@smthrs/artifacts 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/RemoteArtifacts.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/RemoteArtifacts.ts"],
+  "sourcesContent": ["/**\n * The shared artifact tier: an {@link ArtifactStore.Service} spoken over HTTP.\n *\n * The wire protocol mirrors Bazel's dumb-HTTP remote cache, class\n * `HttpCacheClient` in `com.google.devtools.build.lib.remote.http`, which\n * documents it as: \"CAS (Content Addressable Storage) blobs are stored under\n * the path `/cas/base16-key`\", uploaded with `PUT`, downloaded with `GET`. We add\n * `HEAD /cas/{digest}` for a single existence probe and\n * `POST /cas/findMissing` for the batched one, because Bazel's HTTP client has\n * no `findMissingDigests` at all \u2014 it answers \"everything is missing\" and\n * re-uploads \u2014 and a batched probe is the whole reason\n * `MissingDigestsFinder` exists in the gRPC client.\n *\n * Transport is Effect's own `HttpClient` tag. There is no lower transport in\n * this repository, and there does not need to be one: the kernel already\n * decorates that tag with `net:get`/`net:post` capability checks, so a remote\n * artifact fetch is permission-checked like every other egress.\n *\n * ## Chunked uploads\n *\n * With `chunkBytes` set, a blob past that size travels as a sequence of\n * `PUT /cas/{digest}` requests carrying `Content-Range: bytes {a}-{b}/{total}`,\n * preceded by a `HEAD /cas/{digest}` existence probe and a\n * `Content-Range: bytes *\\/{total}` probe with an empty body. This is the\n * resumable-upload shape HTTP already has: the range probe asks what prefix\n * the tier holds and `308` means \"keep going\", with a `Range: bytes=0-{last}`\n * header on the probe or on a chunk answer moving the offset.\n *\n * Only a `308` continues the sequence, and the completing chunk's `2xx` is\n * confirmed with `HEAD` before `put` reports the digest as published. A `2xx`\n * anywhere else, to the empty probe or to a chunk the tier is still owed bytes\n * after, reads as a tier that ignored `Content-Range` and stored the body it\n * was handed, which is what plain WebDAV `PUT` does. That tier, the one that\n * answers `400`, `411`, or `416`, and the one whose `HEAD` will not confirm\n * the stored length all get the same treatment: one whole-blob `PUT`, which\n * overwrites the partial body the sequence left behind. So the blob always\n * lands whole, and the cost of turning the dial on against a server that\n * never learned about it is round trips, never a digest published over bytes\n * the server does not hold.\n *\n * This repository's own hosted and self-hosted cache services are such\n * servers: neither implements the resumable sequence, and both refuse a\n * ranged `PUT` with `400`, RFC 9110 section 14.5's answer from a resource\n * that does not support partial `PUT`. Against them `chunkBytes` costs the\n * probe round trip and the blob travels whole, and both cap one request body\n * at 16 MiB, so a blob past that cap is refused with `413` in either mode.\n *\n * The endpoint and its credentials arrive as **layer construction options**.\n * They are capabilities, never step inputs: they are not hashed into a step\n * key, journaled, or returned in a recorded result. Invalid endpoint errors are\n * sanitized before they cross the boundary.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport * as Stream from \"effect/Stream\"\nimport * as FetchHttpClient from \"effect/unstable/http/FetchHttpClient\"\nimport * as Headers from \"effect/unstable/http/Headers\"\nimport * as HttpClient from \"effect/unstable/http/HttpClient\"\nimport * as HttpClientRequest from \"effect/unstable/http/HttpClientRequest\"\nimport type * as HttpClientResponse from \"effect/unstable/http/HttpClientResponse\"\nimport * as ArtifactStore from \"./ArtifactStore.ts\"\n\n/**\n * How eagerly a composition materializes shared blobs into its local store.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const DownloadPolicy = Schema.Literals([\"all\", \"toplevel\", \"minimal\"] as const)\n\n/**\n * How eagerly a composition materializes remote blobs.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type DownloadPolicy = typeof DownloadPolicy.Type\n\n/**\n * Every download policy, in materialization order.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const downloadPolicies: ReadonlyArray<DownloadPolicy> = Object.freeze([\"all\", \"toplevel\", \"minimal\"])\n\n/**\n * A remote artifact tier, which is an ordinary store that also states how\n * eagerly a composition reading through it should materialize blobs locally.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Service extends ArtifactStore.Service {\n  readonly downloadPolicy: DownloadPolicy\n}\n\n/**\n * Reads the download policy a store declares, or `undefined` for a store that\n * declares none \u2014 every local store, and any foreign implementation.\n *\n * @category getters\n * @since 1.0.0-rc.0\n */\nexport const downloadPolicyOf = (store: ArtifactStore.Service): DownloadPolicy | undefined => {\n  const declared = (store as { readonly downloadPolicy?: unknown }).downloadPolicy\n  return Schema.is(DownloadPolicy)(declared) ? declared : undefined\n}\n\n/**\n * How to reach the shared artifact tier.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport interface Options {\n  /**\n   * The cache root, e.g. `https://cache.example.com`. `/cas/{digest}` and\n   * `/cas/findMissing` are resolved beneath it. A trailing slash is ignored.\n   *\n   * Four shapes are refused at construction as `invalid_configuration`, before\n   * any request leaves and therefore before `headers` can reach a wire: a value\n   * that is not a string, one no `URL` parser accepts, a scheme other than\n   * `https:` (plain `http:` is accepted only for the literal loopback hosts\n   * `localhost`, `127.0.0.1`, and `[::1]`), and an endpoint carrying\n   * userinfo, a query, or a fragment. The\n   * last rule keeps a credential out of a place nothing here would redact: an\n   * endpoint is interpolated into every request path and into span attributes.\n   *\n   * The refusal message names only the violated rule and never echoes the\n   * endpoint, so a rejected `https://user:secret@host` cannot leak its\n   * credential into a log line or a durable error.\n   */\n  readonly endpoint: string\n  /**\n   * Headers sent with every request \u2014 an `Authorization` bearer token, a\n   * tenant header, whatever the deployment's gateway wants. This is the\n   * credential seam, and it is deliberately construction-time: a credential\n   * that arrived as a step input would be hashed into a step key and persisted\n   * everywhere the journal goes.\n   *\n   * The protocol wins every collision. These headers are applied to a request\n   * first. Configured `content-type`, `content-length`, and `content-range`\n   * are removed, then computed only where the protocol needs them. Whole-blob\n   * uploads, including fallbacks, never carry `content-range`.\n   * All configured header names are redacted in HTTP spans, in addition to\n   * the host's existing redaction rules.\n   *\n   * A name that is not an HTTP token, or a value longer than 16 KiB or\n   * carrying a control character (CR and LF included), is refused at\n   * construction as `invalid_configuration`.