chore: sync from internal repo

.devcontainer/Dockerfile

@@ -0,0 +1,7 @@
+FROM mcr.microsoft.com/devcontainers/rust:1-1-bookworm
+
+# Include lld linker to improve build times either by using environment variable
+# RUSTFLAGS="-C link-arg=-fuse-ld=lld" or with Cargo's configuration file (i.e see .cargo/config.toml).
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+   && apt-get -y install clang lld \
+   && apt-get autoremove -y && apt-get clean -y

.devcontainer/devcontainer.json

@@ -0,0 +1,63 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/rust
+{
+	"name": "Rust",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"dockerComposeFile": "docker-compose.yaml",
+	"service": "app",
+	"workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}",
+	"features": {
+		"ghcr.io/devcontainers/features/git-lfs:1": {},
+		"ghcr.io/devcontainers/features/rust:1": {
+			"version": "nightly-2023-01-04"
+		},
+		"ghcr.io/devcontainers/features/node:1": {},
+		"ghcr.io/devcontainers/features/go:1": {},
+		"ghcr.io/devcontainers-extra/features/protoc:1": {},
+		"ghcr.io/nordcominc/devcontainer-features/android-sdk:1": {
+			"platform": "34",
+			"extra_packages": "ndk;26.3.11579264 emulator system-images;android-34;google_apis;x86_64"
+		},
+		"ghcr.io/devcontainers/features/desktop-lite:1": {}
+	},
+	"onCreateCommand": ".devcontainer/oncreate.sh",
+	// "updateContentCommand": ".devcontainer/updatecontent.sh",
+	"forwardPorts": [
+		6080,
+		5901
+	],
+	"portsAttributes": {
+		"6080": {
+			"label": "VNC web client (noVNC)",
+			"onAutoForward": "silent"
+		},
+		"5901": {
+			"label": "VNC TCP port",
+			"onAutoForward": "silent"
+		}
+	},
+	"hostRequirements": {
+		"memory": "9gb"
+	},
+	"remoteEnv": {
+		"RUSTFLAGS": "-C link-arg=-fuse-ld=lld"
+	},
+	// Use 'mounts' to make the cargo cache persistent in a Docker Volume.
+	// "mounts": [
+	// 	{
+	// 		"source": "devcontainer-cargo-cache-${devcontainerId}",
+	// 		"target": "/usr/local/cargo",
+	// 		"type": "volume"
+	// 	}
+	// ]
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	// "features": {},
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [],
+	// Use 'postCreateCommand' to run commands after the container is created.
+	// "postCreateCommand": "rustc --version",
+	// Configure tool-specific properties.
+	// "customizations": {},
+	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+	"remoteUser": "root"
+}

.devcontainer/docker-compose.yaml

@@ -0,0 +1,38 @@
+version: '3.8'
+
+volumes:
+  postgres-data:
+
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+
+    volumes:
+      - ../..:/workspaces:cached
+
+    # Overrides default command so things don't shut down after the process ends.
+    command: sleep infinity
+
+    # Runs app on the same network as the database container, allows "forwardPorts" in devcontainer.json function.
+    network_mode: service:db
+
+    devices:
+      - "/dev/kvm:/dev/kvm"
+
+    # Use "forwardPorts" in **devcontainer.json** to forward an app port locally. 
+    # (Adding the "ports" property to this file will not forward from a Codespace.)
+
+  db:
+    image: postgres:15.13
+    restart: unless-stopped
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_HOST_AUTH_METHOD: trust
+      POSTGRES_DB: guild
+      POSTGRES_USER: root
+
+    # Add "forwardPorts": ["5432"] to **devcontainer.json** to forward PostgreSQL locally.
+    # (Adding the "ports" property to this file will not forward from a Codespace.)

.devcontainer/oncreate.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env sh
+
+sed -i 's/"runOn": "default",/"runOn": "folderOpen",/g' .vscode/tasks.json
+
+avdmanager create avd -n MyDevice -k 'system-images;android-34;google_apis;x86_64' -d pixel
+
+(
+    cd /tmp &&\
+    wget https://github.com/Genymobile/scrcpy/releases/download/v3.0/scrcpy-linux-v3.0.tar.gz &&\
+    sudo tar -xvf scrcpy-linux-v3.0.tar.gz -C /var/lib &&\
+    sudo ln -s /var/lib/scrcpy-linux-v3.0/scrcpy_bin /usr/bin/scrcpy &&\
+    rm scrcpy-linux-v3.0.tar.gz
+)
+
+# Trigger rustup toolchain install.
+# This should be installed by the devcontainer feature,
+# but there seems to be a race condition that causes the tasks
+# to download the toolchain, and if multiple try to download it at once,
+# they fail and the installed toolchain is broken.
+cargo --version

