@effect-vfs/core 0.8.0 → 0.9.0

package/dist/internal/callerWatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callerWatch.d.ts","sourceRoot":"","sources":["../../src/internal/callerWatch.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAIpC,OAAO,EAAW,KAAK,GAAG,EAAE,KAAK,IAAI,EAAY,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAE9C,gBAAgB;AAChB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,gBAAgB;AAChB,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IACjB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAClB;AAED,gBAAgB;AAChB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CACzC;AA6ED,iGAAiG;AACjG,eAAO,MAAM,IAAI,YAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,CAAA;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAA;IAC5D,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;CACzB,KAAG,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CA6IhD,CAAA"}

package/dist/internal/callerWatch.js

@@ -0,0 +1,184 @@
+import * as Predicate from "effect/Predicate";
+import { Change } from "../Watch.js";
+import { getBytes } from "./bytePath.js";
+import { fsFailure } from "./errors.js";
+import { nameBytes, ownedPath, SLASH_HEX } from "./path.js";
+import { getNode, ROOT_INO } from "./volumeState.js";
+const directoryPath = (state, ino) => {
+    const names = [];
+    const visited = new Set();
+    let at = ino;
+    for (;;) {
+        if (visited.has(at))
+            return undefined;
+        visited.add(at);
+        const directory = getNode(state, at);
+        if (directory?.kind !== "directory" || directory.metadata.nlink === 0)
+            return undefined;
+        if (at === ROOT_INO)
+            return SLASH_HEX + names.reverse().join(SLASH_HEX);
+        names.push(directory.name);
+        at = directory.parent;
+    }
+};
+const below = (path, root) => root === SLASH_HEX || path === root || path.startsWith(root + SLASH_HEX);
+const rebase = (path, root) => root === SLASH_HEX ? path : path === root ? SLASH_HEX : path.slice(root.length);
+const entryPath = (state, link) => {
+    const parent = directoryPath(state, link.parent);
+    return parent === undefined ? undefined : parent + (parent === SLASH_HEX ? "" : SLASH_HEX) + link.name;
+};
+const paths = (state, target) => {
+    const node = getNode(state, target);
+    if (node === undefined || node.metadata.nlink === 0)
+        return [];
+    if (node.kind === "directory") {
+        const path = directoryPath(state, target);
+        return path === undefined ? [] : [path];
+    }
+    return node.links.flatMap((link) => {
+        const directory = getNode(state, link.parent);
+        const path = directory?.kind === "directory" && directory.entries.get(link.name) === target
+            ? entryPath(state, link)
+            : undefined;
+        return path === undefined ? [] : [path];
+    });
+};
+const rootPath = (state, roots) => {
+    let previous = SLASH_HEX;
+    for (const root of roots) {
+        const path = directoryPath(state, root);
+        if (path === undefined)
+            return fsFailure("ClosedCaller", "watch");
+        if (!below(path, previous))
+            return fsFailure("AccessDenied", "watch");
+        previous = path;
+    }
+    return previous;
+};
+const eventName = (event) => {
+    if (event.name !== undefined)
+        return event.name;
+    const bytes = getBytes(event.change.path);
+    const last = bytes.lastIndexOf(47);
+    return Array.from(bytes.subarray(last + 1), (byte) => byte.toString(16).padStart(2, "0")).join("");
+};
+/** Select and rebase names while publication holds both installed namespace states. @internal */
+export const make = (options) => {
+    let selected = options.selected;
+    let oldSelected = selected;
+    let failure;
+    let previousRoot = SLASH_HEX;
+    let currentRoot = SLASH_HEX;
+    let terminal;
+    let rescanPath = SLASH_HEX;
+    const visible = (state, root, selection) => {
+        const aliases = paths(state, options.target);
+        for (const chain of options.additionalRoots ?? []) {
+            const boundary = rootPath(state, chain);
+            if (!Predicate.isString(boundary) || !aliases.some((path) => below(path, boundary)))
+                return [];
+        }
+        return aliases.filter((path) => below(path, root) && (selection === undefined || path === entryPath(state, selection)));
+    };
+    return {
+        boundedTerminal: true,
+        prepare: ({ before, after, renames }) => {
+            terminal = undefined;
+            oldSelected = selected;
+            const beforeRoot = rootPath(before, options.roots);
+            const afterRoot = rootPath(after, options.roots);
+            for (const chain of options.additionalRoots ?? []) {
