@abelxiaoxing/cadence 1.3.0 → 1.4.0

package/src/workspace-io-worker.mjs

@@ -0,0 +1,984 @@
+// Generated by scripts/build-workspace-io.mjs; edit workspace-io-entry.mjs and its source modules.
+// src/workspace-io-entry.mjs
+import { parentPort, workerData } from "node:worker_threads";
+
+// src/artifact-store.ts
+import { createHash, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  copyFileSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import path from "node:path";
+var SHA256 = /^[a-f0-9]{64}$/u;
+function digest(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function requireHash(hash) {
+  if (!SHA256.test(hash))
+    throw new Error("artifact-hash-invalid");
+}
+function ensureDirectory(directory) {
+  const stat = lstatSync(directory, { throwIfNoEntry: false });
+  if (stat) {
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error("artifact-store-path-unsafe");
+    }
+    chmodSync(directory, 448);
+    return;
+  }
+  let cursor = path.dirname(directory);
+  while (cursor !== path.dirname(cursor)) {
+    const ancestor = lstatSync(cursor, { throwIfNoEntry: false });
+    if (ancestor) {
+      if (ancestor.isSymbolicLink() || !ancestor.isDirectory()) {
+        throw new Error("artifact-store-path-unsafe");
+      }
+      break;
+    }
+    cursor = path.dirname(cursor);
+  }
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  const created = lstatSync(directory);
+  if (created.isSymbolicLink() || !created.isDirectory()) {
+    throw new Error("artifact-store-path-unsafe");
+  }
+  chmodSync(directory, 448);
+}
+function syncDirectory(directory) {
+  const descriptor = openSync(directory, constants.O_RDONLY);
+  try {
+    fsyncSync(descriptor);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+function writeAtomic(target, bytes) {
+  const directory = path.dirname(target);
+  ensureDirectory(directory);
+  const temporary = path.join(directory, `.${path.basename(target)}.${process.pid}.${randomUUID()}.tmp`);
+  const descriptor = openSync(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 384);
+  try {
+    writeFileSync(descriptor, bytes);
+    fsyncSync(descriptor);
+  } finally {
+    closeSync(descriptor);
+  }
+  try {
+    renameSync(temporary, target);
+    chmodSync(target, 384);
+    syncDirectory(directory);
+  } catch (error) {
+    try {
+      unlinkSync(temporary);
+    } catch {}
+    throw error;
+  }
+}
+
+class ArtifactStore {
+  root;
+  #blobs;
+  #references;
+  constructor(root) {
+    if (!path.isAbsolute(root))
+      throw new Error("artifact-store-root-invalid");
+    this.root = path.resolve(root);
+    this.#blobs = path.join(this.root, "blobs");
+    this.#references = path.join(this.root, "references");
+    ensureDirectory(this.root);
+    ensureDirectory(this.#blobs);
+    ensureDirectory(this.#references);
+  }
+  #blobPath(hash) {
+    requireHash(hash);
+    return path.join(this.#blobs, hash.slice(0, 2), hash);
+  }
+  #referencePath(hash) {
+    requireHash(hash);
+    return path.join(this.#references, hash.slice(0, 2), `${hash}.ref`);
+  }
+  put(input) {
+    if (!(input instanceof Uint8Array))
+      throw new Error("artifact-bytes-invalid");
+    const bytes = Buffer.from(input);
+    const hash = digest(bytes);
+    const target = this.#blobPath(hash);
+    const existing = lstatSync(target, { throwIfNoEntry: false });
+    if (existing) {
+      if (existing.isSymbolicLink() || !existing.isFile()) {
+        throw new Error("artifact-store-path-unsafe");
+      }
+      const current = readFileSync(target);
+      if (current.length !== bytes.length || digest(current) !== hash) {
+        throw new Error("artifact-integrity-invalid");
+      }
+    } else {
+      writeAtomic(target, bytes);
+      const stored = readFileSync(target);
+      if (stored.length !== bytes.length || digest(stored) !== hash) {
+        throw new Error("artifact-integrity-invalid");
+      }
+    }
+    return Object.freeze({ hash, bytes: bytes.length });
+  }
+  read(hash) {
+    const target = this.#blobPath(hash);
+    const stat = lstatSync(target, { throwIfNoEntry: false });
+    if (!stat?.isFile() || stat.isSymbolicLink()) {
+      throw new Error("artifact-unavailable");
+    }
+    const bytes = readFileSync(target);
+    if (digest(bytes) !== hash)
+      throw new Error("artifact-integrity-invalid");
+    return Buffer.from(bytes);
+  }
+  copyVerified(hash, destination) {
