@cloudflare/workspace 0.0.0-alpha.0

package/dist/index.js

@@ -0,0 +1,2902 @@
+import { createHash } from "node:crypto";
+import { EventEmitter } from "node:events";
+import { RpcTarget, newWebSocketRpcSession } from "capnweb";
+import { RpcTarget as RpcTarget$1, WorkerEntrypoint } from "cloudflare:workers";
+//#region ../dofs/src/errors.ts
+function createWorkspaceError(code, message, path) {
+	const error = new Error(path === void 0 ? message : `${message}: ${path}`);
+	error.name = "WorkspaceFsError";
+	error.code = code;
+	error.path = path;
+	return error;
+}
+function invalidPath(path, reason) {
+	return createWorkspaceError("EINVAL", `Invalid path (${reason})`, path);
+}
+//#endregion
+//#region ../dofs/src/path.ts
+function canonicalizePath(path) {
+	if (path.length === 0) throw invalidPath(path, "empty");
+	if (!path.startsWith("/")) throw invalidPath(path, "must be absolute");
+	if (path.includes("\0")) throw invalidPath(path, "contains NUL byte");
+	const parts = [];
+	for (const part of path.split("/")) {
+		if (part === "" || part === ".") continue;
+		if (part === "..") {
+			if (parts.length === 0) throw invalidPath(path, "escapes root");
+			parts.pop();
+			continue;
+		}
+		parts.push(part);
+	}
+	const canonical = parts.length === 0 ? "/" : `/${parts.join("/")}`;
+	const name = parts.length === 0 ? "" : parts[parts.length - 1];
+	const parentParts = parts.slice(0, -1);
+	return {
+		path: canonical,
+		parts,
+		name,
+		parentPath: parts.length === 0 ? void 0 : parentParts.length === 0 ? "/" : `/${parentParts.join("/")}`
+	};
+}
+//#endregion
+//#region ../dofs/src/schema/core.ts
+const CORE_STATEMENTS = [
+	`CREATE TABLE IF NOT EXISTS vfs_meta (
+    k TEXT PRIMARY KEY,
+    v INTEGER NOT NULL
+  )`,
+	`CREATE TABLE IF NOT EXISTS vfs_nodes (
+    inode         INTEGER PRIMARY KEY AUTOINCREMENT,
+    type          TEXT    NOT NULL CHECK(type IN ('file','dir','symlink')),
+    mode          INTEGER NOT NULL DEFAULT 493,
+    mtime         INTEGER NOT NULL,
+    rev           INTEGER NOT NULL DEFAULT 0,
+    mount_root    TEXT,
+    stub_size     INTEGER,
+    manifest_hash BLOB,
+    link_target   TEXT
+  )`,
+	`CREATE TABLE IF NOT EXISTS vfs_dirents (
+    parent_inode INTEGER NOT NULL,
+    name         TEXT    NOT NULL,
+    child_inode  INTEGER NOT NULL,
+    PRIMARY KEY (parent_inode, name)
+  )`,
+	`CREATE INDEX IF NOT EXISTS vfs_dirents_by_child ON vfs_dirents(child_inode)`,
+	`CREATE INDEX IF NOT EXISTS vfs_nodes_by_rev ON vfs_nodes(rev)`,
+	`CREATE INDEX IF NOT EXISTS vfs_nodes_by_manifest_hash
+    ON vfs_nodes(manifest_hash) WHERE manifest_hash IS NOT NULL`,
+	`CREATE TABLE IF NOT EXISTS vfs_blobs (
+    hash      BLOB    PRIMARY KEY,
+    size      INTEGER NOT NULL,
+    last_seen INTEGER NOT NULL
+  )`,
+	`CREATE TABLE IF NOT EXISTS vfs_blob_bytes (
+    hash  BLOB PRIMARY KEY REFERENCES vfs_blobs(hash) ON DELETE CASCADE,
+    bytes BLOB NOT NULL
+  )`,
+	`CREATE TABLE IF NOT EXISTS vfs_chunks (
+    inode INTEGER NOT NULL,
+    idx   INTEGER NOT NULL,
+    hash  BLOB    NOT NULL,
+    size  INTEGER NOT NULL,
+    PRIMARY KEY (inode, idx)
+  )`,
+	`CREATE INDEX IF NOT EXISTS vfs_chunks_by_hash ON vfs_chunks(hash)`
+];
+//#endregion
+//#region ../dofs/src/schema/migrations.ts
+function v1_to_v2_add_mounts_mode(db) {
+	db.run(`ALTER TABLE _vfs_mounts
+       ADD COLUMN mode TEXT NOT NULL DEFAULT 'read-only'
+       CHECK(mode IN ('read-only', 'read-write'))`);
+}
+const MIGRATIONS = [{
+	from: 1,
+	to: 2,
+	migrator: v1_to_v2_add_mounts_mode
+}];
+function runMigrations(db, current, target) {
+	let version = current;
+	while (version < target) {
+		const next = MIGRATIONS.find((m) => m.from === version);
+		if (next === void 0) throw new Error(`dofs schema: no migration registered for v${version} -> v${target}`);
+		next.migrator(db);
+		version = next.to;
+	}
+	return version;
+}
+//#endregion
+//#region ../dofs/src/schema/sync.ts
+const SYNC_STATEMENTS = [
+	`CREATE TABLE IF NOT EXISTS vfs_manifests (
+    hash      BLOB    PRIMARY KEY,
+    size      INTEGER NOT NULL,
+    encoded   BLOB    NOT NULL,
+    last_seen INTEGER NOT NULL DEFAULT 0
+  )`,
+	`CREATE TABLE IF NOT EXISTS vfs_changes (
+    id   INTEGER PRIMARY KEY AUTOINCREMENT,
+    rev  INTEGER NOT NULL,
+    path TEXT    NOT NULL,
+    op   TEXT    NOT NULL CHECK(op IN ('delete'))
+  )`,
+	`CREATE INDEX IF NOT EXISTS vfs_changes_by_rev ON vfs_changes(rev)`,
+	`CREATE INDEX IF NOT EXISTS vfs_changes_by_path ON vfs_changes(path, id DESC)`,
+	`CREATE TABLE IF NOT EXISTS _vfs_watermark (
+    k TEXT PRIMARY KEY,
+    v INTEGER NOT NULL
+  )`,
+	`CREATE TABLE IF NOT EXISTS _vfs_mounts (
+    root    TEXT PRIMARY KEY,
+    kind    TEXT NOT NULL,
+    indexed INTEGER NOT NULL DEFAULT 0,
+    mode    TEXT NOT NULL DEFAULT 'read-only'
+            CHECK(mode IN ('read-only', 'read-write'))
+  )`
+];
+//#endregion
+//#region ../dofs/src/schema/index.ts
+function initializeSchema(db, now) {
+	db.transactionSync(() => {
+		for (const statement of CORE_STATEMENTS) db.run(statement);
+		for (const statement of SYNC_STATEMENTS) db.run(statement);
+		const onDiskVersion = db.one("SELECT v FROM vfs_meta WHERE k = ?", "schema_version")?.v ?? 0;
+		if (onDiskVersion > 2) throw createWorkspaceError("EIO", `Unsupported workspace filesystem schema version ${onDiskVersion}`);
+		if (onDiskVersion > 0 && onDiskVersion < 2) runMigrations(db, onDiskVersion, 2);
+		db.run("INSERT OR IGNORE INTO vfs_meta (k, v) VALUES (?, ?)", "schema_version", 2);
+		db.run("UPDATE vfs_meta SET v = ? WHERE k = ?", 2, "schema_version");
+		db.run("INSERT OR IGNORE INTO vfs_meta (k, v) VALUES (?, ?)", "rev", 1);
+		db.run("INSERT OR IGNORE INTO _vfs_watermark (k, v) VALUES (?, ?)", "pushRev", 0);
+		db.run("INSERT OR IGNORE INTO _vfs_watermark (k, v) VALUES (?, ?)", "fetchRev", 0);
+		db.run(`INSERT OR IGNORE INTO vfs_nodes
+        (inode, type, mode, mtime, rev)
+        VALUES (?, 'dir', ?, ?, 0)`, 1, 493, now());
+	});
+}
+//#endregion
+//#region ../dofs/src/fs/resolve.ts
+const MAX_SYMLINK_FOLLOWS = 40;
+function resolveInode(db, path, options = {}) {
+	const followFinal = options.followSymlinks !== false;
+	return resolveParts(db, canonicalizePath(path).parts, followFinal, 0);
+}
+function resolveParts(db, parts, followFinal, follows) {
+	const root = readNode(db, 1);
+	if (root === null) return null;
+	let current = root;
+	for (let i = 0; i < parts.length; i++) {
+		const isFinal = i === parts.length - 1;
+		if (current.type !== "dir") return null;
+		const child = db.one("SELECT child_inode FROM vfs_dirents WHERE parent_inode = ? AND name = ?", current.inode, parts[i]);
+		if (child === void 0) return null;
+		const next = readNode(db, child.child_inode);
+		if (next === null) return null;
+		if (next.type === "symlink" && (!isFinal || followFinal)) {
+			follows += 1;
+			if (follows > MAX_SYMLINK_FOLLOWS) throw createWorkspaceError("ELOOP", "too many symlinks resolving path");
+			const resolved = resolveParts(db, canonicalizePath(next.link_target ?? "").parts, true, follows);
+			if (resolved === null) return null;
+			current = {
+				inode: resolved.inode,
+				type: resolved.type,
+				mode: resolved.mode,
+				mtime: resolved.mtime,
+				link_target: resolved.linkTarget ?? null
+			};
+			continue;
+		}
+		current = next;
+	}
+	return {
+		inode: current.inode,
+		type: current.type,
+		mode: current.mode,
+		mtime: current.mtime,
+		linkTarget: current.link_target ?? void 0
+	};
+}
+function readNode(db, inode) {
+	return db.one("SELECT inode, type, mode, mtime, link_target FROM vfs_nodes WHERE inode = ?", inode) ?? null;
+}
+//#endregion
+//#region ../dofs/src/fs/find.ts
+function find(db, directory, pattern) {
+	const { path: canonical } = canonicalizePath(directory);
+	const node = resolveInode(db, canonical);
+	if (node === null) throw createWorkspaceError("ENOENT", `no such path: ${canonical}`, canonical);
+	if (node.type !== "dir") throw createWorkspaceError("ENOTDIR", `not a directory: ${canonical}`, canonical);
+	const out = [];
+	const regex = pattern !== void 0 ? compileGlob(pattern) : void 0;
+	walk(db, node.inode, canonical, out);
+	if (regex === void 0) return out;
+	const prefix = canonical === "/" ? "/" : `${canonical}/`;
+	return out.filter((entry) => {
+		if (!entry.path.startsWith(prefix)) return false;
+		const rel = entry.path.slice(prefix.length);
+		return regex.test(rel);
+	});
+}
+function walk(db, parentInode, parentPath, out) {
+	const children = db.all(`SELECT d.name AS name, d.child_inode AS child_inode, n.type AS type
+       FROM vfs_dirents d
+       JOIN vfs_nodes n ON n.inode = d.child_inode
+      WHERE d.parent_inode = ?
