kobako 0.28.0 → 0.29.0

data/crates/kobako-runtime/src/filesystem/path.rs

@@ -0,0 +1,60 @@
+//! Paths as a Filesystem receives them: relative to its root, components
+//! joined by `/`, the empty path being the root.
+
+use super::{FileType, FilesystemError};
+
+/// The directory holding `path`; the root holds every top-level entry.
+pub(crate) fn parent(path: &str) -> &str {
+    path.rsplit_once('/').map_or("", |(parent, _)| parent)
+}
+
+/// The last name of `path`, within its parent.
+pub(crate) fn name(path: &str) -> &str {
+    path.rsplit_once('/').map_or(path, |(_, name)| name)
+}
+
+/// The path of `name` within the directory `dir`.
+pub(crate) fn join(dir: &str, name: &str) -> String {
+    if dir.is_empty() {
+        name.to_string()
+    } else {
+        format!("{dir}/{name}")
+    }
+}
+
+/// The names of `path`, outermost first; the root has none.
+pub(crate) fn components(path: &str) -> impl Iterator<Item = &str> {
+    path.split('/').filter(|name| !name.is_empty())
+}
+
+/// Every directory above `path`, outermost first, the root left out.
+pub(crate) fn ancestors(path: &str) -> impl Iterator<Item = &str> {
+    path.match_indices('/').map(move |(end, _)| &path[..end])
+}
+
+/// Whether `path` lies beneath `dir`, `dir` itself left out.
+pub(crate) fn is_beneath(path: &str, dir: &str) -> bool {
+    dir.is_empty() && !path.is_empty()
+        || path
+            .strip_prefix(dir)
+            .is_some_and(|rest| rest.starts_with('/'))
+}
+
+/// Why an entry of `file_type` cannot move beneath itself: a directory
+/// cannot hold itself, and a file stands where the new path needs a
+/// directory, as `rename(2)` answers each.
+pub(crate) fn beneath_itself(file_type: FileType) -> FilesystemError {
+    match file_type {
+        FileType::Directory => FilesystemError::InvalidInput,
+        _ => FilesystemError::NotADirectory,
+    }
+}
+
+/// A path a Host App seeds a Filesystem with, in the form a runtime hands
+/// over: no leading `/`, and no empty or `.` component.
+pub(crate) fn normalize_seed(path: &str) -> String {
+    path.split('/')
+        .filter(|component| !component.is_empty() && *component != ".")
+        .collect::<Vec<_>>()
+        .join("/")
+}

