@effect-vfs/core 0.5.0 → 0.7.0

package/dist/internal/snapshotDelta.js

@@ -1,622 +1,724 @@
-// Exact snapshot delta construction, inspection, serialization, and application.
 import * as ByteSize from "effect/ByteSize";
-import * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
 import * as Encoding from "effect/Encoding";
-import * as Fn from "effect/Function";
 import * as Match from "effect/Match";
-import * as Predicate from "effect/Predicate";
+import * as Order from "effect/Order";
 import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
-import { ImageError } from "../Snapshot.js";
-import { SnapshotDeltaError, SnapshotDifference, SnapshotNodeKind } from "../SnapshotDelta.js";
+import { SnapshotChange, SnapshotDifference, SnapshotNodeKind } from "../SnapshotDelta.js";
 import { make as makeBytePath } from "./bytePath.js";
-import { bytesOrder, sameBytes } from "./bytes.js";
+import { bytesOrder, decodeUtf8, sameBytes } from "./bytes.js";
 import { CanonicalBase64 } from "./canonicalBase64.js";
+import { imageFailure, isEncodingIssue, issueSite, VfsError } from "./errors.js";
 import * as Image from "./image.js";
-import { WireStoredMetadata } from "./metadata.js";
+import * as InodeTable from "./inodeTable.js";
+import * as Merkle from "./merkle.js";
+import { StoredMetadata } from "./metadata.js";
+import { isAttachedBytes, isNameBytes, joinPath, nameBytes, NUL_BYTE, ROOT_PATH, SLASH_BYTE } from "./path.js";
 import * as SnapshotDeltaModel from "./snapshotDeltaModel.js";
+import { UNCHECKED } from "./tree.js";
+import { byEntryName, getNode, Ino, MAX_INO, payloadOf, ROOT_INO, storedMetadata } from "./volumeState.js";
 const FORMAT = "effect-vfs-delta";
-const ALGORITHM = "effect-vfs-semantic-sha256-v1";
-const SLASH_BYTE = 47;
-const DOT_BYTE = 46;
-const MAX_NAME_BYTES = 255;
-const NUL_BYTE = 0;
-const SHA256_BYTES = 32;
-const ROOT_PATH = new Uint8Array([SLASH_BYTE]);
+const OPERATION = "snapshotDelta";
+const RULE_CHECK = "@effect-vfs/core/deltaRuleCheck";
 const Path = CanonicalBase64.Encoded;
-const InlinePayload = Schema.TaggedStruct("Inline", { bytes: CanonicalBase64.Encoded });
-const BasePayload = Schema.TaggedStruct("Base", { path: Path });
-const Payload = Schema.Union([InlinePayload, BasePayload]);
-const DeltaRecord = Schema.Union([
-    Schema.Struct({ kind: Schema.Literal("directory"), paths: Schema.Array(Path), metadata: Image.StoredMetadata }),
-    Schema.Struct({
-        kind: Schema.Literal("file"),
-        paths: Schema.Array(Path),
-        metadata: Image.StoredMetadata,
-        payload: Payload
-    }),
-    Schema.Struct({
-        kind: Schema.Literal("symlink"),
-        paths: Schema.Array(Path),
-        metadata: Image.StoredMetadata,
-        payload: Payload
-    })
-]);
-const AddedChange = Schema.TaggedStruct("Added", { path: Path, kind: SnapshotNodeKind });
-const RemovedChange = Schema.TaggedStruct("Removed", { path: Path, kind: SnapshotNodeKind });
-const UpdatedChange = Schema.TaggedStruct("Updated", {
-    path: Path,
-    beforeKind: SnapshotNodeKind,
-    afterKind: SnapshotNodeKind,
-    differences: Schema.Array(SnapshotDifference).check(Schema.isMinLength(1))
+// Unchanged payloads come from the base; a new hard link points to the group's first changed path.
+const InlineContent = Schema.TaggedStruct("Inline", { bytes: CanonicalBase64.Encoded });
+const DeltaNode = Schema.TaggedUnion({
+    directory: { metadata: StoredMetadata },
+    file: { metadata: StoredMetadata, content: Schema.optionalKey(InlineContent) },
+    symlink: { metadata: StoredMetadata, target: Schema.optionalKey(CanonicalBase64.Encoded) },
+    link: { to: Path }
 });
-const Change = Schema.Union([AddedChange, RemovedChange, UpdatedChange]);
-const WirePayload = Schema.Union([
-    Schema.TaggedStruct("Inline", { bytes: Schema.String }),
-    Schema.TaggedStruct("Base", { path: Schema.String })
-]);
-const WireDeltaRecord = Schema.Union([
-    Schema.Struct({
-        kind: Schema.Literal("directory"),
-        paths: Schema.Array(Schema.String),
-        metadata: WireStoredMetadata
-    }),
-    Schema.Struct({
-        kind: Schema.Literal("file"),
-        paths: Schema.Array(Schema.String),
-        metadata: WireStoredMetadata,
-        payload: WirePayload
-    }),
-    Schema.Struct({
-        kind: Schema.Literal("symlink"),
-        paths: Schema.Array(Schema.String),
-        metadata: WireStoredMetadata,
-        payload: WirePayload
-    })
-]);
-const WireChange = Schema.Union([
-    Schema.TaggedStruct("Added", { path: Schema.String, kind: SnapshotNodeKind }),
-    Schema.TaggedStruct("Removed", { path: Schema.String, kind: SnapshotNodeKind }),
-    Schema.TaggedStruct("Updated", {
-        path: Schema.String,
+const Change = Schema.TaggedUnion({
+    Added: { path: Path, kind: SnapshotNodeKind, node: DeltaNode },
+    Removed: { path: Path, kind: SnapshotNodeKind },
+    Updated: {
+        path: Path,
         beforeKind: SnapshotNodeKind,
         afterKind: SnapshotNodeKind,
-        differences: Schema.Array(SnapshotDifference).check(Schema.isMinLength(1))
-    })
-]);
-const sameChanges = Schema.toEquivalence(Schema.Array(Change));
-const VersionProbe = Schema.Struct({
-    format: Schema.Literal(FORMAT),
-    version: Schema.Unknown
+        differences: Schema.Array(SnapshotDifference).check(Schema.isMinLength(1)),
+        node: DeltaNode
+    }
 });
 const Document = Schema.Struct({
     format: Schema.Literal(FORMAT),
     version: Schema.Literal(1),
-    base: Schema.Struct({ algorithm: Schema.Literal(ALGORITHM), digest: CanonicalBase64.Encoded }),
-    records: Schema.Array(DeltaRecord),
+    base: CanonicalBase64.Encoded,
+    target: CanonicalBase64.Encoded,
     changes: Schema.Array(Change)
 });
-const WireDocument = Schema.Struct({
+const VersionProbe = Schema.Struct({
     format: Schema.Literal(FORMAT),
-    version: Schema.Literal(1),
-    base: Schema.Struct({ algorithm: Schema.Literal(ALGORITHM), digest: Schema.String }),
-    records: Schema.Array(WireDeltaRecord),
-    changes: Schema.Array(WireChange)
+    version: Schema.Unknown
 });
-const timestampFields = new Set(["atimeNs", "mtimeNs", "ctimeNs", "birthtimeNs"]);
 const differenceOrder = SnapshotDifference.literals;
-const encoder = new TextEncoder();
-const Json = Schema.fromJsonString(Schema.Unknown);
-const JsonDocument = Schema.fromJsonString(Document);
+const timestampFields = new Set(["atimeNs", "mtimeNs", "ctimeNs", "birthtimeNs"]);
 const key = Encoding.encodeHex;
-const join = (parent, name) => {
-    const out = new Uint8Array(parent.length + (parent.length === 1 ? 0 : 1) + name.length);
-    out.set(parent);
-    let offset = parent.length;
-    if (parent.length !== 1)
-        out[offset++] = SLASH_BYTE;
-    out.set(name, offset);
-    return out;
-};
-const parentKey = (path) => {
-    let slash = path.length - 1;
-    while (slash > 0 && path[slash] !== SLASH_BYTE)
-        slash--;
-    return key(slash === 0 ? ROOT_PATH : path.subarray(0, slash));
-};
-const basename = (path) => {
-    let slash = path.length - 1;
-    while (slash > 0 && path[slash] !== SLASH_BYTE)
-        slash--;
-    return path.subarray(slash + 1);
-};
-const safeAdd = (a, b) => {
-    const n = a + b;
-    return Number.isSafeInteger(n) ? n : undefined;
-};
