@rivet-dev/agentos-core 0.0.0-main.2f99c77 → 0.0.0-main.5ac5a14

package/dist/filesystem-snapshot.d.ts

@@ -1,4 +1,4 @@
-import { type VirtualFileSystem } from "./runtime-compat.js";
+import type { VirtualFileSystem } from "./runtime-compat.js";
 export interface FilesystemEntry {
     path: string;
     type: "directory" | "file" | "symlink";
@@ -10,5 +10,4 @@ export interface FilesystemEntry {
     target?: string;
 }
 export declare function sortFilesystemEntries(entries: FilesystemEntry[]): FilesystemEntry[];
-export declare function createFilesystemFromEntries(entries: FilesystemEntry[]): Promise<VirtualFileSystem>;
 export declare function snapshotVirtualFilesystem(filesystem: VirtualFileSystem, rootPath?: string): Promise<FilesystemEntry[]>;

package/dist/filesystem-snapshot.js

@@ -1,8 +1,4 @@
 import * as posixPath from "node:path/posix";
-import { createInMemoryFileSystem, } from "./runtime-compat.js";
-function parseMode(mode) {
-    return Number.parseInt(mode, 8);
-}
 export function sortFilesystemEntries(entries) {
     return [...entries].sort((a, b) => {
         const depthA = a.path === "/" ? 0 : a.path.split("/").filter(Boolean).length;
@@ -13,45 +9,6 @@ export function sortFilesystemEntries(entries) {
         return a.path.localeCompare(b.path);
     });
 }
-async function applyDirectory(filesystem, entry) {
-    if (entry.path !== "/") {
-        await filesystem.mkdir(entry.path, { recursive: true });
-    }
-    await filesystem.chmod(entry.path, parseMode(entry.mode));
-    await filesystem.chown(entry.path, entry.uid, entry.gid);
-}
-async function applyFile(filesystem, entry) {
-    const content = entry.content ?? "";
-    await filesystem.writeFile(entry.path, entry.encoding === "base64" ? Buffer.from(content, "base64") : content);
-    await filesystem.chmod(entry.path, parseMode(entry.mode));
-    await filesystem.chown(entry.path, entry.uid, entry.gid);
-}
-async function applySymlink(filesystem, entry) {
-    if (!entry.target) {
-        throw new Error(`Missing symlink target for ${entry.path}`);
-    }
-    await filesystem.symlink(entry.target, entry.path);
-}
-export async function createFilesystemFromEntries(entries) {
-    const filesystem = createInMemoryFileSystem();
-    const sortedEntries = sortFilesystemEntries(entries);
-    for (const entry of sortedEntries) {
-        if (entry.type === "directory") {
-            await applyDirectory(filesystem, entry);
-        }
-    }
-    for (const entry of sortedEntries) {
-        if (entry.type === "file") {
-            await applyFile(filesystem, entry);
-        }
-    }
-    for (const entry of sortedEntries) {
-        if (entry.type === "symlink") {
-            await applySymlink(filesystem, entry);
-        }
-    }
-    return filesystem;
-}
 function toModeString(mode) {
     return `0${(mode & 0o7777).toString(8)}`;
 }

package/dist/generated/AcpLimitsConfig.d.ts

@@ -1,4 +1,20 @@
 export type AcpLimitsConfig = {
     maxReadLineBytes?: number;
     stdoutBufferByteLimit?: number;
+    maxCompletedMessageBytes?: number;
+    maxTurnOutputBytes?: number;
+    maxPromptBytes?: number;
+    maxPromptBlocks?: number;
+    maxFallbackContinuationBytes?: number;
+    maxSessionHistoryBytes?: number;
+    maxSessionHistoryEvents?: number;
+    maxHistoryPageEntries?: number;
+    maxSessionListEntries?: number;
+    maxSessionsPerVm?: number;
+    maxPromptsPerSession?: number;
+    maxPromptsPerVm?: number;
+    maxPendingPermissionsPerSession?: number;
+    maxPendingPermissionsPerVm?: number;
+    maxPermissionOutcomesPerSession?: number;
+    maxPermissionOutcomesPerVm?: number;
 };

package/dist/generated/BindingLimitsConfig.d.ts

@@ -0,0 +1,10 @@
+export type BindingLimitsConfig = {
+    defaultBindingTimeoutMs?: number;
+    maxBindingTimeoutMs?: number;
+    maxRegisteredCollections?: number;
+    maxRegisteredBindingsPerVm?: number;
+    maxBindingsPerCollection?: number;
+    maxBindingSchemaBytes?: number;
+    maxExamplesPerBinding?: number;
+    maxBindingExampleInputBytes?: number;
+};