data/crates/kobako-runtime/src/filesystem/temporary.rs

@@ -0,0 +1,167 @@
+//! `Temporary`: a Filesystem held in memory that every Invocation starts
+//! empty.
+
+use std::sync::Arc;
+
+use super::memory::Memory;
+use super::{DirEntry, File, Filesystem, FilesystemError, Hold, Metadata, OpenOptions, Rename};
+
+/// Files and directories held in memory for one Invocation. The next one
+/// is handed a new, empty Temporary in its place, so nothing one writes
+/// reaches another. Each one holds as much as a Memory does.
+#[derive(Default)]
+pub struct Temporary {
+    memory: Memory,
+}
+
+impl Temporary {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// This Temporary, and every one handed out in its place, with its
+    /// files holding at most `limit` bytes together, or without bound for
+    /// `None`, as `Memory::with_limit` bounds a Memory.
+    pub fn with_limit(self, limit: Option<usize>) -> Self {
+        Self {
+            memory: self.memory.with_limit(limit),
+        }
+    }
+
+    /// This Temporary, and every one handed out in its place, holding at
+    /// most `inodes` entries, as `Memory::with_inodes` bounds a Memory.
+    pub fn with_inodes(self, inodes: Option<usize>) -> Self {
+        Self {
+            memory: self.memory.with_inodes(inodes),
+        }
+    }
+}
+
+impl Filesystem for Temporary {
+    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
+        self.memory.open(path, options)
+    }
+
+    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
+        self.memory.metadata(path)
+    }
+
+    fn symlink_metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
+        self.memory.symlink_metadata(path)
+    }
+
+    fn stored_path(&self, path: &str) -> Result<String, FilesystemError> {
+        self.memory.stored_path(path)
+    }
+
+    fn canonicalize_beneath(&self, base: &str, path: &str) -> Result<String, FilesystemError> {
+        self.memory.canonicalize_beneath(base, path)
+    }
+
+    fn for_policy(&self) -> Option<Arc<dyn Filesystem>> {
+        self.memory.for_policy()
+    }
+
+    fn hold_directory(&self, path: &str) -> Result<Option<Hold>, FilesystemError> {
+        self.memory.hold_directory(path)
+    }
+
+    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
+        self.memory.read_dir(path)
+    }
+
+    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
+        self.memory.create_dir(path)
+    }
+
+    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
+        self.memory.remove_dir(path)
+    }
+
+    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
+        self.memory.remove_file(path)
+    }
+
+    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
+        self.memory.rename(from, to, rename)
+    }
+
+    fn for_invocation(&self) -> Option<Arc<dyn Filesystem>> {
+        Some(Arc::new(Self {
+            memory: self.memory.to_empty(),
+        }))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // @behavior FS-004
+    #[test]
+    fn a_temporary_starts_every_invocation_empty() {
+        let temporary = Temporary::new();
+        temporary
+            .open(
+                "scratch",
+                &OpenOptions {
+                    write: true,
+                    create: true,
+                    ..OpenOptions::default()
+                },
+            )
+            .expect("a new file must be created")
+            .write_at(b"gone", 0)
+            .expect("the write must land");
+
+        let next = temporary
+            .for_invocation()
+            .expect("a Temporary must hand the next Invocation a Filesystem of its own");
+        assert_eq!(
+            next.read_dir("").expect("the root must list"),
+            Vec::new(),
+            "Temporary::for_invocation must hand the next Invocation a Filesystem holding no file"
+        );
+    }
+
+    // @behavior FS-033
+    #[test]
+    fn a_temporary_keeps_its_inodes_in_every_invocation() {
+        let next = Temporary::new()
+            .with_inodes(Some(1))
+            .for_invocation()
+            .expect("a Temporary must hand the next Invocation a Filesystem of its own");
+        assert_eq!(
+            next.create_dir("dir"),
+            Err(FilesystemError::StorageFull),
+            "a directory past a Temporary's inodes in the Filesystem Temporary::for_invocation \
+             hands the next Invocation must answer StorageFull"
+        );
+    }
+
+    // @behavior FS-027
+    #[test]
+    fn a_temporary_keeps_its_limit_in_every_invocation() {
+        let next = Temporary::new()
+            .with_limit(Some(4))
+            .for_invocation()
+            .expect("a Temporary must hand the next Invocation a Filesystem of its own");
+        let written = next
+            .open(
+                "scratch",
+                &OpenOptions {
+                    write: true,
+                    create: true,
+                    ..OpenOptions::default()
+                },
+            )
+            .expect("a new file must be created")
+            .write_at(b"five!", 0);
+        assert_eq!(
+            written,
+            Err(FilesystemError::StorageFull),
+            "a write past a Temporary's limit in the Filesystem Temporary::for_invocation hands \
+             the next Invocation must answer StorageFull"
+        );
+    }
+}