+                const boundary = rootPath(after, chain);
+                if (!Predicate.isString(boundary)) {
+                    failure = boundary;
+                    return;
+                }
+            }
+            if (!Predicate.isString(afterRoot)) {
+                failure = afterRoot;
+                return;
+            }
+            if (!Predicate.isString(beforeRoot))
+                return;
+            previousRoot = beforeRoot;
+            currentRoot = afterRoot;
+            for (const rename of renames ?? []) {
+                if (rename.ino === options.target && selected !== undefined && selected.parent === rename.from.parent &&
+                    selected.name === rename.from.name)
+                    selected = rename.to;
+            }
+            const oldPaths = visible(before, previousRoot, oldSelected);
+            const nextPaths = visible(after, currentRoot, selected);
+            rescanPath = rebase(nextPaths[0] ?? oldPaths[0] ?? currentRoot, nextPaths.length > 0 ? currentRoot : previousRoot);
+            if (nextPaths.length === 0)
+                terminal = oldPaths.map((path) => rebase(path, previousRoot));
+        },
+        includes: () => failure === undefined,
+        project: (event, { before, after }) => {
+            if (failure !== undefined)
+                return undefined;
+            if (terminal === undefined && event.ino !== options.target && Predicate.isTagged(event.change, "Create")) {
+                const name = eventName(event);
+                const parent = getNode(before, event.parent);
+                const replacedPath = entryPath(before, { parent: event.parent, name });
+                // Rename publishes the incoming object; its replaced alias needs the old target's removal.
+                if (parent?.kind === "directory" && parent.entries.get(name) === options.target &&
+                    replacedPath !== undefined && visible(before, previousRoot, oldSelected).includes(replacedPath)) {
+                    return {
+                        ...event,
+                        ino: options.target,
+                        change: Change.cases.Remove.make({ path: ownedPath(nameBytes(rebase(replacedPath, previousRoot))) })
+                    };
+                }
+            }
+            const removed = Predicate.isTagged(event.change, "Remove");
+            const installed = removed ? before : after;
+            const root = removed ? previousRoot : currentRoot;
+            const selection = removed ? oldSelected : selected;
+            let path;
+            const node = getNode(installed, event.ino);
+            if (event.ino === options.target) {
+                // Settlement emits the terminal removals once, behind already queued changes.
+                if (removed && terminal !== undefined)
+                    return undefined;
+                path = node?.kind === "directory"
+                    ? directoryPath(installed, event.ino)
+                    : entryPath(installed, { parent: event.parent, name: eventName(event) });
+                if (selection !== undefined && path !== entryPath(installed, selection))
+                    return undefined;
+            }
+            else {
+                const scopes = visible(installed, root, selection);
+                path = entryPath(installed, { parent: event.parent, name: eventName(event) });
+                if (path === undefined || !scopes.some((scope) => {
+                    if (!below(path, scope))
+                        return false;
+                    if (options.recursive)
+                        return true;
+                    return directoryPath(installed, event.parent) === scope;
+                }))
+                    return undefined;
+            }
+            if (path === undefined || !below(path, root))
+                return undefined;
+            // A confinement root's outside parent is never reported as a rename.
+            if (event.ino === options.roots.at(-1) && !Predicate.isTagged(event.change, "Update"))
+                return undefined;
+            return {
+                ...event,
+                change: Change.cases[event.change._tag].make({ path: ownedPath(nameBytes(rebase(path, root))) })
+            };
+        },
+        rescan: () => ({
+            change: Change.cases.Rescan.make({ path: ownedPath(nameBytes(rescanPath)) }),
+            parent: options.target,
+            ino: options.target
+        }),
+        failure: () => failure,
+        settle: () => terminal?.map((path) => ({
+            change: Change.cases.Remove.make({ path: ownedPath(nameBytes(path)) }),
+            parent: options.target,
+            ino: options.target
+        }))
+    };
+};