+    const source = this.#blobPath(hash);
+    const stat = lstatSync(source, { throwIfNoEntry: false });
+    if (!stat?.isFile() || stat.isSymbolicLink())
+      throw new Error("artifact-unavailable");
+    copyFileSync(source, destination, constants.COPYFILE_EXCL | constants.COPYFILE_FICLONE);
+    const bytes = readFileSync(destination);
+    if (digest(bytes) !== hash)
+      throw new Error("artifact-integrity-invalid");
+    return bytes.byteLength;
+  }
+  referenceCount(hash) {
+    requireHash(hash);
+    const referencePath = this.#referencePath(hash);
+    const stat = lstatSync(referencePath, { throwIfNoEntry: false });
+    if (!stat)
+      return 0;
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error("artifact-reference-invalid");
+    }
+    const raw = readFileSync(referencePath, "utf8");
+    if (!/^(?:0|[1-9][0-9]*)\n$/u.test(raw)) {
+      throw new Error("artifact-reference-invalid");
+    }
+    const count = Number(raw.trim());
+    if (!Number.isSafeInteger(count))
+      throw new Error("artifact-reference-invalid");
+    return count;
+  }
+  #setReferenceCount(hash, count) {
+    if (!Number.isSafeInteger(count) || count < 0) {
+      throw new Error("artifact-reference-invalid");
+    }
+    writeAtomic(this.#referencePath(hash), Buffer.from(`${count}
+`));
+    return count;
+  }
+  retain(hash) {
+    this.read(hash);
+    const current = this.referenceCount(hash);
+    if (current === Number.MAX_SAFE_INTEGER) {
+      throw new Error("artifact-reference-overflow");
+    }
+    return this.#setReferenceCount(hash, current + 1);
+  }
+  release(hash) {
+    this.read(hash);
+    const current = this.referenceCount(hash);
+    if (current === 0)
+      throw new Error("artifact-reference-underflow");
+    return this.#setReferenceCount(hash, current - 1);
+  }
+}
+
+// src/verification-identity.ts
+import { createHash as createHash2 } from "node:crypto";
+import {
+  closeSync as closeSync2,
+  constants as constants2,
+  fstatSync,
+  lstatSync as lstatSync2,
+  openSync as openSync2,
+  readdirSync,
+  readlinkSync,
+  readSync
+} from "node:fs";
+import path2 from "node:path";
+function verificationEnvironmentDigest(roots, checkCancelled = () => {}) {
+  const digest2 = createHash2("sha256");
+  let entries = 0;
+  let bytes = 0;
+  const started = Date.now();
+  const buffer = Buffer.alloc(256 * 1024);
+  const visit = (file, relative, dependencyRoot) => {
+    checkCancelled();
+    if (++entries > 500000 || Date.now() - started > 60000)
+      throw new Error("verification-environment-limit");
+    const stat = lstatSync2(file, { throwIfNoEntry: false });
+    digest2.update(JSON.stringify([relative, stat ? stat.mode & 511 : null]));
+    if (!stat) {
+      digest2.update("absent");
+      return;
+    }
+    if (stat.isSymbolicLink()) {
+      digest2.update(JSON.stringify(["link", readlinkSync(file)]));
+      return;
+    }
+    if (stat.isDirectory()) {
+      digest2.update("directory");
+      for (const name of readdirSync(file).sort()) {
+        if (dependencyRoot && [".vite", ".vite-temp"].includes(name))
+          continue;
+        visit(path2.join(file, name), `${relative}/${name}`, false);
+      }
+      return;
+    }
+    if (!stat.isFile())
+      throw new Error("verification-environment-unsafe");
+    const fd = openSync2(file, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    try {
+      const before = fstatSync(fd);
+      if (before.ino !== stat.ino || before.dev !== stat.dev)
+        throw new Error("verification-environment-changed");
+      const content = createHash2("sha256");
+      for (;; ) {
+        const count = readSync(fd, buffer, 0, buffer.length, null);
+        if (count === 0)
+          break;
+        checkCancelled();
+        bytes += count;
+        if (bytes > 16 * 1024 ** 3 || Date.now() - started > 60000)
+          throw new Error("verification-environment-limit");
+        content.update(buffer.subarray(0, count));
+      }
+      const after = fstatSync(fd);
+      if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs)
+        throw new Error("verification-environment-changed");
+      digest2.update(JSON.stringify(["file", content.digest("hex")]));
+    } finally {
+      closeSync2(fd);
+    }
+  };
+  for (const root of [...new Set(roots)].sort())
+    visit(root, root, path2.basename(root) === "node_modules");
+  return digest2.digest("hex");
+}
+
+// src/workspace-store.ts