.devcontainer/updatecontent.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env
+
+# yarn install is tooooo slow
+# (cd eth && yarn --frozen-lockfile)
+# (cd app/packages/payy && yarn --frozen-lockfile)

.github/workflows/beam.release.yml

@@ -0,0 +1,183 @@
+name: Beam / Release
+
+on:
+  workflow_dispatch:
+    # GitHub does not support branch filters for manual dispatches.
+    # Jobs below explicitly gate releases to refs/heads/main.
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/beam.release.yml"
+      - "pkg/beam-cli/**"
+      - "scripts/install-beam.sh"
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "rust-toolchain.toml"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: beam-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  detect-version:
+    if: github.repository == 'polybase/payy' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    outputs:
+      is_prerelease: ${{ steps.detect.outputs.is_prerelease }}
+      should_release: ${{ steps.detect.outputs.should_release }}
+      tag: ${{ steps.detect.outputs.tag }}
+      version: ${{ steps.detect.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect beam version change
+        id: detect
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          version="$(awk -F' = ' '/^version = / { gsub(/"/, "", $2); print $2; exit }' pkg/beam-cli/Cargo.toml)"
+          tag="beam-v${version}"
+          if [[ "$version" == *-* ]]; then
+            is_prerelease=true
+          else
+            is_prerelease=false
+          fi
+
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+          echo "is_prerelease=${is_prerelease}" >> "$GITHUB_OUTPUT"
+
+          # Beam release tags are immutable: never rebuild or republish an existing version.
+          if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+            echo "Beam tag ${tag} already exists; skipping release publication."
+            echo "should_release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then
+              echo "Manual beam releases are only allowed from refs/heads/main; skipping ${GITHUB_REF}."
+              echo "should_release=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+
+            echo "should_release=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          before="${{ github.event.before }}"
+          if [[ -z "$before" || "$before" == "0000000000000000000000000000000000000000" ]]; then
+            echo "should_release=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if git diff --quiet "$before" "${{ github.sha }}" -- pkg/beam-cli/Cargo.toml; then
+            echo "should_release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if git show "${before}:pkg/beam-cli/Cargo.toml" > /tmp/beam-prev-cargo.toml 2>/dev/null; then
+            before_version="$(
+              awk -F' = ' '/^version = / { gsub(/"/, "", $2); print $2; exit }' /tmp/beam-prev-cargo.toml
+            )"
+
+            if [[ "$before_version" == "$version" ]]; then
+              echo "should_release=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "should_release=true" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "No previous pkg/beam-cli/Cargo.toml; treating as version changed."
+            echo "should_release=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  build:
+    needs: detect-version
+    if: github.repository == 'polybase/payy' && github.ref == 'refs/heads/main' && needs.detect-version.outputs.should_release == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - runner: macos-15-intel
+            target: x86_64-apple-darwin
+          - runner: macos-14
+            target: aarch64-apple-darwin
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        run: rustup show
+
+      - name: Build beam release binary
+        run: cargo build --release --locked -p beam-cli --bin beam --target ${{ matrix.target }}
+
+      - name: Package release asset
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          cp "target/${{ matrix.target }}/release/beam" "dist/beam-${{ matrix.target }}"
+
+      - name: Upload release asset
+        uses: actions/upload-artifact@v4
+        with:
+          name: beam-${{ matrix.target }}
+          path: dist/beam-${{ matrix.target }}
+          if-no-files-found: error
+
+  release:
+    needs:
+      - detect-version
+      - build
+    if: github.repository == 'polybase/payy' && github.ref == 'refs/heads/main' && needs.detect-version.outputs.should_release == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download release assets
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: Validate release assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected_assets=(
+            dist/beam-x86_64-unknown-linux-gnu
+            dist/beam-x86_64-apple-darwin
+            dist/beam-aarch64-apple-darwin
+          )
+
+          for asset in "${expected_assets[@]}"; do
+            if [[ ! -f "$asset" ]]; then
+              echo "Expected release asset missing or not a file: $asset" >&2
+              exit 1
+            fi
+          done
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ needs.detect-version.outputs.tag }}
+          name: beam ${{ needs.detect-version.outputs.version }}
+          generate_release_notes: true
+          prerelease: ${{ needs.detect-version.outputs.is_prerelease == 'true' }}
+          files: |
+            dist/beam-x86_64-unknown-linux-gnu
+            dist/beam-x86_64-apple-darwin
+            dist/beam-aarch64-apple-darwin

.github/workflows/test.yml

@@ -72,7 +72,7 @@ jobs:
   cargo-test:
     name: Cargo Test in Docker
     runs-on: ${{ vars.RUNNER_LABELS}}
-    timeout-minutes: 80
+    timeout-minutes: 40
     steps:
       - name: Checkout
         uses: actions/checkout@v4