+      ORDER BY d.name`, parentInode);
+	for (const child of children) {
+		const childPath = parentPath === "/" ? `/${child.name}` : `${parentPath}/${child.name}`;
+		out.push({
+			path: childPath,
+			type: child.type
+		});
+		if (child.type === "dir") walk(db, child.child_inode, childPath, out);
+	}
+}
+function compileGlob(pattern) {
+	let re = "";
+	let i = 0;
+	while (i < pattern.length) {
+		const ch = pattern[i];
+		if (ch === "*") {
+			if (pattern[i + 1] === "*") if (pattern[i + 2] === "/") {
+				re += "(?:.*/)?";
+				i += 3;
+			} else {
+				re += ".*";
+				i += 2;
+			}
+			else {
+				re += "[^/]*";
+				i += 1;
+			}
+			continue;
+		}
+		if (REGEX_METACHARS.has(ch)) re += `\\${ch}`;
+		else re += ch;
+		i += 1;
+	}
+	return new RegExp(`^${re}$`);
+}
+const REGEX_METACHARS = new Set([
+	".",
+	"+",
+	"?",
+	"^",
+	"$",
+	"(",
+	")",
+	"[",
+	"]",
+	"{",
+	"}",
+	"|",
+	"\\"
+]);
+//#endregion
+//#region ../dofs/src/fs/readFile.ts
+async function readFile(db, path, optionsOrEncoding, now = Date.now) {
+	const wantString = optionsOrEncoding === "utf8" || typeof optionsOrEncoding === "object" && optionsOrEncoding?.encoding === "utf8";
+	const node = resolveInode(db, path);
+	if (node === null) throw createWorkspaceError("ENOENT", `no such file: ${path}`, path);
+	if (node.type !== "file") throw createWorkspaceError("EISDIR", `path is a directory: ${path}`, path);
+	const chunks = db.all("SELECT hash, size FROM vfs_chunks WHERE inode = ? ORDER BY idx", node.inode);
+	if (wantString) {
+		const totalSize = chunks.reduce((acc, c) => acc + c.size, 0);
+		const out = new Uint8Array(totalSize);
+		let offset = 0;
+		const touched = now();
+		for (const chunk of chunks) {
+			const row = db.one("SELECT bytes FROM vfs_blob_bytes WHERE hash = ?", chunk.hash);
+			if (row === void 0) throw createWorkspaceError("EIO", `missing blob bytes for ${path}`, path);
+			out.set(row.bytes, offset);
+			offset += row.bytes.byteLength;
+		}
+		if (chunks.length > 0) touchBlobs(db, chunks, touched);
+		return new TextDecoder().decode(out);
+	}
+	let i = 0;
+	return new ReadableStream({ pull(controller) {
+		if (i >= chunks.length) {
+			controller.close();
+			return;
+		}
+		const chunk = chunks[i++];
+		const row = db.one("SELECT bytes FROM vfs_blob_bytes WHERE hash = ?", chunk.hash);
+		if (row === void 0) {
+			controller.error(createWorkspaceError("EIO", `missing blob bytes for ${path}`, path));
+			return;
+		}
+		db.run("UPDATE vfs_blobs SET last_seen = ? WHERE hash = ?", now(), chunk.hash);
+		controller.enqueue(row.bytes);
+	} });
+}
+function touchBlobs(db, chunks, at) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const chunk of chunks) {
+		const key = bufferKey(chunk.hash);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		db.run("UPDATE vfs_blobs SET last_seen = ? WHERE hash = ?", at, chunk.hash);
+	}
+}
+function bufferKey(bytes) {
+	let key = "";
+	for (const byte of bytes) key += byte.toString(16).padStart(2, "0");
+	return key;
+}
+//#endregion
+//#region ../dofs/src/fs/grep.ts
+async function grep(db, pattern, path, options = {}) {
+	const { path: canonical } = canonicalizePath(path);
+	const node = resolveInode(db, canonical);
+	if (node === null) throw createWorkspaceError("ENOENT", `no such path: ${canonical}`, canonical);
+	const filePaths = node.type === "file" ? [canonical] : find(db, canonical).filter((entry) => entry.type === "file").map((entry) => entry.path);
+	const matches = [];
+	for (const filePath of filePaths) await scanFile(db, filePath, pattern, options, matches);
+	return matches;
+}
+async function scanFile(db, path, pattern, options, out) {
+	const reader = (await readFile(db, path)).getReader();
+	const decoder = new TextDecoder("utf-8", { fatal: false });
+	const needle = options.ignoreCase ? pattern.toUpperCase() : pattern;
+	let tail = "";
+	let lineNo = 1;
+	while (true) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		if (value === void 0) continue;
+		const text = tail + decoder.decode(value, { stream: true });
+		const newlineIdx = text.lastIndexOf("\n");
+		const ready = newlineIdx === -1 ? "" : text.slice(0, newlineIdx);
+		tail = newlineIdx === -1 ? text : text.slice(newlineIdx + 1);
+		if (ready.length > 0) lineNo = scanLines(ready, lineNo, needle, options.ignoreCase === true, path, out);
+	}
+	tail += decoder.decode();
+	if (tail.length > 0) scanLines(tail, lineNo, needle, options.ignoreCase === true, path, out);
+}
+function scanLines(block, startLine, needle, ignoreCase, path, out) {
+	let line = startLine;
+	let cursor = 0;
+	while (cursor <= block.length) {
+		const next = block.indexOf("\n", cursor);
+		const end = next === -1 ? block.length : next;
+		const text = block.slice(cursor, end);
+		if ((ignoreCase ? text.toUpperCase() : text).includes(needle)) out.push({
+			path,
+			line,
+			text
+		});
+		line += 1;
+		if (next === -1) break;
+		cursor = next + 1;
+	}
+	return line;
+}
+//#endregion
+//#region ../dofs/src/fs/ls.ts
+const LS_QUERY = `
+  WITH RECURSIVE walk(inode, path, type) AS (
+    SELECT inode, '', type FROM vfs_nodes WHERE inode = ?
+    UNION ALL
+    SELECT n.inode, w.path || '/' || d.name, n.type
+      FROM walk w
+      JOIN vfs_dirents d ON d.parent_inode = w.inode
+      JOIN vfs_nodes n ON n.inode = d.child_inode
+  )
+  SELECT path FROM walk
+   WHERE type = 'file'
+     AND (? = '/' OR path = ? OR path LIKE ? || '/%')
+   ORDER BY path
+`;
+function ls(db, prefix) {
+	const { path: canonical } = canonicalizePath(prefix);
+	return db.all(LS_QUERY, 1, canonical, canonical, canonical).map((row) => row.path);
+}
+//#endregion
+//#region ../dofs/src/rev.ts
+function incrementRev(db) {
+	db.run("UPDATE vfs_meta SET v = v + 1 WHERE k = 'rev'");
+	const next = db.scalar("SELECT v FROM vfs_meta WHERE k = ?", "rev");
+	if (next === void 0) throw new Error("vfs_meta.rev row missing; was initializeSchema run?");
+	return next;
+}
+//#endregion
+//#region ../dofs/src/fs/mount-guard.ts
+const cache = /* @__PURE__ */ new WeakMap();
+function invalidateReadOnlyMountCache(db) {
+	cache.delete(db);
+}
+function loadReadOnlyRoots(db) {
+	const roots = db.all("SELECT root FROM _vfs_mounts WHERE mode = 'read-only'").map((r) => r.root);
+	cache.set(db, roots);
+	return roots;
+}
+function getReadOnlyMountRoots(db) {
+	const cached = cache.get(db);
+	if (cached !== void 0) return cached;
+	return loadReadOnlyRoots(db);
+}
+function overlapsRoot(path, root) {
+	return path === root || path.startsWith(`${root}/`) || root.startsWith(`${path}/`);
+}
+function assertNotReadOnly(db, path) {
+	const roots = getReadOnlyMountRoots(db);
+	if (roots.length === 0) return;
+	for (const root of roots) if (overlapsRoot(path, root)) throw createWorkspaceError("EROFS", `read-only mount at ${root}: cannot modify`, path);
+}
+function readOnlyRootFor(db, path) {
+	const roots = getReadOnlyMountRoots(db);
+	for (const root of roots) if (overlapsRoot(path, root)) return root;
+}
+//#endregion
+//#region ../dofs/src/fs/mkdir.ts
+function lookupChild(db, parentInode, name) {
+	const row = db.one("SELECT child_inode FROM vfs_dirents WHERE parent_inode = ? AND name = ?", parentInode, name);
+	if (row === void 0) return;
+	const node = db.one("SELECT inode, type FROM vfs_nodes WHERE inode = ?", row.child_inode);
+	if (node === void 0) return;
+	return node;
+}
+function createDir(db, parentInode, name, mode, mtime, rev) {
+	db.run("INSERT INTO vfs_nodes (type, mode, mtime, rev) VALUES ('dir', ?, ?, ?)", mode, mtime, rev);
+	const inode = db.scalar("SELECT last_insert_rowid()");
+	if (inode === void 0) throw createWorkspaceError("EIO", "failed to allocate inode");
+	db.run("INSERT INTO vfs_dirents (parent_inode, name, child_inode) VALUES (?, ?, ?)", parentInode, name, inode);
+	return inode;
+}
+function mkdir(db, path, options, now) {
+	const { parts, path: canonical } = canonicalizePath(path);
+	const recursive = options.recursive === true;
+	const mode = (options.mode ?? 493) & 4095;
+	if (parts.length === 0) throw createWorkspaceError("EEXIST", `path exists: ${canonical}`, canonical);
+	assertNotReadOnly(db, canonical);
+	db.transactionSync(() => {
+		const rev = incrementRev(db);
+		const mtime = now();
+		let parentInode = 1;
+		for (let i = 0; i < parts.length - 1; i++) {
+			const name = parts[i];
+			const existing = lookupChild(db, parentInode, name);
+			if (existing === void 0) {
+				if (!recursive) throw createWorkspaceError("ENOENT", `parent directory missing: ${canonical}`, canonical);
+				parentInode = createDir(db, parentInode, name, 493, mtime, rev);
+				continue;
+			}
+			if (existing.type !== "dir") throw createWorkspaceError("ENOTDIR", `parent path segment is not a directory: ${canonical}`, canonical);
+			parentInode = existing.inode;
+		}
+		const leafName = parts[parts.length - 1];
+		const existing = lookupChild(db, parentInode, leafName);
+		if (existing !== void 0) {
+			if (recursive && existing.type === "dir") return;
+			throw createWorkspaceError("EEXIST", `path exists: ${canonical}`, canonical);
+		}
+		createDir(db, parentInode, leafName, mode, mtime, rev);
+	});
+}
+//#endregion
+//#region ../dofs/src/fs/readdir.ts
+function readdir(db, path) {
+	const { path: canonical } = canonicalizePath(path);
+	const node = resolveInode(db, canonical);
+	if (node === null) throw createWorkspaceError("ENOENT", `no such path: ${canonical}`, canonical);
+	if (node.type !== "dir") throw createWorkspaceError("ENOTDIR", `not a directory: ${canonical}`, canonical);
+	return db.all(`SELECT d.name AS name, n.type AS type
+       FROM vfs_dirents d
+       JOIN vfs_nodes n ON n.inode = d.child_inode
+      WHERE d.parent_inode = ?
+      ORDER BY d.name`, node.inode).map((row) => ({
+		name: row.name,
+		parentPath: canonical,
+		isFile: row.type === "file",
+		isDirectory: row.type === "dir"
+	}));
+}
+//#endregion
+//#region ../dofs/src/sync/changes.ts
+function recordDelete(db, rev, path) {
+	db.run("INSERT INTO vfs_changes (rev, path, op) VALUES (?, ?, 'delete')", rev, path);
+}
+function materialiseChange(db, path) {
+	const canonical = canonicalizePath(path).path;
+	const live = resolveInode(db, canonical, { followSymlinks: false });
+	if (live !== null) {
+		const rev = db.one("SELECT rev FROM vfs_nodes WHERE inode = ?", live.inode)?.rev ?? 0;
+		if (live.type === "dir") return {
+			kind: "dir",
+			rev,
+			path: canonical,
+			mode: live.mode,
+			mtime: live.mtime
+		};
+		if (live.type === "symlink") return {
+			kind: "symlink",
+			rev,
+			path: canonical,
+			target: live.linkTarget ?? "",
+			mode: live.mode,
+			mtime: live.mtime
+		};
+		const chunks = db.all("SELECT hash, size FROM vfs_chunks WHERE inode = ? ORDER BY idx", live.inode);
+		let size = 0;
+		for (const c of chunks) size += c.size;
+		return {
+			kind: "file",
+			rev,
+			path: canonical,
+			mode: live.mode,
+			mtime: live.mtime,
+			size,
+			chunks
+		};
+	}
+	const tomb = db.one("SELECT rev, op FROM vfs_changes WHERE path = ? ORDER BY id DESC LIMIT 1", canonical);
+	if (tomb?.op === "delete") return {
+		kind: "delete",
+		rev: tomb.rev,
+		path: canonical
+	};
+	return null;
+}
+//#endregion
+//#region ../dofs/src/fs/rm.ts
+function* walkPostOrder(db, rootInode, rootPath) {
+	const stack = [{
+		inode: rootInode,
+		path: rootPath,
+		type: "dir",
+		expanded: false
+	}];
+	while (stack.length > 0) {
+		const top = stack[stack.length - 1];
+		if (top.type === "file" || top.expanded) {
+			stack.pop();
+			yield {
+				path: top.path,
+				inode: top.inode,
+				type: top.type
+			};
+			continue;
+		}
+		top.expanded = true;
+		const children = db.all(`SELECT d.name AS name, d.child_inode AS child_inode, n.type AS type
+         FROM vfs_dirents d
+         JOIN vfs_nodes n ON n.inode = d.child_inode
+        WHERE d.parent_inode = ?