-const exceeds = (value, limit) => ByteSize.isGreaterThan(ByteSize.bytes(value), limit);
 const validPath = (path) => {
-    if (path.length === 0 || path[0] !== SLASH_BYTE || path.includes(NUL_BYTE) ||
-        (path.length > 1 && path.at(-1) === SLASH_BYTE))
+    if (path[0] !== SLASH_BYTE)
         return false;
-    if (path.length === 1)
-        return true;
     let start = 1;
-    for (let i = 1; i <= path.length; i++) {
+    for (let i = 1; i <= path.length && path.length > 1; i++) {
         if (i === path.length || path[i] === SLASH_BYTE) {
-            const length = i - start;
-            if (length < 1 || length > MAX_NAME_BYTES || (length === 1 && path[start] === DOT_BYTE) ||
-                (length === 2 && path[start] === DOT_BYTE && path[start + 1] === DOT_BYTE))
+            if (!isNameBytes(path.subarray(start, i)))
                 return false;
             start = i + 1;
         }
     }
     return true;
 };
-const roleBudget = (limits, role) => role === "base"
-    ? {
-        records: limits.maxBaseRecords,
-        recordsField: "baseRecords",
-        pathBytes: limits.maxIdentityBytes,
-        pathBytesField: "identityBytes",
-        payloadBytes: limits.maxIdentityBytes,
-        payloadBytesField: "identityBytes"
-    }
-    : {
-        records: limits.maxTargetRecords,
-        recordsField: "targetRecords",
-        pathBytes: limits.maxDecodedDeltaBytes,
-        pathBytesField: "decodedDeltaBytes",
-        payloadBytes: limits.maxOutputBytes,
-        payloadBytesField: "outputBytes"
-    };
-const encodedPayload = (record) => Match.value(record).pipe(Match.tag("directory", () => undefined), Match.tag("file", (record) => record.data), Match.tag("symlink", (record) => record.target), Match.exhaustive);
-const normalize = Effect.fnUntraced(function* (snapshot, limits, role) {
-    const doc = yield* Image.inspect(snapshot);
-    const budget = roleBudget(limits, role);
-    if (doc.records.length > budget.records) {
-        return yield* new ImageError({ code: "LimitExceeded", field: budget.recordsField });
+const splitNames = (path) => {
+    const names = [];
+    if (path.length === 1)
+        return names;
+    let start = 1;
+    for (let i = 1; i <= path.length; i++) {
+        if (i === path.length || path[i] === SLASH_BYTE) {
+            names.push(key(path.subarray(start, i)));
+            start = i + 1;
+        }
     }
-    const records = new Map(doc.records.map((record) => [record.id, record]));
-    const pathsById = new Map();
-    const pending = [[doc.root, ROOT_PATH]];
-    let entries = 0;
-    let pathBytes = ByteSize.bytes(ROOT_PATH.length);
-    // Index loop: `pending` grows while it is being walked.
-    for (let i = 0; i < pending.length; i++) {
-        const [recordId, path] = pending[i];
-        const record = records.get(recordId);
-        if (record === undefined)
-            return yield* new ImageError({ code: "InvalidStructure", field: role });
-        const paths = pathsById.get(recordId);
-        if (paths === undefined)
-            pathsById.set(recordId, [path]);
-        else
-            paths.push(path);
-        if (Image.Record.guards.directory(record)) {
-            for (const entry of record.entries) {
-                if (++entries > limits.maxEntries)
-                    return yield* new ImageError({ code: "LimitExceeded", field: "entries" });
-                const separator = path.length === ROOT_PATH.length ? 0 : 1;
-                const pathLength = path.length + separator + CanonicalBase64.decodedLength(entry.name);
-                pathBytes = ByteSize.sum(pathBytes, ByteSize.bytes(pathLength));
-                if (ByteSize.isGreaterThan(pathBytes, budget.pathBytes)) {
-                    return yield* new ImageError({ code: "LimitExceeded", field: budget.pathBytesField });
-                }
-                pending.push([entry.target, join(path, yield* CanonicalBase64.decode(entry.name))]);
+    return names;
+};
+const kindOf = (change) => Change.guards.Updated(change) ? change.afterKind : change.kind;
+const payloadDifference = (kind) => (kind === "file" ? "content" : "target");
+const carriesPayload = (change) => Change.guards.Added(change) ||
+    (Change.guards.Updated(change) &&
+        (change.differences.includes("kind") || change.differences.includes(payloadDifference(change.afterKind))));
+const carriedPayload = (node) => DeltaNode.guards.file(node) ? node.content?.bytes : DeltaNode.guards.symlink(node) ? node.target : undefined;
+const changesIssue = (changes) => {
+    const at = (path, issue) => ({ path: ["changes", ...path], issue });
+    const heads = new Map();
+    let previous;
+    for (const [index, change] of changes.entries()) {
+        const path = CanonicalBase64.toBytes(change.path);
+        if (!validPath(path) || (previous !== undefined && bytesOrder(previous, path) >= 0)) {
+            return at([], "changes ascend by path bytes, each a valid path");
+        }
+        previous = path;
+        const root = path.length === 1;
+        if (Change.guards.Removed(change)) {
+            if (root)
+                return at([index], "the root is never removed");
+            continue;
+        }
+        if (Change.guards.Added(change) && root)
+            return at([index], "the root is never added");
+        if (Change.guards.Updated(change)) {
+            const positions = change.differences.map((field) => differenceOrder.indexOf(field));
+            if (positions.some((position, place) => place > 0 && position <= positions[place - 1])) {
+                return at([index, "differences"], "differences are listed once each in their canonical order");
+            }
+            if (change.differences.includes("kind") !== (change.beforeKind !== change.afterKind)) {
+                return at([index, "differences"], "an update lists kind exactly when the kind changes");
+            }
+            if (root && (change.beforeKind !== "directory" || change.afterKind !== "directory")) {
+                return at([index], "the root stays a directory");
             }
         }
-    }
-    const objects = [];
-    const byPath = new Map();
-    let payloadBytes = ByteSize.zero;
-    for (const record of doc.records) {
-        const paths = pathsById.get(record.id);
-        if (paths === undefined)
-            return yield* new ImageError({ code: "InvalidStructure", field: role });
-        paths.sort(bytesOrder);
-        const encoded = encodedPayload(record);
-        if (encoded !== undefined) {
-            payloadBytes = ByteSize.sum(payloadBytes, ByteSize.bytes(CanonicalBase64.decodedLength(encoded)));
-            if (ByteSize.isGreaterThan(payloadBytes, budget.payloadBytes)) {
-                return yield* new ImageError({ code: "LimitExceeded", field: budget.payloadBytesField });
+        const kind = kindOf(change);
+        const node = change.node;
+        if (DeltaNode.guards.link(node)) {
+            if (heads.get(node.to) !== kind) {
+                return at([index, "node", "to"], "a link names an earlier change's file or symbolic link of its kind");
             }
+            continue;
         }
-        const object = {
-            kind: record._tag,
-            metadata: record.metadata,
-            paths,