data/crates/kobako-runtime/src/filesystem.rs

@@ -0,0 +1,392 @@
+//! The Filesystem behind a Mount: what answers every call a
+//! guest makes beneath that Mount's path.
+//!
+//! A runtime owns the descriptors and path resolution, and the Mount
+//! decides access; a `Filesystem` only answers for the files and directories
+//! themselves, so a third party brings one without implementing any of
+//! that. Every path a runtime hands over is relative to the Filesystem's
+//! own root, its components joined by `/`, with no `.` or `..` left and
+//! no leading `/`; the empty path is the root, which a runtime never asks
+//! to remove or move.
+
+mod directory;
+mod memory;
+mod overlay;
+mod path;
+mod temporary;
+
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Arc;
+
+pub use directory::Directory;
+pub use memory::{Memory, SeedError};
+pub use overlay::{Blocking, Overlay};
+pub use temporary::Temporary;
+
+/// What the guest may do beneath a Mount, or an Overlay in one of its
+/// Layers.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Access {
+    Read,
+    ReadWrite,
+}
+
+/// The files and directories behind a Mount. One may wrap
+/// another and answer by delegating, so it sees every call on the way
+/// through.
+///
+/// Six methods keep a guarantee the runtime gives the guest, so each
+/// Filesystem answers them itself and a wrapper forwards them:
+/// `symlink_metadata` keeps a link from being followed where a Mount
+/// refuses links, `stored_path` keeps a Policy judging the spelling the
+/// host stores, `canonicalize_beneath` keeps a link within the directory
+/// a descriptor opened, `hold_directory` keeps an open directory's
+/// identity its own, `for_invocation` keeps one Invocation's changes
+/// from the next, and `for_policy` keeps a call to the path a Policy
+/// judged.
+pub trait Filesystem: Send + Sync {
+    /// Open the file at `path` as `options` asks, creating or truncating it
+    /// where they say to.
+    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError>;
+
+    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError>;
+
+    /// What `path` names without following a link standing there, as
+    /// `lstat` answers. A link is reported as one and nothing of where it
+    /// points: no size, and no way to read it. A Filesystem holding no
+    /// links answers `metadata`.
+    fn symlink_metadata(&self, path: &str) -> Result<Metadata, FilesystemError>;
+
+    /// `path` with each name this Filesystem holds spelled as it stores
+    /// it, so a name a host reaches by more than one spelling is judged by
+    /// one; names past the last it holds stay as given. A Filesystem
+    /// matching names exactly answers `path`.
+    fn stored_path(&self, path: &str) -> Result<String, FilesystemError>;
+
+    /// `path`, relative to the directory at `base`, with every link on it
+    /// followed, as cap-std's `Dir::canonicalize` answers: still relative
+    /// to `base`, `NotPermitted` where a link leads out of `base`, and
+    /// `NotFound` where nothing stands. A descriptor opened on `base`
+    /// reaches nothing above it, as a capability never widens. A
+    /// Filesystem holding no links answers `path`.
+    fn canonicalize_beneath(&self, base: &str, path: &str) -> Result<String, FilesystemError>;
+
+    /// Keep the directory at `path` from handing its identity to another
+    /// while the Hold lives, as an open descriptor keeps a host's inode
+    /// from being reused. A Filesystem whose identities never repeat
+    /// holds nothing.
+    fn hold_directory(&self, path: &str) -> Result<Option<Hold>, FilesystemError>;
+
+    /// The entries of the directory at `path`, without `.` or `..`.
+    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError>;
+
+    fn create_dir(&self, path: &str) -> Result<(), FilesystemError>;
+
+    /// Remove the empty directory at `path`.
+    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError>;
+
+    fn remove_file(&self, path: &str) -> Result<(), FilesystemError>;
+
+    /// Move the entry at `from` to `to`, refusing one `rename` does not
+    /// allow; a move onto its own path changes nothing and is allowed.
+    /// The Filesystem checks what stands at `from` as it moves it, under
+    /// the same lock, so nothing replaces it in between.
+    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError>;
+
+    /// The Filesystem a new Invocation starts from in this one's place, or
+    /// `None` when every Invocation shares this one.
+    fn for_invocation(&self) -> Option<Arc<dyn Filesystem>>;
+
+    /// The Filesystem a Mount with a Policy hands its calls in this one's
+    /// place, following no link anywhere on a path, each name reached
+    /// from the directory already held, so a link another writer swaps in
+    /// after the Policy judged the path is a link loop rather than