\n   */\n  readonly headers?: Record<string, string> | undefined\n  /**\n   * The deadline on a single download, from the request leaving to the last\n   * body byte arriving. A shared tier that stops answering must fail the read\n   * rather than park it forever. `CombinedArtifacts.get` propagates a remote\n   * `ArtifactStoreError`, including a download timeout. Only opportunistic\n   * uploads from `CombinedArtifacts.put` ignore remote failures;\n   * `ArtifactSync.hydrate` separately turns a failure into replay rejection.\n   * Defaults to 60 seconds, Bazel's `--remote_timeout`\n   * default for the same REST protocol (its `RemoteOptions`: \"For the REST\n   * cache, this is both the connect and the read timeout\").\n   */\n  readonly downloadTimeout?: Duration.Input | undefined\n  /**\n   * Deadline for an upload, including every resume probe and chunk. Defaults\n   * to 60 seconds.\n   */\n  readonly uploadTimeout?: Duration.Input | undefined\n  /**\n   * Deadline for an existence probe or one `findMissing` batch, including its\n   * response body. Defaults to 60 seconds.\n   */\n  readonly requestTimeout?: Duration.Input | undefined\n  /**\n   * The largest download this client will buffer, in bytes. The body is read\n   * incrementally and abandoned the moment it exceeds the bound \u2014 and refused\n   * outright when `Content-Length` already declares the excess \u2014 so a\n   * mis-serving or hostile cache cannot make this process buffer and hash an\n   * arbitrarily large body before the digest check refuses it. Defaults to\n   * 256 MiB.\n   */\n  readonly maxDownloadBytes?: number | undefined\n  /**\n   * Largest `findMissing` response body accepted. Defaults to the protocol's\n   * 256 KiB request/response bound and may only lower that bound.\n   */\n  readonly maxFindMissingResponseBytes?: number | undefined\n  /**\n   * Above this many bytes an upload travels as a sequence of `Content-Range`\n   * `PUT`s instead of one whole-blob body, and a transfer that died partway\n   * resumes from the prefix the tier kept rather than starting over. See\n   * {@link module:RemoteArtifacts | the chunked upload protocol} below.\n   *\n   * Absent by default: every upload is one whole-blob `PUT`, which is what\n   * Bazel's dumb-HTTP client does and what every deployment already serving\n   * this protocol expects. Set it when a proxy caps request bodies, or when\n   * artifacts are large enough that losing a transfer is expensive.\n   *\n   * The repository's own hosted and self-hosted cache services answer the\n   * ranged probe with `400`, so against them this dial degrades to one\n   * whole-blob `PUT`, and their 16 MiB body cap refuses a larger blob with\n   * `413` in either mode.\n   */\n  readonly chunkBytes?: number | undefined\n  /**\n   * How eagerly a composition reading through this tier materializes blobs\n   * into its local store. This is Bazel's `--remote_download_{all,toplevel,\n   * minimal}` dial (`RemoteOutputChecker`), and it lives here because the\n   * shared tier is the thing being conserved.\n   *\n   * - `all` (the default) prefetches every referenced blob when a replay is\n   *   admitted, so the replay reads local bytes.\n   * - `toplevel` prefetches nothing and materializes a blob into the local\n   *   store on the first read that actually needs it.\n   * - `minimal` prefetches nothing and materializes nothing: a read is served\n   *   straight from the shared tier and the local store never grows.\n   *\n   * `CombinedArtifacts.get` honors the last two; `@smthrs/engine-store`'s\n   * `ArtifactSync.hydrate` honors the first.\n   */\n  readonly downloadPolicy?: DownloadPolicy | undefined\n}\n\n/**\n * The default download deadline. 60 seconds is Bazel's `--remote_timeout`\n * default, governing the same dumb-HTTP cache protocol.\n */\nconst defaultDownloadTimeout = Duration.seconds(60)\nconst defaultUploadTimeout = Duration.seconds(60)\nconst defaultRequestTimeout = Duration.seconds(60)\n\n/**\n * The default bound on a downloaded blob: 256 MiB. Artifacts are spilled step\n * values, not media libraries; a body past this size is far more likely a\n * mis-serving cache than a legitimate blob, and the dial is per-store for a\n * deployment that knows better.\n */\nconst defaultMaxDownloadBytes = 256 * 1024 * 1024\nconst maxFindMissingBatchDigests = 1_000\nconst maxFindMissingBodyBytes = 256 * 1024\nconst encoder = new TextEncoder()\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true })\n\n/**\n * The credential-free part of a transport failure: the HTTP client's reason\n * tag and the first operating-system error code (`ECONNREFUSED`, `ENOTFOUND`,\n * `CERT_HAS_EXPIRED`) in its cause chain. Never the request, the URL, the\n * headers, or free-form text, any of which may carry a credential.\n */\nconst transportReason = (cause: unknown): string | undefined => {\n  const reason = (cause as { readonly reason?: { readonly _tag?: unknown } } | null)?.reason\n  const tag = typeof reason?._tag === \"string\" ? reason._tag : undefined\n  let code: string | undefined\n  let current: unknown = reason ?? cause\n  for (let depth = 0; depth < 8 && typeof current === \"object\" && current !== null; depth++) {\n    const candidate = (current as { readonly code?: unknown }).code\n    if (typeof candidate === \"string\" && /^[A-Z][A-Z0-9_]{1,63}$/.test(candidate)) {\n      code = candidate\n      break\n    }\n    current = (current as { readonly cause?: unknown }).cause\n  }\n  const parts = [tag, code].filter((part): part is string => part !== undefined)\n  return parts.length === 0 ? undefined : parts.join(\" \")\n}\n\nconst transportFailure = (operation: string, cause?: unknown): ArtifactStore.ArtifactStoreError => {\n  const reason = transportReason(cause)\n  return new ArtifactStore.ArtifactStoreError({\n    code: \"transport_failed\",\n    message: `the remote artifact tier refused ${operation}${reason === undefined ? \"\" : ` (${reason})`}`\n  })\n}\n\nconst unexpectedStatus = (operation: string, status: number): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({\n    code: \"transport_failed\",\n    message: `the remote artifact tier answered ${operation} with HTTP ${status}`\n  })\n\nconst invalidOption = (name: string): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({\n    code: \"invalid_configuration\",\n    message: `invalid remote artifact option: ${name}`\n  })\n\n/** The batched-probe response body. */\nconst FindMissingResponse = Schema.Struct({ missing: Schema.Array(Schema.String) })\n\n/** An RFC 9110 field-name token. */\nconst headerName = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/\n\n/** Whether a header value carries a C0 control character or DEL, CR and LF included. */\nconst hasControlText = (value: string): boolean => {\n  for (let index = 0; index < value.length; index++) {\n    const unit = value.charCodeAt(index)\n    if (unit <= 0x1f || unit === 0x7f) return true\n  }\n  return false\n}\n\nconst configurationFailure = (message: string): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({ code: \"invalid_configuration\", message })\n\n/**\n * A 2xx is success, a 404 is a miss, and everything else is a transport\n * failure. Bazel's HTTP client takes the same three-way split; it is the only\n * classification a dumb-HTTP cache can support, because there is no richer\n * error envelope on the wire.