-            pathIdentity: paths.map(key).join("/"),
-            payload: encoded === undefined ? undefined : yield* CanonicalBase64.decode(encoded)
-        };
-        objects.push(object);
-        for (const path of paths)
-            byPath.set(key(path), { object, path });
+        if (node._tag !== kind)
+            return at([index, "node"], "a node matches its change's kind");
+        if (DeltaNode.guards.directory(node))
+            continue;
+        if ((carriedPayload(node) !== undefined) !== carriesPayload(change)) {
+            return at([index, "node"], "a node carries its payload exactly when the change alters it");
+        }
+        if (DeltaNode.guards.symlink(node) && node.target !== undefined &&
+            CanonicalBase64.toBytes(node.target).includes(NUL_BYTE)) {
+            return at([index, "node", "target"], "a symbolic link's target holds no NUL");
+        }
+        heads.set(change.path, kind);
     }
-    objects.sort((a, b) => bytesOrder(a.paths[0], b.paths[0]));
-    return { objects, byPath };
-});
-const U64_BYTES = 8;
-const EMPTY = new Uint8Array();
-const IDENTITY_PREFIX = encoder.encode(`${ALGORITHM}\0`);
-const KIND_BYTE = { directory: 0, file: 1, symlink: 2 };
-const u64 = (n) => {
-    const out = new Uint8Array(U64_BYTES);
-    new DataView(out.buffer).setBigUint64(0, BigInt(n), false);
-    return out;
 };
-const framedLength = (bytes) => U64_BYTES + bytes.length;
-const timestampBytes = (metadata) => [metadata.atimeNs, metadata.mtimeNs, metadata.ctimeNs, metadata.birthtimeNs].map((value) => encoder.encode(String(value)));
-// This is the versioned semantic identity encoding, not a generic byte builder.
-// Field framing, ordering, and the domain prefix are part of the persisted delta contract.
-const identityBytes = (view, limits) => {
-    const timestamps = view.objects.map((object) => timestampBytes(object.metadata));
-    let total = ByteSize.bytes(IDENTITY_PREFIX.length + U64_BYTES);
-    for (const [index, object] of view.objects.entries()) {
-        const objectBytes = U64_BYTES +
-            object.paths.reduce((sum, path) => sum + framedLength(path), 0) +
-            1 + 3 * U64_BYTES +
-            timestamps[index].reduce((sum, stamp) => sum + framedLength(stamp), 0) +
-            framedLength(object.payload ?? EMPTY);
-        total = ByteSize.sum(total, ByteSize.bytes(objectBytes));
-    }
-    if (ByteSize.isGreaterThan(total, limits.maxIdentityBytes)) {
-        return Result.fail(new ImageError({ code: "LimitExceeded", field: "identityBytes" }));
+const ValidDocument = Document.check(Schema.makeFilter((document) => changesIssue(document.changes) ?? true, {
+    identifier: "ValidSnapshotDelta",
+    [RULE_CHECK]: true
+}));
+const JsonDocument = Schema.fromJsonString(Document);
+const Json = Schema.fromJsonString(Schema.Unknown);
+const decodeDocument = Schema.decodeUnknownEffect(ValidDocument, { onExcessProperty: "error" });
+// Preserve the codec's stable error fields for digest, path, and payload failures.
+const failureField = (path) => {
+    const [head, , field] = path;
+    if (head === "base" || head === "target")
+        return "digest";
+    if (head === "changes" && path.length === 3 && field === "path")
+        return "changePath";
+    if (head === "changes" && field === "node" && (path[3] === "target" || path.at(-1) === "bytes"))
+        return "payload";
+    return path.length === 0 ? "document" : path.map(String).join(".");
+};
+const decodeFailure = (error) => {
+    const site = issueSite(error.issue);
+    const rule = site.checks.some((check) => check.annotations?.[RULE_CHECK] === true);
+    return rule
+        ? imageFailure(OPERATION, "InvalidStructure", { field: site.path.map(String).join("."), cause: error })
+        : imageFailure(OPERATION, isEncodingIssue(site) ? "InvalidEncoding" : "InvalidStructure", {
+            field: failureField(site.path),
+            cause: error
+        });
+};
+const exceeds = (value, limit) => ByteSize.isGreaterThan(ByteSize.bytes(value), limit);
+const validate = (document, limits) => {
+    const fail = (code, field) => Result.fail(imageFailure(OPERATION, code, { field }));
+    if (document.changes.length > limits.records)
+        return fail("LimitExceeded", "deltaRecords");
+    for (const digest of [document.base, document.target]) {
+        if (CanonicalBase64.decodedLength(digest) !== Merkle.DIGEST_BYTES)
+            return fail("InvalidEncoding", "digest");
     }
-    const output = new Uint8Array(Number(ByteSize.toBigInt(total)));
-    let offset = 0;
-    const put = (bytes) => {
-        output.set(bytes, offset);
-        offset += bytes.length;
-    };
-    const frame = (bytes) => {
-        put(u64(bytes.length));
-        put(bytes);
-    };
-    put(IDENTITY_PREFIX);
-    put(u64(view.objects.length));
-    for (const [index, object] of view.objects.entries()) {
-        put(u64(object.paths.length));
-        for (const path of object.paths)
-            frame(path);
-        put(new Uint8Array([KIND_BYTE[object.kind]]));
-        put(u64(object.metadata.uid));
-        put(u64(object.metadata.gid));
-        put(u64(object.metadata.mode));
-        for (const stamp of timestamps[index])
-            frame(stamp);
-        frame(object.payload ?? EMPTY);
+    let decoded = 2 * Merkle.DIGEST_BYTES;
+    let entries = 0;
+    let payloadBytes = 0;
+    for (const change of document.changes) {
+        const pathBytes = CanonicalBase64.decodedLength(change.path);
+        decoded += pathBytes;
+        if (Change.guards.Removed(change))
+            continue;
+        if (pathBytes > 1)
+            entries++;
+        if (DeltaNode.guards.link(change.node))
+            decoded += CanonicalBase64.decodedLength(change.node.to);
+        else {
+            const payload = carriedPayload(change.node);
+            const length = payload === undefined ? 0 : CanonicalBase64.decodedLength(payload);
+            decoded += length;
+            payloadBytes += length;
+        }
     }
-    return Result.succeed(output);
+    if (exceeds(decoded, limits.decodedBytes))
+        return fail("LimitExceeded", "decodedDeltaBytes");
+    if (entries > limits.entries)
+        return fail("LimitExceeded", "entries");
+    if (exceeds(payloadBytes, limits.outputBytes))
+        return fail("LimitExceeded", "outputBytes");
+    return Result.void;
 };
-const digest = Effect.fnUntraced(function* (view, limits) {
-    const crypto = yield* Crypto.Crypto;
-    return yield* crypto.digest("SHA-256", yield* Effect.fromResult(identityBytes(view, limits)));
+const baseBudget = (limits) => ({
+    operation: OPERATION,
+    records: limits.baseRecords,
+    recordsField: "baseRecords",
+    entries: limits.entries,
+    identityBytes: limits.identityBytes
+});
+const targetBudget = (limits) => ({
+    operation: OPERATION,
+    records: limits.targetRecords,
+    recordsField: "targetRecords",
+    entries: limits.entries,
+    identityBytes: limits.identityBytes,
+    payloadBytes: { limit: limits.outputBytes, field: "outputBytes" }
 });
-const samePaths = (a, b) => a.pathIdentity === b.pathIdentity;
-const differences = (before, after) => differenceOrder.filter((field) => {
+// Check target bounds first so applying and diffing report the same limit.