+        ORDER BY d.name`, top.inode);
+		for (const child of children) {
+			const childPath = top.path === "/" ? `/${child.name}` : `${top.path}/${child.name}`;
+			stack.push({
+				inode: child.child_inode,
+				path: childPath,
+				type: child.type,
+				expanded: false
+			});
+		}
+	}
+}
+function rm(db, path, options) {
+	const { parts, path: canonical } = canonicalizePath(path);
+	if (parts.length === 0) throw createWorkspaceError("EPERM", `cannot remove the root directory`, canonical);
+	assertNotReadOnly(db, canonical);
+	const force = options.force === true;
+	const recursive = options.recursive === true;
+	db.transactionSync(() => {
+		const node = resolveInode(db, canonical);
+		if (node === null) {
+			if (force) return;
+			throw createWorkspaceError("ENOENT", `no such path: ${canonical}`, canonical);
+		}
+		if (node.type === "dir" && !recursive) {
+			if ((db.scalar("SELECT COUNT(*) FROM vfs_dirents WHERE parent_inode = ?", node.inode) ?? 0) > 0) throw createWorkspaceError("ENOTEMPTY", `directory not empty: ${canonical}`, canonical);
+		}
+		const rev = incrementRev(db);
+		if (node.type === "file" || !recursive) {
+			removeInode(db, node.inode, node.type);
+			recordDelete(db, rev, canonical);
+			return;
+		}
+		for (const entry of walkPostOrder(db, node.inode, canonical)) {
+			removeInode(db, entry.inode, entry.type);
+			recordDelete(db, rev, entry.path);
+		}
+	});
+}
+function removeInode(db, inode, type) {
+	db.run("DELETE FROM vfs_dirents WHERE child_inode = ?", inode);
+	if (type === "file") db.run("DELETE FROM vfs_chunks WHERE inode = ?", inode);
+	db.run("DELETE FROM vfs_nodes WHERE inode = ?", inode);
+}
+//#endregion
+//#region ../dofs/src/fs/stat.ts
+function stat(db, path) {
+	const { name } = canonicalizePath(path);
+	const node = resolveInode(db, path);
+	if (node === null) throw createWorkspaceError("ENOENT", `no such path: ${path}`, path);
+	const isDirectory = node.type === "dir";
+	const isFile = node.type === "file";
+	const size = isFile ? db.scalar("SELECT COALESCE(SUM(size), 0) FROM vfs_chunks WHERE inode = ?", node.inode) ?? 0 : 0;
+	return {
+		name,
+		mode: node.mode,
+		mtime: node.mtime,
+		size,
+		isFile,
+		isDirectory
+	};
+}
+//#endregion
+//#region ../dofs/src/sync/blobs.ts
+function stageBlob(db, hash, bytes, now) {
+	db.run("INSERT INTO vfs_blobs (hash, size, last_seen) VALUES (?, ?, ?) ON CONFLICT(hash) DO UPDATE SET last_seen = excluded.last_seen", hash, bytes.byteLength, now);
+	db.run("INSERT INTO vfs_blob_bytes (hash, bytes) VALUES (?, ?) ON CONFLICT(hash) DO NOTHING", hash, bytes);
+}
+function toHex(bytes) {
+	let out = "";
+	for (let i = 0; i < bytes.byteLength; i++) out += bytes[i].toString(16).padStart(2, "0");
+	return out;
+}
+function sha256$1(bytes) {
+	return new Uint8Array(createHash("sha256").update(bytes).digest());
+}
+function computeManifestHash(chunks) {
+	const encoded = {
+		version: 1,
+		chunks: chunks.map((c) => ({
+			hash: toHex(c.hash),
+			size: c.size
+		}))
+	};
+	return sha256$1(new TextEncoder().encode(JSON.stringify(encoded)));
+}
+function buildManifest(db, chunks, now) {
+	const hash = computeManifestHash(chunks);
+	const size = chunks.reduce((acc, c) => acc + c.size, 0);
+	const encoded = {
+		version: 1,
+		chunks: chunks.map((c) => ({
+			hash: toHex(c.hash),
+			size: c.size
+		}))
+	};
+	const bytes = new TextEncoder().encode(JSON.stringify(encoded));
+	db.run("INSERT INTO vfs_manifests (hash, size, encoded, last_seen) VALUES (?, ?, ?, ?) ON CONFLICT(hash) DO UPDATE SET last_seen = excluded.last_seen", hash, size, bytes, now);
+	return hash;
+}
+//#endregion
+//#region ../dofs/src/fs/writeFile.ts
+const CHUNK_SIZE = 512 * 1024;
+function resolveParent(db, parts, canonical) {
+	let parentInode = 1;
+	for (let i = 0; i < parts.length - 1; i++) {
+		const name = parts[i];
+		const child = db.one("SELECT child_inode FROM vfs_dirents WHERE parent_inode = ? AND name = ?", parentInode, name);
+		if (child === void 0) throw createWorkspaceError("ENOENT", `parent directory missing: ${canonical}`, canonical);
+		const next = db.one("SELECT inode, type FROM vfs_nodes WHERE inode = ?", child.child_inode);
+		if (next === void 0) throw createWorkspaceError("ENOENT", `dangling dirent: ${canonical}`, canonical);
+		if (next.type !== "dir") throw createWorkspaceError("ENOTDIR", `parent path segment is not a directory: ${canonical}`, canonical);
+		parentInode = next.inode;
+	}
+	return parentInode;
+}
+async function materialize(content) {
+	if (typeof content === "string") return new TextEncoder().encode(content);
+	return content;
+}
+function sha256(bytes) {
+	const hash = createHash("sha256");
+	hash.update(bytes);
+	return new Uint8Array(hash.digest());
+}
+function chunksOf(bytes) {
+	const chunks = [];
+	for (let offset = 0; offset < bytes.byteLength; offset += CHUNK_SIZE) {
+		const end = Math.min(offset + CHUNK_SIZE, bytes.byteLength);
+		const slice = bytes.subarray(offset, end);
+		const hash = sha256(slice);
+		chunks.push({
+			hash,
+			bytes: slice,
+			size: slice.byteLength
+		});
+	}
+	return chunks;
+}
+async function writeFile(db, path, content, options, now) {
+	if (content instanceof ReadableStream) {
+		await writeFileStreaming(db, path, content, options, now);
+		return;
+	}
+	writeFileSync(db, path, await materialize(content), options, now);
+}
+async function writeFileStreaming(db, path, source, options, now) {
+	const { parts, path: canonical } = canonicalizePath(path);
+	if (parts.length === 0) throw createWorkspaceError("EISDIR", "cannot write to the root directory", canonical);
+	assertNotReadOnly(db, canonical);
+	const mode = (options.mode ?? 420) & 4095;
+	const mtime = now();
+	const chunkRefs = [];
+	let carry;
+	const flush = (chunk) => {
+		const hash = sha256(chunk);
+		stageBlob(db, hash, chunk, mtime);
+		chunkRefs.push({
+			hash,
+			size: chunk.byteLength
+		});
+	};
+	const reader = source.getReader();
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			if (value === void 0 || value.byteLength === 0) continue;
+			let input = value;
+			if (carry !== void 0) {
+				const merged = new Uint8Array(carry.byteLength + input.byteLength);
+				merged.set(carry, 0);
+				merged.set(input, carry.byteLength);
+				input = merged;
+				carry = void 0;
+			}
+			let offset = 0;
+			while (input.byteLength - offset >= CHUNK_SIZE) {
+				flush(input.slice(offset, offset + CHUNK_SIZE));
+				offset += CHUNK_SIZE;
+			}
+			if (offset < input.byteLength) carry = input.slice(offset);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	if (carry !== void 0 && carry.byteLength > 0) flush(carry);
+	db.transactionSync(() => {
+		const parentInode = resolveParent(db, parts, canonical);
+		const leafName = parts[parts.length - 1];
+		const existing = db.one("SELECT child_inode FROM vfs_dirents WHERE parent_inode = ? AND name = ?", parentInode, leafName);
+		let inode;
+		if (existing !== void 0) {
+			if (db.one("SELECT type FROM vfs_nodes WHERE inode = ?", existing.child_inode)?.type === "dir") throw createWorkspaceError("EISDIR", `path is a directory: ${canonical}`, canonical);
+			inode = existing.child_inode;
+			db.run("DELETE FROM vfs_chunks WHERE inode = ?", inode);
+		} else {
+			db.run("INSERT INTO vfs_nodes (type, mode, mtime, rev) VALUES ('file', ?, ?, 0)", mode, mtime);
+			const allocated = db.scalar("SELECT last_insert_rowid()");
+			if (allocated === void 0) throw createWorkspaceError("EIO", "failed to allocate inode");
+			inode = allocated;
+			db.run("INSERT INTO vfs_dirents (parent_inode, name, child_inode) VALUES (?, ?, ?)", parentInode, leafName, inode);
+		}
+		for (let idx = 0; idx < chunkRefs.length; idx++) {
+			const ref = chunkRefs[idx];
+			db.run("INSERT INTO vfs_chunks (inode, idx, hash, size) VALUES (?, ?, ?, ?)", inode, idx, ref.hash, ref.size);
+		}
+		const manifestHash = buildManifest(db, chunkRefs, mtime);
+		const rev = incrementRev(db);
+		db.run("UPDATE vfs_nodes SET mode = ?, mtime = ?, rev = ?, manifest_hash = ? WHERE inode = ?", mode, mtime, rev, manifestHash, inode);
+	});
+}
+function writeFileSync(db, path, bytes, options, now) {
+	const { parts, path: canonical } = canonicalizePath(path);
+	if (parts.length === 0) throw createWorkspaceError("EISDIR", "cannot write to the root directory", canonical);
+	assertNotReadOnly(db, canonical);
+	const mode = (options.mode ?? 420) & 4095;
+	const chunks = chunksOf(bytes);
+	const mtime = now();
+	db.transactionSync(() => {
+		const parentInode = resolveParent(db, parts, canonical);
+		const leafName = parts[parts.length - 1];
+		const existing = db.one("SELECT child_inode FROM vfs_dirents WHERE parent_inode = ? AND name = ?", parentInode, leafName);
+		let inode;
+		if (existing !== void 0) {
+			if (db.one("SELECT type FROM vfs_nodes WHERE inode = ?", existing.child_inode)?.type === "dir") throw createWorkspaceError("EISDIR", `path is a directory: ${canonical}`, canonical);
+			inode = existing.child_inode;
+			db.run("DELETE FROM vfs_chunks WHERE inode = ?", inode);
+		} else {
+			db.run("INSERT INTO vfs_nodes (type, mode, mtime, rev) VALUES ('file', ?, ?, 0)", mode, mtime);
+			const allocated = db.scalar("SELECT last_insert_rowid()");
+			if (allocated === void 0) throw createWorkspaceError("EIO", "failed to allocate inode");
+			inode = allocated;
+			db.run("INSERT INTO vfs_dirents (parent_inode, name, child_inode) VALUES (?, ?, ?)", parentInode, leafName, inode);
+		}
+		for (let idx = 0; idx < chunks.length; idx++) {
+			const chunk = chunks[idx];
+			db.run("INSERT INTO vfs_blobs (hash, size, last_seen) VALUES (?, ?, ?) ON CONFLICT(hash) DO UPDATE SET last_seen = excluded.last_seen", chunk.hash, chunk.size, mtime);
+			db.run("INSERT INTO vfs_blob_bytes (hash, bytes) VALUES (?, ?) ON CONFLICT(hash) DO NOTHING", chunk.hash, chunk.bytes);
+			db.run("INSERT INTO vfs_chunks (inode, idx, hash, size) VALUES (?, ?, ?, ?)", inode, idx, chunk.hash, chunk.size);
+		}
+		const manifestHash = buildManifest(db, chunks, mtime);
+		const rev = incrementRev(db);
+		db.run("UPDATE vfs_nodes SET mode = ?, mtime = ?, rev = ?, manifest_hash = ? WHERE inode = ?", mode, mtime, rev, manifestHash, inode);
+	});
+}
+//#endregion
+//#region ../dofs/src/fs/filesystem.ts
+var WorkspaceFilesystem = class {
+	db;
+	now;
+	constructor(db, options = {}) {
+		this.db = db;
+		this.now = options.now ?? Date.now;
+	}
+	readFile(path, optionsOrEncoding) {
+		return readFile(this.db, path, optionsOrEncoding, this.now);
+	}
+	async stat(path) {
+		return stat(this.db, path);
+	}
+	async readdir(path) {
+		return readdir(this.db, path);
+	}
+	async find(directory, pattern) {
+		return find(this.db, directory, pattern);
+	}
+	async ls(prefix) {
+		return ls(this.db, prefix);
+	}
+	grep(pattern, path, options = {}) {
+		return grep(this.db, pattern, path, options);
+	}
+	writeFile(path, content, options = {}) {
+		return writeFile(this.db, path, content, options, this.now);
+	}
+	async mkdir(path, options = {}) {
+		mkdir(this.db, path, options, this.now);
+	}
+	async rm(path, options = {}) {
+		rm(this.db, path, options);
+	}
+};
+//#endregion
+//#region ../dofs/src/fs/readlink.ts
+function readlink(db, path) {
+	const node = resolveInode(db, path, { followSymlinks: false });
+	if (node === null) throw createWorkspaceError("ENOENT", `no such path: ${path}`, path);
+	if (node.type !== "symlink" || node.linkTarget === void 0) throw createWorkspaceError("EINVAL", `not a symlink: ${path}`, path);
+	return node.linkTarget;
+}
+//#endregion
+//#region ../dofs/src/fs/symlink.ts
+function symlink(db, target, path, now) {
+	const { parts, path: canonical } = canonicalizePath(path);
+	if (parts.length === 0) throw createWorkspaceError("EEXIST", "cannot symlink onto root", canonical);
+	db.transactionSync(() => {
+		let parentInode = 1;
+		for (let i = 0; i < parts.length - 1; i++) {
+			const child = db.one("SELECT child_inode FROM vfs_dirents WHERE parent_inode = ? AND name = ?", parentInode, parts[i]);
+			if (child === void 0) throw createWorkspaceError("ENOENT", `parent directory missing: ${canonical}`, canonical);
+			const next = db.one("SELECT inode, type FROM vfs_nodes WHERE inode = ?", child.child_inode);
+			if (next === void 0 || next.type !== "dir") throw createWorkspaceError("ENOTDIR", `parent path segment is not a directory: ${canonical}`, canonical);
+			parentInode = next.inode;
+		}
+		const leafName = parts[parts.length - 1];
+		if (db.one("SELECT child_inode FROM vfs_dirents WHERE parent_inode = ? AND name = ?", parentInode, leafName) !== void 0) throw createWorkspaceError("EEXIST", `path exists: ${canonical}`, canonical);