package/dist/internal/confinement.d.ts

@@ -0,0 +1,16 @@
+import * as Effect from "effect/Effect";
+import type { FsFailure } from "../VfsError.js";
+import type { OpContext } from "./errors.js";
+import { type Ino, type Node } from "./volumeState.js";
+/** @internal */
+export declare const make: (view: Effect.Effect<(ino: Ino) => Node | undefined>, roots: ReadonlyArray<Ino>) => {
+    roots: readonly Ino[];
+    root: Ino;
+    alive: (op: OpContext, handle?: boolean) => Effect.Effect<undefined, FsFailure, never>;
+    contains: (node: Node) => Effect.Effect<boolean, never, never>;
+    check: (node: Node, op: OpContext, handle?: boolean | undefined) => Effect.Effect<void, FsFailure, never>;
+    path: (ino: Ino) => Effect.Effect<string | undefined, never, never>;
+};
+/** @internal */
+export type Confinement = ReturnType<typeof make>;
+//# sourceMappingURL=confinement.d.ts.map

package/dist/internal/confinement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confinement.d.ts","sourceRoot":"","sources":["../../src/internal/confinement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,IAAI,EAAiC,MAAM,kBAAkB,CAAA;AAErF,gBAAgB;AAChB,eAAO,MAAM,IAAI,SAAU,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,SAAS,CAAC,SAAS,aAAa,CAAC,GAAG,CAAC;;;gBAoD9E,SAAS,WAAU,OAAO;qBAErB,IAAI;;;CAuC7B,CAAA;AAED,gBAAgB;AAChB,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC,CAAA"}

package/dist/internal/confinement.js

@@ -0,0 +1,79 @@
+import * as Effect from "effect/Effect";
+import { ROOT_INO, WALK_YIELD_INTERVAL } from "./volumeState.js";
+/** @internal */
+export const make = (view, roots) => {
+    const descends = Effect.fnUntraced(function* (get, ino, root) {
+        let node = get(ino);
+        let steps = 0;
+        while (node?.kind === "directory" && node.metadata.nlink > 0) {
+            if (node.ino === root)
+                return true;
+            if (node.ino === ROOT_INO)
+                return false;
+            const parent = get(node.parent);
+            if (parent?.kind !== "directory" || parent.entries.get(node.name) !== node.ino)
+                return false;
+            node = parent;
+            if (++steps % WALK_YIELD_INTERVAL === 0)
+                yield* Effect.yieldNow;
+        }
+        return false;
+    });
+    const aliveIn = Effect.fnUntraced(function* (get, op, handle) {
+        for (let index = 0; index < roots.length; index++) {
+            const root = roots[index];
+            const node = get(root);
+            if (node?.kind !== "directory" || node.metadata.nlink === 0) {
+                return yield* op.fail(handle ? "InvalidHandle" : "ClosedCaller");
+            }
+            if (index > 0 && !(yield* descends(get, root, roots[index - 1])))
+                return yield* op.fail("AccessDenied");
+        }
+    });
+    const containsIn = Effect.fnUntraced(function* (get, node) {
+        const root = roots.at(-1);
+        if (root === undefined)
+            return true;
+        if (node.kind === "directory")
+            return yield* descends(get, node.ino, root);
+        for (const link of node.links) {
+            const parent = get(link.parent);
+            if (parent?.kind === "directory" && parent.entries.get(link.name) === node.ino &&
+                (yield* descends(get, parent.ino, root)))
+                return true;
+        }
+        return false;
+    });
+    const alive = (op, handle = false) => Effect.flatMap(view, (get) => aliveIn(get, op, handle));
+    const contains = (node) => Effect.flatMap(view, (get) => containsIn(get, node));
+    const check = Effect.fnUntraced(function* (node, op, handle = false) {
+        // Share the current lookup within authorization, never its result between operations.
+        const get = yield* view;
+        yield* aliveIn(get, op, handle);
+        if (!(yield* containsIn(get, node)))
+            return yield* op.fail("AccessDenied");
+    });
+    const path = Effect.fnUntraced(function* (ino) {
+        const names = [];
+        const get = yield* view;
+        let node = get(ino);
+        let steps = 0;
+        if (node?.kind !== "directory" || node.metadata.nlink === 0)
+            return undefined;
+        const root = roots.at(-1) ?? ROOT_INO;
+        while (node.ino !== root) {
+            if (node.ino === ROOT_INO)
+                return undefined;
+            names.push(node.name);
+            const parent = get(node.parent);
+            if (parent?.kind !== "directory" || parent.metadata.nlink === 0 || parent.entries.get(node.name) !== node.ino) {
+                return undefined;
+            }
+            node = parent;
+            if (++steps % WALK_YIELD_INTERVAL === 0)
+                yield* Effect.yieldNow;
+        }
+        return "2f" + names.reverse().join("2f");
+    });
+    return { roots, root: roots.at(-1) ?? ROOT_INO, alive, contains, check, path };
+};

package/dist/internal/directoryEntries.d.ts

@@ -0,0 +1,6 @@
+import type { Ino } from "./volumeState.js";
+/** @internal */
+export declare const set: (entries: ReadonlyMap<string, Ino>, name: string, ino: Ino) => ReadonlyMap<string, Ino>;
+/** @internal */
+export declare const remove: (entries: ReadonlyMap<string, Ino>, name: string) => ReadonlyMap<string, Ino>;
+//# sourceMappingURL=directoryEntries.d.ts.map