+const outputIssue = (limits, output) => {
+    const fail = (field) => Result.fail(imageFailure(OPERATION, "LimitExceeded", { field }));
+    if (output.records > limits.targetRecords)
+        return fail("targetRecords");
+    if (output.entries > limits.entries)
+        return fail("entries");
+    if (output.records > limits.outputRecords)
+        return fail("outputRecords");
+    if (exceeds(output.payloadBytes, limits.outputBytes))
+        return fail("outputBytes");
+    if (output.records - output.written > limits.inheritedRecords)
+        return fail("inheritedRecords");
+    return Result.void;
+};
+const groupKey = (paths) => paths.map(key).join("/");
+const side = (value, identity) => {
+    const groupOf = new Map();
+    const firstOf = new Map();
+    for (const [ino, paths] of identity.groups) {
+        const group = groupKey(paths);
+        firstOf.set(ino, paths[0]);
+        for (const path of paths)
+            groupOf.set(key(path), group);
+    }
+    return { value, identity, groupOf, firstOf };
+};
+const groupAt = (side, pathKey) => side.groupOf.get(pathKey) ?? pathKey;
+const differencesOf = (before, after, hardLinks) => differenceOrder.filter((field) => {
     if (field === "kind")
         return before.kind !== after.kind;
-    if (field === "content") {
-        return before.kind === after.kind && after.kind === "file" && !sameBytes(before.payload, after.payload);
-    }
-    if (field === "target") {
-        return before.kind === after.kind && after.kind === "symlink" && !sameBytes(before.payload, after.payload);
+    if (field === "content" || field === "target") {
+        return before.kind === after.kind && after.kind !== "directory" && payloadDifference(after.kind) === field &&
+            !sameBytes(payloadOf(before), payloadOf(after));
     }
     if (field === "hardLinks")
-        return !samePaths(before, after);
+        return hardLinks;
     return before.metadata[field] !== after.metadata[field];
 });
+const deltaNode = (target, path, node, withPayload) => {
+    const first = target.firstOf.get(node.ino);
+    if (node.kind !== "directory" && first !== undefined && !sameBytes(first, path)) {
+        return DeltaNode.cases.link.make({ to: CanonicalBase64.encode(first) }, UNCHECKED);
+    }
+    const metadata = storedMetadata(node.metadata);
+    return Match.value(node).pipe(Match.discriminator("kind")("directory", () => DeltaNode.cases.directory.make({ metadata }, UNCHECKED)), Match.discriminator("kind")("file", (file) => DeltaNode.cases.file.make(withPayload
+        ? { metadata, content: InlineContent.make({ bytes: CanonicalBase64.encode(file.data) }, UNCHECKED) }
+        : { metadata }, UNCHECKED)), Match.discriminator("kind")("symlink", (symlink) => DeltaNode.cases.symlink.make(withPayload ? { metadata, target: CanonicalBase64.encode(symlink.target) } : { metadata }, UNCHECKED)), Match.exhaustive);
+};
+const lookup = (get, entriesOf, path) => {
+    let parent = ROOT_INO;
+    let node = get(ROOT_INO);
+    let name = "";
+    for (const component of splitNames(path)) {
+        if (node?.kind !== "directory")
+            return undefined;
+        const ino = entriesOf(node).get(component);
+        if (ino === undefined)
+            return undefined;
+        parent = node.ino;
+        name = component;
+        node = get(ino);
+    }
+    return node === undefined ? undefined : { parent, name, node };
+};
+const valueEntries = (directory) => directory.entries;
+// Equal digests skip a subtree; hard-link groups still need a separate path comparison.
 const compare = (base, target) => {
     const changes = [];
-    const add = (change, path) => changes.push({ change, path });
-    // Memoized per object pair so hard-link groups compare each pair once.
-    const cachedDifferences = Fn.memoize((before) => Fn.memoize((after) => differences(before, after)));
-    for (const [pathKey, before] of base.byPath) {
-        const after = target.byPath.get(pathKey);
-        if (after === undefined) {
-            add(RemovedChange.make({ path: CanonicalBase64.encode(before.path), kind: before.object.kind }), before.path);
+    const listed = new Set();
+    const pending = [];
+    const encode = CanonicalBase64.encode;
+    const children = (path, before, after) => {
+        const names = new Set([
+            ...(before?.kind === "directory" ? before.entries.keys() : []),
+            ...(after?.kind === "directory" ? after.entries.keys() : [])
+        ]);
+        for (const name of names) {
+            const b = before?.kind === "directory" ? before.entries.get(name) : undefined;
+            const a = after?.kind === "directory" ? after.entries.get(name) : undefined;
+            pending.push([
+                joinPath(path, nameBytes(name)),
+                b === undefined ? undefined : getNode(base.value, b),
+                a === undefined ? undefined : getNode(target.value, a)
+            ]);
         }
-        else {
-            const diff = cachedDifferences(before.object)(after.object);
-            if (diff.length > 0) {
-                add(UpdatedChange.make({
-                    path: CanonicalBase64.encode(before.path),
-                    beforeKind: before.object.kind,
-                    afterKind: after.object.kind,
-                    differences: diff
-                }), before.path);
-            }
+    };
+    const updated = (path, before, after, differences) => changes.push({
+        path,
+        change: Change.cases.Updated.make({
+            path: encode(path),
+            beforeKind: before.kind,
+            afterKind: after.kind,
+            differences,
+            node: deltaNode(target, path, after, differences.includes("kind") || differences.includes(payloadDifference(after.kind)))
+        }, UNCHECKED)
+    });
+    pending.push([ROOT_PATH, getNode(base.value, ROOT_INO), getNode(target.value, ROOT_INO)]);
+    while (pending.length > 0) {
+        const [path, before, after] = pending.pop();
+        const pathKey = key(path);
+        if (base.groupOf.has(pathKey) || target.groupOf.has(pathKey))
+            listed.add(pathKey);
+        if (before === undefined && after !== undefined) {
+            changes.push({
+                path,
+                change: Change.cases.Added.make({ path: encode(path), kind: after.kind, node: deltaNode(target, path, after, true) }, UNCHECKED)
+            });
+            children(path, undefined, after);
+        }
+        else if (before !== undefined && after === undefined) {
+            changes.push({ path, change: Change.cases.Removed.make({ path: encode(path), kind: before.kind }, UNCHECKED) });
+            children(path, before, undefined);
+        }
+        else if (before !== undefined && after !== undefined) {
+            const same = sameBytes(base.identity.digests.get(before.ino), target.identity.digests.get(after.ino));
+            const hardLinks = groupAt(base, pathKey) !== groupAt(target, pathKey);
+            if (same && !hardLinks)
+                continue;
+            const differences = differencesOf(before, after, hardLinks);
+            if (differences.length > 0)
+                updated(path, before, after, differences);
+            if (!same)
+                children(path, before, after);
         }
     }
-    for (const [pathKey, after] of target.byPath) {
-        if (!base.byPath.has(pathKey)) {
-            add(AddedChange.make({ path: CanonicalBase64.encode(after.path), kind: after.object.kind }), after.path);
+    for (const s of [base, target]) {
+        for (const paths of s.identity.groups.values()) {
+            for (const path of paths) {
+                const pathKey = key(path);
+                if (listed.has(pathKey))
+                    continue;
+                listed.add(pathKey);
+                if (groupAt(base, pathKey) === groupAt(target, pathKey))
+                    continue;
+                const before = lookup((ino) => getNode(base.value, ino), valueEntries, path).node;
+                const after = lookup((ino) => getNode(target.value, ino), valueEntries, path).node;
+                updated(path, before, after, ["hardLinks"]);
+            }
         }
     }
-    changes.sort((a, b) => bytesOrder(a.path, b.path));
-    return changes.map(({ change }) => change);
+    return changes.sort(Order.mapInput(bytesOrder, (entry) => entry.path)).map(({ change }) => change);
 };
 const getDocument = (delta) => Effect.suspend(() => {
     const value = SnapshotDeltaModel.value(delta);
     return value !== undefined && Schema.is(Document)(value)
         ? Effect.succeed(value)
-        : Effect.fail(new ImageError({ code: "InvalidStructure", field: "delta" }));
+        : Effect.fail(imageFailure(OPERATION, "InvalidStructure", { field: "delta" }));
 });
-const byEntryName = (a, b) => bytesOrder(a.name, b.name);
-// Every recorded path must be the root directory or the child of a recorded directory.