\n */\nconst isOk = (response: HttpClientResponse.HttpClientResponse): boolean =>\n  response.status >= 200 && response.status < 300\n\n/**\n * Builds a remote artifact store over Effect's `HttpClient`.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const make = (\n  options: Options\n): Effect.Effect<Service, ArtifactStore.ArtifactStoreError, HttpClient.HttpClient> =>\n  Effect.gen(function*() {\n    const configured = yield* Effect.try({\n      try: () => {\n        const headers = options.headers === undefined\n          ? undefined\n          : Object.freeze(Object.fromEntries(\n            Object.entries(options.headers).map(([name, value]) => {\n              // Refused here, once, rather than on every request as an opaque\n              // transport failure: a CRLF in a value or a space in a name can\n              // never become a valid header.\n              if (typeof value !== \"string\" || value.length > 16 * 1024 || hasControlText(value)) {\n                throw new TypeError(\"header value\")\n              }\n              if (!headerName.test(name)) throw new TypeError(\"header name\")\n              return [name, value]\n            })\n          ))\n        return {\n          endpoint: options.endpoint,\n          headers,\n          downloadTimeout: options.downloadTimeout,\n          uploadTimeout: options.uploadTimeout,\n          requestTimeout: options.requestTimeout,\n          maxDownloadBytes: options.maxDownloadBytes,\n          maxFindMissingResponseBytes: options.maxFindMissingResponseBytes,\n          chunkBytes: options.chunkBytes,\n          downloadPolicy: options.downloadPolicy\n        }\n      },\n      catch: () => invalidOption(\"options\")\n    })\n    if (typeof configured.endpoint !== \"string\") return yield* Effect.fail(invalidOption(\"endpoint\"))\n    const endpoint = yield* Effect.try({\n      try: () => new URL(configured.endpoint),\n      catch: () => configurationFailure(\"invalid remote artifact endpoint\")\n    })\n    // A self-hosted cache on this machine is reachable over plain HTTP, and\n    // loopback traffic never leaves the host. Only literal loopback names are\n    // exempt: a `*.localhost` name reaches loopback only on a resolver that\n    // follows RFC 6761, and one that forwards it to DNS would carry the\n    // credential headers over plaintext to whatever host answers.\n    const loopback = endpoint.hostname === \"localhost\" || endpoint.hostname === \"127.0.0.1\" ||\n      endpoint.hostname === \"[::1]\"\n    if (endpoint.protocol !== \"https:\" && !(endpoint.protocol === \"http:\" && loopback)) {\n      return yield* Effect.fail(configurationFailure(\"remote artifact endpoint must use HTTPS\"))\n    }\n    if (endpoint.username !== \"\" || endpoint.password !== \"\" || endpoint.search !== \"\" || endpoint.hash !== \"\") {\n      return yield* Effect.fail(\n        configurationFailure(\"remote artifact endpoint must not contain credentials, a query, or a fragment\")\n      )\n    }\n    endpoint.pathname = endpoint.pathname.replace(/\\/+$/, \"\")\n    const base = endpoint.toString().replace(/\\/+$/, \"\")\n    const headers = configured.headers\n    const client = yield* HttpClient.HttpClient\n    const credentialNames = Object.keys(headers ?? {}).map((name) => name.toLowerCase())\n    /**\n     * Protocol-owned headers are computed from each request's body and range,\n     * never inherited from credentials, including on a whole-blob fallback.\n     */\n    const authorized = (request: HttpClientRequest.HttpClientRequest): HttpClientRequest.HttpClientRequest =>\n      (headers === undefined ? request : HttpClientRequest.setHeaders(request, headers)).pipe(\n        HttpClientRequest.removeHeader(\"content-type\"),\n        HttpClientRequest.removeHeader(\"content-length\"),\n        HttpClientRequest.removeHeader(\"content-range\")\n      )\n    // The address is a URL path segment, so it is refused before it is\n    // interpolated and percent-encoded when it is: an address carrying a\n    // separator or a `..` would otherwise point this client at a different\n    // resource on the configured endpoint. `ArtifactStore.validateDigest` is\n    // the same guard the filesystem tier applies to the same untrusted input \u2014\n    // a digest read back out of a durable row.\n    const casUrl = (digest: ArtifactStore.Digest) => `${base}/cas/${digest}`\n    const scopedClient = HttpClient.withScope(client)\n    /**\n     * Keep body processing inside the exchange; abort unused responses on every exit.\n     *\n     * Redirects are never followed. A fetch-based client follows them by\n     * default and strips only `Authorization` on a cross-origin hop, so a\n     * tier answering `3xx` would otherwise receive the credential headers at\n     * another origin or over plain HTTP. Manual mode hands the `3xx` back,\n     * where it is an unexpected status (or, for `308`, the resumable-upload\n     * answer this protocol already speaks).\n     */\n    const send = <A, E, R>(\n      operation: string,\n      request: HttpClientRequest.HttpClientRequest,\n      use: (response: HttpClientResponse.HttpClientResponse) => Effect.Effect<A, E, R>\n    ): Effect.Effect<A, E | ArtifactStore.ArtifactStoreError, R> =>\n      Effect.gen(function*() {\n        const redactedNames = yield* Headers.CurrentRedactedNames\n        const requestInit = yield* Effect.serviceOption(FetchHttpClient.RequestInit)\n        return yield* scopedClient.execute(request).pipe(\n          Effect.provideService(FetchHttpClient.RequestInit, {\n            ...Option.getOrUndefined(requestInit),\n            redirect: \"manual\"\n          }),\n          Effect.mapError((cause) => transportFailure(operation, cause)),\n          Effect.flatMap(use),\n          Effect.provideService(Headers.CurrentRedactedNames, [...redactedNames, ...credentialNames]),\n          Effect.scoped\n        )\n      })\n    const parseDeadline = (name: string, input: Duration.Input | undefined, fallback: Duration.Duration) =>\n      Effect.gen(function*() {\n        const parsed = Duration.fromInput(input ?? fallback)\n        if (\n          Option.isNone(parsed) ||\n          !Number.isFinite(Duration.toMillis(parsed.value)) ||\n          Duration.toMillis(parsed.value) <= 0\n        ) {\n          return yield* Effect.fail(invalidOption(name))\n        }\n        return parsed.value\n      })\n    const downloadDeadline = yield* parseDeadline(\n      \"downloadTimeout\",\n      configured.downloadTimeout,\n      defaultDownloadTimeout\n    )\n    const uploadDeadline = yield* parseDeadline(\"uploadTimeout\", configured.uploadTimeout, defaultUploadTimeout)\n    const requestDeadline = yield* parseDeadline(\"requestTimeout\", configured.requestTimeout, defaultRequestTimeout)\n    const maxDownloadBytes = configured.maxDownloadBytes ?? defaultMaxDownloadBytes\n    if (!Number.isSafeInteger(maxDownloadBytes) || maxDownloadBytes <= 0) {\n      return yield* Effect.fail(invalidOption(\"maxDownloadBytes\"))\n    }\n    const maxFindMissingResponseBytes = configured.maxFindMissingResponseBytes ?? maxFindMissingBodyBytes\n    if (\n      !Number.isSafeInteger(maxFindMissingResponseBytes) ||\n      maxFindMissingResponseBytes <= 0 ||\n      maxFindMissingResponseBytes > maxFindMissingBodyBytes\n    ) {\n      return yield* Effect.fail(invalidOption(\"maxFindMissingResponseBytes\"))\n    }\n    const chunkBytes = configured.chunkBytes\n    if (chunkBytes !