+    /// followed. A Filesystem holding no links answers `None`.
+    fn for_policy(&self) -> Option<Arc<dyn Filesystem>>;
+}
+
+/// One open file. The runtime keeps its position, so every read and write
+/// names the offset it starts at.
+pub trait File: Send {
+    fn read_at(&mut self, buf: &mut [u8], offset: u64) -> Result<usize, FilesystemError>;
+
+    fn write_at(&mut self, buf: &[u8], offset: u64) -> Result<usize, FilesystemError>;
+
+    /// Write `buf` at the file's end as it stands when the write lands,
+    /// answering the offset it landed at and how much was written. It
+    /// keeps another writer's append from landing over this one, as Linux
+    /// takes an append under the file's lock, so a file that cannot read
+    /// its end and write there in one step answers `Unsupported`.
+    fn append(&mut self, buf: &[u8]) -> Result<(u64, usize), FilesystemError>;
+
+    fn metadata(&self) -> Result<Metadata, FilesystemError>;
+
+    /// Truncate or extend the file to `len` bytes, extending with zeros.
+    fn set_len(&mut self, len: u64) -> Result<(), FilesystemError>;
+
+    /// Make what was written durable. The default has nothing to flush,
+    /// which is the truthful answer of a file with no durability of its
+    /// own.
+    fn sync(&mut self) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Release the file once the guest closes it, answering whether what
+    /// it held was kept. The default has nothing to release; a file the
+    /// guest never closes is dropped instead.
+    fn close(self: Box<Self>) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+}
+
+/// How `Filesystem::open` opens a file.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct OpenOptions {
+    pub read: bool,
+    pub write: bool,
+    /// Create the file when it does not exist.
+    pub create: bool,
+    /// Create the file, refusing one that already exists.
+    pub create_new: bool,
+    /// Empty the file once it is open.
+    pub truncate: bool,
+    /// Refuse a symbolic link standing at the path, as `O_NOFOLLOW` does;
+    /// a Filesystem holding no links has none to refuse.
+    pub nofollow: bool,
+}
+
+/// What `Filesystem::rename` may move, as `renameat2` flags ask more of
+/// a rename than its two paths.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum Rename {
+    /// Whatever stands at the source.
+    #[default]
+    Any,
+    /// Only a file. A directory is refused as `CrossesDevices`, so a
+    /// caller copies what is beneath it one entry at a time instead.
+    File,
+    /// Only a directory, as a trailing `/` asks. A file is refused as
+    /// `NotADirectory`.
+    Directory,
+}
+
+impl Rename {
+    /// Refuse moving an entry of `file_type` this rename may not move.
+    pub fn check(self, file_type: FileType) -> Result<(), FilesystemError> {
+        match (self, file_type) {
+            (Self::File, FileType::Directory) => Err(FilesystemError::CrossesDevices),
+            (Self::Directory, file_type) if file_type != FileType::Directory => {
+                Err(FilesystemError::NotADirectory)
+            }
+            _ => Ok(()),
+        }
+    }
+}
+
+/// What a path names.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum FileType {
+    File,
+    Directory,
+    /// A link, as only `symlink_metadata` and a listing report one.
+    Symlink,
+    /// Anything else a host holds, such as a FIFO, a socket, or a device,
+    /// which no Filesystem opens.
+    Unknown,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct Metadata {
+    pub file_type: FileType,
+    /// The length in bytes; zero for a directory or a link.
+    pub len: u64,
+    /// The device and inode numbers naming what the path holds, as
+    /// `st_dev` and `st_ino` do. An `ino` of zero reports none, so a
+    /// descriptor of such a directory follows its path alone.
+    pub dev: u64,
+    pub ino: u64,
+}
+
+impl Metadata {
+    /// Metadata reporting no identity.
+    pub fn new(file_type: FileType, len: u64) -> Self {
+        Self {
+            file_type,
+            len,
+            dev: 0,
+            ino: 0,
+        }
+    }
+
+    /// This metadata naming `dev` and `ino` as what the path holds.
+    pub fn with_identity(self, dev: u64, ino: u64) -> Self {
+        Self { dev, ino, ..self }
+    }
+
+    /// A device number for a Filesystem with none of its own, as each
+    /// tmpfs mount takes one: no earlier call returned it, and its top bit,
+    /// which no host's `st_dev` sets, keeps it apart from a host's.
+    pub fn unique_device() -> u64 {
+        static NEXT: AtomicU64 = AtomicU64::new(1);
+        (1 << 63) | NEXT.fetch_add(1, Ordering::Relaxed)
+    }
+}
+
+/// What keeps a directory's identity its own while a descriptor has the
+/// directory open, released when it drops.
+pub struct Hold {
+    _kept: Box<dyn Send + Sync>,
+}
+
+impl Hold {