-// Together with `validPath` and the per-record path rules in `validate`, this subsumes the
-// structural checks `Image.capture` would otherwise perform on the applied image.
-const linkTree = (paths) => {
-    const rootKey = key(ROOT_PATH);
-    const root = paths.get(rootKey);
-    if (root?.kind !== "directory")
-        return Result.fail(new ImageError({ code: "InvalidStructure", field: "root" }));
-    const entriesById = new Map();
-    for (const entry of paths.values()) {
-        if (entry.kind === "directory")
-            entriesById.set(entry.id, []);
-    }
-    for (const [pathKey, child] of paths) {
-        if (pathKey === rootKey)
+// Detach deepest paths first, then attach from the root. Check each claimed change against the base: a matching
+// target digest alone cannot detect unreachable children or forged hard-link groups.
+const fold = (base, identity, document) => {
+    const fail = (index, field) => Result.fail(imageFailure(OPERATION, "InvalidStructure", {
+        field: field === undefined ? `changes.${index}` : `changes.${index}.${field}`
+    }));
+    const owner = Symbol();
+    const revision = base.revision + 1n;
+    let inodes = base.inodes;
+    let nextInode = base.nextInode;
+    let entries = base.entries;
+    let usedBytes = base.usedBytes;
+    let records = identity.records;
+    let payloadBytes = identity.payloadBytes;
+    let written = 0;
+    const drafts = new Map();
+    const dirty = new Set();
+    const removed = new Set();
+    const created = new Map();
+    const get = (ino) => InodeTable.get(inodes, ino);
+    const put = (ino, node) => {
+        inodes = InodeTable.set(inodes, ino, node, owner);
+    };
+    const entriesOf = (directory) => drafts.get(directory.ino) ?? directory.entries;
+    const editable = (directory) => {
+        let draft = drafts.get(directory);
+        if (draft === undefined) {
+            const node = get(directory);
+            draft = new Map(node?.kind === "directory" ? node.entries : []);
+            drafts.set(directory, draft);
+        }
+        dirty.add(directory);
+        return draft;
+    };
+    const placed = document.changes.map((change, index) => {
+        const path = CanonicalBase64.toBytes(change.path);
+        return { index, change, path, pathKey: key(path) };
+    });
+    const changed = new Map(placed.map(({ change, pathKey }) => [pathKey, change]));
+    const before = new Map();
+    for (const { change, index, path, pathKey } of placed) {
+        if (Change.guards.Added(change))
             continue;
-        const parent = paths.get(parentKey(child.bytes));
-        const entries = parent === undefined ? undefined : entriesById.get(parent.id);
-        if (entries === undefined)
-            return Result.fail(new ImageError({ code: "InvalidStructure", field: "parent" }));
-        entries.push({ name: basename(child.bytes), target: child.id });
-    }
-    for (const entries of entriesById.values())
-        entries.sort(byEntryName);
-    return Result.succeed({ root: root.id, entriesById });
-};
-const inheritedPayload = Effect.fnUntraced(function* (base, kind, encodedPath) {
-    const source = base.byPath.get(key(yield* CanonicalBase64.decode(encodedPath)))?.object;
-    return source?.kind === kind ? source.payload : undefined;
-});
-// Expects a document that already passed `validate`.
-const buildImage = Effect.fnUntraced(function* (document, base, limits) {
-    const paths = new Map();
-    for (const [index, record] of document.records.entries()) {
-        for (const encodedPath of record.paths) {
-            const bytes = yield* CanonicalBase64.decode(encodedPath);
-            paths.set(key(bytes), { id: String(index), kind: record.kind, bytes });
+        const found = lookup((ino) => getNode(base, ino), valueEntries, path);
+        if (found?.node.kind !== (Change.guards.Updated(change) ? change.beforeKind : change.kind))
+            return fail(index);
+        before.set(pathKey, found);
+        // Reject partial removal of hard links or directory contents.