+import { execFile, execFileSync } from "node:child_process";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
+import {
+  chmodSync as chmodSync2,
+  closeSync as closeSync3,
+  constants as constants3,
+  fsyncSync as fsyncSync2,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync2,
+  openSync as openSync3,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import path4 from "node:path";
+import { promisify } from "node:util";
+
+// src/canonical.ts
+function compareCanonicalStrings(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+// src/control-contracts.ts
+var CONTROL_SCHEMA_PROPERTIES = {
+  command: {
+    type: "string",
+    enum: ["start", "status", "resume", "rebind", "cancel", "discard"]
+  },
+  stage: { type: "string", enum: ["abel-implement"] },
+  change: { type: "string" },
+  operationId: { type: "string" },
+  deliveryRevision: { type: "integer", minimum: 1 },
+  receiptHash: { type: "string" },
+  routeId: { type: "string" },
+  recovery: {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      incidentKey: { type: "string", pattern: "^[a-f0-9]{64}$" },
+      failureSequence: { type: "integer", minimum: 1 },
+      reason: {
+        type: "string",
+        enum: ["parent-directed-retry", "route-changed", "context-extended"]
+      }
+    },
+    required: ["incidentKey", "failureSequence", "reason"]
+  }
+};
+var commandSchema = (command, fields) => ({
+  type: "object",
+  properties: {
+    command: { type: "string", enum: [command] },
+    ...Object.fromEntries(fields.map((field) => [field, CONTROL_SCHEMA_PROPERTIES[field]]))
+  },
+  required: ["command", ...fields],
+  additionalProperties: false
+});
+var CONTROL_COMMAND_PARAMETERS = {
+  type: "object",
+  properties: CONTROL_SCHEMA_PROPERTIES,
+  required: ["command", "stage", "change"],
+  anyOf: [
+    commandSchema("start", ["stage", "change", "operationId"]),
+    commandSchema("status", ["stage", "change"]),
+    commandSchema("resume", ["stage", "change", "operationId"]),
+    commandSchema("resume", ["stage", "change", "operationId", "recovery"]),
+    commandSchema("resume", [
+      "stage",
+      "change",
+      "operationId",
+      "deliveryRevision",
+      "receiptHash",
+      "recovery"
+    ]),
+    commandSchema("resume", [
+      "stage",
+      "change",
+      "operationId",
+      "deliveryRevision",
+      "receiptHash"
+    ]),
+    commandSchema("rebind", ["stage", "change", "operationId", "routeId"]),
+    commandSchema("cancel", ["stage", "change", "operationId"]),
+    commandSchema("discard", ["stage", "change", "operationId"])
+  ],
+  additionalProperties: false
+};
+var CONTROL_TOOL_FIELDS = new Set([
+  "command",
+  "stage",
+  "change",
+  "operationId",
+  "deliveryRevision",
+  "receiptHash",
+  "routeId",
+  "recovery"
+]);
+var COMMAND_FIELDS = Object.freeze({
+  start: new Set(["command", "stage", "change", "operationId"]),
+  status: new Set(["command", "stage", "change"]),
+  resume: new Set([
+    "command",
+    "stage",
+    "change",
+    "operationId",
+    "deliveryRevision",
+    "receiptHash",
+    "recovery"
+  ]),
+  rebind: new Set(["command", "stage", "change", "operationId", "routeId"]),
+  cancel: new Set(["command", "stage", "change", "operationId"]),
+  discard: new Set(["command", "stage", "change", "operationId"])
+});
+// src/contracts.ts
+var LIMITS = {
+  maxActiveChildSessions: 4,
+  maxEnvelopeBytes: 64 * 1024,
+  phaseTimeoutMs: 20 * 60 * 1000,
+  maxCompleteResultBytes: 64 * 1024
+};
+var NONCANONICAL = /(^|\/)\.\.(\/|$)|(^|\/)\/|^\//;
+function isValidRelativePath(p) {
+  return typeof p === "string" && p.length > 0 && p.length <= 512 && !NONCANONICAL.test(p) && !p.startsWith("/") && !/^[a-z]:\//iu.test(p) && (p === "." || !p.startsWith("./") && !p.endsWith("/") && !p.split("/").includes(".")) && !p.includes("..") && !p.includes("\\") && !p.includes("\x00");
+}
+
+// src/safe-path.ts
+import { lstatSync as lstatSync3 } from "node:fs";
+import path3 from "node:path";
+function observeSafePath(root, relative) {
+  if (!isValidRelativePath(relative)) {
+    return { kind: "unsafe", reason: "invalid-path" };
+  }
+  try {
+    const resolvedRoot = path3.resolve(root);
+    const rootStat = lstatSync3(resolvedRoot, { throwIfNoEntry: false });
+    if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
+      return { kind: "unsafe", reason: "root-unavailable" };
+    }
+    if (relative === ".")