+		const rev = incrementRev(db);
+		const mtime = now();
+		db.run("INSERT INTO vfs_nodes (type, mode, mtime, rev, link_target) VALUES ('symlink', ?, ?, ?, ?)", 511, mtime, rev, target);
+		const inode = db.scalar("SELECT last_insert_rowid()");
+		if (inode === void 0) throw createWorkspaceError("EIO", "failed to allocate inode");
+		db.run("INSERT INTO vfs_dirents (parent_inode, name, child_inode) VALUES (?, ?, ?)", parentInode, leafName, inode);
+	});
+}
+//#endregion
+//#region ../dofs/src/sync/ignore.ts
+function isIgnored(path, patterns) {
+	if (patterns.length === 0) return false;
+	const segments = path.split("/").filter((s) => s.length > 0);
+	for (const segment of segments) for (const p of patterns) if (segment === p) return true;
+	return false;
+}
+//#endregion
+//#region ../dofs/src/sync/coalesce.ts
+function pathOf(db, inode) {
+	if (inode === 1) return "/";
+	const segments = [];
+	let current = inode;
+	for (let i = 0; i < 1e6; i++) {
+		const row = db.one("SELECT parent_inode, name FROM vfs_dirents WHERE child_inode = ?", current);
+		if (row === void 0) return null;
+		segments.push(row.name);
+		if (row.parent_inode === 1) {
+			segments.reverse();
+			return `/${segments.join("/")}`;
+		}
+		current = row.parent_inode;
+	}
+	return null;
+}
+async function* coalesceChanges(db, sinceRev, options = {}) {
+	const ignore = options.ignore ?? [];
+	const candidates = /* @__PURE__ */ new Map();
+	const touched = db.all("SELECT inode, rev FROM vfs_nodes WHERE rev > ? ORDER BY rev", sinceRev);
+	for (const { inode, rev } of touched) {
+		const path = pathOf(db, inode);
+		if (path === null) continue;
+		if (isIgnored(path, ignore)) continue;
+		const prior = candidates.get(path);
+		if (prior === void 0 || rev > prior.rev) candidates.set(path, {
+			path,
+			rev
+		});
+	}
+	const tombs = db.all("SELECT path, MAX(rev) AS rev FROM vfs_changes WHERE rev > ? AND op = 'delete' GROUP BY path", sinceRev);
+	for (const { path, rev } of tombs) {
+		if (isIgnored(path, ignore)) continue;
+		const prior = candidates.get(path);
+		if (prior === void 0 || rev > prior.rev) candidates.set(path, {
+			path,
+			rev
+		});
+	}
+	const ordered = Array.from(candidates.values()).sort((a, b) => {
+		if (a.rev !== b.rev) return a.rev - b.rev;
+		return a.path < b.path ? -1 : a.path > b.path ? 1 : 0;
+	});
+	for (const { path } of ordered) {
+		const entry = materialiseChange(db, path);
+		if (entry !== null) yield entry;
+	}
+}
+//#endregion
+//#region ../dofs/src/sync/watermarks.ts
+function readWatermark(db, key) {
+	return db.scalar("SELECT v FROM _vfs_watermark WHERE k = ?", key) ?? 0;
+}
+function writeWatermark(db, key, value) {
+	db.run("INSERT INTO _vfs_watermark (k, v) VALUES (?, ?) ON CONFLICT(k) DO UPDATE SET v = excluded.v", key, value);
+}
+function currentRev(db) {
+	return db.scalar("SELECT v FROM vfs_meta WHERE k = 'rev'") ?? 0;
+}
+//#endregion
+//#region ../dofs/src/fs/watch.ts
+function createWatcher(db, path, options, defaultInterval) {
+	const { path: canonical } = canonicalizePath(path);
+	const prefix = canonical === "/" ? "/" : `${canonical}/`;
+	const recursive = options.recursive === true;
+	const interval = options.interval ?? defaultInterval;
+	const emitter = new EventEmitter();
+	let cursor = currentRev(db);
+	let closed = false;
+	const tick = async () => {
+		if (closed) return;
+		try {
+			const seen = /* @__PURE__ */ new Set();
+			for await (const entry of coalesceChanges(db, cursor)) {
+				if (!isInScope(entry.path, canonical, prefix, recursive)) continue;
+				if (seen.has(entry.path)) continue;
+				seen.add(entry.path);
+				const filename = relativeName(entry.path, canonical);
+				const eventType = entry.kind === "delete" ? "rename" : "change";
+				emitter.emit("change", eventType, filename);
+			}
+			cursor = currentRev(db);
+		} catch (error) {
+			emitter.emit("error", error);
+		}
+	};
+	const handle = setInterval(() => void tick(), interval);
+	handle.unref?.();
+	emitter.close = () => {
+		if (closed) return;
+		closed = true;
+		clearInterval(handle);
+		emitter.emit("close");
+	};
+	if (options.signal !== void 0) if (options.signal.aborted) emitter.close();
+	else options.signal.addEventListener("abort", () => emitter.close(), { once: true });
+	return emitter;
+}
+function isInScope(entryPath, watchedPath, prefix, recursive) {
+	if (entryPath === watchedPath) return true;
+	if (!entryPath.startsWith(prefix)) return false;
+	if (recursive) return true;
+	return !entryPath.slice(prefix.length).includes("/");
+}
+function relativeName(entryPath, watchedPath) {
+	if (entryPath === watchedPath) return "";
+	const prefix = watchedPath === "/" ? "/" : `${watchedPath}/`;
+	return entryPath.startsWith(prefix) ? entryPath.slice(prefix.length) : entryPath;
+}
+function createWatchAsyncIterable(watcher) {
+	const pending = [];
+	const waiters = [];
+	let done = false;
+	watcher.on("change", (eventType, filename) => {
+		const event = {
+			eventType,
+			filename
+		};
+		const next = waiters.shift();
+		if (next) next({
+			value: event,
+			done: false
+		});
+		else pending.push(event);
+	});
+	watcher.on("close", () => {
+		done = true;
+		while (waiters.length > 0) {
+			const next = waiters.shift();
+			if (next) next({
+				value: void 0,
+				done: true
+			});
+		}
+	});
+	return {
+		[Symbol.asyncIterator]() {
+			return this;
+		},
+		next() {
+			const buffered = pending.shift();
+			if (buffered) return Promise.resolve({
+				value: buffered,
+				done: false
+			});
+			if (done) return Promise.resolve({
+				value: void 0,
+				done: true
+			});
+			return new Promise((resolve) => waiters.push(resolve));
+		},
+		async return() {
+			watcher.close();
+			return {
+				value: void 0,
+				done: true
+			};
+		}
+	};
+}
+//#endregion
+//#region ../dofs/src/provider.ts
+var SQLiteWorkspaceProvider = class {
+	db;
+	now;
+	readonly = false;
+	supportsSymlinks = true;
+	supportsWatch = true;
+	#fds = /* @__PURE__ */ new Map();
+	#nextFd = 3;
+	watchIntervalMs;
+	constructor(db, options = {}) {
+		this.db = db;
+		this.now = options.now ?? Date.now;
+		this.watchIntervalMs = options.watchIntervalMs ?? 100;
+	}
+	open(path, flags, mode) {
+		return Promise.resolve(this.openSync(path, flags, mode));
+	}
+	openSync(path, flags = "r", _mode) {
+		const { read, write, truncate, append, create, exclusive } = parseFlags(flags);
+		const existing = resolveInode(this.db, path);
+		if (existing === null) {
+			if (!create) throw createWorkspaceError("ENOENT", `no such file: ${path}`, path);
+			writeFileSync(this.db, path, new Uint8Array(), {}, this.now);
+		} else {
+			if (existing.type !== "file") throw createWorkspaceError("EISDIR", `path is a directory: ${path}`, path);
+			if (exclusive) throw createWorkspaceError("EEXIST", `path exists: ${path}`, path);
+			if (truncate) writeFileSync(this.db, path, new Uint8Array(), {}, this.now);
+		}
+		const stat$1 = stat(this.db, path);
+		const fd = this.#nextFd++;
+		this.#fds.set(fd, {
+			path,
+			position: append ? stat$1.size : 0,
+			readable: read,
+			writable: write,
+			append
+		});
+		return fd;
+	}
+	stat(path, options) {
+		return Promise.resolve(this.statSync(path, options));
+	}
+	statSync(path, _options) {
+		const s = stat(this.db, path);
+		const ino = resolveInode(this.db, path)?.inode ?? 0;
+		return wrapStats({
+			mode: s.mode,
+			size: s.size,
+			mtimeMs: s.mtime,
+			ino,
+			isFile: s.isFile,
+			isDirectory: s.isDirectory,
+			isSymbolicLink: false
+		});
+	}
+	lstat(path, options) {
+		return Promise.resolve(this.lstatSync(path, options));
+	}
+	lstatSync(path, _options) {
+		const node = resolveInode(this.db, path, { followSymlinks: false });
+		if (node === null) throw createWorkspaceError("ENOENT", `no such path: ${path}`, path);
+		const isSymlink = node.type === "symlink";
+		const size = isSymlink ? (node.linkTarget ?? "").length : node.type === "file" ? this.db.scalar("SELECT COALESCE(SUM(size), 0) FROM vfs_chunks WHERE inode = ?", node.inode) ?? 0 : 0;
+		return wrapStats({
+			mode: node.mode,
+			size,
+			mtimeMs: node.mtime,
+			ino: node.inode,
+			isFile: node.type === "file",
+			isDirectory: node.type === "dir",
+			isSymbolicLink: isSymlink
+		});
+	}
+	readdir(path, options) {
+		return Promise.resolve(this.readdirSync(path, options));
+	}
+	readdirSync(path, options) {
+		const entries = readdir(this.db, path);
+		if (options?.withFileTypes === true) return entries.map((entry) => wrapDirent(entry));
+		return entries.map((entry) => entry.name);
+	}
+	mkdir(path, options) {
+		return Promise.resolve(this.mkdirSync(path, options));
+	}
+	mkdirSync(path, options) {
+		mkdir(this.db, path, options ?? {}, this.now);
+	}
+	rmdir(path) {
+		this.rmdirSync(path);
+		return Promise.resolve();
+	}
+	rmdirSync(path) {
+		rm(this.db, path, {});
+	}
+	unlink(path) {
+		this.unlinkSync(path);
+		return Promise.resolve();
+	}
+	unlinkSync(path) {
+		rm(this.db, path, {});
+	}
+	rename(oldPath, newPath) {
+		this.renameSync(oldPath, newPath);
+		return Promise.resolve();
+	}
+	renameSync(oldPath, newPath) {
+		const node = resolveInode(this.db, oldPath);
+		if (node === null) throw createWorkspaceError("ENOENT", `no such path: ${oldPath}`, oldPath);
+		const { parts, path: newCanonical } = canonicalizePath(newPath);
+		if (parts.length === 0) throw createWorkspaceError("EINVAL", "cannot rename onto root", newCanonical);
+		const newName = parts[parts.length - 1];
+		const newParentPath = parts.length === 1 ? "/" : `/${parts.slice(0, -1).join("/")}`;
+		const newParent = resolveInode(this.db, newParentPath);
+		if (newParent === null || newParent.type !== "dir") throw createWorkspaceError("ENOENT", `parent directory missing: ${newCanonical}`, newCanonical);
+		this.db.transactionSync(() => {
+			const existing = this.db.one(`SELECT d.child_inode AS child_inode, n.type AS type
+         FROM vfs_dirents d JOIN vfs_nodes n ON n.inode = d.child_inode
+         WHERE d.parent_inode = ? AND d.name = ?`, newParent.inode, newName);
+			if (existing !== void 0 && existing.child_inode !== node.inode) {
+				if (existing.type === "dir") {
+					if ((this.db.scalar("SELECT COUNT(*) FROM vfs_dirents WHERE parent_inode = ?", existing.child_inode) ?? 0) > 0) throw createWorkspaceError("ENOTEMPTY", `not empty: ${newCanonical}`, newCanonical);
+				}
+				this.db.run("DELETE FROM vfs_dirents WHERE child_inode = ?", existing.child_inode);
+				this.db.run("DELETE FROM vfs_chunks WHERE inode = ?", existing.child_inode);
+				this.db.run("DELETE FROM vfs_nodes WHERE inode = ?", existing.child_inode);
+			}
+			this.db.run("DELETE FROM vfs_dirents WHERE child_inode = ?", node.inode);
+			this.db.run("INSERT INTO vfs_dirents (parent_inode, name, child_inode) VALUES (?, ?, ?)", newParent.inode, newName, node.inode);
+		});
+	}
+	readFile(path, options) {
+		return Promise.resolve(this.readFileSync(path, options));
+	}
+	readFileSync(path, options) {
+		const node = resolveInode(this.db, path);
+		if (node === null) throw createWorkspaceError("ENOENT", `no such file: ${path}`, path);
+		if (node.type !== "file") throw createWorkspaceError("EISDIR", `path is a directory: ${path}`, path);
+		const chunks = this.db.all("SELECT hash, size FROM vfs_chunks WHERE inode = ? ORDER BY idx", node.inode);
+		let total = 0;
+		for (const c of chunks) total += c.size;
+		const out = Buffer.alloc(total);
+		let offset = 0;
+		for (const chunk of chunks) {
+			const row = this.db.one("SELECT bytes FROM vfs_blob_bytes WHERE hash = ?", chunk.hash);
+			if (row === void 0) throw createWorkspaceError("EIO", `missing blob bytes for ${path}`, path);
+			out.set(row.bytes, offset);
+			offset += row.bytes.byteLength;
+		}
+		const encoding = typeof options === "string" ? options : options?.encoding;
+		return encoding ? out.toString(encoding) : out;
+	}
+	writeFile(path, data, options) {
+		this.writeFileSync(path, data, options);
+		return Promise.resolve();
+	}
+	writeFileSync(path, data, options) {
+		const mode = typeof options === "string" ? void 0 : options?.mode;
+		const bytes = typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+		writeFileSync(this.db, path, bytes, { mode }, this.now);
+	}
+	appendFile(_path, _data, _options) {
+		return Promise.reject(notImplemented("appendFile"));
+	}
+	appendFileSync(_path, _data, _options) {
+		throw notImplemented("appendFileSync");
+	}
+	exists(path) {
+		return Promise.resolve(this.existsSync(path));
+	}
+	existsSync(path) {
+		try {
+			return resolveInode(this.db, path) !== null;
+		} catch {
+			return false;
+		}
+	}
+	copyFile(_src, _dest, _mode) {