package/dist/generated/CreateVmConfig.d.ts

@@ -5,6 +5,7 @@ import type { RootFilesystemConfig } from "./RootFilesystemConfig.js";
 import type { VmDnsConfig } from "./VmDnsConfig.js";
 import type { VmLimitsConfig } from "./VmLimitsConfig.js";
 import type { VmListenPolicyConfig } from "./VmListenPolicyConfig.js";
+import type { VmUserConfig } from "./VmUserConfig.js";
 /**
  * Canonical Rust-side VM config. Unknown fields must stay rejected here and in
  * the TS preflight schema at
@@ -14,6 +15,7 @@ import type { VmListenPolicyConfig } from "./VmListenPolicyConfig.js";
 export type CreateVmConfig = {
     cwd?: string;
     env: Record<string, string>;
+    user?: VmUserConfig;
     rootFilesystem: RootFilesystemConfig;
     permissions?: PermissionsPolicy;
     limits?: VmLimitsConfig;

package/dist/generated/ProcessLimitsConfig.d.ts

@@ -0,0 +1,7 @@
+export type ProcessLimitsConfig = {
+    maxSpawnFileActions?: number;
+    maxSpawnFileActionBytes?: number;
+    pendingStdinBytes?: number;
+    pendingEventCount?: number;
+    pendingEventBytes?: number;
+};

package/dist/generated/ProcessLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/VmGroupConfig.d.ts

@@ -0,0 +1,5 @@
+export type VmGroupConfig = {
+    gid: number;
+    name: string;
+    members: Array<string>;
+};

package/dist/generated/VmGroupConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/VmLimitsConfig.d.ts

@@ -1,18 +1,20 @@
 import type { AcpLimitsConfig } from "./AcpLimitsConfig.js";
+import type { BindingLimitsConfig } from "./BindingLimitsConfig.js";
 import type { HttpLimitsConfig } from "./HttpLimitsConfig.js";
 import type { JsRuntimeLimitsConfig } from "./JsRuntimeLimitsConfig.js";
 import type { PluginLimitsConfig } from "./PluginLimitsConfig.js";
+import type { ProcessLimitsConfig } from "./ProcessLimitsConfig.js";
 import type { PythonLimitsConfig } from "./PythonLimitsConfig.js";
 import type { ResourceLimitsConfig } from "./ResourceLimitsConfig.js";
-import type { ToolLimitsConfig } from "./ToolLimitsConfig.js";
 import type { WasmLimitsConfig } from "./WasmLimitsConfig.js";
 export type VmLimitsConfig = {
     resources?: ResourceLimitsConfig;
     http?: HttpLimitsConfig;
-    tools?: ToolLimitsConfig;
+    bindings?: BindingLimitsConfig;
     plugins?: PluginLimitsConfig;
     acp?: AcpLimitsConfig;
     jsRuntime?: JsRuntimeLimitsConfig;
     python?: PythonLimitsConfig;
     wasm?: WasmLimitsConfig;
+    process?: ProcessLimitsConfig;
 };

package/dist/generated/VmUserAccountConfig.d.ts

@@ -0,0 +1,9 @@
+export type VmUserAccountConfig = {
+    uid: number;
+    gid: number;
+    username: string;
+    homedir: string;
+    shell: string;
+    gecos?: string;
+    supplementaryGids: Array<number>;
+};

package/dist/generated/VmUserAccountConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/VmUserConfig.d.ts

@@ -0,0 +1,19 @@
+import type { VmGroupConfig } from "./VmGroupConfig.js";
+import type { VmUserAccountConfig } from "./VmUserAccountConfig.js";
+/**
+ * Initial Linux-style credentials and account record for processes in a VM.
+ */
+export type VmUserConfig = {
+    uid?: number;
+    gid?: number;
+    euid?: number;
+    egid?: number;
+    username?: string;
+    homedir?: string;
+    shell?: string;
+    gecos?: string;
+    groupName?: string;
+    supplementaryGids?: Array<number>;
+    accounts?: Array<VmUserAccountConfig>;
+    groups?: Array<VmGroupConfig>;
+};

package/dist/generated/WasmLimitsConfig.d.ts

@@ -4,4 +4,5 @@ export type WasmLimitsConfig = {
     syncReadLimitBytes?: number;
     prewarmTimeoutMs?: number;
     runnerHeapLimitMb?: number;
+    runnerCpuTimeLimitMs?: number;
 };