+      return { kind: "directory" };
+    let current = resolvedRoot;
+    const parts = relative.split("/");
+    for (const [index, part] of parts.entries()) {
+      current = path3.join(current, part);
+      if (!current.startsWith(`${resolvedRoot}${path3.sep}`)) {
+        return { kind: "unsafe", reason: "invalid-path" };
+      }
+      const stat = lstatSync3(current, { throwIfNoEntry: false });
+      if (!stat)
+        return { kind: "absent" };
+      if (stat.isSymbolicLink()) {
+        return { kind: "unsafe", reason: "symlink" };
+      }
+      if (index < parts.length - 1) {
+        if (!stat.isDirectory()) {
+          return { kind: "unsafe", reason: "parent-not-directory" };
+        }
+        continue;
+      }
+      if (stat.isFile())
+        return { kind: "file" };
+      if (stat.isDirectory())
+        return { kind: "directory" };
+      return { kind: "unsafe", reason: "special-file" };
+    }
+  } catch {
+    return { kind: "unsafe", reason: "path-unavailable" };
+  }
+  return { kind: "unsafe", reason: "invalid-path" };
+}
+
+// src/workspace-io.ts
+import { Worker } from "node:worker_threads";
+async function runWorkspaceIo(input) {
+  input.signal?.throwIfAborted();
+  const cancelled = new SharedArrayBuffer(4);
+  const flag = new Int32Array(cancelled);
+  const started = performance.now();
+  const worker = new Worker(new URL("./workspace-io-worker.mjs", import.meta.url), {
+    workerData: {
+      root: input.root,
+      artifactRoot: input.artifactRoot,
+      operation: input.operation,
+      args: input.args,
+      cancelled
+    },
+    execArgv: []
+  });
+  const abort = () => {
+    Atomics.store(flag, 0, 1);
+    worker.postMessage("cancel");
+  };
+  input.signal?.addEventListener("abort", abort, { once: true });
+  if (input.signal?.aborted)
+    abort();
+  try {
+    return await new Promise((resolve, reject) => {
+      let message;
+      let failure;
+      worker.once("message", (value) => {
+        message = value;
+      });
+      worker.once("error", (error) => {
+        failure = error;
+      });
+      worker.once("exit", (code) => {
+        try {
+          input.onMetrics?.({
+            operation: input.operation,
+            elapsedMs: performance.now() - started,
+            files: message?.files ?? 0,
+            bytes: message?.bytes ?? 0
+          });
+        } catch {}
+        if (input.signal?.aborted)
+          reject(input.signal.reason);
+        else if (failure || code !== 0 || !message)
+          reject(new Error("workspace-io-unavailable"));
+        else if (!message.ok)
+          reject(new Error(message.error ?? "workspace-io-failed"));
+        else
+          resolve(message.result);
+      });
+    });
+  } finally {
+    input.signal?.removeEventListener("abort", abort);
+  }
+}
+
+// src/workspace-store.ts
+var SHA2562 = /^[a-f0-9]{64}$/u;
+function hash(...values) {
+  const digest2 = createHash3("sha256");
+  for (const value of values) {
+    const bytes = typeof value === "string" ? Buffer.from(value) : value;
+    digest2.update(`${bytes.byteLength}:`);
+    digest2.update(bytes);
+  }
+  return digest2.digest("hex");
+}
+function stableEntries(entries) {
+  return Object.fromEntries(Object.entries(entries).sort(([left], [right]) => compareCanonicalStrings(left, right)).map(([relative, entry]) => [relative, { ...entry }]));
+}
+function manifestHash(entries) {
+  return hash("cadence-workspace-manifest", JSON.stringify(stableEntries(entries)));
+}
+function revisionId(parentRevisionId, manifest) {
+  return hash("cadence-workspace-revision", parentRevisionId ?? "", manifest);
+}
+function ensureDirectory2(directory) {
+  const stat = lstatSync4(directory, { throwIfNoEntry: false });
+  if (stat) {
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error("unsafe-workspace-path");
+    }
+    chmodSync2(directory, 448);
+    return;
+  }
+  let cursor = path4.dirname(directory);
+  while (cursor !== path4.dirname(cursor)) {
+    const ancestor = lstatSync4(cursor, { throwIfNoEntry: false });
+    if (ancestor) {
+      if (ancestor.isSymbolicLink() || !ancestor.isDirectory()) {
+        throw new Error("unsafe-workspace-path");
+      }