package/dist/internal/directoryEntries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directoryEntries.d.ts","sourceRoot":"","sources":["../../src/internal/directoryEntries.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AA2E3C,gBAAgB;AAChB,eAAO,MAAM,GAAG,YAAa,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,MAAM,OAAO,GAAG,KAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAYtG,CAAA;AAED,gBAAgB;AAChB,eAAO,MAAM,MAAM,YAAa,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,MAAM,KAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAa/F,CAAA"}

package/dist/internal/directoryEntries.js

@@ -0,0 +1,79 @@
+import * as HashMap from "effect/HashMap";
+import * as Option from "effect/Option";
+import * as InodeTable from "./inodeTable.js";
+// Name lookup and insertion order share immutable trees. Deleted slots are compacted once they outnumber live entries.
+class DirectoryEntries {
+    names;
+    slots;
+    length;
+    [Symbol.toStringTag] = "Map";
+    constructor(names, slots, length) {
+        this.names = names;
+        this.slots = slots;
+        this.length = length;
+    }
+    get size() {
+        return HashMap.size(this.names);
+    }
+    get(name) {
+        const slot = HashMap.get(this.names, name);
+        return Option.isSome(slot) ? slot.value.ino : undefined;
+    }
+    has(name) {
+        return HashMap.has(this.names, name);
+    }
+    *entries() {
+        for (let index = 0; index < this.length; index++) {
+            const entry = InodeTable.get(this.slots, index);
+            if (entry !== undefined)
+                yield [entry.name, entry.ino];
+        }
+    }
+    *keys() {
+        for (const [name] of this)
+            yield name;
+    }
+    *values() {
+        for (const [, ino] of this)
+            yield ino;
+    }
+    [Symbol.iterator]() {
+        return this.entries();
+    }
+    // oxlint-disable-next-line anti-slop/no-unknown-parameters -- ReadonlyMap forwards the opaque callback receiver without inspecting it.
+    forEach(callback, thisArg) {
+        for (const [name, ino] of this)
+            callback.call(thisArg, ino, name, this);
+    }
+}
+const fromEntries = (entries) => {
+    let slots = InodeTable.empty();
+    let length = 0;
+    const owner = Symbol();
+    const names = HashMap.mutate(HashMap.empty(), (mutable) => {
+        for (const [name, ino] of entries) {
+            const entry = { name, ino, index: length };
+            HashMap.set(mutable, name, entry);
+            slots = InodeTable.set(slots, length, entry, owner);
+            length++;
+        }
+    });
+    return new DirectoryEntries(names, slots, length);
+};
+/** @internal */
+export const set = (entries, name, ino) => {
+    const current = entries instanceof DirectoryEntries ? entries : fromEntries(entries);
+    const existing = HashMap.get(current.names, name);
+    const index = Option.isSome(existing) ? existing.value.index : current.length;
+    const entry = { name, ino, index };
+    return new DirectoryEntries(HashMap.set(current.names, name, entry), InodeTable.set(current.slots, index, entry), Option.isSome(existing) ? current.length : current.length + 1);
+};
+/** @internal */
+export const remove = (entries, name) => {
+    const current = entries instanceof DirectoryEntries ? entries : fromEntries(entries);
+    const existing = HashMap.get(current.names, name);
+    if (Option.isNone(existing))
+        return current;
+    const removed = new DirectoryEntries(HashMap.remove(current.names, name), InodeTable.set(current.slots, existing.value.index, undefined), current.length);
+    return removed.length > removed.size * 2 ? fromEntries(removed) : removed;
+};

package/dist/internal/fixture.js

@@ -10,7 +10,7 @@ import { assemble, Ino, ROOT_INO } from "./volumeState.js";
 const DEFAULT_MODE = { directory: 0o755, file: 0o644, symlink: 0o777 };
 const EPOCH_NS = 0n;
 /** @internal */
-export const fromFixture = Effect.fn("VirtualFileSystem.fromFixture")(function* (fixture, options) {
+export const fromFixture = Effect.fnUntraced(function* (fixture, options) {
     const config = yield* Effect.fromResult(decodeConfiguration(VolumeOptionsSchema, options ?? {}, "fromFixture"));
     const source = yield* Schema.decodeEffect(FixtureSchema, { onExcessProperty: "error" })(fixture).pipe(Effect.mapError((cause) => imageFailure("fromFixture", "InvalidStructure", { field: "fixture", cause })));
     if (source.entries.some((entry) => FixtureEntry.match(entry, {