package/dist/index.d.ts

@@ -1,12 +1,14 @@
 export { AgentOs, AgentOsSidecar } from "./agent-os.js";
+export type * from "./language-execution.js";
 export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriver, } from "./cron/index.js";
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
-export { hostTool, MAX_TOOL_DESCRIPTION_LENGTH, toolKit, validateToolkits, } from "./host-tools.js";
-export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, hostToolSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, toolKitSchema, } from "./options-schema.js";
-export { createInMemoryLayerStore, createSnapshotExport, } from "./layers.js";
+export { binding, MAX_BINDING_DESCRIPTION_LENGTH, bindings, validateBindings, } from "./bindings.js";
+export type { Binding, BindingExample, Bindings } from "./bindings.js";
+export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, bindingSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, bindingsSchema, } from "./options-schema.js";
+export { createSnapshotExport } from "./layers.js";
 export { defineSoftware } from "./packages.js";
 export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
-export { isAcpTimeoutErrorData, isUnknownSessionErrorData, } from "./json-rpc.js";
-export { createInMemoryFileSystem, KernelError } from "./runtime-compat.js";
+export { KernelError } from "./runtime-compat.js";
 export type { ExecOptions, ExecResult, ManagedProcess, ProcessInfo, ShellHandle, VirtualDirEntry, VirtualStat, } from "./runtime.js";
+export { createSandboxBindings, createSandboxFs, getSandboxDisposeHooks, resolveSandboxOptions, } from "./sandbox.js";
 export type * from "./types.js";

package/dist/index.js

@@ -2,10 +2,10 @@
 export { AgentOs, AgentOsSidecar } from "./agent-os.js";
 export { CronManager, InvalidScheduleError, PastScheduleError, TimerScheduleDriver, } from "./cron/index.js";
 export { createHostDirBackend, nodeModulesMount } from "./host-dir-mount.js";
-export { hostTool, MAX_TOOL_DESCRIPTION_LENGTH, toolKit, validateToolkits, } from "./host-tools.js";
-export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, hostToolSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, toolKitSchema, } from "./options-schema.js";
-export { createInMemoryLayerStore, createSnapshotExport, } from "./layers.js";
+export { binding, MAX_BINDING_DESCRIPTION_LENGTH, bindings, validateBindings, } from "./bindings.js";
+export { agentOsLimitsSchema, agentOsOptionFieldSchemas, agentOsOptionsSchema, bindingSchema, mountConfigSchema, nativeMountConfigSchema, parseAgentOsOptions, permissionsSchema, rootFilesystemConfigSchema, sharedSidecarConfigSchema, sidecarConfigSchema, bindingsSchema, } from "./options-schema.js";
+export { createSnapshotExport } from "./layers.js";
 export { defineSoftware } from "./packages.js";
 export { isPackageDescriptor, OPT_AGENTOS_BIN, OPT_AGENTOS_ROOT, tryReadAgentosPackageManifest, } from "./agentos-package.js";
-export { isAcpTimeoutErrorData, isUnknownSessionErrorData, } from "./json-rpc.js";
-export { createInMemoryFileSystem, KernelError } from "./runtime-compat.js";
+export { KernelError } from "./runtime-compat.js";
+export { createSandboxBindings, createSandboxFs, getSandboxDisposeHooks, resolveSandboxOptions, } from "./sandbox.js";