== undefined && (!Number.isSafeInteger(chunkBytes) || chunkBytes <= 0)) {\n      return yield* Effect.fail(invalidOption(\"chunkBytes\"))\n    }\n    const downloadPolicy = configured.downloadPolicy ?? \"all\"\n    if (!Schema.is(DownloadPolicy)(downloadPolicy)) {\n      return yield* Effect.fail(invalidOption(\"downloadPolicy\"))\n    }\n    const bodyTooLarge = (operation: string, received: number, bound: number): ArtifactStore.ArtifactStoreError =>\n      new ArtifactStore.ArtifactStoreError({\n        code: \"transport_failed\",\n        message: `the remote artifact tier answered ${operation} with ${received} bytes, past the ${bound}-byte bound`\n      })\n    const timedOut = (operation: string): ArtifactStore.ArtifactStoreError =>\n      new ArtifactStore.ArtifactStoreError({\n        code: \"transport_failed\",\n        message: `the remote artifact tier did not finish ${operation} within its configured deadline`\n      })\n    const within = <A, E, R>(\n      operation: string,\n      deadline: Duration.Duration,\n      effect: Effect.Effect<A, E, R>\n    ): Effect.Effect<A, E | ArtifactStore.ArtifactStoreError, R> =>\n      effect.pipe(\n        Effect.timeout(deadline),\n        Effect.catchTag(\"TimeoutError\", () => Effect.fail(timedOut(operation)))\n      )\n    /**\n     * Reads a download body incrementally, refusing it the moment it exceeds\n     * the size bound; a `Content-Length` that already declares the excess is\n     * refused before a single body byte is read. Streaming instead of\n     * buffering the whole body means the guard fires at most one chunk past\n     * the bound, never after an arbitrarily large response is in memory.\n     */\n    const readBounded = (\n      response: HttpClientResponse.HttpClientResponse,\n      operation: string,\n      bound: number\n    ) =>\n      Effect.gen(function*() {\n        const declared = response.headers[\"content-length\"]\n        if (declared !== undefined) {\n          const declaredBytes = Number(declared)\n          if (!/^\\d+$/.test(declared) || !Number.isSafeInteger(declaredBytes)) {\n            return yield* Effect.fail(transportFailure(`${operation} body`))\n          }\n          if (declaredBytes > bound) return yield* Effect.fail(bodyTooLarge(operation, declaredBytes, bound))\n        }\n        const chunks: Array<Uint8Array> = []\n        let received = 0\n        yield* Stream.runForEach(response.stream, (chunk: Uint8Array) =>\n          Effect.suspend(() => {\n            received += chunk.byteLength\n            if (received > bound) return Effect.fail(bodyTooLarge(operation, received, bound))\n            chunks.push(new Uint8Array(chunk))\n            return Effect.void\n          })).pipe(\n            Effect.catchTag(\"HttpClientError\", (cause) =>\n              // An absent body is zero bytes, not a transport refusal: the\n              // digest check in `get` is the arbiter of whether empty content\n              // is the requested artifact.\n              cause.reason._tag === \"EmptyBodyError\"\n                ? Effect.void\n                : Effect.fail(transportFailure(`${operation} body`)))\n          )\n        const bytes = new Uint8Array(received)\n        let offset = 0\n        for (const chunk of chunks) {\n          bytes.set(chunk, offset)\n          offset += chunk.byteLength\n        }\n        return bytes\n      })\n    /** The network half of `get`: request, status split, bounded body read. */\n    const download = (digest: ArtifactStore.Digest) =>\n      send(\"a download\", authorized(HttpClientRequest.get(casUrl(digest))), (response) =>\n        Effect.gen(function*() {\n          if (response.status === 404) {\n            return yield* Effect.fail(new ArtifactStore.ArtifactMissing({ code: \"artifact_missing\", digest }))\n          }\n          if (!isOk(response)) return yield* Effect.fail(unexpectedStatus(\"a download\", response.status))\n          return yield* readBounded(response, \"a download\", maxDownloadBytes)\n        }))\n\n    /** One whole-blob `PUT`: the protocol every dumb-HTTP CAS already speaks. */\n    const uploadWhole = (digest: ArtifactStore.Digest, bytes: Uint8Array) =>\n      send(\n        \"an upload\",\n        authorized(HttpClientRequest.put(casUrl(digest))).pipe(\n          HttpClientRequest.bodyUint8Array(bytes, \"application/octet-stream\")\n        ),\n        (response) => isOk(response) ? Effect.void : Effect.fail(unexpectedStatus(\"an upload\", response.status))\n      )\n\n    /**\n     * The byte after the prefix a `Range: bytes=0-{last}` header reports, or\n     * `undefined` when the answer names no prefix. Only a prefix starting at\n     * zero is usable: a tier holding a middle span has nothing this client can\n     * continue from, so it is treated as holding nothing.\n     */\n    const resumeOffset = (response: HttpClientResponse.HttpClientResponse): number | undefined => {\n      const header = response.headers[\"range\"]\n      if (header === undefined) return undefined\n      const match = /^bytes=0-(\\d+)$/.exec(header.trim())\n      if (match === null) return undefined\n      const last = Number(match[1])\n      // A prefix past the safe integer range does not survive `Number`: the\n      // decimal digits are rounded, so the offset it names is a number this\n      // client made up. It proves nothing about what the tier holds, which is\n      // the same as naming no prefix at all.\n      if (!Number.isSafeInteger(last)) return undefined\n      return last + 1\n    }\n\n    /**\n     * A tier that refuses ranged bodies, in the three ways HTTP has to say\n     * so. `411` and `416` refuse the body's framing; `400` is RFC 9110\n     * section 14.5's answer from a resource that \"does not support partial\n     * PUT requests\", and it is what both of this repository's cache services\n     * send. Falling back on it can mask no genuine `400`: the whole-blob\n     * `PUT` that follows presents the same URL, digest, and credential, so a\n     * real refusal comes straight back on that request.\n     */\n    const rejectsRanges = (status: number): boolean => status === 400 || status === 411 || status === 416\n\n    /**\n     * Whether the tier holds exactly `total` bytes under `digest`, read from\n     * the `Content-Length` of a `HEAD` answer.\n     *\n     * This is the only claim about a chunked transfer this client will make on\n     * its own behalf. A tier that answers `HEAD` without a length is not\n     * refused \u2014 it simply proves nothing, so the caller sends the blob whole.\n     */\n    const holdsWhole = (digest: ArtifactStore.Digest, total: number) =>\n      send(\"an existence probe\", authorized(HttpClientRequest.head(casUrl(digest))), (response) =>\n        Effect.sync(() => {\n          if (!isOk(response)) return false\n          const declared = response.headers[\"content-length\"]\n          return declared !== undefined && Number(declared) === total\n        }))\n\n    /**\n     * Sends `bytes` as `Content-Range` chunks, resuming from whatever prefix\n     * the tier reports. Answers `false` when the tier has not proved it stored\n     * the whole blob, which is the caller's signal to send it whole.