package/dist/internal/path.js

@@ -63,7 +63,7 @@ const attachedBuffer = (bytes) => {
 /** @internal */
 export const isAttachedBytes = (bytes) => Predicate.isUint8Array(bytes) && bytes.buffer instanceof ArrayBuffer && attachedBuffer(bytes);
 /** @internal */
-export const pathFromBytes = Effect.fn("VirtualFileSystem.pathFromBytes")(function* (bytes) {
+export const pathFromBytes = Effect.fnUntraced(function* (bytes) {
     if (!isAttachedBytes(bytes))
         return yield* fsFailure("InvalidArgument", "pathFromBytes");
     const owned = new Uint8Array(bytes);
@@ -73,7 +73,7 @@ export const pathFromBytes = Effect.fn("VirtualFileSystem.pathFromBytes")(functi
     return makeBytePath(owned);
 });
 /** @internal */
-export const pathToBytes = Effect.fn("VirtualFileSystem.pathToBytes")(function* (path) {
+export const pathToBytes = Effect.fnUntraced(function* (path) {
     const bytes = getBytePathBytes(path);
     if (bytes === undefined)
         return yield* fsFailure("InvalidArgument", "pathToBytes");

package/dist/internal/resolution.d.ts

@@ -4,7 +4,8 @@ import * as Result from "effect/Result";
 import type { Identity } from "../Caller.js";
 import { type EntryInput, type NameInput, type Target } from "../Target.js";
 import type { FsFailure } from "../VfsError.js";
-import type { DirectoryHandle, PathInput } from "../VirtualFileSystem.js";
+import type { DirectoryHandle, FileHandle, PathInput } from "../VirtualFileSystem.js";
+import { type Confinement } from "./confinement.js";
 import type { OpContext } from "./errors.js";
 import { type PreparedPath } from "./path.js";
 import * as TokenRegistry from "./tokenRegistry.js";
@@ -86,7 +87,10 @@ export declare const authorize: (node: Node, identity: Identity, bits: number, o
 /** @internal */
 export declare const entryName: (input: NameInput, op: OpContext) => Result.Result<string, FsFailure>;
 /** @internal */
-export declare const make: ({ caller, get, identity, maxPathBytes, registry }: {
+export declare const make: ({ caller, get, identity, maxPathBytes, registry, confinement, additional, authorityView }: {
+    readonly additional?: ReadonlyArray<Confinement> | undefined;
+    readonly authorityView: Effect.Effect<(ino: Ino) => Node | undefined>;
+    readonly confinement?: Confinement | undefined;
     readonly caller: TokenRegistry.DirectoryReference;
     readonly get: (ino: Ino) => Effect.Effect<Node | undefined>;
     readonly identity: Identity;
@@ -102,7 +106,7 @@ export declare const make: ({ caller, get, identity, maxPathBytes, registry }: {
     };
     directory: (target: {
         readonly _tag: "Handle";
-        readonly handle: import("../VirtualFileSystem.js").FileHandle | DirectoryHandle;
+        readonly handle: FileHandle | DirectoryHandle;
     } | {
         readonly _tag: "Path";
         readonly path: PathInput;
@@ -117,7 +121,7 @@ export declare const make: ({ caller, get, identity, maxPathBytes, registry }: {
     }, FsFailure, never>;
     entryDirectory: (target: {
         readonly _tag: "Handle";
-        readonly handle: import("../VirtualFileSystem.js").FileHandle | DirectoryHandle;
+        readonly handle: FileHandle | DirectoryHandle;
     } | {
         readonly _tag: "Path";
         readonly path: PathInput;