+		return Promise.reject(notImplemented("copyFile"));
+	}
+	copyFileSync(_src, _dest, _mode) {
+		throw notImplemented("copyFileSync");
+	}
+	internalModuleStat(_path) {
+		throw notImplemented("internalModuleStat");
+	}
+	realpath(path, _options) {
+		return Promise.resolve(this.realpathSync(path));
+	}
+	realpathSync(path, _options) {
+		const { path: canonical } = canonicalizePath(path);
+		if (resolveInode(this.db, canonical) === null) throw createWorkspaceError("ENOENT", `no such path: ${canonical}`, canonical);
+		return canonical;
+	}
+	access(path, _mode) {
+		this.accessSync(path);
+		return Promise.resolve();
+	}
+	accessSync(path, _mode) {
+		if (resolveInode(this.db, path) === null) throw createWorkspaceError("ENOENT", `no such path: ${path}`, path);
+	}
+	closeSync(fd) {
+		if (!this.#fds.delete(fd)) throw createWorkspaceError("EBADF", `unknown fd ${fd}`);
+	}
+	readSync(fd, buffer, offset, length, position) {
+		const state = this.#fdOrThrow(fd);
+		if (!state.readable) throw createWorkspaceError("EBADF", `fd ${fd} is not readable`);
+		const startAt = position ?? state.position;
+		const bytes = readFileBytesSync(this.db, state.path);
+		if (startAt >= bytes.byteLength) return 0;
+		const end = Math.min(startAt + length, bytes.byteLength);
+		const n = end - startAt;
+		(buffer instanceof Buffer ? buffer : Buffer.from(buffer.buffer, buffer.byteOffset, buffer.byteLength)).set(bytes.subarray(startAt, end), offset);
+		if (position === null || position === void 0) state.position += n;
+		return n;
+	}
+	writeSync(fd, buffer, offset = 0, length = buffer.byteLength - offset, position = null) {
+		const state = this.#fdOrThrow(fd);
+		if (!state.writable) throw createWorkspaceError("EBADF", `fd ${fd} is not writable`);
+		const existing = readFileBytesSync(this.db, state.path);
+		const startAt = state.append ? existing.byteLength : position ?? state.position;
+		const next = spliceBytes(existing, startAt, buffer, offset, length);
+		writeFileSync(this.db, state.path, next, {}, this.now);
+		if (position === null || position === void 0) state.position = startAt + length;
+		return length;
+	}
+	fstatSync(fd, _options) {
+		const state = this.#fdOrThrow(fd);
+		return this.statSync(state.path);
+	}
+	truncateSync(path, len) {
+		const node = resolveInode(this.db, path);
+		if (node === null) throw createWorkspaceError("ENOENT", `no such path: ${path}`, path);
+		if (node.type !== "file") throw createWorkspaceError("EISDIR", `path is a directory: ${path}`, path);
+		const existing = readFileBytesSync(this.db, path);
+		if (existing.byteLength === len) return;
+		let next;
+		if (len < existing.byteLength) next = existing.subarray(0, len);
+		else {
+			next = new Uint8Array(len);
+			next.set(existing, 0);
+		}
+		writeFileSync(this.db, path, next, {}, this.now);
+	}
+	ftruncateSync(fd, len) {
+		const state = this.#fdOrThrow(fd);
+		this.truncateSync(state.path, len);
+	}
+	#fdOrThrow(fd) {
+		const state = this.#fds.get(fd);
+		if (state === void 0) throw createWorkspaceError("EBADF", `unknown fd ${fd}`);
+		return state;
+	}
+	readlink(path, _options) {
+		return Promise.resolve(this.readlinkSync(path));
+	}
+	readlinkSync(path, _options) {
+		return readlink(this.db, path);
+	}
+	symlink(target, path, _type) {
+		this.symlinkSync(target, path);
+		return Promise.resolve();
+	}
+	symlinkSync(target, path, _type) {
+		symlink(this.db, target, path, this.now);
+	}
+	watch(path, options = {}) {
+		return createWatcher(this.db, path, options, this.watchIntervalMs);
+	}
+	watchAsync(path, options = {}) {
+		return createWatchAsyncIterable(this.watch(path, options));
+	}
+	watchFile(_path, _options, _listener) {
+		throw notImplemented("watchFile");
+	}
+	unwatchFile(_path, _listener) {
+		throw notImplemented("unwatchFile");
+	}
+};
+function notImplemented(method) {
+	return createWorkspaceError("ENOSYS", `SQLiteWorkspaceProvider.${method} is not implemented yet`);
+}
+const S_IFREG = 32768;
+const S_IFDIR = 16384;
+const S_IFLNK = 40960;
+function fileTypeBits(input) {
+	if (input.isDirectory) return S_IFDIR;
+	if (input.isSymbolicLink) return S_IFLNK;
+	if (input.isFile) return S_IFREG;
+	return 0;
+}
+function wrapStats(input) {
+	const mtime = new Date(input.mtimeMs);
+	return {
+		dev: 0,
+		mode: input.mode & 4095 | fileTypeBits(input),
+		nlink: 1,
+		uid: 0,
+		gid: 0,
+		rdev: 0,
+		blksize: 4096,
+		ino: input.ino,
+		size: input.size,
+		blocks: Math.ceil(input.size / 512),
+		atimeMs: input.mtimeMs,
+		mtimeMs: input.mtimeMs,
+		ctimeMs: input.mtimeMs,
+		birthtimeMs: input.mtimeMs,
+		atime: mtime,
+		mtime,
+		ctime: mtime,
+		birthtime: mtime,
+		isFile: () => input.isFile,
+		isDirectory: () => input.isDirectory,
+		isSymbolicLink: () => input.isSymbolicLink,
+		isBlockDevice: () => false,
+		isCharacterDevice: () => false,
+		isFIFO: () => false,
+		isSocket: () => false
+	};
+}
+function wrapDirent(input) {
+	const fullPath = input.parentPath === "/" ? `/${input.name}` : `${input.parentPath}/${input.name}`;
+	return {
+		name: input.name,
+		parentPath: input.parentPath,
+		path: fullPath,
+		isFile: () => input.isFile,
+		isDirectory: () => input.isDirectory,
+		isSymbolicLink: () => false,
+		isBlockDevice: () => false,
+		isCharacterDevice: () => false,
+		isFIFO: () => false,
+		isSocket: () => false
+	};
+}
+function parseFlags(flags) {
+	switch (flags) {
+		case "r": return {
+			read: true,
+			write: false,
+			create: false,
+			truncate: false,
+			append: false,
+			exclusive: false
+		};
+		case "r+": return {
+			read: true,
+			write: true,
+			create: false,
+			truncate: false,
+			append: false,
+			exclusive: false
+		};
+		case "w": return {
+			read: false,
+			write: true,
+			create: true,
+			truncate: true,
+			append: false,
+			exclusive: false
+		};
+		case "w+": return {
+			read: true,
+			write: true,
+			create: true,
+			truncate: true,
+			append: false,
+			exclusive: false
+		};
+		case "wx": return {
+			read: false,
+			write: true,
+			create: true,
+			truncate: false,
+			append: false,
+			exclusive: true
+		};
+		case "wx+": return {
+			read: true,
+			write: true,
+			create: true,
+			truncate: false,
+			append: false,
+			exclusive: true
+		};
+		case "a": return {
+			read: false,
+			write: true,
+			create: true,
+			truncate: false,
+			append: true,
+			exclusive: false
+		};
+		case "a+": return {
+			read: true,
+			write: true,
+			create: true,
+			truncate: false,
+			append: true,
+			exclusive: false
+		};
+		case "ax": return {
+			read: false,
+			write: true,
+			create: true,
+			truncate: false,
+			append: true,
+			exclusive: true
+		};
+		case "ax+": return {
+			read: true,
+			write: true,
+			create: true,
+			truncate: false,
+			append: true,
+			exclusive: true
+		};
+		default: throw createWorkspaceError("EINVAL", `unsupported fs flag: ${flags}`);
+	}
+}
+function readFileBytesSync(db, path) {
+	const node = resolveInode(db, path);
+	if (node === null) throw createWorkspaceError("ENOENT", `no such file: ${path}`, path);
+	if (node.type !== "file") throw createWorkspaceError("EISDIR", `path is a directory: ${path}`, path);
+	const chunks = db.all("SELECT hash, size FROM vfs_chunks WHERE inode = ? ORDER BY idx", node.inode);
+	let total = 0;
+	for (const c of chunks) total += c.size;
+	const out = new Uint8Array(total);
+	let pos = 0;
+	for (const chunk of chunks) {
+		const row = db.one("SELECT bytes FROM vfs_blob_bytes WHERE hash = ?", chunk.hash);
+		if (row === void 0) throw createWorkspaceError("EIO", `missing blob bytes for ${path}`, path);
+		out.set(row.bytes, pos);
+		pos += row.bytes.byteLength;
+	}
+	return out;
+}
+function spliceBytes(dst, at, src, srcOffset, length) {
+	const newLength = Math.max(dst.byteLength, at + length);
+	const out = new Uint8Array(newLength);
+	out.set(dst, 0);
+	const srcView = src.subarray(srcOffset, srcOffset + length);
+	out.set(srcView, at);
+	return out;
+}
+//#endregion
+//#region ../dofs/src/storage.ts
+var Database = class {
+	sql;
+	transactionSync;
+	#txDepth = 0;
+	constructor(storage) {
+		this.sql = storage.sql;
+		this.transactionSync = (closure) => {
+			if (this.#txDepth > 0) {
+				const sp = `_t${this.#txDepth}`;
+				this.sql.exec(`SAVEPOINT ${sp}`);
+				this.#txDepth++;
+				try {
+					const result = closure();
+					this.sql.exec(`RELEASE ${sp}`);
+					return result;
+				} catch (error) {
+					this.sql.exec(`ROLLBACK TO ${sp}`);
+					this.sql.exec(`RELEASE ${sp}`);
+					throw error;
+				} finally {
+					this.#txDepth--;
+				}
+			}
+			this.#txDepth++;
+			try {
+				if (storage.transactionSync !== void 0) return storage.transactionSync(closure);
+				if (storage.transaction !== void 0) {
+					const result = storage.transaction(closure);
+					if (result !== void 0 && result !== null && typeof result === "object" && "then" in result) throw new Error("Durable Object storage adapter requires synchronous transactions");
+					return result;
+				}
+				return closure();
+			} finally {
+				this.#txDepth--;
+			}
+		};
+	}
+	run(query, ...bindings) {
+		this.sql.exec(query, ...bindings);
+	}
+	all(query, ...bindings) {
+		return this.sql.exec(query, ...bindings).toArray().map((row) => normalizeRow(row));
+	}
+	one(query, ...bindings) {
+		return this.all(query, ...bindings)[0];
+	}
+	scalar(query, ...bindings) {
+		const row = this.one(query, ...bindings);
+		if (row === void 0) return;
+		const [value] = Object.values(row);
+		return value;
+	}
+};
+function normalizeRow(row) {
+	const out = {};
+	for (const key of Object.keys(row)) {
+		const value = row[key];
+		out[key] = value instanceof ArrayBuffer ? new Uint8Array(value) : value;
+	}
+	return out;
+}
+//#endregion
+//#region ../dofs/src/sync/apply.ts
+const DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
+const DEFAULT_MAX_PATHS = 1024;
+function hex$1(bytes) {
+	let s = "";
+	for (let i = 0; i < bytes.byteLength; i++) s += bytes[i].toString(16).padStart(2, "0");
+	return s;
+}
+async function applyChanges(db, entries, objects, options = {}) {
+	const revBeforeApply = currentRev(db);
+	const maxBytes = options.maxBytesPerBatch ?? DEFAULT_MAX_BYTES;
+	const maxPaths = options.maxPathsPerBatch ?? DEFAULT_MAX_PATHS;
+	let bytesInBatch = 0;
+	let pathsInBatch = 0;
+	let applied = 0;
+	const skipped = [];
+	const flush = () => {
+		bytesInBatch = 0;
+		pathsInBatch = 0;
+	};
+	for await (const entry of entries) {
+		if (options.source === "upstream" && entry.kind !== "delete") {
+			if (alreadyApplied(db, entry)) continue;
+		}
+		const blockingRoot = readOnlyRootFor(db, entry.path);
+		if (blockingRoot !== void 0) {
+			skipped.push({
+				path: entry.path,
+				mountRoot: blockingRoot,
+				op: entry.kind === "delete" ? "delete" : "write",
+				reason: "read-only"
+			});
+			continue;
+		}
+		if (entry.kind === "delete") {
+			try {
+				rm(db, entry.path, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+			applied++;
+			pathsInBatch++;
+			if (pathsInBatch >= maxPaths) flush();
+			continue;
+		}
+		if (entry.kind === "dir") {
+			mkdir(db, entry.path, {
+				mode: entry.mode,
+				recursive: true
+			}, () => entry.mtime);
+			applied++;
+			pathsInBatch++;
+			if (pathsInBatch >= maxPaths) flush();
+			continue;
+		}
+		if (entry.kind === "symlink") {
+			symlink(db, entry.target, entry.path, () => entry.mtime);
+			applied++;
+			pathsInBatch++;
+			if (pathsInBatch >= maxPaths) flush();
+			continue;
+		}
+		const parts = [];
+		let total = 0;
+		for (const c of entry.chunks) {
+			const k = hex$1(c.hash);
+			let bytes = objects.get(k);
+			if (bytes === void 0) bytes = db.one("SELECT bytes FROM vfs_blob_bytes WHERE hash = ?", c.hash)?.bytes;
+			if (bytes === void 0) throw new Error(`applyChanges: missing object ${k} for ${entry.path}`);
+			parts.push(bytes);
+			total += bytes.byteLength;
+		}
+		const buf = new Uint8Array(total);
+		let off = 0;
+		for (const p of parts) {
+			buf.set(p, off);
+			off += p.byteLength;
+		}
+		await writeFile(db, entry.path, buf, { mode: entry.mode }, () => entry.mtime);
+		applied++;
+		bytesInBatch += total;
+		pathsInBatch++;
+		if (bytesInBatch >= maxBytes || pathsInBatch >= maxPaths) flush();
+	}
+	if (options.advanceFetchRev !== void 0) {
+		const current = readWatermark(db, "fetchRev");
+		if (options.advanceFetchRev > current) writeWatermark(db, "fetchRev", options.advanceFetchRev);
+	}
+	if (options.source === "upstream") {
+		const revAfter = currentRev(db);
+		const existing = readWatermark(db, "pushRev");
+		if (existing >= revBeforeApply && revAfter > existing) writeWatermark(db, "pushRev", revAfter);