\n     *\n     * A `2xx` answer is never by itself proof of that. A tier that ignores\n     * `Content-Range`, such as plain WebDAV `PUT`, which Bazel documents as a\n     * supported dumb-HTTP cache, answers every request in this sequence `201`\n     * while storing only the last body it was handed, which for the probe is\n     * zero bytes. So only a `308` continues the sequence, and the completing\n     * chunk's `2xx` is confirmed with `HEAD` before the caller is told the\n     * digest is published. Everything else falls back, and the whole-blob\n     * `PUT` overwrites whatever partial body the sequence left behind.\n     */\n    const uploadChunked = (digest: ArtifactStore.Digest, bytes: Uint8Array, chunk: number) =>\n      Effect.gen(function*() {\n        const total = bytes.byteLength\n        const ranged = (range: string, body: Uint8Array) =>\n          send(\n            \"an upload\",\n            authorized(HttpClientRequest.put(casUrl(digest))).pipe(\n              HttpClientRequest.bodyUint8Array(body, \"application/octet-stream\"),\n              HttpClientRequest.setHeader(\"content-range\", range)\n            ),\n            // Only status and headers are used after the response is released.\n            Effect.succeed\n          )\n        // A blob the tier already holds whole costs one `HEAD` and no body.\n        // Asking first is also what makes the probe's answer readable: a `2xx`\n        // to it can no longer mean \"already there\", so the one reading left is\n        // a tier that ignored the header and stored the empty body.\n        if (yield* holdsWhole(digest, total)) return true\n        // The probe carries no bytes: it exists to learn where to start, so\n        // that an interrupted transfer costs one round trip rather than the\n        // whole blob again.\n        const probe = yield* ranged(`bytes */${total}`, new Uint8Array(0))\n        if (isOk(probe) || rejectsRanges(probe.status)) return false\n        if (probe.status !== 308 && probe.status !== 404) {\n          return yield* Effect.fail(unexpectedStatus(\"an upload probe\", probe.status))\n        }\n        let offset = probe.status === 308 ? resumeOffset(probe) ?? 0 : 0\n        while (offset < total) {\n          const end = Math.min(offset + chunk, total)\n          const answer = yield* ranged(`bytes ${offset}-${end - 1}/${total}`, bytes.subarray(offset, end))\n          if (answer.status !== 308) {\n            // The completing chunk may answer `2xx`; anything before it may\n            // not, because a tier that is still owed bytes and reports success\n            // is a tier that is not reading the header. Both are checked\n            // against what the tier actually holds below.\n            if (end === total && isOk(answer)) break\n            if (isOk(answer) || rejectsRanges(answer.status)) return false\n            return yield* Effect.fail(unexpectedStatus(\"an upload\", answer.status))\n          }\n          // A tier that reports a longer prefix than this chunk delivered has\n          // more than we just sent, so the next chunk starts there. Never\n          // backwards: an answer naming a shorter prefix would loop forever.\n          offset = Math.max(end, resumeOffset(answer) ?? 0)\n        }\n        return yield* holdsWhole(digest, total)\n      })\n\n    const put: ArtifactStore.Service[\"put\"] = Effect.fn(\"RemoteArtifacts.put\")((bytes: Uint8Array) =>\n      Effect.flatMap(ArtifactStore.snapshotBytes(bytes), (snapshot) =>\n        Effect.gen(function*() {\n          const digest = yield* ArtifactStore.measureBytes(snapshot)\n          yield* Effect.annotateCurrentSpan({ digest })\n          yield* within(\n            \"an upload\",\n            uploadDeadline,\n            Effect.gen(function*() {\n              if (chunkBytes === undefined || snapshot.byteLength <= chunkBytes) {\n                yield* uploadWhole(digest, snapshot)\n                return\n              }\n              const transferred = yield* uploadChunked(digest, snapshot, chunkBytes)\n              if (!transferred) yield* uploadWhole(digest, snapshot)\n            })\n          )\n          return digest\n        }))\n    )\n\n    const get: ArtifactStore.Service[\"get\"] = Effect.fn(\"RemoteArtifacts.get\")((digest: string) =>\n      Effect.gen(function*() {\n        const validated = yield* ArtifactStore.validateDigest(digest)\n        yield* Effect.annotateCurrentSpan({ digest: validated })\n        // The deadline covers the whole exchange \u2014 request, headers, body \u2014\n        // because a tier that stalls mid-body is exactly as unanswering as\n        // one that never accepts the connection.\n        const bytes = yield* within(\"a download\", downloadDeadline, download(validated))\n        // The shared tier is the least trusted store there is: it is written\n        // by machines this one has never met. Verifying the address here means\n        // a mis-serving or compromised cache can waste a round trip but can\n        // never substitute content.\n        const measured = yield* ArtifactStore.measureBytes(bytes)\n        if (measured !== validated) {\n          return yield* Effect.fail(\n            new ArtifactStore.ArtifactCorruption({\n              code: \"artifact_corruption\",\n              recordedDigest: validated,\n              measuredDigest: measured\n            })\n          )\n        }\n        return bytes\n      })\n    )\n\n    const has: ArtifactStore.Service[\"has\"] = Effect.fn(\"RemoteArtifacts.has\")((digest: string) =>\n      Effect.gen(function*() {\n        const validated = yield* ArtifactStore.validateDigest(digest)\n        yield* Effect.annotateCurrentSpan({ digest: validated })\n        const response = yield* within(\n          \"an existence probe\",\n          requestDeadline,\n          send(\"an existence probe\", authorized(HttpClientRequest.head(casUrl(validated))), Effect.succeed)\n        )\n        if (response.status === 404) return false\n        if (!isOk(response)) return yield* Effect.fail(unexpectedStatus(\"an existence probe\", response.status))\n        return true\n      })\n    )\n\n    const findMissing: ArtifactStore.Service[\"findMissing\"] = Effect.fn(\"RemoteArtifacts.findMissing\")(\n      (digests: Iterable<string>) =>\n        Effect.gen(function*() {\n          const requested = [...new Set(digests)]\n          if (requested.length === 0) return []\n          // The batch travels in a JSON body rather than a path, but an\n          // unusable address is still an unusable address, and the local tier\n          // refuses the same batch wholesale rather than probing part of it.