package/dist/internal/resolution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolution.d.ts","sourceRoot":"","sources":["../../src/internal/resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,KAAK,UAAU,EAAqB,KAAK,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAUL,KAAK,YAAY,EAGlB,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,GAAG,EAAE,KAAK,IAAI,EAAY,MAAM,kBAAkB,CAAA;AAEhF,gBAAgB;AAChB,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjF,gBAAgB;AAChB,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;CACrH;AAED,gBAAgB;AAChB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CACxB;AAED,gBAAgB;AAChB,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,WAAW,GAAG,WAAW,CAAA;IACpD,QAAQ,CAAC,YAAY,EAAE,QAAQ,GAAG,UAAU,CAAA;IAE5C,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,GAAG,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;CAC1G;AAID,gBAAgB;AAChB,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;CAAE,GACtE;IACA,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;CACvB,CAAA;AASH,gBAAgB;AAChB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;CACvB;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IAEtB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvE;AAED,gBAAgB;AAChB,MAAM,MAAM,YAAY,GACpB,CAAC,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,GAClE,CAAC,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAA;AAIhD,gBAAgB;AAChB,eAAO,MAAM,OAAO,aAAc,QAAQ,OAAO,MAAM,YAA0D,CAAA;AAEjH,gBAAgB;AAChB,eAAO,MAAM,SAAS,SAAU,IAAI,YAAY,QAAQ,WAIvD,CAAA;AAED,gBAAgB;AAChB,eAAO,MAAM,SAAS,SAAU,IAAI,YAAY,QAAQ,QAAQ,MAAM,MAAM,SAAS,+EAG3C,CAAA;AAE1C,gBAAgB;AAChB,eAAO,MAAM,SAAS,UAAW,SAAS,MAAM,SAAS,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAU1F,CAAA;AAED,gBAAgB;AAChB,eAAO,MAAM,IAAI,sDAAuD;IACtE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,kBAAkB,CAAA;IACjD,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,CAAA;IAC3D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAA;IACpD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAA;CAC/C;qBACyB,SAAS,MAAM,SAAS;0BAEnB,UAAU,MAAM,SAAS,KAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;;SAyU/E,CAAC,kBAAkB,MAAM,QAAQ,QAAQ,CAAC,CAAC,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;mBAC3F,aAAa,QAAQ,UAAU,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;SACjG,CAAC,oBACN,aAAa,QACjB,YAAY,CAAC,CAAC,CAAC,MACjB,SAAS,GACZ,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkB7C,CAAA"}
+{"version":3,"file":"resolution.d.ts","sourceRoot":"","sources":["../../src/internal/resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,KAAK,UAAU,EAAqB,KAAK,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACrF,OAAO,EAAE,KAAK,WAAW,EAA2B,MAAM,kBAAkB,CAAA;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAUL,KAAK,YAAY,EAGlB,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,GAAG,EAAE,KAAK,IAAI,EAAY,MAAM,kBAAkB,CAAA;AAEhF,gBAAgB;AAChB,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjF,gBAAgB;AAChB,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;CACrH;AAED,gBAAgB;AAChB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CACxB;AAED,gBAAgB;AAChB,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,WAAW,GAAG,WAAW,CAAA;IACpD,QAAQ,CAAC,YAAY,EAAE,QAAQ,GAAG,UAAU,CAAA;IAE5C,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,GAAG,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;CAC1G;AAID,gBAAgB;AAChB,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;CAAE,GACtE;IACA,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;CACvB,CAAA;AASH,gBAAgB;AAChB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;CACvB;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IAEtB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvE;AAED,gBAAgB;AAChB,MAAM,MAAM,YAAY,GACpB,CAAC,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,GAClE,CAAC,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAA;AAMhD,gBAAgB;AAChB,eAAO,MAAM,OAAO,aAAc,QAAQ,OAAO,MAAM,YAA0D,CAAA;AAEjH,gBAAgB;AAChB,eAAO,MAAM,SAAS,SAAU,IAAI,YAAY,QAAQ,WAIvD,CAAA;AAED,gBAAgB;AAChB,eAAO,MAAM,SAAS,SAAU,IAAI,YAAY,QAAQ,QAAQ,MAAM,MAAM,SAAS,+EAG3C,CAAA;AAE1C,gBAAgB;AAChB,eAAO,MAAM,SAAS,UAAW,SAAS,MAAM,SAAS,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAU1F,CAAA;AAED,gBAAgB;AAChB,eAAO,MAAM,IAAI,8FAA+F;IAC9G,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,SAAS,CAAC,CAAA;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;IAC9C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,kBAAkB,CAAA;IACjD,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,CAAA;IAC3D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAA;IACpD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAA;CAC/C;qBAEyB,SAAS,MAAM,SAAS;0BAEnB,UAAU,MAAM,SAAS,KAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;;SA4Y/E,CAAC,kBAAkB,MAAM,QAAQ,QAAQ,CAAC,CAAC,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;mBAC3F,aAAa,QAAQ,UAAU,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;SACjG,CAAC,oBACN,aAAa,QACjB,YAAY,CAAC,CAAC,CAAC,MACjB,SAAS,GACZ,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkB7C,CAAA"}