package/dist/language-execution.d.ts

@@ -0,0 +1,170 @@
+import type { JsonValue } from "./session-api.js";
+export type ExecutionSignal = "SIGHUP" | "SIGINT" | "SIGQUIT" | "SIGTERM" | "SIGKILL" | "SIGSTOP" | "SIGCONT" | "SIGUSR1" | "SIGUSR2";
+export interface LanguageExecutionOptions {
+    contextId?: string;
+    cwd?: string;
+    env?: Record<string, string>;
+    args?: string[];
+    stdin?: string | Uint8Array;
+    timeoutMs?: number;
+    pty?: {
+        cols?: number;
+        rows?: number;
+    };
+    signal?: AbortSignal;
+    onStdout?: (chunk: Uint8Array) => void;
+    onStderr?: (chunk: Uint8Array) => void;
+    output?: ExecutionOutputOptions;
+}
+export type OutputCapture = "none" | "stderr" | "all";
+export interface ExecutionOutputOptions {
+    capture?: OutputCapture;
+    retainEvents?: boolean;
+}
+export interface InlineExecutionOptions extends LanguageExecutionOptions {
+    inputs?: Record<string, JsonValue>;
+}
+export interface JavaScriptExecutionOptions extends InlineExecutionOptions {
+    format?: "module" | "commonjs";
+    filePath?: string;
+}
+export type JavaScriptEvaluationOptions = JavaScriptExecutionOptions;
+export interface TypeScriptExecutionOptions extends InlineExecutionOptions {
+    filePath?: string;
+    tsconfigPath?: string;
+    compilerOptions?: Record<string, JsonValue>;
+}
+export type TypeScriptEvaluationOptions = TypeScriptExecutionOptions;
+export interface TypeScriptFileExecutionOptions extends LanguageExecutionOptions {
+    tsconfigPath?: string;
+    compilerOptions?: Record<string, JsonValue>;
+}
+export interface TypeScriptCheckOptions {
+    contextId?: string;
+    cwd?: string;
+    filePath?: string;
+    tsconfigPath?: string;
+    compilerOptions?: Record<string, JsonValue>;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    output?: ExecutionOutputOptions;
+}
+export interface NpmProjectInstallOptions extends Omit<LanguageExecutionOptions, "args" | "stdin"> {
+    frozen?: boolean;
+}
+export interface NpmPackageInstallOptions extends Omit<LanguageExecutionOptions, "args" | "stdin"> {
+    dev?: boolean;
+    global?: boolean;
+}
+export interface PythonInstallOptions extends Omit<LanguageExecutionOptions, "args" | "stdin"> {
+    upgrade?: boolean;
+    requirementsFile?: string;
+    indexUrl?: string;
+    extraIndexUrls?: string[];
+}
+export type ContextState = "idle" | "running" | "resetting" | "deleting" | "failed";
+export type ExecutionOutcome = "succeeded" | "failed" | "cancelled" | "timed_out";
+export interface ContextDescriptor {
+    contextId: string;
+    state: ContextState;
+    language?: "javascript" | "python";
+    createdAtMs: number;
+    lastStartedAtMs?: number;
+    lastCompletedAtMs?: number;
+}
+export interface ProcessDescriptor {
+    pid: number;
+    state: "running" | "exited";
+    language?: "javascript" | "python";
+    command?: string;
+    startedAtMs: number;
+}
+export interface ProcessExit {
+    pid: number;
+    outcome: "exited" | "signalled" | "timed_out";
+    exitCode?: number;
+    signal?: ExecutionSignal;
+}
+export interface SpawnOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    args?: string[];
+    stdin?: string | Uint8Array;
+    timeoutMs?: number;
+    pty?: {
+        cols?: number;
+        rows?: number;
+    };
+    signal?: AbortSignal;
+    onStdout?: (chunk: Uint8Array) => void;
+    onStderr?: (chunk: Uint8Array) => void;
+    output?: {
+        retainEvents?: boolean;
+    };
+}
+export type LanguageSpawnOptions = SpawnOptions;
+export interface ExecutionErrorData {
+    code: string;
+    name: string;
+    message: string;
+    stack?: string;
+    details?: JsonValue;
+}
+interface CodeExecutionResultBase {
+    exitCode?: number;
+    stdout?: string;
+    stderr?: string;
+    stdoutTruncated?: boolean;
+    stderrTruncated?: boolean;
+}
+type ExecutionResultOutcome<TIdentity> = (CodeExecutionResultBase & {
+    outcome: "succeeded";
+    error?: never;
+} & TIdentity) | (CodeExecutionResultBase & {
+    outcome: Exclude<ExecutionOutcome, "succeeded">;
+    error: ExecutionErrorData;
+} & TIdentity);
+export type CodeExecutionResult = ExecutionResultOutcome<Record<never, never>>;
+export type CodeEvaluationResult<T = JsonValue> = (CodeExecutionResultBase & {
+    outcome: "succeeded";
+    error?: never;
+    value: T;
+}) | (CodeExecutionResultBase & {
+    outcome: Exclude<ExecutionOutcome, "succeeded">;
+    error: ExecutionErrorData;
+    value?: never;
+});
+export interface TypeScriptDiagnostic {
+    code: number;
+    category: "error" | "warning" | "suggestion" | "message";
+    message: string;
+    filePath?: string;
+    line?: number;
+    column?: number;
+}
+export type TypeScriptCheckResult = (CodeExecutionResultBase & {
+    outcome: "succeeded";
+    error?: never;
+    hasErrors: boolean;
+    diagnostics: TypeScriptDiagnostic[];
+}) | (CodeExecutionResultBase & {
+    outcome: Exclude<ExecutionOutcome, "succeeded">;
+    error: ExecutionErrorData;
+    hasErrors?: never;
+    diagnostics: TypeScriptDiagnostic[];
+});
+export interface ProcessOutputEvent<TChunk = Uint8Array> {
+    pid: number;
+    sequence: number;
+    channel: "stdout" | "stderr" | "pty";
+    chunk: TChunk;
+    timestampMs: number;
+}
+export interface OutputReplay<TChunk = Uint8Array> {
+    pid: number;
+    events: ProcessOutputEvent<TChunk>[];
+    nextCursor: string;
+    hasMore: boolean;
+    truncated: boolean;
+}
+export {};