+	}
+	return {
+		applied,
+		skipped
+	};
+}
+function alreadyApplied(db, entry) {
+	const live = resolveInode(db, entry.path, { followSymlinks: false });
+	if (live === null) return false;
+	if (entry.kind === "file") {
+		if (live.type !== "file") return false;
+		const row = db.one("SELECT manifest_hash FROM vfs_nodes WHERE inode = ?", live.inode);
+		if (!row?.manifest_hash) return false;
+		const wanted = computeManifestHash(entry.chunks);
+		return uint8Equal(row.manifest_hash, wanted);
+	}
+	if (entry.kind === "dir") return live.type === "dir" && (live.mode & 4095) === (entry.mode & 4095);
+	return live.type === "symlink" && live.linkTarget === entry.target && (live.mode & 4095) === (entry.mode & 4095);
+}
+function uint8Equal(a, b) {
+	if (a.byteLength !== b.byteLength) return false;
+	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+//#endregion
+//#region ../dofs/src/sync/invariant.ts
+function assertAppliedPushRev(appliedPushRev, pushRev) {
+	if (appliedPushRev < pushRev) throw new Error(`cross-side invariant violated: appliedPushRev (${appliedPushRev}) < pushRev (${pushRev})`);
+}
+//#endregion
+//#region src/heartbeat.ts
+function startHeartbeat(options) {
+	const { intervalMs, ping, onFailure } = options;
+	let stopped = false;
+	const timer = setInterval(() => {
+		if (stopped) return;
+		ping().catch((error) => {
+			if (stopped) return;
+			stopped = true;
+			clearInterval(timer);
+			onFailure(error instanceof Error ? error : new Error(String(error)));
+		});
+	}, intervalMs);
+	return () => {
+		if (stopped) return;
+		stopped = true;
+		clearInterval(timer);
+	};
+}
+//#endregion
+//#region src/backends/cloudflare-container.ts
+const DEFAULT_EGRESS_HOST = "workspace.internal";
+const DEFAULT_CONTAINER_PORT = 8080;
+const DEFAULT_CONNECT_TIMEOUT_MS = 3e4;
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 2e4;
+var CloudflareContainerBackend = class {
+	id = "cloudflare-container";
+	#options;
+	#pendingUpgrade;
+	#resolveUpgrade;
+	#rejectUpgrade;
+	#handle;
+	constructor(options) {
+		this.#options = {
+			container: options.container,
+			workspace: options.workspace,
+			containerEnv: options.containerEnv,
+			egressHost: options.egressHost ?? DEFAULT_EGRESS_HOST,
+			containerPort: options.containerPort ?? DEFAULT_CONTAINER_PORT,
+			connectTimeoutMs: options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS,
+			heartbeatIntervalMs: options.heartbeatIntervalMs ?? DEFAULT_HEARTBEAT_INTERVAL_MS
+		};
+	}
+	async connect() {
+		if (this.#handle) return this.#handle;
+		const deadline = Date.now() + this.#options.connectTimeoutMs;
+		const host = await (await this.#options.container()).getWorkspaceContainer();
+		await host.start({
+			PORT: String(this.#options.containerPort),
+			MOUNT_POINT: "/workspace",
+			...this.#options.containerEnv
+		});
+		await host.interceptOutboundHttp(this.#options.egressHost, this.#options.workspace);
+		this.#armUpgrade();
+		await this.#waitForPort(host, deadline);
+		await this.#postConnect(host, deadline);
+		const ws = await this.#waitForUpgrade(deadline);
+		const stub = newWebSocketRpcSession(ws);
+		let stopHeartbeat;
+		const closed = new Promise((resolve) => {
+			let fired = false;
+			const onClose = () => {
+				if (fired) return;
+				fired = true;
+				stopHeartbeat?.();
+				resolve();
+				this.#handle = void 0;
+			};
+			ws.addEventListener("close", onClose, { once: true });
+			ws.addEventListener("error", onClose, { once: true });
+			stub.onRpcBroken(onClose);
+		});
+		if (this.#options.heartbeatIntervalMs > 0) stopHeartbeat = startHeartbeat({
+			intervalMs: this.#options.heartbeatIntervalMs,
+			ping: () => stub.sync.watermarks(),
+			onFailure: () => {
+				try {
+					ws.close();
+				} catch {}
+			}
+		});
+		const handle = {
+			rpc: stub,
+			closed,
+			close: async () => {
+				stopHeartbeat?.();
+				try {
+					stub[Symbol.dispose]?.();
+				} catch {}
+				try {
+					ws.close();
+				} catch {}
+				this.#handle = void 0;
+			}
+		};
+		this.#handle = handle;
+		return handle;
+	}
+	async handleFetch(req) {
+		if (new URL(req.url).pathname !== "/ws") return new Response("not found", { status: 404 });
+		if (req.headers.get("upgrade") !== "websocket") return new Response("expected websocket upgrade", { status: 426 });
+		const pair = new WebSocketPair();
+		const [client, server] = [pair[0], pair[1]];
+		server.accept();
+		if (this.#resolveUpgrade) this.#resolveUpgrade(server);
+		else {
+			server.close(1011, "no pending connect");
+			return new Response("no pending connect", { status: 409 });
+		}
+		return new Response(null, {
+			status: 101,
+			webSocket: client
+		});
+	}
+	#armUpgrade() {
+		this.#pendingUpgrade = new Promise((resolve, reject) => {
+			this.#resolveUpgrade = resolve;
+			this.#rejectUpgrade = reject;
+		});
+		this.#pendingUpgrade.catch(() => {});
+	}
+	#clearUpgrade() {
+		this.#pendingUpgrade = void 0;
+		this.#resolveUpgrade = void 0;
+		this.#rejectUpgrade = void 0;
+	}
+	async #waitForPort(host, deadline) {
+		let lastError;
+		while (Date.now() < deadline) try {
+			(await host.port(this.#options.containerPort).fetch("http://container/health", { method: "HEAD" })).body?.cancel();
+			return;
+		} catch (error) {
+			lastError = error;
+			await sleep$1(250);
+		}
+		this.#rejectUpgrade?.(/* @__PURE__ */ new Error("port did not open"));
+		this.#clearUpgrade();
+		throw new Error(`CloudflareContainerBackend: container port ${this.#options.containerPort} did not open: ${describeError(lastError)}`);
+	}
+	async #postConnect(host, deadline) {
+		const remaining = Math.max(0, deadline - Date.now());
+		let res;
+		try {
+			res = await host.port(this.#options.containerPort).fetch("http://container/connect", {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					url: `http://${this.#options.egressHost}`,
+					healthTimeoutMs: remaining
+				})
+			});
+		} catch (error) {
+			this.#rejectUpgrade?.(error);
+			this.#clearUpgrade();
+			throw new Error(`CloudflareContainerBackend: POST /connect failed: ${describeError(error)}`);
+		}
+		if (!res.ok) {
+			const body = await res.text().catch(() => "");
+			this.#rejectUpgrade?.(/* @__PURE__ */ new Error(`/connect ${res.status}`));
+			this.#clearUpgrade();
+			throw new Error(`CloudflareContainerBackend: POST /connect returned ${res.status}: ${body}`);
+		}
+	}
+	async #waitForUpgrade(deadline) {
+		const upgrade = this.#pendingUpgrade;
+		if (!upgrade) throw new Error("CloudflareContainerBackend: upgrade promise missing");
+		const remaining = Math.max(0, deadline - Date.now());
+		let timer;
+		try {
+			return await Promise.race([upgrade, new Promise((_, reject) => {
+				timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`CloudflareContainerBackend: /ws upgrade did not arrive within ${this.#options.connectTimeoutMs}ms`)), remaining);
+			})]);
+		} finally {
+			if (timer) clearTimeout(timer);
+			this.#clearUpgrade();
+		}
+	}
+};
+function sleep$1(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function describeError(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+//#endregion
+//#region src/backends/container-host.ts
+var WorkspaceContainerAPI = class extends RpcTarget$1 {
+	#container;
+	#ctx;
+	constructor(ctx) {
+		super();
+		if (!ctx.container) throw new Error("WorkspaceContainerAPI: DO is not container-enabled (check wrangler.jsonc)");
+		this.#container = ctx.container;
+		this.#ctx = ctx;
+	}
+	async start(env) {
+		if (this.#container.running) return;
+		this.#container.start({
+			enableInternet: true,
+			env
+		});
+	}
+	async interceptOutboundHttp(host, ref) {
+		const exports = this.#ctx.exports;
+		await this.#container.interceptOutboundHttp(host, exports.WorkspaceProxy({ props: ref }));
+	}
+	port(port) {
+		return this.#container.getTcpPort(port);
+	}
+};
+function withWorkspaceContainer(Base) {
+	class WithWorkspaceContainer extends Base {
+		getWorkspaceContainer() {
+			return new WorkspaceContainerAPI(this.ctx);
+		}
+	}
+	return WithWorkspaceContainer;
+}
+//#endregion
+//#region ../rpc/dist/client.js
+function createWorkspaceClient(options) {
+	const ws = new (options.WebSocketImpl ?? WebSocket)(options.url);
+	const stub = newWebSocketRpcSession(ws);
+	return new Proxy(stub, { get(target, prop, receiver) {
+		if (prop === "close") return async () => {
+			try {
+				target[Symbol.dispose]?.();
+			} catch {}
+			await new Promise((resolve) => {
+				const w = ws;
+				if (w.readyState >= 2) {
+					resolve();
+					return;
+				}
+				ws.addEventListener("close", () => resolve(), { once: true });
+				w.close();
+				setTimeout(resolve, 200);
+			});
+		};
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+//#endregion
+//#region src/backends/test.ts
+var TestBackend = class {
+	id = "test";
+	#url;
+	constructor(options) {
+		this.#url = options.url;
+	}
+	async connect() {
+		const wsUrl = toWebSocketUrl(this.#url);
+		await probeHealth(this.#url);
+		const client = createWorkspaceClient({ url: `${wsUrl}/ws` });
+		return {
+			rpc: client,
+			close: async () => {
+				await client.close();
+			}
+		};
+	}
+};
+function toWebSocketUrl(input) {
+	if (input.startsWith("ws://") || input.startsWith("wss://")) return stripTrailingSlash(input);
+	if (input.startsWith("http://")) return stripTrailingSlash(`ws://${input.slice(7)}`);
+	if (input.startsWith("https://")) return stripTrailingSlash(`wss://${input.slice(8)}`);
+	throw new Error(`TestBackend: unsupported URL scheme in ${input}`);
+}
+function stripTrailingSlash(url) {
+	return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+async function probeHealth(url) {
+	const healthUrl = `${stripTrailingSlash(toHttpUrl(url))}/health`;
+	let response;
+	try {
+		response = await fetch(healthUrl);
+	} catch (cause) {
+		throw new Error(`TestBackend: ${healthUrl} is not reachable. Is the wsd container running? (${cause instanceof Error ? cause.message : String(cause)})`);
+	}
+	if (!response.ok) throw new Error(`TestBackend: ${healthUrl} returned ${response.status} ${response.statusText}`);
+}
+function toHttpUrl(input) {
+	if (input.startsWith("ws://")) return `http://${input.slice(5)}`;
+	if (input.startsWith("wss://")) return `https://${input.slice(6)}`;
+	return input;
+}
+//#endregion
+//#region src/mounts/providers/r2.ts
+function normalisePrefix(prefix) {
+	if (!prefix) return "";
+	return prefix.endsWith("/") ? prefix : `${prefix}/`;
+}
+async function* paginate(bucket, prefix, limit) {
+	let cursor;
+	while (true) {
+		const page = await bucket.list({
+			prefix: prefix.length > 0 ? prefix : void 0,
+			cursor,
+			limit
+		});
+		for (const obj of page.objects) yield obj;
+		if (!page.truncated || !page.cursor) return;
+		cursor = page.cursor;
+	}
+}
+async function runBounded(tasks, concurrency) {
+	if (concurrency < 1) concurrency = 1;
+	let next = 0;
+	const workers = [];
+	let firstError;
+	for (let i = 0; i < Math.min(concurrency, tasks.length); i++) workers.push((async () => {
+		while (true) {
+			if (firstError !== void 0) return;
+			const idx = next++;
+			if (idx >= tasks.length) return;
+			try {
+				await tasks[idx]();
+			} catch (error) {
+				if (firstError === void 0) firstError = error;
+				return;
+			}
+		}
+	})());
+	await Promise.all(workers);
+	if (firstError !== void 0) throw firstError;
+}
+function R2Bucket(bucket, options = {}) {
+	const prefix = normalisePrefix(options.prefix);
+	const mode = options.mode ?? "read-only";
+	const listLimit = options.listLimit ?? 1e3;
+	const concurrency = options.concurrency ?? 8;
+	return {
+		kind: "r2",
+		mode,
+		strategy: "eager",
+		maxBytes: options.maxBytes,
+		maxEntries: options.maxEntries,
+		async materialize(api) {
+			const keys = [];
+			for await (const obj of paginate(bucket, prefix, listLimit)) keys.push(obj);
+			await runBounded(keys.map((entry) => async () => {
+				const got = await bucket.get(entry.key);
+				if (got === null) throw new Error(`R2Bucket: object disappeared mid-materialize: ${entry.key}`);
+				const relKey = prefix.length > 0 ? entry.key.slice(prefix.length) : entry.key;
+				if (relKey.length === 0) return;
+				await api.writeFile(`${api.root}/${relKey}`, got.body);
+			}), concurrency);
+		}
+	};
+}
+//#endregion
+//#region src/proxy.ts
+var WorkspaceProxy = class extends WorkerEntrypoint {
+	async fetch(request) {
+		const url = new URL(request.url);
+		if (url.pathname === "/health") return new Response("ok\n", { headers: { "content-type": "text/plain; charset=utf-8" } });
+		if (url.pathname === "/ws") {
+			const { binding, id } = this.ctx.props;
+			const ns = this.env[binding];