+      break;
+    }
+    cursor = path4.dirname(cursor);
+  }
+  mkdirSync2(directory, { recursive: true, mode: 448 });
+  const created = lstatSync4(directory);
+  if (created.isSymbolicLink() || !created.isDirectory()) {
+    throw new Error("unsafe-workspace-path");
+  }
+  chmodSync2(directory, 448);
+}
+function syncDirectory2(directory) {
+  const descriptor = openSync3(directory, constants3.O_RDONLY);
+  try {
+    fsyncSync2(descriptor);
+  } finally {
+    closeSync3(descriptor);
+  }
+}
+function writeAtomic2(target, bytes) {
+  const directory = path4.dirname(target);
+  ensureDirectory2(directory);
+  const temporary = path4.join(directory, `.${path4.basename(target)}.${process.pid}.${randomUUID2()}.tmp`);
+  const descriptor = openSync3(temporary, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
+  try {
+    writeFileSync2(descriptor, bytes);
+    fsyncSync2(descriptor);
+  } finally {
+    closeSync3(descriptor);
+  }
+  try {
+    renameSync2(temporary, target);
+    chmodSync2(target, 384);
+    syncDirectory2(directory);
+  } catch (error) {
+    try {
+      unlinkSync2(temporary);
+    } catch {}
+    throw error;
+  }
+}
+function requireSafeRelative(relative) {
+  if (!isValidRelativePath(relative) || relative === ".") {
+    throw new Error("unsafe-workspace-path");
+  }
+}
+function isExcluded(relative, excluded) {
+  return excluded.some((entry) => relative === entry || relative.startsWith(`${entry}/`));
+}
+function parseNullSeparated(bytes) {
+  const decoded = bytes.toString("utf8");
+  if (!Buffer.from(decoded, "utf8").equals(bytes)) {
+    throw new Error("unsafe-workspace-path");
+  }
+  return decoded.split("\x00").filter((entry) => entry.length > 0);
+}
+function sameEntry(left, right) {
+  if (!left || !right)
+    return left === right;
+  if (left.kind !== right.kind)
+    return false;
+  return left.kind === "absent" || right.kind === "file" && left.hash === right.hash && left.bytes === right.bytes && left.mode === right.mode;
+}
+function requireMode(mode) {
+  if (!Number.isInteger(mode) || mode < 0 || mode > 511) {
+    throw new Error("workspace-file-mode-invalid");
+  }
+  return mode;
+}
+function requireRevisionShape(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("workspace-revision-invalid");
+  }
+  const candidate = value;
+  if (typeof candidate.revisionId !== "string" || !SHA2562.test(candidate.revisionId) || candidate.parentRevisionId !== null && (typeof candidate.parentRevisionId !== "string" || !SHA2562.test(candidate.parentRevisionId)) || typeof candidate.manifestHash !== "string" || !SHA2562.test(candidate.manifestHash) || !candidate.entries || typeof candidate.entries !== "object" || Array.isArray(candidate.entries)) {
+    throw new Error("workspace-revision-invalid");
+  }
+  for (const [relative, entry] of Object.entries(candidate.entries)) {
+    requireSafeRelative(relative);
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new Error("workspace-revision-invalid");
+    }
+    if (entry.kind === "absent") {
+      if (Object.keys(entry).length !== 1) {
+        throw new Error("workspace-revision-invalid");
+      }
+      continue;
+    }
+    const file = entry;
+    if (file.kind !== "file" || !SHA2562.test(file.hash) || !Number.isSafeInteger(file.bytes) || file.bytes < 0 || Object.keys(file).length !== 4) {
+      throw new Error("workspace-revision-invalid");
+    }
+    requireMode(file.mode);
+  }
+  return candidate;
+}
+
+class WorkspaceStore {
+  root;
+  #revisions;
+  #artifacts;
+  #checkCancelled;
+  #onMetrics;
+  constructor(root, artifacts, options = {}) {
+    this.#checkCancelled = options.checkCancelled ?? (() => {});
+    this.#onMetrics = options.onMetrics;
+    if (!path4.isAbsolute(root))
+      throw new Error("workspace-store-root-invalid");
+    this.root = path4.resolve(root);
+    this.#revisions = path4.join(this.root, "revisions");
+    this.#artifacts = artifacts;
+    ensureDirectory2(this.root);
+    ensureDirectory2(this.#revisions);
+  }
+  #revisionPath(id) {
+    if (!SHA2562.test(id))
+      throw new Error("workspace-revision-id-invalid");
+    return path4.join(this.#revisions, id.slice(0, 2), `${id}.json`);
+  }
+  #storeRevision(parentRevisionId, rawEntries) {