+    /// A Hold keeping `kept`, such as a host directory's descriptor, until
+    /// it drops.
+    pub fn new(kept: impl Send + Sync + 'static) -> Self {
+        Self {
+            _kept: Box::new(kept),
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct DirEntry {
+    pub name: String,
+    pub file_type: FileType,
+}
+
+impl DirEntry {
+    /// The entry `name` in its directory, naming a `file_type`.
+    pub fn new(name: impl Into<String>, file_type: FileType) -> Self {
+        Self {
+            name: name.into(),
+            file_type,
+        }
+    }
+}
+
+/// Why a Filesystem call failed. The runtime hands the guest the matching
+/// error code.
+#[derive(Clone, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum FilesystemError {
+    NotFound,
+    AlreadyExists,
+    NotADirectory,
+    IsADirectory,
+    DirectoryNotEmpty,
+    PermissionDenied,
+    ReadOnlyFilesystem,
+    InvalidInput,
+    Unsupported,
+    /// A change past what the Filesystem can hold.
+    StorageFull,
+    /// A file grown past the largest the Filesystem keeps.
+    FileTooLarge,
+    /// A move that cannot happen in one step, as between two devices.
+    CrossesDevices,
+    /// A call that would wait on a lock its own thread holds.
+    Deadlock,
+    /// A symbolic link where the call asked to follow none.
+    FilesystemLoop,
+    /// A call only a privileged caller may make, as apart from one the
+    /// file's permissions deny.
+    NotPermitted,
+    BadDescriptor,
+    ResourceBusy,
+    /// Bytes that are no valid character where the call needs one.
+    IllegalSequence,
+    Interrupted,
+    TooManyOpenFiles,
+    /// A name too long for the Filesystem.
+    InvalidFilename,
+    OutOfMemory,
+    NotASocket,
+    /// A value too large for the type the call answers in.
+    ValueTooLarge,
+    NotSeekable,
+    /// Any other failure, with what the Filesystem knows of it.
+    Other(String),
+}
+
+/// Each failure under the POSIX error name it stands for. `ENOTSUP` comes
+/// before `EOPNOTSUPP`, a name some hosts give the same error, so
+/// `Unsupported` answers to the first.
+const POSIX_NAMES: [(&str, FilesystemError); 26] = [
+    ("ENOENT", FilesystemError::NotFound),
+    ("EEXIST", FilesystemError::AlreadyExists),
+    ("ENOTDIR", FilesystemError::NotADirectory),
+    ("EISDIR", FilesystemError::IsADirectory),
+    ("ENOTEMPTY", FilesystemError::DirectoryNotEmpty),
+    ("EACCES", FilesystemError::PermissionDenied),
+    ("EROFS", FilesystemError::ReadOnlyFilesystem),
+    ("EINVAL", FilesystemError::InvalidInput),
+    ("ENOTSUP", FilesystemError::Unsupported),
+    ("EOPNOTSUPP", FilesystemError::Unsupported),
+    ("ENOSPC", FilesystemError::StorageFull),
+    ("EFBIG", FilesystemError::FileTooLarge),
+    ("EXDEV", FilesystemError::CrossesDevices),
+    ("EDEADLK", FilesystemError::Deadlock),
+    ("ELOOP", FilesystemError::FilesystemLoop),
+    ("EPERM", FilesystemError::NotPermitted),
+    ("EBADF", FilesystemError::BadDescriptor),
+    ("EBUSY", FilesystemError::ResourceBusy),
+    ("EILSEQ", FilesystemError::IllegalSequence),
+    ("EINTR", FilesystemError::Interrupted),
+    ("EMFILE", FilesystemError::TooManyOpenFiles),
+    ("ENAMETOOLONG", FilesystemError::InvalidFilename),
+    ("ENOMEM", FilesystemError::OutOfMemory),
+    ("ENOTSOCK", FilesystemError::NotASocket),
+    ("EOVERFLOW", FilesystemError::ValueTooLarge),
+    ("ESPIPE", FilesystemError::NotSeekable),
+];
+
+impl FilesystemError {
+    /// The POSIX error name this failure stands for, as `ENOENT`. `Other`
+    /// has none.
+    pub fn posix_name(&self) -> Option<&'static str> {
+        POSIX_NAMES
+            .iter()
+            .find(|(_, error)| error == self)
+            .map(|(name, _)| *name)
+    }
+
+    /// The failure a POSIX error name stands for, if it is one of these.
+    pub fn from_posix_name(name: &str) -> Option<Self> {
+        POSIX_NAMES
+            .iter()
+            .find(|(known, _)| *known == name)
+            .map(|(_, error)| error.clone())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_posix_name_answers_back_to_its_failure() {
+        for (name, error) in &POSIX_NAMES {
+            assert_eq!(
+                FilesystemError::from_posix_name(name)
+                    .as_ref()
+                    .and_then(FilesystemError::posix_name)
+                    .and_then(FilesystemError::from_posix_name),
+                Some(error.clone()),
+                "{name} through FilesystemError::from_posix_name and posix_name must name {error:?} again"
+            );
+        }
+        assert_eq!(
+            (
+                FilesystemError::Unsupported.posix_name(),
+                FilesystemError::Other("x".into()).posix_name()
+            ),
+            (Some("ENOTSUP"), None),
+            "Unsupported through FilesystemError::posix_name must answer ENOTSUP, and Other none"
+        );
+    }
+}