package/dist/language-execution.js

@@ -0,0 +1 @@
+export {};

package/dist/layers.d.ts

@@ -1,5 +1,5 @@
 import type { BaseFilesystemSnapshot } from "./base-filesystem.js";
-import { type FilesystemEntry } from "./filesystem-snapshot.js";
+import type { FilesystemEntry } from "./filesystem-snapshot.js";
 import type { VirtualFileSystem } from "./runtime-compat.js";
 export type OverlayFilesystemMode = "ephemeral" | "read-only";
 export interface FilesystemSnapshotExport {
@@ -31,6 +31,10 @@ export type SnapshotImportSource = {
     kind: "snapshot-export";
     source: FilesystemSnapshotExport | unknown;
 };
+/**
+ * Caller-provided durable layer store. AgentOS forwards these explicit handles
+ * but does not provide a second client-side filesystem or overlay engine.
+ */
 export interface LayerStore {
     readonly storeId: string;
     createWritableLayer(): Promise<WritableLayerHandle>;
@@ -48,4 +52,3 @@ export interface LayerStore {
     dispose(): void;
 }
 export declare function createSnapshotExport(entries: FilesystemEntry[]): RootSnapshotExport;
-export declare function createInMemoryLayerStore(): LayerStore;

package/dist/layers.js

@@ -1,52 +1,3 @@
-import { randomUUID } from "node:crypto";
-import { createFilesystemFromEntries, snapshotVirtualFilesystem, } from "./filesystem-snapshot.js";
-import { createOverlayBackend } from "./overlay-filesystem.js";
-function cloneSnapshotHandle(storeId, layerId) {
-    return { kind: "snapshot", storeId, layerId };
-}
-function cloneWritableHandle(storeId, layerId, leaseId) {
-    return { kind: "writable", storeId, layerId, leaseId };
-}
-function isBaseFilesystemSnapshot(value) {
-    if (!value || typeof value !== "object") {
-        return false;
-    }
-    const filesystem = value.filesystem;
-    if (!filesystem || typeof filesystem !== "object") {
-        return false;
-    }
-    return Array.isArray(filesystem.entries);
-}
-function isFilesystemSnapshotExport(value) {
-    if (!value || typeof value !== "object") {
-        return false;
-    }
-    if (value.format !== "agentos-filesystem-snapshot-v1") {
-        return false;
-    }
-    const filesystem = value.filesystem;
-    if (!filesystem || typeof filesystem !== "object") {
-        return false;
-    }
-    return Array.isArray(filesystem.entries);
-}
-function normalizeSnapshotExport(source) {
-    if (source.kind === "base-filesystem-artifact") {
-        if (!isBaseFilesystemSnapshot(source.source)) {
-            throw new Error("Invalid base filesystem artifact");
-        }
-        return {
-            format: "agentos-filesystem-snapshot-v1",
-            filesystem: {
-                entries: source.source.filesystem.entries,
-            },
-        };
-    }
-    if (!isFilesystemSnapshotExport(source.source)) {
-        throw new Error("Invalid snapshot export");
-    }
-    return source.source;
-}
 export function createSnapshotExport(entries) {
     return {
         kind: "snapshot-export",
@@ -56,139 +7,3 @@ export function createSnapshotExport(entries) {
         },
     };
 }
-export function createInMemoryLayerStore() {
-    const storeId = `memory-layer-store:${randomUUID()}`;
-    const layers = new Map();
-    function getLayerState(handle) {
-        if (handle.storeId !== storeId) {
-            throw new Error(`Layer ${handle.layerId} belongs to store ${handle.storeId}, not ${storeId}`);
-        }
-        const state = layers.get(handle.layerId);
-        if (!state) {
-            throw new Error(`Unknown layer: ${handle.layerId}`);
-        }
-        if (state.kind !== handle.kind) {
-            throw new Error(`Layer kind mismatch for ${handle.layerId}`);
-        }
-        return state;
-    }
-    const store = {
-        storeId,
-        get retainedLayerCount() {
-            return layers.size;
-        },
-        async createWritableLayer() {
-            const layerId = randomUUID();
-            const leaseId = randomUUID();
-            layers.set(layerId, {
-                kind: "writable",
-                fs: await createFilesystemFromEntries([
-                    {
-                        path: "/",
-                        type: "directory",
-                        mode: "0755",
-                        uid: 0,
-                        gid: 0,
-                    },
-                ]),
-                leaseId,
-                valid: true,
-                activeOverlay: null,