+    const entries = stableEntries(rawEntries);
+    const manifest = manifestHash(entries);
+    const id = revisionId(parentRevisionId, manifest);
+    const revision = {
+      revisionId: id,
+      parentRevisionId,
+      manifestHash: manifest,
+      entries
+    };
+    const target = this.#revisionPath(id);
+    const existing = lstatSync4(target, { throwIfNoEntry: false });
+    if (existing) {
+      const stored = this.getRevision(id);
+      if (JSON.stringify(stored) !== JSON.stringify(revision)) {
+        throw new Error("workspace-revision-conflict");
+      }
+      return stored;
+    }
+    writeAtomic2(target, Buffer.from(`${JSON.stringify(revision)}
+`));
+    const inherited = parentRevisionId ? this.getRevision(parentRevisionId).entries : {};
+    for (const [relative, entry] of Object.entries(entries)) {
+      if (entry.kind === "file" && !sameEntry(entry, inherited[relative]))
+        this.#artifacts.retain(entry.hash);
+    }
+    return structuredClone(revision);
+  }
+  #isAncestor(ancestorId, revision) {
+    let cursor = revision;
+    const visited = new Set;
+    while (cursor) {
+      if (cursor.revisionId === ancestorId)
+        return true;
+      if (visited.has(cursor.revisionId)) {
+        throw new Error("workspace-revision-cycle");
+      }
+      visited.add(cursor.revisionId);
+      cursor = cursor.parentRevisionId ? this.getRevision(cursor.parentRevisionId) : null;
+    }
+    return false;
+  }
+  captureBaseline(input) {
+    const consumerRoot = path4.resolve(input.consumerRoot);
+    const rootStat = lstatSync4(consumerRoot, { throwIfNoEntry: false });
+    if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
+      throw new Error("unsafe-workspace-path");
+    }
+    const excluded = [".git", "node_modules", ...input.excludedPaths ?? []];
+    for (const relative of excluded)
+      requireSafeRelative(relative);
+    return this.#captureBaselineFiles(input, this.#trackedFiles(input), consumerRoot, excluded);
+  }
+  #trackedFiles(input) {
+    const timeout = input.gitTimeoutMs ?? 30000;
+    if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000)
+      throw new Error("workspace-git-timeout-invalid");
+    const consumerRoot = path4.resolve(input.consumerRoot);
+    let tracked;
+    try {
+      tracked = parseNullSeparated(execFileSync("git", ["ls-files", "-z", "--cached"], {
+        cwd: consumerRoot,
+        maxBuffer: 32 * 1024 * 1024,
+        timeout,
+        killSignal: "SIGKILL"
+      }));
+    } catch (error) {
+      if (error instanceof Error && error.message === "unsafe-workspace-path") {
+        throw error;
+      }
+      throw new Error("workspace-git-baseline-unavailable");
+    }
+    return tracked;
+  }
+  #captureBaselineFiles(input, tracked, consumerRoot, excluded) {
+    const approved = input.approvedUntracked ?? [];
+    const absent = input.absent ?? [];
+    const selected = [...new Set([...tracked, ...approved])].sort();
+    const entries = {};
+    for (const relative of selected) {
+      this.#checkCancelled();
+      requireSafeRelative(relative);
+      if (isExcluded(relative, excluded))
+        continue;
+      const observation = observeSafePath(consumerRoot, relative);
+      if (observation.kind === "absent") {
+        entries[relative] = { kind: "absent" };
+        continue;
+      }
+      if (observation.kind !== "file")
+        throw new Error("unsafe-workspace-path");
+      const absolute = path4.join(consumerRoot, ...relative.split("/"));
+      const bytes = readFileSync2(absolute);
+      const artifact = this.#artifacts.put(bytes);
+      const stat = lstatSync4(absolute);
+      entries[relative] = {
+        kind: "file",
+        hash: artifact.hash,
+        bytes: artifact.bytes,
+        mode: requireMode(stat.mode & 511)
+      };
+    }
+    for (const relative of [...new Set(absent)].sort()) {
+      requireSafeRelative(relative);
+      if (isExcluded(relative, excluded))
+        throw new Error("unsafe-workspace-path");
+      if (observeSafePath(consumerRoot, relative).kind !== "absent") {
+        throw new Error("workspace-path-not-absent");
+      }
+      entries[relative] = { kind: "absent" };