\n          const validated: Array<ArtifactStore.Digest> = []\n          for (const digest of requested) validated.push(yield* ArtifactStore.validateDigest(digest))\n          yield* Effect.annotateCurrentSpan({ count: validated.length })\n          const missing = new Set<string>()\n          for (let offset = 0; offset < validated.length; offset += maxFindMissingBatchDigests) {\n            const batch = validated.slice(offset, offset + maxFindMissingBatchDigests)\n            const requestBody = encoder.encode(JSON.stringify({ digests: batch }))\n            /* v8 ignore next 3 -- strict 64-byte digests plus the 1,000-entry batch cap make this\n             * at most 67,013 bytes; keep the protocol assertion beside serialization in case either invariant changes. */\n            if (requestBody.byteLength > maxFindMissingBodyBytes) {\n              return yield* Effect.fail(configurationFailure(\"remote artifact findMissing request exceeds 256 KiB\"))\n            }\n            const decoded = yield* within(\n              \"a batched existence probe\",\n              requestDeadline,\n              send(\n                \"a batched existence probe\",\n                authorized(HttpClientRequest.post(`${base}/cas/findMissing`)).pipe(\n                  HttpClientRequest.bodyUint8Array(requestBody, \"application/json\")\n                ),\n                (response) =>\n                  Effect.gen(function*() {\n                    if (!isOk(response)) {\n                      return yield* Effect.fail(unexpectedStatus(\"a batched existence probe\", response.status))\n                    }\n                    const bodyBytes = yield* readBounded(\n                      response,\n                      \"a batched existence probe\",\n                      maxFindMissingResponseBytes\n                    )\n                    const body = yield* Effect.try({\n                      try: () => JSON.parse(decoder.decode(bodyBytes)) as unknown,\n                      catch: () => transportFailure(\"a batched existence probe body\")\n                    })\n                    return yield* Schema.decodeUnknownEffect(FindMissingResponse)(body).pipe(\n                      Effect.mapError(() => transportFailure(\"a batched existence probe body\"))\n                    )\n                  })\n              )\n            )\n            const asked = new Set<string>(batch)\n            for (const digest of decoded.missing) if (asked.has(digest)) missing.add(digest)\n          }\n          // \"The returned set is guaranteed to be a subset of `digests`\"\n          // (`MissingDigestsFinder`). Bazel gets that from the server; we\n          // enforce it on this side too, because a server that answered with\n          // an unrequested digest would otherwise make the caller upload bytes\n          // it never asked about.\n          return validated.filter((digest) => missing.has(digest))\n        })\n    )\n\n    return { put, get, has, findMissing, downloadPolicy }\n  })\n\n/**\n * Provides a remote artifact store as the `ArtifactStore` tag.\n *\n * Composing this *alone* makes every artifact read and write a network round\n * trip. The intended production shape is\n * {@link CombinedArtifacts.layer | CombinedArtifacts}, with this as its remote\n * tier.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer = (\n  options: Options\n): Layer.Layer<ArtifactStore.ArtifactStore, ArtifactStore.ArtifactStoreError, HttpClient.HttpClient> =>\n  Layer.effect(ArtifactStore.ArtifactStore)(make(options))\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuDA,eAA0B;AAC1B,aAAwB;AACxB,YAAuB;AACvB,aAAwB;AACxB,aAAwB;AACxB,aAAwB;AACxB,sBAAiC;AACjC,cAAyB;AACzB,iBAA4B;AAC5B,wBAAmC;AAEnC,oBAA+B;AAQxB,MAAM,iBAAiB,OAAO,SAAS,CAAC,OAAO,YAAY,SAAS,CAAU;AAgB9E,MAAM,mBAAkD,OAAO,OAAO,CAAC,OAAO,YAAY,SAAS,CAAC;AAoBpG,MAAM,mBAAmB,CAAC,UAA6D;AAC5F,QAAM,WAAY,MAAgD;AAClE,SAAO,OAAO,GAAG,cAAc,EAAE,QAAQ,IAAI,WAAW;AAC1D;AA2HA,MAAM,yBAAyB,SAAS,QAAQ,EAAE;AAClD,MAAM,uBAAuB,SAAS,QAAQ,EAAE;AAChD,MAAM,wBAAwB,SAAS,QAAQ,EAAE;AAQjD,MAAM,0BAA0B,MAAM,OAAO;AAC7C,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AACtC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAQxD,MAAM,kBAAkB,CAAC,UAAuC;AAC9D,QAAM,SAAU,OAAoE;AACpF,QAAM,MAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AAC7D,MAAI;AACJ,MAAI,UAAmB,UAAU;AACjC,WAAS,QAAQ,GAAG,QAAQ,KAAK,OAAO,YAAY,YAAY,YAAY,MAAM,SAAS;AACzF,UAAM,YAAa,QAAwC;AAC3D,QAAI,OAAO,cAAc,YAAY,yBAAyB,KAAK,SAAS,GAAG;AAC7E,aAAO;AACP;AAAA,IACF;AACA,cAAW,QAAyC;AAAA,EACtD;AACA,QAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,OAAO,CAAC,SAAyB,SAAS,MAAS;AAC7E,SAAO,MAAM,WAAW,IAAI,SAAY,MAAM,KAAK,GAAG;AACxD;AAEA,MAAM,mBAAmB,CAAC,WAAmB,UAAsD;AACjG,QAAM,SAAS,gBAAgB,KAAK;AACpC,SAAO,IAAI,cAAc,mBAAmB;AAAA,IAC1C,MAAM;AAAA,IACN,SAAS,oCAAoC,SAAS,GAAG,WAAW,SAAY,KAAK,KAAK,MAAM,GAAG;AAAA,EACrG,CAAC;AACH;AAEA,MAAM,mBAAmB,CAAC,WAAmB,WAC3C,IAAI,cAAc,mBAAmB;AAAA,EACnC,MAAM;AAAA,EACN,SAAS,qCAAqC,SAAS,cAAc,MAAM;AAC7E,CAAC;AAEH,MAAM,gBAAgB,CAAC,SACrB,IAAI,cAAc,mBAAmB;AAAA,EACnC,MAAM;AAAA,EACN,SAAS,mCAAmC,IAAI;AAClD,CAAC;AAGH,MAAM,sBAAsB,OAAO,OAAO,EAAE,SAAS,OAAO,MAAM,OAAO,MAAM,EAAE,CAAC;AAGlF,MAAM,aAAa;AAGnB,MAAM,iBAAiB,CAAC,UAA2B;AACjD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,MAAQ,SAAS,IAAM,QAAO;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,MAAM,uBAAuB,CAAC,YAC5B,IAAI,cAAc,mBAAmB,EAAE,MAAM,yBAAyB,QAAQ,CAAC;AAQjF,MAAM,OAAO,CAAC,aACZ,SAAS,UAAU,OAAO,SAAS,SAAS;AASvC,MAAM,OAAO,CAClB,YAEA,OAAO,IAAI,aAAY;AACrB,QAAM,aAAa,OAAO,OAAO,IAAI;AAAA,IACnC,KAAK,MAAM;AACT,YAAMA,WAAU,QAAQ,YAAY,SAChC,SACA,OAAO,OAAO,OAAO;AAAA,QACrB,OAAO,QAAQ,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAIrD,cAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,QAAQ,eAAe,KAAK,GAAG;AAClF,kBAAM,IAAI,UAAU,cAAc;AAAA,UACpC;AACA,cAAI,CAAC,WAAW,KAAK,IAAI,EAAG,OAAM,IAAI,UAAU,aAAa;AAC7D,iBAAO,CAAC,MAAM,KAAK;AAAA,QACrB,CAAC;AAAA,MACH,CAAC;AACH,aAAO;AAAA,QACL,UAAU,QAAQ;AAAA,QAClB,SAAAA;AAAA,QACA,iBAAiB,QAAQ;AAAA,QACzB,eAAe,QAAQ;AAAA,QACvB,gBAAgB,QAAQ;AAAA,QACxB,kBAAkB,QAAQ;AAAA,QAC1B,6BAA6B,QAAQ;AAAA,QACrC,YAAY,QAAQ;AAAA,QACpB,gBAAgB,QAAQ;AAAA,MAC1B;AAAA,IACF;AAAA,IACA,OAAO,MAAM,cAAc,SAAS;AAAA,EACtC,CAAC;AACD,MAAI,OAAO,WAAW,aAAa,SAAU,QAAO,OAAO,OAAO,KAAK,cAAc,UAAU,CAAC;AAChG,QAAM,WAAW,OAAO,OAAO,IAAI;AAAA,IACjC,KAAK,MAAM,IAAI,IAAI,WAAW,QAAQ;AAAA,IACtC,OAAO,MAAM,qBAAqB,kCAAkC;AAAA,EACtE,CAAC;AAMD,QAAM,WAAW,SAAS,aAAa,eAAe,SAAS,aAAa,eAC1E,SAAS,aAAa;AACxB,MAAI,SAAS,aAAa,YAAY,EAAE,SAAS,aAAa,WAAW,WAAW;AAClF,WAAO,OAAO,OAAO,KAAK,qBAAqB,yCAAyC,CAAC;AAAA,EAC3F;AACA,MAAI,SAAS,aAAa,MAAM,SAAS,aAAa,MAAM,SAAS,WAAW,MAAM,SAAS,SAAS,IAAI;AAC1G,WAAO,OAAO,OAAO;AAAA,MACnB,qBAAqB,+EAA+E;AAAA,IACtG;AAAA,EACF;AACA,WAAS,WAAW,SAAS,SAAS,QAAQ,QAAQ,EAAE;AACxD,QAAM,OAAO,SAAS,SAAS,EAAE,QAAQ,QAAQ,EAAE;AACnD,QAAM,UAAU,WAAW;AAC3B,QAAM,SAAS,OAAO,WAAW;AACjC,QAAM,kBAAkB,OAAO,KAAK,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC;AAKnF,QAAM,aAAa,CAAC,aACjB,YAAY,SAAY,UAAU,kBAAkB,WAAW,SAAS,OAAO,GAAG;AAAA,IACjF,kBAAkB,aAAa,cAAc;AAAA,IAC7C,kBAAkB,aAAa,gBAAgB;AAAA,IAC/C,kBAAkB,aAAa,eAAe;AAAA,EAChD;AAOF,QAAM,SAAS,CAAC,WAAiC,GAAG,IAAI,QAAQ,MAAM;AACtE,QAAM,eAAe,WAAW,UAAU,MAAM;AAWhD,QAAM,OAAO,CACX,WACA,SACA,QAEA,OAAO,IAAI,aAAY;AACrB,UAAM,gBAAgB,OAAO,QAAQ;AACrC,UAAM,cAAc,OAAO,OAAO,cAAc,gBAAgB,WAAW;AAC3E,WAAO,OAAO,aAAa,QAAQ,OAAO,EAAE;AAAA,MAC1C,OAAO,eAAe,gBAAgB,aAAa;AAAA,QACjD,GAAG,OAAO,eAAe,WAAW;AAAA,QACpC,UAAU;AAAA,MACZ,CAAC;AAAA,MACD,OAAO,SAAS,CAAC,UAAU,iBAAiB,WAAW,KAAK,CAAC;AAAA,MAC7D,OAAO,QAAQ,GAAG;AAAA,MAClB,OAAO,eAAe,QAAQ,sBAAsB,CAAC,GAAG,eAAe,GAAG,eAAe,CAAC;AAAA,MAC1F,OAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH,QAAM,gBAAgB,CAAC,MAAc,OAAmC,aACtE,OAAO,IAAI,aAAY;AACrB,UAAM,SAAS,SAAS,UAAU,SAAS,QAAQ;AACnD,QACE,OAAO,OAAO,MAAM,KACpB,CAAC,OAAO,SAAS,SAAS,SAAS,OAAO,KAAK,CAAC,KAChD,SAAS,SAAS,OAAO,KAAK,KAAK,GACnC;AACA,aAAO,OAAO,OAAO,KAAK,cAAc,IAAI,CAAC;AAAA,IAC/C;AACA,WAAO,OAAO;AAAA,EAChB,CAAC;AACH,QAAM,mBAAmB,OAAO;AAAA,IAC9B;AAAA,IACA,WAAW;AAAA,IACX;AAAA,EACF;AACA,QAAM,iBAAiB,OAAO,cAAc,iBAAiB,WAAW,eAAe,oBAAoB;AAC3G,QAAM,kBAAkB,OAAO,cAAc,kBAAkB,WAAW,gBAAgB,qBAAqB;AAC/G,QAAM,mBAAmB,WAAW,oBAAoB;AACxD,MAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,oBAAoB,GAAG;AACpE,WAAO,OAAO,OAAO,KAAK,cAAc,kBAAkB,CAAC;AAAA,EAC7D;AACA,QAAM,8BAA8B,WAAW,+BAA+B;AAC9E,MACE,CAAC,OAAO,cAAc,2BAA2B,KACjD,+BAA+B,KAC/B,8BAA8B,yBAC9B;AACA,WAAO,OAAO,OAAO,KAAK,cAAc,6BAA6B,CAAC;AAAA,EACxE;AACA,QAAM,aAAa,WAAW;AAC9B,MAAI,eAAe,WAAc,CAAC,OAAO,cAAc,UAAU,KAAK,cAAc,IAAI;AACtF,WAAO,OAAO,OAAO,KAAK,cAAc,YAAY,CAAC;AAAA,EACvD;AACA,QAAM,iBAAiB,WAAW,kBAAkB;AACpD,MAAI,CAAC,OAAO,GAAG,cAAc,EAAE,cAAc,GAAG;AAC9C,WAAO,OAAO,OAAO,KAAK,cAAc,gBAAgB,CAAC;AAAA,EAC3D;AACA,QAAM,eAAe,CAAC,WAAmB,UAAkB,UACzD,IAAI,cAAc,mBAAmB;AAAA,IACnC,MAAM;AAAA,IACN,SAAS,qCAAqC,SAAS,SAAS,QAAQ,oBAAoB,KAAK;AAAA,EACnG,CAAC;AACH,QAAM,WAAW,CAAC,cAChB,IAAI,cAAc,mBAAmB;AAAA,IACnC,MAAM;AAAA,IACN,SAAS,2CAA2C,SAAS;AAAA,EAC/D,CAAC;AACH,QAAM,SAAS,CACb,WACA,UACA,WAEA,OAAO;AAAA,IACL,OAAO,QAAQ,QAAQ;AAAA,IACvB,OAAO,SAAS,gBAAgB,MAAM,OAAO,KAAK,SAAS,SAAS,CAAC,CAAC;AAAA,EACxE;AAQF,QAAM,cAAc,CAClB,UACA,WACA,UAEA,OAAO,IAAI,aAAY;AACrB,UAAM,WAAW,SAAS,QAAQ,gBAAgB;AAClD,QAAI,aAAa,QAAW;AAC1B,YAAM,gBAAgB,OAAO,QAAQ;AACrC,UAAI,CAAC,QAAQ,KAAK,QAAQ,KAAK,CAAC,OAAO,cAAc,aAAa,GAAG;AACnE,eAAO,OAAO,OAAO,KAAK,iBAAiB,GAAG,SAAS,OAAO,CAAC;AAAA,MACjE;AACA,UAAI,gBAAgB,MAAO,QAAO,OAAO,OAAO,KAAK,aAAa,WAAW,eAAe,KAAK,CAAC;AAAA,IACpG;AACA,UAAM,SAA4B,CAAC;AACnC,QAAI,WAAW;AACf,WAAO,OAAO,WAAW,SAAS,QAAQ,CAAC,UACzC,OAAO,QAAQ,MAAM;AACnB,kBAAY,MAAM;AAClB,UAAI,WAAW,MAAO,QAAO,OAAO,KAAK,aAAa,WAAW,UAAU,KAAK,CAAC;AACjF,aAAO,KAAK,IAAI,WAAW,KAAK,CAAC;AACjC,aAAO,OAAO;AAAA,IAChB,CAAC,CAAC,EAAE;AAAA,MACF,OAAO,SAAS,mBAAmB,CAAC;AAAA;AAAA;AAAA;AAAA,QAIlC,MAAM,OAAO,SAAS,mBAClB,OAAO,OACP,OAAO,KAAK,iBAAiB,GAAG,SAAS,OAAO,CAAC;AAAA,OAAC;AAAA,IAC1D;AACF,UAAM,QAAQ,IAAI,WAAW,QAAQ;AACrC,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,YAAM,IAAI,OAAO,MAAM;AACvB,gBAAU,MAAM;AAAA,IAClB;AACA,WAAO;AAAA,EACT,CAAC;AAEH,QAAM,WAAW,CAAC,WAChB,KAAK,cAAc,WAAW,kBAAkB,IAAI,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,aACrE,OAAO,IAAI,aAAY;AACrB,QAAI,SAAS,WAAW,KAAK;AAC3B,aAAO,OAAO,OAAO,KAAK,IAAI,cAAc,gBAAgB,EAAE,MAAM,oBAAoB,OAAO,CAAC,CAAC;AAAA,IACnG;AACA,QAAI,CAAC,KAAK,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,iBAAiB,cAAc,SAAS,MAAM,CAAC;AAC9F,WAAO,OAAO,YAAY,UAAU,cAAc,gBAAgB;AAAA,EACpE,CAAC,CAAC;AAGN,QAAM,cAAc,CAAC,QAA8B,UACjD;AAAA,IACE;AAAA,IACA,WAAW,kBAAkB,IAAI,OAAO,MAAM,CAAC,CAAC,EAAE;AAAA,MAChD,kBAAkB,eAAe,OAAO,0BAA0B;AAAA,IACpE;AAAA,IACA,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,OAAO,OAAO,KAAK,iBAAiB,aAAa,SAAS,MAAM,CAAC;AAAA,EACzG;AAQF,QAAM,eAAe,CAAC,aAAwE;AAC5F,UAAM,SAAS,SAAS,QAAQ,OAAO;AACvC,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,QAAQ,kBAAkB,KAAK,OAAO,KAAK,CAAC;AAClD,QAAI,UAAU,KAAM,QAAO;AAC3B,UAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAK5B,QAAI,CAAC,OAAO,cAAc,IAAI,EAAG,QAAO;AACxC,WAAO,OAAO;AAAA,EAChB;AAWA,QAAM,gBAAgB,CAAC,WAA4B,WAAW,OAAO,WAAW,OAAO,WAAW;AAUlG,QAAM,aAAa,CAAC,QAA8B,UAChD,KAAK,sBAAsB,WAAW,kBAAkB,KAAK,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,aAC9E,OAAO,KAAK,MAAM;AAChB,QAAI,CAAC,KAAK,QAAQ,EAAG,QAAO;AAC5B,UAAM,WAAW,SAAS,QAAQ,gBAAgB;AAClD,WAAO,aAAa,UAAa,OAAO,QAAQ,MAAM;AAAA,EACxD,CAAC,CAAC;AAgBN,QAAM,gBAAgB,CAAC,QAA8B,OAAmB,UACtE,OAAO,IAAI,aAAY;AACrB,UAAM,QAAQ,MAAM;AACpB,UAAM,SAAS,CAAC,OAAe,SAC7B;AAAA,MACE;AAAA,MACA,WAAW,kBAAkB,IAAI,OAAO,MAAM,CAAC,CAAC,EAAE;AAAA,QAChD,kBAAkB,eAAe,MAAM,0BAA0B;AAAA,QACjE,kBAAkB,UAAU,iBAAiB,KAAK;AAAA,MACpD;AAAA;AAAA,MAEA,OAAO;AAAA,IACT;AAKF,QAAI,OAAO,WAAW,QAAQ,KAAK,EAAG,QAAO;AAI7C,UAAM,QAAQ,OAAO,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,CAAC;AACjE,QAAI,KAAK,KAAK,KAAK,cAAc,MAAM,MAAM,EAAG,QAAO;AACvD,QAAI,MAAM,WAAW,OAAO,MAAM,WAAW,KAAK;AAChD,aAAO,OAAO,OAAO,KAAK,iBAAiB,mBAAmB,MAAM,MAAM,CAAC;AAAA,IAC7E;AACA,QAAI,SAAS,MAAM,WAAW,MAAM,aAAa,KAAK,KAAK,IAAI;AAC/D,WAAO,SAAS,OAAO;AACrB,YAAM,MAAM,KAAK,IAAI,SAAS,OAAO,KAAK;AAC1C,YAAM,SAAS,OAAO,OAAO,SAAS,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,MAAM,SAAS,QAAQ,GAAG,CAAC;AAC/F,UAAI,OAAO,WAAW,KAAK;AAKzB,YAAI,QAAQ,SAAS,KAAK,MAAM,EAAG;AACnC,YAAI,KAAK,MAAM,KAAK,cAAc,OAAO,MAAM,EAAG,QAAO;AACzD,eAAO,OAAO,OAAO,KAAK,iBAAiB,aAAa,OAAO,MAAM,CAAC;AAAA,MACxE;AAIA,eAAS,KAAK,IAAI,KAAK,aAAa,MAAM,KAAK,CAAC;AAAA,IAClD;AACA,WAAO,OAAO,WAAW,QAAQ,KAAK;AAAA,EACxC,CAAC;AAEH,QAAM,MAAoC,OAAO,GAAG,qBAAqB;AAAA,IAAE,CAAC,UAC1E,OAAO,QAAQ,cAAc,cAAc,KAAK,GAAG,CAAC,aAClD,OAAO,IAAI,aAAY;AACrB,YAAM,SAAS,OAAO,cAAc,aAAa,QAAQ;AACzD,aAAO,OAAO,oBAAoB,EAAE,OAAO,CAAC;AAC5C,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,OAAO,IAAI,aAAY;AACrB,cAAI,eAAe,UAAa,SAAS,cAAc,YAAY;AACjE,mBAAO,YAAY,QAAQ,QAAQ;AACnC;AAAA,UACF;AACA,gBAAM,cAAc,OAAO,cAAc,QAAQ,UAAU,UAAU;AACrE,cAAI,CAAC,YAAa,QAAO,YAAY,QAAQ,QAAQ;AAAA,QACvD,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT,CAAC,CAAC;AAAA,EACN;AAEA,QAAM,MAAoC,OAAO,GAAG,qBAAqB;AAAA,IAAE,CAAC,WAC1E,OAAO,IAAI,aAAY;AACrB,YAAM,YAAY,OAAO,cAAc,eAAe,MAAM;AAC5D,aAAO,OAAO,oBAAoB,EAAE,QAAQ,UAAU,CAAC;AAIvD,YAAM,QAAQ,OAAO,OAAO,cAAc,kBAAkB,SAAS,SAAS,CAAC;AAK/E,YAAM,WAAW,OAAO,cAAc,aAAa,KAAK;AACxD,UAAI,aAAa,WAAW;AAC1B,eAAO,OAAO,OAAO;AAAA,UACnB,IAAI,cAAc,mBAAmB;AAAA,YACnC,MAAM;AAAA,YACN,gBAAgB;AAAA,YAChB,gBAAgB;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,MAAoC,OAAO,GAAG,qBAAqB;AAAA,IAAE,CAAC,WAC1E,OAAO,IAAI,aAAY;AACrB,YAAM,YAAY,OAAO,cAAc,eAAe,MAAM;AAC5D,aAAO,OAAO,oBAAoB,EAAE,QAAQ,UAAU,CAAC;AACvD,YAAM,WAAW,OAAO;AAAA,QACtB;AAAA,QACA;AAAA,QACA,KAAK,sBAAsB,WAAW,kBAAkB,KAAK,OAAO,SAAS,CAAC,CAAC,GAAG,OAAO,OAAO;AAAA,MAClG;AACA,UAAI,SAAS,WAAW,IAAK,QAAO;AACpC,UAAI,CAAC,KAAK,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,iBAAiB,sBAAsB,SAAS,MAAM,CAAC;AACtG,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,cAAoD,OAAO,GAAG,6BAA6B;AAAA,IAC/F,CAAC,YACC,OAAO,IAAI,aAAY;AACrB,YAAM,YAAY,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC;AACtC,UAAI,UAAU,WAAW,EAAG,QAAO,CAAC;AAIpC,YAAM,YAAyC,CAAC;AAChD,iBAAW,UAAU,UAAW,WAAU,KAAK,OAAO,cAAc,eAAe,MAAM,CAAC;AAC1F,aAAO,OAAO,oBAAoB,EAAE,OAAO,UAAU,OAAO,CAAC;AAC7D,YAAM,UAAU,oBAAI,IAAY;AAChC,eAAS,SAAS,GAAG,SAAS,UAAU,QAAQ,UAAU,4BAA4B;AACpF,cAAM,QAAQ,UAAU,MAAM,QAAQ,SAAS,0BAA0B;AACzE,cAAM,cAAc,QAAQ,OAAO,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,CAAC;AAGrE,YAAI,YAAY,aAAa,yBAAyB;AACpD,iBAAO,OAAO,OAAO,KAAK,qBAAqB,qDAAqD,CAAC;AAAA,QACvG;AACA,cAAM,UAAU,OAAO;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA,WAAW,kBAAkB,KAAK,GAAG,IAAI,kBAAkB,CAAC,EAAE;AAAA,cAC5D,kBAAkB,eAAe,aAAa,kBAAkB;AAAA,YAClE;AAAA,YACA,CAAC,aACC,OAAO,IAAI,aAAY;AACrB,kBAAI,CAAC,KAAK,QAAQ,GAAG;AACnB,uBAAO,OAAO,OAAO,KAAK,iBAAiB,6BAA6B,SAAS,MAAM,CAAC;AAAA,cAC1F;AACA,oBAAM,YAAY,OAAO;AAAA,gBACvB;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AACA,oBAAM,OAAO,OAAO,OAAO,IAAI;AAAA,gBAC7B,KAAK,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,gBAC/C,OAAO,MAAM,iBAAiB,gCAAgC;AAAA,cAChE,CAAC;AACD,qBAAO,OAAO,OAAO,oBAAoB,mBAAmB,EAAE,IAAI,EAAE;AAAA,gBAClE,OAAO,SAAS,MAAM,iBAAiB,gCAAgC,CAAC;AAAA,cAC1E;AAAA,YACF,CAAC;AAAA,UACL;AAAA,QACF;AACA,cAAM,QAAQ,IAAI,IAAY,KAAK;AACnC,mBAAW,UAAU,QAAQ,QAAS,KAAI,MAAM,IAAI,MAAM,EAAG,SAAQ,IAAI,MAAM;AAAA,MACjF;AAMA,aAAO,UAAU,OAAO,CAAC,WAAW,QAAQ,IAAI,MAAM,CAAC;AAAA,IACzD,CAAC;AAAA,EACL;AAEA,SAAO,EAAE,KAAK,KAAK,KAAK,aAAa,eAAe;AACtD,CAAC;AAcI,MAAM,QAAQ,CACnB,YAEA,MAAM,OAAO,cAAc,aAAa,EAAE,KAAK,OAAO,CAAC;",
+  "names": ["headers"]
+}

package/dist/cjs/index.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The content-addressed artifact store: bytes addressed by their own digest.