data/crates/kobako-runtime/src/grant.rs

@@ -0,0 +1,20 @@
+//! A Grant: a host resource the Host App hands the runtime instead of
+//! binding it by name. The Sandbox holds it and each Invocation receives it
+//! afresh; the guest reaches it through its system interface.
+
+use crate::mount::Mount;
+
+/// One resource handed over for an Invocation. Each kind carries what it
+/// is and decides its own access.
+#[derive(Clone)]
+#[non_exhaustive]
+pub enum Grant {
+    Mount(Mount),
+}
+
+/// The kinds of Grant a runtime may support.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum GrantKind {
+    Mount,
+}

data/crates/kobako-runtime/src/lib.rs

@@ -2,7 +2,8 @@
 //!
 //! The surface where a wasm engine implementation and a host frontend
 //! meet: the `Runtime` trait, the isolation `Profile` a runtime
-//! declares, the neutral per-invocation value types, and the dispatch /
+//! declares, the Grants it presents to the guest and the `Filesystem` a
+//! Mount places, the neutral per-invocation value types, and the dispatch /
 //! yield re-entry traits a frontend supplies. The messages these carry
 //! are `kobako-transport`'s, which this crate takes as given.
 //! Nothing here depends on an engine or a frontend type — each engine
@@ -13,6 +14,9 @@
 
 pub mod dispatch;
 pub mod error;
+pub mod filesystem;
+pub mod grant;
+pub mod mount;
 pub mod profile;
 pub mod runtime;
 pub mod snapshot;
@@ -23,6 +27,12 @@ pub mod yielder;
 // a reader of `kobako_runtime::Runtime` was missing.
 pub use dispatch::DispatchHandler;
 pub use error::{InvokeError, SetupError, Trap};
+pub use filesystem::{
+    Access, Blocking, DirEntry, Directory, File, FileType, Filesystem, FilesystemError, Hold,
+    Memory, Metadata, OpenOptions, Overlay, Rename, SeedError, Temporary,
+};
+pub use grant::{Grant, GrantKind};
+pub use mount::{Denial, Mount, MountPathError, Policy};
 pub use profile::Profile;
 pub use runtime::{Entry, Runtime};
 pub use snapshot::{Capture, Completion, Snapshot, Usage};