package/dist/internal/resolution.js

@@ -4,10 +4,12 @@ import * as Hex from "effect/encoding/Hex";
 import * as Predicate from "effect/Predicate";
 import * as Result from "effect/Result";
 import { isEntry, isTarget } from "../Target.js";
+import { make as makeConfinement } from "./confinement.js";
 import { DOT_DOT_HEX, DOT_HEX, isAttachedBytes, isDotComponent, isWellFormed, MAX_NAME_BYTES, MAX_SYMLINK_TRAVERSALS, nameBytes, ownedPath, preparePath, SLASH_BYTE } from "./path.js";
 import * as TokenRegistry from "./tokenRegistry.js";
 import { ROOT_INO } from "./volumeState.js";
 const encoder = new TextEncoder();
+const EMPTY_AUTHORITIES = [];
 /** @internal */
 export const inGroup = (identity, gid) => identity.gid === gid || identity.groups.includes(gid);
 /** @internal */
@@ -30,28 +32,37 @@ export const entryName = (input, op) => {
     return Result.succeed(Hex.encode(new Uint8Array(bytes)));
 };
 /** @internal */
-export const make = ({ caller, get, identity, maxPathBytes, registry }) => {
+export const make = ({ caller, get, identity, maxPathBytes, registry, confinement, additional, authorityView }) => {
+    const visibleRoot = confinement?.root ?? ROOT_INO;
     const prepare = (input, op) => preparePath(input, op.operation, maxPathBytes);
     const prepareEntry = (input, op) => isEntry(input)
         ? Result.map(entryName(input.name, op), (name) => ({ kind: "entry", directory: input.directory, name }))
         : isTarget(input)
             ? Result.map(prepare(input.path, op), (path) => ({ kind: "path", path, base: input.relativeTo }))
             : Result.map(prepare(input, op), (path) => ({ kind: "path", path, base: undefined }));
-    const nodeAt = Effect.fnUntraced(function* (ino) {
-        const node = yield* get(ino);
+    const nodeAt = Effect.fnUntraced(function* (lookup, ino) {
+        const node = lookup(ino);
         return node === undefined ? yield* Effect.die("Inode left the table during resolution") : node;
     });
-    const directoryAt = Effect.fnUntraced(function* (ino) {
-        const node = yield* nodeAt(ino);
+    const directoryAt = Effect.fnUntraced(function* (lookup, ino) {
+        const node = yield* nodeAt(lookup, ino);
         return node.kind !== "directory" ? yield* Effect.die("Directory left the table during resolution") : node;
     });
-    const callerDirectory = Effect.fnUntraced(function* (op) {
+    const callerDirectory = Effect.fnUntraced(function* (lookup, op) {
         const ino = TokenRegistry.inode(caller);
-        const node = ino === undefined ? undefined : yield* get(ino);
+        const node = ino === undefined ? undefined : lookup(ino);
         return node?.kind !== "directory" ? yield* op.fail("ClosedCaller") : node;
     });
     const walk = Effect.fnUntraced(function* (path, base, op, mode, referencedBase) {
         const pathOp = op.at(path.input);
+        const baseAuthorities = base === undefined
+            ? EMPTY_AUTHORITIES
+            : registry.handleBoundaries(base).map((roots) => makeConfinement(authorityView, roots));
+        const authorizeDirectory = baseAuthorities.length === 0 ? authorize : Effect.fnUntraced(function* (node, callerIdentity, bits, context) {
+            for (const authority of baseAuthorities)
+                yield* authority.check(node, context, true);
+            yield* authorize(node, callerIdentity, bits, context);
+        });
         const parentOnly = mode.kind === "Parent";
         const allowMissing = mode.kind === "OrCreate" && mode.create !== "never";
         const followFinalSymlink = mode.kind === "Node"
@@ -61,7 +72,26 @@ export const make = ({ caller, get, identity, maxPathBytes, registry }) => {
         if (!TokenRegistry.isOpen(caller)) {
             return yield* pathOp.fail("ClosedCaller");
         }
-        let current = path.absolute ? (yield* nodeAt(ROOT_INO)) : yield* callerDirectory(pathOp);
+        if (additional !== undefined && additional.length > 0) {
+            for (const authority of additional)
+                yield* authority.alive(pathOp);
+        }
+        if (confinement !== undefined)
+            yield* confinement.alive(pathOp);
+        if (path.absolute && base !== undefined &&
+            (confinement !== undefined || (additional?.length ?? 0) > 0 || baseAuthorities.length > 0)) {
+            const node = yield* TokenRegistry.nodeOrFail(yield* registry.resolve(base, "directory"), "handle", pathOp);
+            yield* registry.authorizeHandle(base, node, pathOp);
+            if (confinement !== undefined)
+                yield* confinement.check(node, pathOp);
+            if (additional !== undefined && additional.length > 0) {
+                for (const authority of additional)
+                    yield* authority.check(node, pathOp);
+            }
+        }
+        // Reads remain live so recursive creation can revisit nodes added earlier in this walk.
+        const lookup = yield* authorityView;
+        let current = path.absolute ? (yield* nodeAt(lookup, visibleRoot)) : yield* callerDirectory(lookup, pathOp);
         if (!path.absolute && referencedBase !== undefined) {
             current = referencedBase;
             yield* authorize(current, identity, 0o1, op);