+			if (!ns) return new Response(`WorkspaceProxy: env.${binding} is not a DurableObjectNamespace`, { status: 500 });
+			return ns.get(ns.idFromString(id)).fetch(request);
+		}
+		return new Response("not found", { status: 404 });
+	}
+};
+//#endregion
+//#region src/shell.ts
+var WorkspaceShell = class {
+	#shell;
+	#sync;
+	constructor(shell, sync) {
+		this.#shell = shell;
+		this.#sync = sync;
+	}
+	async exec(command, options = {}) {
+		let pushed = 0;
+		try {
+			pushed = await this.#sync.push();
+		} catch {}
+		const envelope = await this.#shell.exec({
+			command,
+			id: options.id,
+			cwd: options.cwd,
+			timeoutMs: options.timeoutMs
+		});
+		const events = disposeOnDone$1(envelope.events, () => maybeDispose$1(envelope));
+		return wrapHandle(this.#shell, this.#sync, envelope.id, events, options.encoding, pushed);
+	}
+	async get(id, options = {}) {
+		const after = resumeToAfter(options.resume);
+		const envelope = await this.#shell.getExec({
+			id,
+			after
+		});
+		const events = disposeOnDone$1(envelope.events, () => maybeDispose$1(envelope));
+		return wrapHandle(this.#shell, this.#sync, id, events, options.encoding, 0);
+	}
+};
+function resumeToAfter(resume) {
+	if (resume === void 0 || resume === "full") return void 0;
+	if (resume === "tail") return "tail";
+	return resume;
+}
+function wrapHandle(shell, sync, id, wireEvents, encoding, pushed) {
+	const [forUser, forWatcher] = wireEvents.tee();
+	const exited = watchForExit(forWatcher);
+	const stream = pipeEvents(forUser, encoding);
+	const handle = stream;
+	Object.defineProperties(handle, {
+		id: {
+			value: id,
+			enumerable: false,
+			writable: false
+		},
+		result: {
+			value: () => drainToResult(stream, encoding, sync, pushed),
+			enumerable: false,
+			writable: false
+		},
+		kill: {
+			value: async (signal) => {
+				await shell.killExec({
+					id,
+					signal
+				});
+				await exited;
+			},
+			enumerable: false,
+			writable: false
+		}
+	});
+	return handle;
+}
+function watchForExit(events) {
+	return (async () => {
+		const reader = events.getReader();
+		try {
+			while (true) {
+				const { value, done } = await reader.read();
+				if (done) return;
+				if (value.name === "exit") return;
+			}
+		} catch {} finally {
+			reader.releaseLock();
+		}
+	})();
+}
+function pipeEvents(source, encoding) {
+	if (encoding !== "utf8") return source;
+	const stdoutDec = new TextDecoder("utf-8", { fatal: false });
+	const stderrDec = new TextDecoder("utf-8", { fatal: false });
+	return source.pipeThrough(new TransformStream({
+		transform(event, controller) {
+			if (event.name === "stdout") controller.enqueue({
+				id: event.id,
+				seq: event.seq,
+				name: "stdout",
+				value: stdoutDec.decode(event.value, { stream: true })
+			});
+			else if (event.name === "stderr") controller.enqueue({
+				id: event.id,
+				seq: event.seq,
+				name: "stderr",
+				value: stderrDec.decode(event.value, { stream: true })
+			});
+			else controller.enqueue(event);
+		},
+		flush(_controller) {
+			stdoutDec.decode();
+			stderrDec.decode();
+		}
+	}));
+}
+async function drainToResult(stream, encoding, sync, pushed) {
+	const reader = stream.getReader();
+	const stdoutParts = [];
+	const stderrParts = [];
+	let exitCode = -1;
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			if (value.name === "stdout") stdoutParts.push(value.value);
+			else if (value.name === "stderr") stderrParts.push(value.value);
+			else exitCode = value.value;
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	let pulled = 0;
+	let skipped = [];
+	try {
+		const result = await sync.pull();
+		pulled = result.applied;
+		skipped = result.skipped;
+	} catch {}
+	return {
+		exitCode,
+		stdout: joinParts(stdoutParts, encoding),
+		stderr: joinParts(stderrParts, encoding),
+		pushed,
+		pulled,
+		skipped
+	};
+}
+function joinParts(parts, encoding) {
+	if (parts.length === 0) return encoding === "utf8" ? "" : new Uint8Array(0);
+	if (typeof parts[0] === "string") return parts.join("");
+	const arrays = parts;
+	const total = arrays.reduce((acc, a) => acc + a.byteLength, 0);
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const a of arrays) {
+		out.set(a, offset);
+		offset += a.byteLength;
+	}
+	return out;
+}
+function disposeOnDone$1(stream, onDone) {
+	let fired = false;
+	const fire = () => {
+		if (fired) return;
+		fired = true;
+		try {
+			onDone();
+		} catch {}
+	};
+	return stream.pipeThrough(new TransformStream({
+		transform(chunk, controller) {
+			controller.enqueue(chunk);
+		},
+		flush() {
+			fire();
+		},
+		cancel() {
+			fire();
+		}
+	}));
+}
+function maybeDispose$1(value) {
+	const d = value?.[Symbol.dispose];
+	if (typeof d === "function") d.call(value);
+}
+//#endregion
+//#region ../rpc/dist/debug.js
+let trackingEnabled = readFlag();
+function readFlag() {
+	try {
+		if ((globalThis.process?.env)?.CAPNWEB_TRACK_STUBS === "1") return true;
+	} catch {}
+	const override = globalThis.CAPNWEB_TRACK_STUBS;
+	return override === "1" || override === true;
+}
+const counters = /* @__PURE__ */ new Map();
+function trackStub(target) {
+	if (!trackingEnabled) return;
+	const name = target.constructor?.name ?? "anonymous";
+	counters.set(name, (counters.get(name) ?? 0) + 1);
+}
+function untrackStub(target) {
+	if (!trackingEnabled) return;
+	const name = target.constructor?.name ?? "anonymous";
+	const current = counters.get(name) ?? 0;
+	if (current <= 1) counters.delete(name);
+	else counters.set(name, current - 1);
+}
+//#endregion
+//#region src/stub.ts
+var WorkspaceFilesystemStub = class extends RpcTarget {
+	#ws;
+	constructor(ws) {
+		super();
+		this.#ws = ws;
+		trackStub(this);
+	}
+	[Symbol.dispose]() {
+		untrackStub(this);
+	}
+	readFile(path, optionsOrEncoding) {
+		return this.#ws.fs.readFile(path, optionsOrEncoding);
+	}
+	stat(path) {
+		return this.#ws.fs.stat(path);
+	}
+	readdir(path) {
+		return this.#ws.fs.readdir(path);
+	}
+	find(directory, pattern) {
+		return this.#ws.fs.find(directory, pattern);
+	}
+	ls(prefix) {
+		return this.#ws.fs.ls(prefix);
+	}
+	grep(pattern, path, options = {}) {
+		return this.#ws.fs.grep(pattern, path, options);
+	}
+	writeFile(path, content, options = {}) {
+		return this.#ws.fs.writeFile(path, content, options);
+	}
+	mkdir(path, options = {}) {
+		return this.#ws.fs.mkdir(path, options);
+	}
+	rm(path, options = {}) {
+		return this.#ws.fs.rm(path, options);
+	}
+};
+var WorkspaceExecHandleStub = class extends RpcTarget {
+	#pending;
+	constructor(pending) {
+		super();
+		this.#pending = pending;
+		trackStub(this);
+	}
+	[Symbol.dispose]() {
+		untrackStub(this);
+	}
+	async result() {
+		const result = await this.#pending;
+		return {
+			exitCode: result.exitCode,
+			stdout: result.stdout,
+			stderr: result.stderr
+		};
+	}
+};
+var WorkspaceShellStub = class extends RpcTarget {
+	#ws;
+	constructor(ws) {
+		super();
+		this.#ws = ws;
+		trackStub(this);
+	}
+	[Symbol.dispose]() {
+		untrackStub(this);
+	}
+	async exec(command, options = {}) {
+		return new WorkspaceExecHandleStub(options.encoding === "utf8" ? this.#ws.shell.exec(command, {
+			cwd: options.cwd,
+			encoding: "utf8"
+		}).then((handle) => handle.result()) : this.#ws.shell.exec(command, { cwd: options.cwd }).then((handle) => handle.result()));
+	}
+};
+var WorkspaceStub = class extends RpcTarget {
+	#fs;
+	#shell;
+	constructor(ws) {
+		super();
+		this.#fs = new WorkspaceFilesystemStub(ws);
+		this.#shell = new WorkspaceShellStub(ws);
+		trackStub(this);
+	}
+	[Symbol.dispose]() {
+		this.#fs[Symbol.dispose]();
+		this.#shell[Symbol.dispose]();
+		untrackStub(this);
+	}
+	get fs() {
+		return this.#fs;
+	}
+	get shell() {
+		return this.#shell;
+	}
+};
+//#endregion
+//#region ../rpc/src/sync-driver.ts
+function hex(bytes) {
+	let s = "";
+	for (let i = 0; i < bytes.byteLength; i++) s += bytes[i].toString(16).padStart(2, "0");
+	return s;
+}
+function disposeOnDone(stream, onDone) {
+	let fired = false;
+	const fire = () => {
+		if (fired) return;
+		fired = true;
+		try {
+			onDone();
+		} catch {}
+	};
+	return stream.pipeThrough(new TransformStream({
+		transform(chunk, controller) {
+			controller.enqueue(chunk);
+		},
+		flush() {
+			fire();
+		},
+		cancel() {
+			fire();
+		}
+	}));
+}
+function maybeDispose(value) {
+	const d = value?.[Symbol.dispose];
+	if (typeof d === "function") d.call(value);
+}
+const PULL_BATCH_SIZE = 256;
+async function pullOnce(db, remote) {
+	const sinceRev = readWatermark(db, "fetchRev");
+	const localPushRev = readWatermark(db, "pushRev");
+	const fetchResult = await remote.fetchChanges({ sinceRev });
+	const { currentRev: remoteRev, appliedPushRev } = fetchResult;
+	assertAppliedPushRev(appliedPushRev, localPushRev);
+	const stream = disposeOnDone(fetchResult.stream, () => maybeDispose(fetchResult));
+	if (remoteRev <= sinceRev) {
+		await stream.cancel().catch(() => {});
+		return {
+			applied: 0,
+			skipped: []
+		};
+	}
+	const reader = stream.getReader();
+	let totalApplied = 0;
+	const totalSkipped = [];
+	let streamDone = false;
+	try {
+		while (!streamDone) {
+			const batch = [];
+			const wantedHashes = [];
+			const seenHash = /* @__PURE__ */ new Set();
+			let batchMaxRev = 0;
+			while (batch.length < PULL_BATCH_SIZE) {
+				const { value, done } = await reader.read();
+				if (done) {
+					streamDone = true;
+					break;
+				}
+				batch.push(value);
+				if (value.rev > batchMaxRev) batchMaxRev = value.rev;
+				if (value.kind === "file") for (const c of value.chunks) {
+					const k = hex(c.hash);
+					if (!seenHash.has(k)) {
+						seenHash.add(k);
+						wantedHashes.push(c.hash);
+					}
+				}
+			}
+			if (batch.length === 0) break;
+			if (wantedHashes.length > 0) {
+				const haveSubset = await remote.hasObjects(wantedHashes);
+				const remoteHasLocally = /* @__PURE__ */ new Set();
+				for (const h of haveSubset) remoteHasLocally.add(hex(h));
+				const missing = wantedHashes.filter((h) => {
+					const k = hex(h);
+					if (!remoteHasLocally.has(k)) return false;
+					return db.one("SELECT hash FROM vfs_blobs WHERE hash = ?", h) === void 0;
+				});
+				if (missing.length > 0) {
+					const bytesReader = (await remote.fetchObjects(missing)).getReader();
+					try {
+						while (true) {
+							const { value, done } = await bytesReader.read();
+							if (done) break;
+							stageBlob(db, value.hash, value.bytes, Date.now());
+						}
+					} finally {
+						bytesReader.releaseLock();
+					}
+				}
+			}
+			const batchResult = await applyChanges(db, batch, /* @__PURE__ */ new Map(), {
+				source: "upstream",
+				advanceFetchRev: batchMaxRev
+			});
+			totalApplied += batchResult.applied;
+			if (batchResult.skipped.length > 0) for (const s of batchResult.skipped) totalSkipped.push(s);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	if (remoteRev > readWatermark(db, "fetchRev")) writeWatermark(db, "fetchRev", remoteRev);
+	return {
+		applied: totalApplied,
+		skipped: totalSkipped
+	};
+}
+async function pushOnce(db, remote) {
+	const sincePush = readWatermark(db, "pushRev");
+	const localRev = currentRev(db);
+	if (localRev <= sincePush) return 0;
+	const entries = [];
+	const wantedHashes = [];
+	const seenHash = /* @__PURE__ */ new Set();
+	for await (const e of coalesceChanges(db, sincePush)) {
+		entries.push(e);
+		if (e.kind === "file") for (const c of e.chunks) {
+			const k = hex(c.hash);
+			if (!seenHash.has(k)) {
+				seenHash.add(k);
+				wantedHashes.push(c.hash);
+			}
+		}
+	}
+	if (entries.length === 0) return 0;
+	const remoteHas = /* @__PURE__ */ new Set();
+	if (wantedHashes.length > 0) {
+		const have = await remote.hasObjects(wantedHashes);
+		for (const h of have) remoteHas.add(hex(h));
+	}
+	const missing = wantedHashes.filter((h) => !remoteHas.has(hex(h)));
+	if (missing.length > 0) {
+		const local = (function* () {
+			for (const h of missing) {
+				const row = db.one("SELECT bytes FROM vfs_blob_bytes WHERE hash = ?", h);
+				if (row === void 0) throw new Error(`pushOnce: missing local blob ${hex(h)}`);
+				yield {
+					hash: h,
+					bytes: row.bytes
+				};
+			}
+		})();
+		const bytesStream = new ReadableStream({ pull(controller) {
+			const next = local.next();
+			if (next.done) controller.close();
+			else controller.enqueue(next.value);
+		} });
+		await remote.pushObjects(bytesStream);
+	}
+	const entryStream = new ReadableStream({ start(controller) {
+		for (const e of entries) controller.enqueue(e);
+		controller.close();
+	} });
+	assertAppliedPushRev((await remote.push({
+		senderRev: localRev,
+		changes: entryStream