+        for (const member of identity.groups.get(found.node.ino) ?? []) {
+            const other = changed.get(key(member));
+            if (other === undefined || Change.guards.Added(other))
+                return fail(index);
+        }
+        if (found.node.kind === "directory" && (Change.guards.Removed(change) || kindOf(change) !== "directory")) {
+            for (const name of found.node.entries.keys()) {
+                const child = changed.get(key(joinPath(path, nameBytes(name))));
+                if (child === undefined || !Change.guards.Removed(child))
+                    return fail(index);
+            }
         }
     }
-    const tree = yield* Effect.fromResult(linkTree(paths));
-    const records = [];
-    let outputBytes = ByteSize.zero;
-    for (const [index, record] of document.records.entries()) {
-        const id = String(index);
-        if (record.kind === "directory") {
-            records.push(Image.Record.cases.directory.make({
-                id,
-                metadata: record.metadata,
-                entries: (tree.entriesById.get(id) ?? []).map((entry) => ({
-                    name: CanonicalBase64.encode(entry.name),
-                    target: entry.target
-                }))
-            }));
+    const inPlace = (change) => Change.guards.Updated(change) && change.beforeKind === "directory" && change.afterKind === "directory";
+    for (let index = placed.length - 1; index >= 0; index--) {
+        const { change, pathKey } = placed[index];
+        if (Change.guards.Added(change) || inPlace(change))
+            continue;
+        const { name, node, parent } = before.get(pathKey);
+        editable(parent).delete(name);
+        entries--;
+        const current = get(node.ino);
+        if (current === undefined)
+            continue;
+        if (current.kind === "directory") {
+            put(current.ino, undefined);
+            removed.add(current.ino);
+            records--;
             continue;
         }
-        const payload = Predicate.isTagged("Inline")(record.payload)
-            ? yield* CanonicalBase64.decode(record.payload.bytes)
-            : yield* inheritedPayload(base, record.kind, record.payload.path);
-        if (payload === undefined)
-            return yield* new ImageError({ code: "InvalidStructure", field: "baseReference" });
-        outputBytes = ByteSize.sum(outputBytes, ByteSize.bytes(payload.length));
-        if (ByteSize.isGreaterThan(outputBytes, limits.maxOutputBytes)) {
-            return yield* new ImageError({ code: "LimitExceeded", field: "outputBytes" });
+        const links = current.links.filter((link) => !(link.parent === parent && link.name === name));
+        if (links.length > 0) {
+            put(current.ino, { ...current, links, metadata: { ...current.metadata, nlink: links.length } });
+            continue;
         }
-        records.push(record.kind === "file"
-            ? Image.Record.cases.file.make({ id, metadata: record.metadata, data: CanonicalBase64.encode(payload) })
-            : Image.Record.cases.symlink.make({
-                id,
-                metadata: record.metadata,
-                target: CanonicalBase64.encode(payload)
-            }));
-    }
-    return yield* Image.capture({ format: "effect-vfs", version: 1, root: tree.root, records }, undefined, true);
-});
-const validate = Effect.fnUntraced(function* (document, limits) {
-    const deltaRecords = safeAdd(document.records.length, document.changes.length);
-    if (deltaRecords === undefined || deltaRecords > limits.maxDeltaRecords) {
-        return yield* new ImageError({ code: "LimitExceeded", field: "deltaRecords" });
-    }
-    if (document.records.length > limits.maxOutputRecords) {
-        return yield* new ImageError({ code: "LimitExceeded", field: "outputRecords" });
-    }
-    if (!CanonicalBase64.is(document.base.digest) ||
-        CanonicalBase64.decodedLength(document.base.digest) !== SHA256_BYTES) {
-        return yield* new ImageError({ code: "InvalidEncoding", field: "digest" });
+        const size = payloadOf(current).length;
+        put(current.ino, undefined);
+        removed.add(current.ino);
+        records--;
+        payloadBytes -= size;
+        usedBytes -= BigInt(size);
     }
-    let decoded = ByteSize.bytes(SHA256_BYTES);
-    let outputBytes = ByteSize.zero;
-    let entries = -1;
-    let inherited = 0;
-    const paths = new Map();
-    const charge = (encoded) => {
-        decoded = ByteSize.sum(decoded, ByteSize.bytes(CanonicalBase64.decodedLength(encoded)));
-        return ByteSize.isGreaterThan(decoded, limits.maxDecodedDeltaBytes)
-            ? Effect.fail(new ImageError({ code: "LimitExceeded", field: "decodedDeltaBytes" }))
-            : Effect.void;
-    };
-    for (const [index, record] of document.records.entries()) {
-        if (record.paths.length < 1 || (record.kind === "directory" && record.paths.length !== 1)) {
-            return yield* new ImageError({ code: "InvalidStructure", field: "paths" });
+    const after = new Map();
+    for (const { change, index, path, pathKey } of placed) {
+        if (Change.guards.Removed(change))
+            continue;
+        const node = change.node;
+        if (!DeltaNode.guards.link(node))
+            written++;
+        if (inPlace(change)) {
+            const current = get(before.get(pathKey).node.ino);
+            if (current?.kind !== "directory" || !DeltaNode.guards.directory(node))
+                return fail(index);
+            put(current.ino, { ...current, metadata: { ...current.metadata, ...node.metadata }, revision });
+            dirty.add(current.ino);
+            after.set(pathKey, current.ino);
+            continue;
         }
-        for (const encodedPath of record.paths) {
-            if (!CanonicalBase64.is(encodedPath)) {
-                return yield* new ImageError({ code: "InvalidEncoding", field: "path" });
-            }
-            yield* charge(encodedPath);
-            entries++;
-            if (entries > limits.maxEntries)
-                return yield* new ImageError({ code: "LimitExceeded", field: "entries" });
-            const bytes = yield* CanonicalBase64.decode(encodedPath);
-            const pathKey = key(bytes);
-            if (!validPath(bytes) || paths.has(pathKey)) {
-                return yield* new ImageError({ code: "InvalidStructure", field: "path" });
-            }
-            paths.set(pathKey, { id: String(index), kind: record.kind, bytes });
+        const name = splitNames(path).at(-1);
+        const parentPath = path.subarray(0, Math.max(1, path.length - name.length / 2 - 1));
+        const parent = lookup(get, entriesOf, parentPath)?.node;
+        if (parent?.kind !== "directory") {
+            return Result.fail(imageFailure(OPERATION, "InvalidStructure", { field: "parent" }));
         }
-        if (record.kind === "directory")
-            continue;
-        if (Predicate.isTagged("Inline")(record.payload)) {
-            if (!CanonicalBase64.is(record.payload.bytes)) {
-                return yield* new ImageError({ code: "InvalidEncoding", field: "payload" });
-            }
-            yield* charge(record.payload.bytes);
-            outputBytes = ByteSize.sum(outputBytes, ByteSize.bytes(CanonicalBase64.decodedLength(record.payload.bytes)));
+        const draft = editable(parent.ino);
+        if (draft.has(name))
+            return fail(index);
+        const link = { parent: parent.ino, name };
+        let ino;
+        if (DeltaNode.guards.link(node)) {
+            const head = after.get(key(CanonicalBase64.toBytes(node.to)));
+            const target = head === undefined ? undefined : get(head);
+            if (target === undefined || target.kind === "directory")
+                return fail(index);
+            ino = target.ino;
+            const links = [...target.links, link];
+            put(ino, { ...target, links, metadata: { ...target.metadata, nlink: links.length } });
+            created.get(ino)?.push(path);
         }
         else {
-            if (!CanonicalBase64.is(record.payload.path)) {
-                return yield* new ImageError({ code: "InvalidEncoding", field: "basePath" });
+            if (nextInode > MAX_INO)
+                return Result.fail(imageFailure(OPERATION, "LimitExceeded", { field: "inodes" }));
+            ino = nextInode;
+            nextInode = Ino(nextInode + 1);
+            const numbered = { ...node.metadata, ino: BigInt(ino) };
+            if (DeltaNode.guards.directory(node)) {
+                const metadata = { ...numbered, kind: "directory", nlink: 2, size: 0n };
+                put(ino, { kind: "directory", ino, parent: parent.ino, name, entries: new Map(), metadata, revision });
             }
-            yield* charge(record.payload.path);
-            inherited++;
-            if (inherited > limits.maxInheritedRecords) {
-                return yield* new ImageError({ code: "LimitExceeded", field: "inheritedRecords" });
-            }
-            if (!validPath(yield* CanonicalBase64.decode(record.payload.path)) || !record.paths.includes(record.payload.path)) {
-                return yield* new ImageError({ code: "InvalidStructure", field: "basePath" });
+            else {
+                const carried = carriedPayload(node);
+                const kept = before.get(pathKey)?.node;
+                const bytes = carried !== undefined
+                    ? CanonicalBase64.toBytes(carried)
+                    : kept === undefined
+                        ? undefined
+                        : payloadOf(kept);
+                if (bytes === undefined)
+                    return fail(index);
+                const counted = { ...numbered, kind: node._tag, nlink: 1, size: BigInt(bytes.length) };
+                put(ino, DeltaNode.guards.file(node)
+                    ? { kind: "file", ino, data: bytes, links: [link], metadata: counted, revision }
+                    : { kind: "symlink", ino, target: bytes, links: [link], metadata: counted, revision });
+                payloadBytes += bytes.length;
+                usedBytes += BigInt(bytes.length);
             }
+            records++;
+            created.set(ino, [path]);
+            dirty.add(ino);
         }
+        draft.set(name, ino);
+        entries++;
+        after.set(pathKey, ino);
     }
-    let previous;
-    for (const change of document.changes) {
-        if (!CanonicalBase64.is(change.path)) {
-            return yield* new ImageError({ code: "InvalidEncoding", field: "changePath" });
-        }
-        yield* charge(change.path);
-        const path = yield* CanonicalBase64.decode(change.path);
-        if (!validPath(path) || (previous !== undefined && bytesOrder(previous, path) >= 0)) {
-            return yield* new ImageError({ code: "InvalidStructure", field: "changes" });
+    const baseGroup = (ino, pathKey) => {
+        const paths = identity.groups.get(ino);
+        return paths === undefined ? pathKey : groupKey(paths);
+    };
+    const targetGroup = (ino, pathKey) => {
+        const paths = created.get(ino);
+        return paths === undefined || paths.length < 2 ? pathKey : groupKey([...paths].sort(bytesOrder));
+    };
+    for (const { change, index, pathKey } of placed) {
+        if (!Change.guards.Updated(change))
+            continue;
+        const was = before.get(pathKey).node;
+        const now = get(after.get(pathKey));
+        const found = differencesOf(was, now, baseGroup(was.ino, pathKey) !== targetGroup(now.ino, pathKey));
+        if (found.length !== change.differences.length || found.some((field, at) => field !== change.differences[at])) {
+            return fail(index, "differences");
         }
-        previous = path;
     }
-    if (ByteSize.isGreaterThan(outputBytes, limits.maxOutputBytes)) {
-        return yield* new ImageError({ code: "LimitExceeded", field: "outputBytes" });
-    }
-    yield* Effect.fromResult(linkTree(paths));
-    // Inline symlink targets are the only applied payloads a base snapshot has not already vetted.