-            });
-            return cloneWritableHandle(storeId, layerId, leaseId);
-        },
-        async importSnapshot(source) {
-            const snapshot = normalizeSnapshotExport(source);
-            const layerId = randomUUID();
-            layers.set(layerId, {
-                kind: "snapshot",
-                snapshot,
-                fs: await createFilesystemFromEntries(snapshot.filesystem.entries),
-            });
-            return cloneSnapshotHandle(storeId, layerId);
-        },
-        async openSnapshotLayer(layerId) {
-            const state = layers.get(layerId);
-            if (!state || state.kind !== "snapshot") {
-                throw new Error(`Unknown snapshot layer: ${layerId}`);
-            }
-            return cloneSnapshotHandle(storeId, layerId);
-        },
-        async sealLayer(layer) {
-            const state = getLayerState(layer);
-            if (state.kind !== "writable") {
-                throw new Error(`Layer ${layer.layerId} is not writable`);
-            }
-            const baseFs = state.activeOverlay ?? state.fs;
-            if (!state.valid || state.leaseId !== layer.leaseId || !baseFs) {
-                throw new Error(`Writable layer ${layer.layerId} is no longer valid`);
-            }
-            const entries = await snapshotVirtualFilesystem(baseFs);
-            const snapshot = createSnapshotExport(entries).source;
-            const layerId = randomUUID();
-            layers.set(layerId, {
-                kind: "snapshot",
-                snapshot,
-                fs: await createFilesystemFromEntries(snapshot.filesystem.entries),
-            });
-            // Release the writable layer's filesystem payload now that it is sealed;
-            // the invalid tombstone is retained so stale handles still report cleanly.
-            state.valid = false;
-            state.activeOverlay = null;
-            state.fs = null;
-            return cloneSnapshotHandle(storeId, layerId);
-        },
-        createOverlayFilesystem(options) {
-            const lowers = options.lowers.map((lower) => {
-                const state = getLayerState(lower);
-                if (state.kind !== "snapshot") {
-                    throw new Error(`Layer ${lower.layerId} is not a snapshot`);
-                }
-                return lower;
-            });
-            if (options.mode === "read-only") {
-                return createOverlayBackend({
-                    mode: "read-only",
-                    lowers: lowers.map((lower) => {
-                        const state = getLayerState(lower);
-                        if (state.kind !== "snapshot") {
-                            throw new Error(`Layer ${lower.layerId} is not a snapshot`);
-                        }
-                        return state.fs;
-                    }),
-                });
-            }
-            const upperState = getLayerState(options.upper);
-            if (upperState.kind !== "writable") {
-                throw new Error(`Layer ${options.upper.layerId} is not writable`);
-            }
-            if (!upperState.valid || upperState.leaseId !== options.upper.leaseId) {
-                throw new Error(`Writable layer ${options.upper.layerId} is no longer valid`);
-            }
-            if (upperState.activeOverlay) {
-                throw new Error(`Writable layer ${options.upper.layerId} is already attached to an overlay`);
-            }
-            if (!upperState.fs) {
-                throw new Error(`Writable layer ${options.upper.layerId} is no longer valid`);
-            }
-            const overlay = createOverlayBackend({
-                upper: upperState.fs,
-                lowers: lowers.map((lower) => {
-                    const state = getLayerState(lower);
-                    if (state.kind !== "snapshot") {
-                        throw new Error(`Layer ${lower.layerId} is not a snapshot`);
-                    }
-                    return state.fs;
-                }),
-            });
-            upperState.activeOverlay = overlay;
-            return overlay;
-        },
-        dispose() {
-            // Release every retained layer's filesystem payload so the store does
-            // not accumulate snapshots/writable layers for the process lifetime.
-            layers.clear();
-        },
-    };
-    return store;
-}