+    }
+    return this.#storeRevision(null, entries);
+  }
+  getRevision(id) {
+    const target = this.#revisionPath(id);
+    const stat = lstatSync4(target, { throwIfNoEntry: false });
+    if (!stat?.isFile() || stat.isSymbolicLink()) {
+      throw new Error("workspace-revision-unavailable");
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync2(target, "utf8"));
+    } catch {
+      throw new Error("workspace-revision-invalid");
+    }
+    const revision = requireRevisionShape(parsed);
+    if (revision.revisionId !== id || manifestHash(revision.entries) !== revision.manifestHash && hash("cadence-workspace-manifest", JSON.stringify(revision.entries)) !== revision.manifestHash || revisionId(revision.parentRevisionId, revision.manifestHash) !== id) {
+      throw new Error("workspace-revision-integrity-invalid");
+    }
+    return structuredClone(revision);
+  }
+  createRevision(input) {
+    const parent = this.getRevision(input.parentRevisionId);
+    const entries = stableEntries(parent.entries);
+    for (const [relative, change] of Object.entries(input.changes).sort(([left], [right]) => compareCanonicalStrings(left, right))) {
+      requireSafeRelative(relative);
+      if (change === null || typeof change === "object" && "kind" in change && change.kind === "absent") {
+        entries[relative] = { kind: "absent" };
+        continue;
+      }
+      const descriptor = change instanceof Uint8Array ? {
+        kind: "file",
+        bytes: change,
+        mode: entries[relative]?.kind === "file" ? entries[relative].mode : 420
+      } : change;
+      if (descriptor?.kind !== "file" || !(descriptor.bytes instanceof Uint8Array)) {
+        throw new Error("workspace-change-invalid");
+      }
+      const artifact = this.#artifacts.put(descriptor.bytes);
+      entries[relative] = {
+        kind: "file",
+        hash: artifact.hash,
+        bytes: artifact.bytes,
+        mode: requireMode(descriptor.mode ?? 420)
+      };
+    }
+    return this.#storeRevision(parent.revisionId, entries);
+  }
+  mergeRevision(input) {
+    const base = this.getRevision(input.baseRevisionId);
+    const current = this.getRevision(input.currentRevisionId);
+    const candidate = this.getRevision(input.candidateRevisionId);
+    if (candidate.parentRevisionId !== base.revisionId || !this.#isAncestor(base.revisionId, current)) {
+      throw new Error("workspace-revision-base-invalid");
+    }
+    const boundPaths = [...new Set(input.boundPaths)];
+    for (const relative of boundPaths) {
+      requireSafeRelative(relative);
+      if (!sameEntry(base.entries[relative], current.entries[relative])) {
+        throw new Error("workspace-revision-stale");
+      }
+    }
+    const allPaths = new Set([
+      ...Object.keys(base.entries),
+      ...Object.keys(candidate.entries)
+    ]);
+    const delta = [...allPaths].filter((relative) => !sameEntry(base.entries[relative], candidate.entries[relative]));
+    for (const relative of delta) {
+      if (!sameEntry(base.entries[relative], current.entries[relative])) {
+        throw new Error("workspace-revision-stale");
+      }
+    }
+    const merged = stableEntries(current.entries);
+    for (const relative of delta.sort()) {
+      const entry = candidate.entries[relative];
+      if (entry)
+        merged[relative] = { ...entry };
+      else
+        delete merged[relative];
+    }
+    return this.#storeRevision(current.revisionId, merged);
+  }
+  materialize(revisionIdValue, destination) {
+    const revision = this.getRevision(revisionIdValue);
+    const root = path4.resolve(destination);
+    ensureDirectory2(root);
+    for (const [relative, entry] of Object.entries(revision.entries)) {
+      this.#checkCancelled();
+      requireSafeRelative(relative);
+      const observation = observeSafePath(root, relative);
+      if (entry.kind === "absent") {
+        const segments2 = relative.split("/");
+        const supersededByFileAncestor = segments2.slice(0, -1).some((_segment, index) => revision.entries[segments2.slice(0, index + 1).join("/")]?.kind === "file");
+        if (supersededByFileAncestor)
+          continue;
+        if (observation.kind !== "absent") {