+	})).appliedPushRev, localRev);
+	writeWatermark(db, "pushRev", localRev);
+	return entries.length;
+}
+async function reconcileWatermarks(db, remote) {
+	const remoteWatermarks = await remote.watermarks();
+	const localFetchRev = readWatermark(db, "fetchRev");
+	const localPushRev = readWatermark(db, "pushRev");
+	let fetchRevReset = false;
+	let pushRevReset = false;
+	if (remoteWatermarks.currentRev < localFetchRev) {
+		writeWatermark(db, "fetchRev", 0);
+		fetchRevReset = true;
+	}
+	if (remoteWatermarks.pushRev < localPushRev) {
+		writeWatermark(db, "pushRev", 0);
+		pushRevReset = true;
+	}
+	return {
+		fetchRevReset,
+		pushRevReset
+	};
+}
+//#endregion
+//#region src/mounts/index.ts
+async function runIndex(opts) {
+	const { db, fs, mounts } = opts;
+	const status = /* @__PURE__ */ new Map();
+	for (const root of mounts.keys()) {
+		const row = db.one("SELECT indexed FROM _vfs_mounts WHERE root = ?", root);
+		status.set(root, row?.indexed === 1);
+	}
+	const pending = [...mounts.entries()].filter(([root]) => status.get(root) !== true);
+	if (pending.length === 0) return;
+	const failures = (await Promise.allSettled(pending.map(async ([root, mount]) => {
+		db.run("INSERT INTO _vfs_mounts (root, kind, mode, indexed) VALUES (?, ?, 'read-write', 0)\n  ON CONFLICT(root) DO UPDATE SET kind = excluded.kind, mode = 'read-write', indexed = 0", root, mount.kind);
+		invalidateReadOnlyMountCache(db);
+		const api = createWriteAPI({
+			fs,
+			root,
+			mount
+		});
+		try {
+			await fs.mkdir(root, { recursive: true });
+			await mount.materialize(api);
+			stampMountProvenance(db, root);
+		} catch (error) {
+			try {
+				await fs.rm(root, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+			throw error;
+		}
+		db.run("UPDATE _vfs_mounts SET mode = ?, indexed = 1 WHERE root = ?", mount.mode, root);
+		invalidateReadOnlyMountCache(db);
+	}))).filter((r) => r.status === "rejected");
+	if (failures.length > 0) throw failures[0].reason;
+}
+function findInodeAt(db, absPath) {
+	if (absPath === "/") return 1;
+	const parts = absPath.split("/").filter((p) => p.length > 0);
+	let current = 1;
+	for (const name of parts) {
+		const row = db.one("SELECT d.child_inode AS child_inode, n.type AS type\n  FROM vfs_dirents d JOIN vfs_nodes n ON n.inode = d.child_inode\n WHERE d.parent_inode = ? AND d.name = ?", current, name);
+		if (row === void 0) return void 0;
+		current = row.child_inode;
+	}
+	return current;
+}
+function stampMountProvenance(db, root) {
+	const rootInode = findInodeAt(db, root);
+	if (rootInode === void 0) return;
+	const inodes = [rootInode];
+	const queue = [rootInode];
+	while (queue.length > 0) {
+		const parent = queue.shift();
+		const children = db.all("SELECT child_inode FROM vfs_dirents WHERE parent_inode = ?", parent);
+		for (const c of children) {
+			inodes.push(c.child_inode);
+			queue.push(c.child_inode);
+		}
+	}
+	for (const inode of inodes) db.run("UPDATE vfs_nodes SET mount_root = ? WHERE inode = ?", root, inode);
+}
+function createWriteAPI(opts) {
+	const { fs, root, mount } = opts;
+	const maxBytes = mount.maxBytes;
+	const maxEntries = mount.maxEntries;
+	let bytesWritten = 0;
+	let entriesWritten = 0;
+	function checkPath(absPath) {
+		if (!absPath.startsWith(`${root}/`) && absPath !== root) throw new Error(`mount ${root}: writeFile/mkdir target ${absPath} is outside the mount root`);
+	}
+	return {
+		root,
+		async writeFile(absPath, source, mode) {
+			checkPath(absPath);
+			if (maxEntries !== void 0 && entriesWritten + 1 > maxEntries) throw new Error(`mount ${root}: maxEntries=${maxEntries} exceeded`);
+			entriesWritten += 1;
+			const lastSlash = absPath.lastIndexOf("/");
+			if (lastSlash > 0) await fs.mkdir(absPath.slice(0, lastSlash), { recursive: true });
+			let toWrite = source;
+			if (maxBytes !== void 0) {
+				const [counted, forwarded] = source.tee();
+				toWrite = forwarded;
+				const cancelForwarded = (reason) => {
+					forwarded.cancel(reason).catch(() => {});
+				};
+				const counter = (async () => {
+					const reader = counted.getReader();
+					try {
+						while (true) {
+							const { value, done } = await reader.read();
+							if (done) break;
+							if (value === void 0) continue;
+							bytesWritten += value.byteLength;
+							if (bytesWritten > maxBytes) {
+								const err = /* @__PURE__ */ new Error(`mount ${root}: maxBytes=${maxBytes} exceeded (saw ${bytesWritten})`);
+								cancelForwarded(err);
+								throw err;
+							}
+						}
+					} finally {
+						reader.releaseLock();
+					}
+				})();
+				const writePromise = fs.writeFile(absPath, toWrite, { mode });
+				const [counterResult, writeResult] = await Promise.allSettled([counter, writePromise]);
+				if (counterResult.status === "rejected") throw counterResult.reason;
+				if (writeResult.status === "rejected") throw writeResult.reason;
+				return;
+			}
+			await fs.writeFile(absPath, toWrite, { mode });
+		},
+		async mkdir(absPath, mode) {
+			checkPath(absPath);
+			if (maxEntries !== void 0 && entriesWritten + 1 > maxEntries) throw new Error(`mount ${root}: maxEntries=${maxEntries} exceeded`);
+			entriesWritten += 1;
+			await fs.mkdir(absPath, {
+				recursive: true,
+				mode
+			});
+		}
+	};
+}
+var MountIndex = class {
+	#db;
+	#fs;
+	#mounts;
+	#inFlight;
+	#done = false;
+	constructor(opts) {
+		this.#db = opts.db;
+		this.#fs = opts.fs;
+		this.#mounts = opts.mounts;
+	}
+	ensureIndexed() {
+		if (this.#done) return Promise.resolve();
+		if (this.#inFlight) return this.#inFlight;
+		if (this.#mounts.size === 0) {
+			this.#done = true;
+			return Promise.resolve();
+		}
+		this.#inFlight = runIndex({
+			db: this.#db,
+			fs: this.#fs,
+			mounts: this.#mounts
+		}).then(() => {
+			this.#done = true;
+		}).finally(() => {
+			this.#inFlight = void 0;
+		});
+		return this.#inFlight;
+	}
+};
+//#endregion
+//#region src/mounts/registry.ts
+function validateRoot(root) {
+	if (root.length === 0 || !root.startsWith("/")) throw new Error(`mount root must be absolute (starts with '/'): ${JSON.stringify(root)}`);
+	if (root.length > 1 && root.endsWith("/")) throw new Error(`mount root must not have a trailing slash: ${JSON.stringify(root)}`);
+}
+function rejectNesting(roots) {
+	for (let i = 0; i < roots.length; i++) for (let j = 0; j < roots.length; j++) {
+		if (i === j) continue;
+		const a = roots[i];
+		const b = roots[j];
+		if (b.startsWith(`${a}/`)) throw new Error(`mount roots must not nest: ${a} contains ${b}`);
+	}
+}
+function buildMountRegistry(mounts, options) {
+	const out = /* @__PURE__ */ new Map();
+	if (mounts === void 0) return out;
+	const roots = Object.keys(mounts);
+	for (const root of roots) validateRoot(root);
+	rejectNesting(roots);
+	const sessionId = options.sessionId ?? "";
+	let vfsCached;
+	const vfs = () => {
+		if (vfsCached === void 0) vfsCached = options.vfs();
+		return vfsCached;
+	};
+	for (const root of roots) {
+		const value = mounts[root];
+		if (typeof value === "function") {
+			const ctx = {
+				sessionId,
+				root,
+				vfs: vfs()
+			};
+			out.set(root, value(ctx));
+		} else out.set(root, value);
+	}
+	return out;
+}
+//#endregion
+//#region src/workspace.ts
+var Workspace = class {
+	#db;
+	#fs;
+	/**
+	* Lazily-constructed dofs provider. Built on first `provider()`
+	* call; cached so repeated callers share the same instance.
+	*/
+	#provider;
+	#backends;
+	#reconnect;
+	#now;
+	#mounts;
+	#mountIndex;
+	#handle;
+	#shell;
+	#readyPromise;
+	#mutationTail = Promise.resolve();
+	constructor(options) {
+		if (options.backends.length === 0) throw new Error("Workspace requires at least one backend");
+		this.#now = options.now ?? Date.now;
+		this.#db = new Database(options.storage);
+		initializeSchema(this.#db, this.#now);
+		this.#fs = new WorkspaceFilesystem(this.#db, { now: this.#now });
+		this.#backends = options.backends.slice();
+		this.#reconnect = options.reconnect ?? {
+			attempts: 1,
+			initialDelayMs: 0,
+			maxDelayMs: 0
+		};
+		this.#mounts = buildMountRegistry(options.mounts, {
+			sessionId: options.sessionId,
+			vfs: () => this.provider()
+		});
+		this.#mountIndex = new MountIndex({
+			db: this.#db,
+			fs: this.#fs,
+			mounts: this.#mounts
+		});
+	}
+	ensureMountsIndexed() {
+		return this.#mountIndex.ensureIndexed();
+	}
+	mounts() {
+		return new Map(this.#mounts);
+	}
+	get db() {
+		return this.#db;
+	}
+	get fs() {
+		return this.#fs;
+	}
+	/**
+	* Underlying dofs `SQLiteWorkspaceProvider` over the local store.
+	*
+	* This is the `@platformatic/vfs`-shaped provider — a node:fs
+	* surface with full symlink support. Callers that want a
+	* `VirtualFileSystem` (e.g. to hand to isomorphic-git) wrap it
+	* themselves to keep `@platformatic/vfs` out of this package's
+	* dependency tree:
+	*
+	* ```ts
+	* import { create, VirtualProvider } from "@platformatic/vfs";
+	* import type { SQLiteWorkspaceProvider } from "@cloudflare/dofs";
+	*
+	* class Glue extends VirtualProvider {
+	*   constructor(private inner: SQLiteWorkspaceProvider) { super(); }
+	*   override get readonly()         { return this.inner.readonly; }
+	*   override get supportsSymlinks() { return this.inner.supportsSymlinks; }
+	*   override get supportsWatch()    { return this.inner.supportsWatch; }
+	* }
+	* // Forward every node:fs method to `inner` via a
+	* // `for (const name of [...]) Object.defineProperty(...)` loop.
+	* const vfs = create(new Glue(workspace.provider()));
+	* ```
+	*
+	* Available immediately; doesn't need `ready()` because the
+	* provider only reads/writes the local store, not the wire.
+	*/
+	provider() {
+		if (!this.#provider) this.#provider = new SQLiteWorkspaceProvider(this.#db, { now: this.#now });
+		return this.#provider;
+	}
+	get shell() {
+		if (!this.#shell) throw new Error("Workspace not connected — await ready() first");
+		return this.#shell;
+	}
+	ready() {
+		if (this.#readyPromise) return this.#readyPromise;
+		this.#readyPromise = (async () => {
+			await this.#connect();
+			await this.#mountIndex.ensureIndexed();
+		})();
+		return this.#readyPromise;
+	}
+	stub() {
+		this.shell;
+		return new WorkspaceStub(this);
+	}
+	push() {
+		return this.#serialize(async () => {
+			await this.ready();
+			if (!this.#handle) throw new Error("Workspace not connected");
+			return pushOnce(this.#db, this.#handle.rpc.sync);
+		});
+	}
+	pull() {
+		return this.#serialize(async () => {
+			await this.ready();
+			if (!this.#handle) throw new Error("Workspace not connected");
+			return pullOnce(this.#db, this.#handle.rpc.sync);
+		});
+	}
+	#serialize(fn) {
+		const run = this.#mutationTail.then(fn, fn);
+		this.#mutationTail = run.then(() => void 0, () => void 0);
+		return run;
+	}
+	async close() {
+		if (this.#handle) try {
+			await this.#handle.close();
+		} finally {
+			this.#handle = void 0;
+			this.#shell = void 0;
+			this.#readyPromise = void 0;
+		}
+	}
+	async #connect() {
+		const { attempts, initialDelayMs, maxDelayMs } = this.#reconnect;
+		let delay = initialDelayMs;
+		let lastError;
+		for (let attempt = 1; attempt <= attempts; attempt++) try {
+			await this.#connectOnce();
+			return;
+		} catch (error) {
+			lastError = error instanceof Error ? error : new Error(String(error));
+			if (attempt === attempts) break;
+			await sleep(delay);
+			delay = Math.min(delay * 2 || 1, maxDelayMs);
+		}
+		throw lastError;
+	}
+	async #connectOnce() {
+		const errors = [];
+		for (const backend of this.#backends) try {
+			const handle = await backend.connect();
+			await reconcileWatermarks(this.#db, handle.rpc.sync);
+			this.#handle = handle;
+			this.#shell = new WorkspaceShell(handle.rpc.shell, this);
+			if (handle.closed) handle.closed.catch(() => {}).then(() => {
+				if (this.#handle === handle) {
+					this.#handle = void 0;
+					this.#shell = void 0;
+					this.#readyPromise = void 0;
+				}
+			});
+			return;
+		} catch (error) {
+			errors.push({
+				id: backend.id,
+				error
+			});
+		}
+		const summary = errors.map(({ id, error }) => `  - ${id}: ${error instanceof Error ? error.message : String(error)}`).join("\n");
+		throw new Error(`Workspace: no backend reachable\n${summary}`);
+	}
+};
+function sleep(ms) {
+	if (ms <= 0) return Promise.resolve();
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//#endregion
+export { CloudflareContainerBackend, R2Bucket, SQLiteWorkspaceProvider, TestBackend, Workspace, WorkspaceContainerAPI, WorkspaceExecHandleStub, WorkspaceFilesystemStub, WorkspaceProxy, WorkspaceShell, WorkspaceShellStub, WorkspaceStub, withWorkspaceContainer };
+
+//# sourceMappingURL=index.js.map