@@ -70,9 +100,16 @@ export const make = ({ caller, get, identity, maxPathBytes, registry }) => {
             const directory = yield* TokenRegistry.nodeOrFail(yield* registry.resolve(base, "directory"), "handle", pathOp);
             if (directory.kind !== "directory")
                 return yield* pathOp.fail("InvalidHandle");
+            yield* registry.authorizeHandle(base, directory, pathOp);
             current = directory;
             yield* authorize(current, identity, 0o1, pathOp);
         }
+        if (confinement !== undefined)
+            yield* confinement.check(current, pathOp);
+        if (additional !== undefined && additional.length > 0) {
+            for (const authority of additional)
+                yield* authority.check(current, pathOp);
+        }
         if (current.metadata.nlink === 0) {
             return yield* pathOp.fail("NotFound");
         }
@@ -87,14 +124,14 @@ export const make = ({ caller, get, identity, maxPathBytes, registry }) => {
             if (current.kind !== "directory") {
                 return yield* pathOp.fail("NotDirectory");
             }
-            yield* authorize(current, identity, 0o1, pathOp);
+            yield* authorizeDirectory(current, identity, 0o1, pathOp);
             const component = work.components[index];
             if (component === undefined)
                 break;
             if (component === DOT_HEX)
                 continue;
             if (component === DOT_DOT_HEX) {
-                current = yield* directoryAt(current.parent);
+                current = yield* directoryAt(lookup, confinement !== undefined && current.ino === visibleRoot ? current.ino : current.parent);
                 parent = undefined;
                 name = undefined;
                 continue;
@@ -102,7 +139,7 @@ export const make = ({ caller, get, identity, maxPathBytes, registry }) => {
             parent = current;
             name = component;
             const childIno = current.entries.get(component);
-            const child = childIno === undefined ? undefined : (yield* get(childIno));
+            const child = childIno === undefined ? undefined : lookup(childIno);
             if (child === undefined) {
                 if (allowMissing && index === work.components.length - 1) {
                     return { kind: "missing", parent, name, op: pathOp };
@@ -139,12 +176,16 @@ export const make = ({ caller, get, identity, maxPathBytes, registry }) => {
                 work = expanded.success;
                 linked = work.components.length - remaining + Math.max(0, linked - index - 1);
                 if (work.absolute)
-                    current = yield* nodeAt(ROOT_INO);
+                    current = yield* nodeAt(lookup, visibleRoot);
                 index = -1;
             }
             else
                 current = child;
         }
+        if (baseAuthorities.length > 0) {
+            for (const authority of baseAuthorities)
+                yield* authority.check(current, pathOp, true);
+        }
         if (!parentOnly && work.trailingSlash && current.kind !== "directory") {
             return yield* pathOp.fail("NotDirectory");
         }
@@ -168,6 +209,14 @@ export const make = ({ caller, get, identity, maxPathBytes, registry }) => {
         const node = yield* TokenRegistry.nodeOrFail(yield* (Predicate.isTagged(target, "Reference")
             ? registry.resolve(target.reference, "reference")
             : registry.resolve(target.handle, "handle")), Predicate.isTagged(target, "Reference") ? "reference" : "handle", op);
+        if (!Predicate.isTagged(target, "Reference"))
+            yield* registry.authorizeHandle(target.handle, node, op);
+        if (confinement !== undefined)
+            yield* confinement.check(node, op);
+        if (additional !== undefined && additional.length > 0) {
+            for (const authority of additional)
+                yield* authority.check(node, op);
+        }
         return { kind: "node", node, op };
     });
     const directory = Effect.fnUntraced(function* (target, op) {
@@ -249,7 +298,13 @@ export const make = ({ caller, get, identity, maxPathBytes, registry }) => {
             : { kind: "entry", node: direct, parent, name: prepared.name, op };
         if (direct?.kind === "symlink" && mode.finalSymlink === "follow") {
             const path = yield* Effect.fromResult(preparePath(ownedPath(nameBytes(prepared.name)), op.operation, undefined));
-            result = yield* walk(path, undefined, op, mode, parent);
+            // Following an entry link must retain the directory capability's boundaries.
+            const base = Predicate.isTagged(prepared.directory, "Handle")
+                ? prepared.directory.handle
+                : Predicate.isTagged(prepared.directory, "Path")
+                    ? prepared.directory.relativeTo
+                    : undefined;
+            result = yield* walk(path, base, op, mode, parent);
             // Entry writeFile rejects a followed directory before checking exclusive creation.
             if (mode.create === "exclusive" && mode.entryExclusive === "afterSymlink" &&
                 (result.kind === "node" || (result.kind === "entry" && result.node.kind === "directory"))) {