+          throw new Error("workspace-materialize-conflict");
+        }
+        continue;
+      }
+      const segments = relative.split("/");
+      let parent = root;
+      for (const segment of segments.slice(0, -1)) {
+        parent = path4.join(parent, segment);
+        ensureDirectory2(parent);
+      }
+      const target = path4.join(root, ...segments);
+      if (observation.kind !== "absent") {
+        throw new Error("workspace-materialize-conflict");
+      }
+      const bytes = this.#artifacts.copyVerified(entry.hash, target);
+      if (bytes !== entry.bytes)
+        throw new Error("workspace-revision-integrity-invalid");
+      chmodSync2(target, entry.mode);
+    }
+  }
+  async captureBaselineWithGit(input, signal) {
+    signal?.throwIfAborted();
+    const consumerRoot = path4.resolve(input.consumerRoot);
+    const stat = lstatSync4(consumerRoot, { throwIfNoEntry: false });
+    if (!stat?.isDirectory() || stat.isSymbolicLink())
+      throw new Error("unsafe-workspace-path");
+    const excluded = [".git", "node_modules", ...input.excludedPaths ?? []];
+    for (const relative of excluded)
+      requireSafeRelative(relative);
+    const timeout = input.gitTimeoutMs ?? 30000;
+    if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000)
+      throw new Error("workspace-git-timeout-invalid");
+    let tracked;
+    try {
+      const { stdout } = await promisify(execFile)("git", ["ls-files", "-z", "--cached"], {
+        cwd: consumerRoot,
+        encoding: "buffer",
+        maxBuffer: 32 * 1024 * 1024,
+        timeout,
+        killSignal: "SIGKILL",
+        signal
+      });
+      tracked = parseNullSeparated(stdout);
+    } catch (error) {
+      signal?.throwIfAborted();
+      if (error instanceof Error && error.message === "unsafe-workspace-path")
+        throw error;
+      throw new Error("workspace-git-baseline-unavailable");
+    }
+    this.#checkCancelled();
+    return this.#captureBaselineFiles(input, tracked, consumerRoot, excluded);
+  }
+  captureBaselineAsync(input, signal) {
+    return runWorkspaceIo({
+      root: this.root,
+      artifactRoot: this.#artifacts.root,
+      operation: "captureBaseline",
+      args: [input],
+      signal,
+      onMetrics: this.#onMetrics
+    });
+  }
+  materializeAsync(revisionId2, destination, signal) {
+    return runWorkspaceIo({
+      root: this.root,
+      artifactRoot: this.#artifacts.root,
+      operation: "materialize",
+      args: [revisionId2, destination],
+      signal,
+      onMetrics: this.#onMetrics
+    });
+  }
+}
+
+// src/workspace-io-entry.mjs
+var controller = new AbortController;
+var flag = new Int32Array(workerData.cancelled);
+parentPort.on("message", () => controller.abort(new Error("cancelled")));
+var checkCancelled = () => {
+  if (Atomics.load(flag, 0))
+    throw new Error("cancelled");
+};
+try {
+  if (workerData.operation === "verificationIdentity") {
+    const result = verificationEnvironmentDigest(workerData.args[0], checkCancelled);
+    parentPort.postMessage({ ok: true, result, files: 0, bytes: 0 });
+  } else {
+    const artifacts = new ArtifactStore(workerData.artifactRoot);
+    const store = new WorkspaceStore(workerData.root, artifacts, {
+      checkCancelled
+    });
+    let result;
+    let revision;
+    checkCancelled();
+    if (workerData.operation === "captureBaseline") {
+      revision = await store.captureBaselineWithGit(workerData.args[0], controller.signal);
+      result = revision;
+    } else if (workerData.operation === "materialize") {
+      revision = store.getRevision(workerData.args[0]);
+      store.materialize(workerData.args[0], workerData.args[1]);
+    } else {
+      throw new Error("workspace-io-operation-invalid");
+    }
+    const files = Object.values(revision.entries).filter((entry) => entry.kind === "file");
+    parentPort.postMessage({
+      ok: true,
+      result,
+      files: files.length,
+      bytes: files.reduce((sum, entry) => sum + entry.bytes, 0)
+    });
+  }
+} catch (error) {
+  parentPort.postMessage({
+    ok: false,
+    error: error instanceof Error ? error.message : "workspace-io-failed",
+    files: 0,
+    bytes: 0
+  });
+} finally {
+  parentPort.close();
+}