAO,6BAA6B,KAAK,EAAE;EAC3C;EACA;EACA,aAAa,uBAAuB,KAAK,MAAM,eAAe;EAC9D;EACA,OAAO,MAAM,eAAe;EAC5B;EACA,qBAAqB,OAAO,OAAO,8BAA8B,iBAAiB;EAClF,WAAW,SAAS,IAAI,WAAW,QAAQ,IAAI;EAC/C;EACA,qBAAqB,MAAM,YAAY;EACvC,qBAAqB,OAClB,OACA,6BAA6B,iBAAiB;EACjD;CACD,CAAC,CACC,QAAQ,SAAyB,SAAS,IAAI,CAAC,CAC/C,KAAK,IAAI;AACZ;AAEA,MAAM,sBAAsB,OAAsB,UAAsC;CACvF,MAAM,EAAE,MAAM,SAAS,cAAc,MAAM,WAAW;CACtD,OAAO;EACN;EACA,qBAAqB,MAAM;EAC3B;EACA,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,eAAe,MAAM;EACrB;EACA,GAAG,kBAAkB,KAAK;EAC1B;EACA;EACA,OAAO,MAAM,eAAe;EAC5B;EACA,wBAAwB,MAAM,eAAe;EAC7C,mBAAmB,MAAM,eAAe;EACxC;EACA,OAAO,MAAM,eAAe;EAC5B;EACA;EACA,yBAAyB,KAAK,GAAG,KAAK;EACtC;CACD,CAAC,CAAC,KAAK,IAAI;AACZ;AAEA,MAAa,8BAA8B,aAAoC;CAI9E,MAAM,gBAAgB,yBAAyB,QAAQ,uBAAuB,MAAM;CAEpF,OADc,IAAI,OAAO,IAAI,cAAc,YAAY,CAAC,CAAC,KAAK,QACnD,CAAC,GAAG,MAAM;AACtB;AAEA,MAAM,gBAAgB,MAAc,QAA+B;CAClE,MAAM,UAAU,IAAI,QAAQ,uBAAuB,MAAM;CAEzD,OADc,IAAI,OAAO,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC,KAAK,IAChD,CAAC,GAAG,EAAE,EAAE,KAAK,KAAK;AAC9B;AAEA,MAAM,cAAc,MAAc,YACjC,QAAQ,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,KAAK;AAEpC,MAAM,iBAAiB,MAAc,QAA+B;CACnE,MAAM,MAAM,aAAa,MAAM,GAAG;CAClC,IAAI,QAAQ,QAAQ,CAAC,QAAQ,KAAK,GAAG,GAAG,OAAO;CAC/C,OAAO,OAAO,SAAS,KAAK,EAAE;AAC/B;AAEA,MAAM,qBAAqB,SAA8C;CACxE,MAAM,cAAc,aAAa,MAAM,cAAc;CACrD,IACC,gBAAgB,UAChB,gBAAgB,SAChB,gBAAgB,WAChB,gBAAgB,OAEhB,OAAO;CAER,IAAI,SAAS,KAAK,IAAI,GAAG,OAAO;CAChC,IAAI,UAAU,KAAK,IAAI,GAAG,OAAO;CACjC,OAAO;AACR;AAEA,MAAM,yBAAyB,SAC9B;CACC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC,CAAC,MAAM,QAAQ,aAAa,MAAM,GAAG,MAAM,IAAI;AAEjD,MAAM,2BACL,MACA,mBAII;CACJ,IAAI,CAAC,sBAAsB,IAAI,GAAG,OAAO;EAAE,OAAO;EAAM,YAAY;CAAK;CACzE,MAAM,aAAa,aAAa,MAAM,mBAAmB;CACzD,MAAM,UAAU,cAAc,MAAM,mBAAmB;CACvD,MAAM,kBAAkB,aAAa,MAAM,iBAAiB;CAC5D,MAAM,MAAM,aAAa,MAAM,UAAU;CACzC,MAAM,QAAQ,aAAa,MAAM,YAAY;CAC7C,MAAM,MAAM,cAAc,MAAM,UAAU;CAC1C,MAAM,YAAY,cAAc,MAAM,gBAAgB;CACtD,MAAM,WAAW,aAAa,MAAM,eAAe;CACnD,MAAM,YAAY,cAAc,MAAM,gBAAgB;CACtD,MAAM,cAAc,cAAc,MAAM,kBAAkB;CAC1D,MAAM,SAAS,aAAa,MAAM,aAAa;CAC/C,IAAI,YAAA,GACH,OAAO;EACN,OAAO;EACP,YAAY;GACX,MAAM;GACN;GACA,QAAQ;GACR,QAAQ,qCAAiE,cAAc;EACxF;CACD;CAED,IACC,oBAAoB,QACpB,QAAQ,QACR,UAAU,QACV,QAAQ,QACR,cAAc,QACd,aAAa,QACb,cAAc,QACd,gBAAgB,QACf,WAAW,YAAY,WAAW,YAEnC,OAAO;EACN,OAAO;EACP,YAAY;GACX,MAAM;GACN;GACA,QAAQ;GACR,QAAQ;EACT;CACD;CAED,OAAO;EACN,OAAO;GACN,SAAA;GACA;GACA;GACA;GACA,OAAO;IACN;IACA;IACA;IACA;IACA;IACA;GACD;EACD;EACA,YAAY;CACb;AACD;AAEA,MAAa,0BACZ,MACA,yBAAwC,SACV;CAC9B,MAAM,iBAAiB,aAAa,MAAM,gBAAgB,KAAK;CAC/D,MAAM,eAAe,kBAAkB,IAAI;CAC3C,MAAM,iBACL,aAAa,MAAM,gBAAgB,KAAK,WAAW,MAAM,4BAA4B;CACtF,MAAM,WACL,aAAa,MAAM,UAAU,KAC7B,WAAW,MAAM,mBAAmB,MACnC,iBAAiB,QAAQ,KAAK;CAChC,MAAM,UAAU,aAAa,MAAM,gBAAgB;CACnD,MAAM,iBACL,YAAY,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,OAAO,SAAS,SAAS,EAAE;CAEhF,IACC,mBAAmB,QACnB,iBAAiB,QACjB,mBAAmB,QACnB,aAAa,MACZ;EACD,MAAM,0BAA0B,kBAAkB;EAClD,OAAO;GACN,MAAM;GACN,gBAAgB;GAChB,aAAa,CACZ;IACC,MAAM;IACN,gBAAgB;IAChB,QAAQ;IACR,QACC;GACF,CACD;EACD;CACD;CACA,MAAM,cAAc,wBAAwB,MAAM,cAAc;CAEhE,OAAO;EACN,MAAM;EACN,OAAO;GACN;GACA;GACA;GACA;GACA;GACA,OAAO,YAAY;EACpB;EACA,aAAa,YAAY,eAAe,OAAO,CAAC,IAAI,CAAC,YAAY,UAAU;CAC5E;AACD;;;;;;;;;;;;;AA0BA,MAAa,oBACZ,WAC2B;CAC3B,MAAM,uBAAO,IAAI,IAA2C;CAC5D,KAAK,MAAM,KAAK,QAAQ;EACvB,MAAM,UACL,EAAE,mBAAmB,OAAO,cAAc,EAAE,mBAAmB,QAAQ,EAAE;EAC1E,MAAM,MAAM,EAAE,iBAAiB,QAAQ,OAAO,YAAY,QAAQ,QAAQ,GAAG,EAAE;EAC/E,MAAM,MAAM,KAAK,IAAI,GAAG;EACxB,IAAI,KAAK,IAAI,KAAK,CAAC;OACd,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;CACvB;CACA,KAAK,MAAM,CAAC,KAAK,cAAc,MAC9B,IAAI,UAAU,SAAS,GAAG;EACzB,MAAM,MAAM,UAAU,KAAK,UAAU,MAAM,cAAc;EACzD,MAAM,QAAQ,UAAU;EACxB,IAAI,IAAI,WAAW,MAAM,GACxB,OAAO,IAAI,eAAe;GACzB,SAAS,sBAAsB;IAC9B,UAAU;IACV,YAAY,OAAO,kBAAkB;IACrC,aAAa;IACb,cAAc;GACf,CAAC;GACD,UAAU;GACV,YAAY,OAAO,kBAAkB;GACrC,aAAa;EACd,CAAC;EAEF,OAAO,IAAI,eAAe;GACzB,SAAS,sBAAsB;IAC9B,UAAU,OAAO,YAAY;IAC7B,YAAY,OAAO,kBAAkB;IACrC,aAAa;IACb,cAAc;GACf,CAAC;GACD,UAAU,OAAO,YAAY;GAC7B,YAAY,OAAO,kBAAkB;GACrC,aAAa;EACd,CAAC;CACF;CAED,OAAO;AACR;AAEA,MAAM,yBAAyB,cAKjB;CACb,MAAM,MAAM,UAAU,YAAY,KAAK,IAAI;CAC3C,IAAI,UAAU,iBAAiB,OAC9B,OAAO,6CAA6C,UAAU,WAAW,sBAAsB;CAEhG,OACC,yCAAyC,UAAU,WAAW,kBAC7C,UAAU,SAAS,sBAAsB;AAE5D"}

package/dist/orchestrators/router/service.mjs CHANGED Viewed

@@ -135,7 +135,7 @@ const liveRouteLeaseMismatch = (existing, resolved) => new RouteCollision({
 	entrypoint: resolved.entrypointName,
 	dispatchIds: [existing.dispatchFileId, resolved.dispatchFileId]
 });
-const resolvedWireProtocolFor = (decl) => decl.wireProtocol === "tcp" ? "tcp" : decl.wireProtocol === "h2c" ? "h2c" : "http";
+const resolvedWireProtocolFor = (decl) => decl.wireProtocol === "tcp" ? "tcp" : decl.wireProtocol === "h2c" ? "h2c" : decl.wireProtocol === "https" ? "https" : "http";
 const validateWireProtocolFamily = (decl, entrypoint) => {
 	const wireProtocol = resolvedWireProtocolFor(decl);
 	if ((wireProtocol === "tcp" ? "tcp" : "http") === (entrypoint.protocol === "tcp" ? "tcp" : "http")) return Effect.succeed(wireProtocol);
@@ -230,7 +230,7 @@ const resolveDisabledDirectRoute = (identity, decl, registry) => Effect.gen(func
 		identity,
 		dispatch: decl.dispatchId
 	});
-	const scheme = wireProtocol === "tcp" ? "tcp" : "http";
+	const scheme = wireProtocol === "tcp" ? "tcp" : wireProtocol === "https" ? "https" : "http";
 	return {
 		dispatchFileId: fileId,
 		hostname: directLoopbackHost,