-    for (const record of document.records) {
-        if (record.kind !== "symlink" || !Predicate.isTagged("Inline")(record.payload))
+    for (const [ino, draft] of drafts) {
+        const node = get(ino);
+        if (node?.kind !== "directory")
             continue;
-        if (!CanonicalBase64.is(record.payload.bytes)) {
-            return yield* new ImageError({ code: "InvalidEncoding", field: "payload" });
+        const sorted = [...draft].sort(byEntryName);
+        const subdirectories = sorted.filter(([, child]) => get(child)?.kind === "directory").length;
+        const metadata = { ...node.metadata, nlink: 2 + subdirectories };
+        put(ino, { ...node, entries: new Map(sorted), metadata, revision });
+    }
+    for (const ino of dirty) {
+        let node = get(ino);
+        if (node === undefined)
+            dirty.delete(ino);
+        while (node !== undefined && node.ino !== ROOT_INO) {
+            const parent = node.kind === "directory" ? node.parent : node.links[0].parent;
+            dirty.add(node.ino);
+            if (dirty.has(parent))
+                break;
+            dirty.add(parent);
+            node = get(parent);
         }
-        if ((yield* CanonicalBase64.decode(record.payload.bytes)).includes(NUL_BYTE)) {
-            return yield* new ImageError({ code: "InvalidStructure", field: "symlink" });
+    }
+    const groups = new Map();
+    for (const [ino, paths] of identity.groups)
+        if (get(ino) !== undefined)
+            groups.set(ino, paths);
+    for (const [ino, paths] of created)
+        if (paths.length > 1)
+            groups.set(ino, [...paths].sort(bytesOrder));
+    const value = {
+        inodes,
+        open: new Map(),
+        nextInode,
+        revision: placed.length === 0 ? base.revision : revision,
+        entries,
+        usedBytes
+    };
+    return Result.succeed({ value, dirty, removed, groups, records, entries, payloadBytes, written });
+};
+// Reuse base digests for untouched nodes, but charge the meter for the whole target.
+const foldedIdentity = Effect.fnUntraced(function* (base, folded, identity, limits) {
+    const digests = new Map();
+    const measure = Merkle.meter(targetBudget(limits));
+    let inherited = identity.nodeBytes;
+    for (const ino of new Set([...folded.dirty, ...folded.removed])) {
+        const was = identity.digests.has(ino) ? getNode(base, ino) : undefined;
+        if (was !== undefined)
+            inherited -= Merkle.nodeBytes(was);
+    }
+    yield* measure.charge(inherited);
+    const digestOf = (ino) => digests.get(ino) ?? identity.digests.get(ino);
+    const nodes = [...folded.dirty].map((ino) => getNode(folded.value, ino));
+    const depths = new Map([[ROOT_INO, 0]]);
+    const depth = (node) => {
+        const chain = [];
+        let current = node;
+        while (current?.kind === "directory" && !depths.has(current.ino)) {
+            chain.push(current.ino);
+            current = getNode(folded.value, current.parent);
         }
+        let found = current === undefined ? -1 : depths.get(current.ino) ?? -1;
+        for (const ino of chain.reverse())
+            depths.set(ino, ++found);
+        return depths.get(node.ino);
+    };
+    const directories = nodes.filter((node) => node.kind === "directory");
+    // Digest children before their directories.
+    const ordered = [
+        ...nodes.filter((node) => node.kind !== "directory"),
+        ...directories.sort(Order.flip(Order.mapInput(Order.Number, depth)))
+    ];
+    for (const node of ordered)
+        digests.set(node.ino, yield* Merkle.nodeDigest(node, digestOf, measure));
+    return yield* Merkle.identityDigest(digestOf(ROOT_INO), folded.groups.values(), measure);
+});
+const verify = Effect.fnUntraced(function* (base, document, limits) {
+    yield* Effect.fromResult(validate(document, limits));
+    const value = yield* Image.valueOf(base);
+    const identity = yield* Merkle.identify(value, baseBudget(limits));
+    if (!sameBytes(identity.digest, CanonicalBase64.toBytes(document.base))) {
+        return yield* new VfsError({ code: "BaseMismatch", operation: OPERATION });
     }
+    const folded = yield* Effect.fromResult(fold(value, identity, document));
+    yield* Effect.fromResult(outputIssue(limits, folded));
+    if (!sameBytes(yield* foldedIdentity(value, folded, identity, limits), CanonicalBase64.toBytes(document.target))) {
+        return yield* imageFailure(OPERATION, "InvalidStructure", { field: "changes" });
+    }
+    return folded.value;
 });
 /** @internal */
 export const diffSnapshots = Effect.fnUntraced(function* (base, target, limits) {
-    const before = yield* normalize(base, limits, "base");
-    const after = yield* normalize(target, limits, "target");
-    const changes = [...compare(before, after)];
-    const deltaRecords = safeAdd(after.objects.length, changes.length);
-    if (deltaRecords === undefined || deltaRecords > limits.maxDeltaRecords) {
-        return yield* new ImageError({ code: "LimitExceeded", field: "deltaRecords" });
+    const baseValue = yield* Image.valueOf(base);
+    const targetValue = yield* Image.valueOf(target);
+    const before = side(baseValue, yield* Merkle.identify(baseValue, baseBudget(limits)));
+    const after = side(targetValue, yield* Merkle.identify(targetValue, targetBudget(limits)));
+    const changes = compare(before, after);
+    if (changes.length > limits.records) {
+        return yield* imageFailure(OPERATION, "LimitExceeded", { field: "deltaRecords" });
     }
-    const samePayload = Fn.memoize((source) => Fn.memoize((candidate) => sameBytes(source.payload, candidate.payload)));
-    const records = after.objects.map((object) => {
-        const paths = object.paths.map(CanonicalBase64.encode);
-        if (object.kind === "directory")
-            return { kind: object.kind, paths, metadata: object.metadata };
-        const inherited = object.paths.find((path) => {
-            const source = before.byPath.get(key(path));
-            return source?.object.kind === object.kind && samePayload(source.object)(object);
-        });
-        return {
-            kind: object.kind,
-            paths,
-            metadata: object.metadata,
-            payload: inherited === undefined
-                ? InlinePayload.make({ bytes: CanonicalBase64.encode(object.payload ?? new Uint8Array()) })
-                : BasePayload.make({ path: CanonicalBase64.encode(inherited) })
-        };
-    });
+    const written = changes.filter((change) => !Change.guards.Removed(change) && !DeltaNode.guards.link(change.node));
+    yield* Effect.fromResult(outputIssue(limits, { ...after.identity, entries: targetValue.entries, written: written.length }));
     const document = {
         format: FORMAT,
         version: 1,
-        base: { algorithm: ALGORITHM, digest: CanonicalBase64.encode(yield* digest(before, limits)) },
-        records,
+        base: CanonicalBase64.encode(before.identity.digest),
+        target: CanonicalBase64.encode(after.identity.digest),
         changes
     };
-    yield* validate(document, limits);
+    yield* Effect.fromResult(validate(document, limits));
     return SnapshotDeltaModel.make(document);
 });
-/** @internal */
-const verify = Effect.fnUntraced(function* (base, document, limits) {
-    yield* validate(document, limits);
-    const before = yield* normalize(base, limits, "base");
-    if (!sameBytes(yield* digest(before, limits), yield* CanonicalBase64.decode(document.base.digest))) {
-        return yield* new SnapshotDeltaError({ code: "BaseMismatch" });
-    }
-    const target = yield* buildImage(document, before, limits);
-    const changes = compare(before, yield* normalize(target, limits, "target"));
-    if (!sameChanges(changes, document.changes)) {
-        return yield* new ImageError({ code: "InvalidStructure", field: "changes" });
+const [AddedSummary, RemovedSummary, UpdatedSummary] = SnapshotChange.members;
+const publicChange = (change, options) => {
+    const path = makeBytePath(CanonicalBase64.toBytes(change.path));
+    if (Change.guards.Added(change))
+        return Object.freeze(AddedSummary.make({ path, kind: change.kind }, UNCHECKED));
+    if (Change.guards.Removed(change)) {
+        return Object.freeze(RemovedSummary.make({ path, kind: change.kind }, UNCHECKED));
     }
-    return { changes, target };
-});
+    const differences = change.differences.filter((field) => options.includeTimestamps === true || !timestampFields.has(field));
+    if (differences.length === 0)
+        return undefined;
+    return Object.freeze(UpdatedSummary.make({
+        path,
+        beforeKind: change.beforeKind,
+        afterKind: change.afterKind,
+        differences: Object.freeze(differences)
+    }, UNCHECKED));
+};
 /** @internal */
 export const inspectSnapshotDelta = Effect.fnUntraced(function* (base, delta, options, limits) {
+    const document = yield* getDocument(delta);
+    yield* verify(base, document, limits);
     const output = [];
-    const { changes } = yield* verify(base, yield* getDocument(delta), limits);
-    for (const change of changes) {
-        const path = makeBytePath(yield* CanonicalBase64.decode(change.path));
-        if (!Predicate.isTagged("Updated")(change))
-            output.push(Object.freeze({ ...change, path }));
-        else {
-            const fields = change.differences.filter((field) => options.includeTimestamps === true || !timestampFields.has(field));
-            if (fields.length > 0)
-                output.push(Object.freeze({ ...change, path, differences: Object.freeze([...fields]) }));
-        }
+    for (const change of document.changes) {
+        const shown = publicChange(change, options);
+        if (shown !== undefined)
+            output.push(shown);
     }
     return Object.freeze(output);
 });
 /** @internal */
+export const applySnapshotDelta = Effect.fnUntraced(function* (base, delta, limits) {
+    return Image.make(yield* verify(base, yield* getDocument(delta), limits));
+});
+const encoder = new TextEncoder();
+/** @internal */
 export const encodeSnapshotDelta = Effect.fnUntraced(function* (delta, limits) {
     const document = yield* getDocument(delta);
-    yield* validate(document, limits);
-    const text = yield* Schema.encodeEffect(JsonDocument)(document).pipe(Effect.mapError(() => new ImageError({ code: "InvalidStructure" })));
+    yield* Effect.fromResult(validate(document, limits));
+    const text = yield* Schema.encodeEffect(JsonDocument)(document).pipe(Effect.mapError((cause) => imageFailure(OPERATION, "InvalidStructure", { cause })));
     const bytes = encoder.encode(text);
-    if (exceeds(bytes.length, limits.maxEncodedBytes)) {
-        return yield* new ImageError({ code: "LimitExceeded", field: "encodedBytes" });
+    if (exceeds(bytes.length, limits.encodedBytes)) {
+        return yield* imageFailure(OPERATION, "LimitExceeded", { field: "encodedBytes" });
     }
     return bytes;
 });
 /** @internal */
 export const decodeSnapshotDelta = Effect.fnUntraced(function* (input, limits) {
-    if (!(input instanceof Uint8Array) || !(input.buffer instanceof ArrayBuffer)) {
-        return yield* new ImageError({ code: "InvalidEncoding" });
+    if (!isAttachedBytes(input)) {
+        return yield* imageFailure(OPERATION, "InvalidEncoding");
     }
-    if (exceeds(input.byteLength, limits.maxEncodedBytes)) {
-        return yield* new ImageError({ code: "LimitExceeded", field: "encodedBytes" });
+    if (exceeds(input.byteLength, limits.encodedBytes)) {
+        return yield* imageFailure(OPERATION, "LimitExceeded", { field: "encodedBytes" });
     }
-    const text = yield* Effect.try({
-        try: () => new TextDecoder("utf-8", { fatal: true }).decode(new Uint8Array(input)),
-        catch: () => new ImageError({ code: "InvalidEncoding" })
-    });
-    const value = yield* Schema.decodeEffect(Json)(text).pipe(Effect.mapError(() => new ImageError({ code: "InvalidEncoding" })));
+    const text = yield* decodeUtf8(input, (cause) => imageFailure(OPERATION, "InvalidEncoding", { cause }));
+    const value = yield* Schema.decodeEffect(Json)(text).pipe(Effect.mapError((cause) => imageFailure(OPERATION, "InvalidEncoding", { cause })));
     const version = Schema.decodeUnknownResult(VersionProbe)(value);
     if (Result.isSuccess(version) && version.success.version !== 1) {
-        return yield* new ImageError({ code: "UnsupportedVersion" });
+        return yield* imageFailure(OPERATION, "UnsupportedVersion");
     }
-    const wire = Schema.decodeUnknownResult(WireDocument, { onExcessProperty: "error" })(value);
-    if (Result.isFailure(wire))
-        return yield* new ImageError({ code: "InvalidStructure" });
-    yield* validate(wire.success, limits);
-    const parsed = Schema.decodeUnknownResult(Document, { onExcessProperty: "error" })(value);
-    if (Result.isFailure(parsed))
-        return yield* new ImageError({ code: "InvalidEncoding" });
-    return SnapshotDeltaModel.make(parsed.success);
-});
-/** @internal */
-export const applySnapshotDelta = Effect.fnUntraced(function* (base, delta, limits) {
-    return (yield* verify(base, yield* getDocument(delta), limits)).target;
+    const document = yield* Effect.mapError(decodeDocument(value), decodeFailure);
+    yield* Effect.fromResult(validate(document, limits));
+    return SnapshotDeltaModel.make(document);
 });