+ *
+ * `ArtifactStore` is the byte half of the cache. `@smthrs/step-cache` maps a
+ * step key to a recorded result, while large result bytes live here under their
+ * digest. The package depends on `effect` and `@smthrs/crypto`, owns no SQL,
+ * and bundles for the browser: host access is Effect's `FileSystem` and
+ * `HttpClient` tags, both of which the capability kernel decorates in place.
+ *
+ * ```ts
+ * import { ArtifactStore, CombinedArtifacts, RemoteArtifacts } from "@smthrs/artifacts"
+ * import * as Effect from "effect/Effect"
+ * import * as FileSystem from "effect/FileSystem"
+ * import * as Path from "effect/Path"
+ *
+ * const layer = CombinedArtifacts.layer({
+ *   local: Effect.map(Effect.all([FileSystem.FileSystem, Path.Path]), ([fs, path]) =>
+ *     ArtifactStore.makeFileSystem(fs, path)),
+ *   remote: RemoteArtifacts.make({ endpoint: "https://cache.example.com" })
+ * })
+ * ```
+ *
+ * @since 1.0.0-rc.0
+ */
+/**
+ * @category services
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export * as ArtifactStore from "./ArtifactStore.ts";
+/**
+ * @category metrics
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export * as ArtifactStoreMetrics from "./ArtifactStoreMetrics.ts";
+/**
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export * as ArtifactBackupLease from "./ArtifactBackupLease.ts";
+/**
+ * @category services
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export * as ArtifactSweep from "./ArtifactSweep.ts";
+/**
+ * @category services
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export * as CombinedArtifacts from "./CombinedArtifacts.ts";
+/**
+ * @category coordination
+ * @since 1.0.0-rc.1
+ */
+export * as FileLease from "./FileLease.ts";
+/**
+ * @category services
+ * @since 1.0.0-rc.0
+ * @slop
+ */
+export * as RemoteArtifacts from "./RemoteArtifacts.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;GAIG;AACH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;GAIG;AACH,OAAO,KAAK,oBAAoB,MAAM,2BAA2B,CAAA;AAEjE;;;GAGG;AACH,OAAO,KAAK,mBAAmB,MAAM,0BAA0B,CAAA;AAE/D;;;;GAIG;AACH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;GAIG;AACH,OAAO,KAAK,iBAAiB,MAAM,wBAAwB,CAAA;AAE3D;;;GAGG;AACH,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAE3C;;;;GAIG;AACH,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA"}

package/dist/cjs/index.js

@@ -0,0 +1,47 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var index_exports = {};
+__export(index_exports, {
+  ArtifactBackupLease: () => ArtifactBackupLease,
+  ArtifactStore: () => ArtifactStore,
+  ArtifactStoreMetrics: () => ArtifactStoreMetrics,
+  ArtifactSweep: () => ArtifactSweep,
+  CombinedArtifacts: () => CombinedArtifacts,
+  FileLease: () => FileLease,
+  RemoteArtifacts: () => RemoteArtifacts
+});
+module.exports = __toCommonJS(index_exports);
+var ArtifactStore = __toESM(require("./ArtifactStore.js"), 1);
+var ArtifactStoreMetrics = __toESM(require("./ArtifactStoreMetrics.js"), 1);
+var ArtifactBackupLease = __toESM(require("./ArtifactBackupLease.js"), 1);
+var ArtifactSweep = __toESM(require("./ArtifactSweep.js"), 1);
+var CombinedArtifacts = __toESM(require("./CombinedArtifacts.js"), 1);
+var FileLease = __toESM(require("./FileLease.js"), 1);
+var RemoteArtifacts = __toESM(require("./RemoteArtifacts.js"), 1);
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/index.ts"],
+  "sourcesContent": ["/**\n * The content-addressed artifact store: bytes addressed by their own digest.\n *\n * `ArtifactStore` is the byte half of the cache. `@smthrs/step-cache` maps a\n * step key to a recorded result, while large result bytes live here under their\n * digest. The package depends on `effect` and `@smthrs/crypto`, owns no SQL,\n * and bundles for the browser: host access is Effect's `FileSystem` and\n * `HttpClient` tags, both of which the capability kernel decorates in place.\n *\n * ```ts\n * import { ArtifactStore, CombinedArtifacts, RemoteArtifacts } from \"@smthrs/artifacts\"\n * import * as Effect from \"effect/Effect\"\n * import * as FileSystem from \"effect/FileSystem\"\n * import * as Path from \"effect/Path\"\n *\n * const layer = CombinedArtifacts.layer({\n *   local: Effect.map(Effect.all([FileSystem.FileSystem, Path.Path]), ([fs, path]) =>\n *     ArtifactStore.makeFileSystem(fs, path)),\n *   remote: RemoteArtifacts.make({ endpoint: \"https://cache.example.com\" })\n * })\n * ```\n *\n * @since 1.0.0-rc.0\n */\n\n/**\n * @category services\n * @since 1.0.0-rc.0\n * @slop\n */\nexport * as ArtifactStore from \"./ArtifactStore.ts\"\n\n/**\n * @category metrics\n * @since 1.0.0-rc.0\n * @slop\n */\nexport * as ArtifactStoreMetrics from \"./ArtifactStoreMetrics.ts\"\n\n/**\n * @category services\n * @since 1.0.0-rc.0\n */\nexport * as ArtifactBackupLease from \"./ArtifactBackupLease.ts\"\n\n/**\n * @category services\n * @since 1.0.0-rc.0\n * @slop\n */\nexport * as ArtifactSweep from \"./ArtifactSweep.ts\"\n\n/**\n * @category services\n * @since 1.0.0-rc.0\n * @slop\n */\nexport * as CombinedArtifacts from \"./CombinedArtifacts.ts\"\n\n/**\n * @category coordination\n * @since 1.0.0-rc.1\n */\nexport * as FileLease from \"./FileLease.ts\"\n\n/**\n * @category services\n * @since 1.0.0-rc.0\n * @slop\n */\nexport * as RemoteArtifacts from \"./RemoteArtifacts.ts\"\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BA,oBAA+B;AAO/B,2BAAsC;AAMtC,0BAAqC;AAOrC,oBAA+B;AAO/B,wBAAmC;AAMnC,gBAA2B;AAO3B,sBAAiC;",
+  "names": []
+}

package/dist/cjs/internal/ArtifactLocks.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Per-digest coordination for filesystem publication and removal.
+ *
+ * The semaphore is the cheap in-process path. A `FileLease` lock file is the
+ * actual workspace-wide fence: every process that can mutate the object
+ * directory observes it, and a crashed owner is recovered after its heartbeat
+ * expires.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Effect from "effect/Effect";
+import type * as FileSystem from "effect/FileSystem";
+/**
+ * The subdirectory of the objects directory that holds lock files and their
+ * stale-owner tombstones. Named here rather than spelled in each caller so the
+ * store's crash-orphan sweep reclaims exactly what this module creates.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export declare const directoryName = ".locks";
+/**
+ * Coordinates publication, freshening, and sweep deletion for one digest.
+ * `process` is the explicit weaker mode for hosts without atomic create.
+ *
+ * @category combinators
+ * @since 1.0.0-rc.0
+ */
+export declare const withDigest: <A, E, R, E2>(fs: FileSystem.FileSystem, directory: string, digest: string, effect: Effect.Effect<A, E, R>, failure: (cause: unknown) => E2, coordination?: "required" | "process") => Effect.Effect<A, E | E2, R>;
+//# sourceMappingURL=ArtifactLocks.d.ts.map

package/dist/cjs/internal/ArtifactLocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArtifactLocks.d.ts","sourceRoot":"","sources":["../../../src/internal/ArtifactLocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAYpD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EACpC,IAAI,UAAU,CAAC,UAAU,EACzB,WAAW,MAAM,EACjB,QAAQ,MAAM,EACd,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,EAAE,EAC/B,eAAc,UAAU,GAAG,SAAsB,KAChD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CA4DzB,CAAA"}

package/dist/cjs/internal/ArtifactLocks.js

@@ -0,0 +1,93 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ArtifactLocks_exports = {};
+__export(ArtifactLocks_exports, {
+  directoryName: () => directoryName,
+  withDigest: () => withDigest
+});
+module.exports = __toCommonJS(ArtifactLocks_exports);
+var Deferred = __toESM(require("effect/Deferred"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Semaphore = __toESM(require("effect/Semaphore"), 1);
+var FileLease = __toESM(require("../FileLease.js"), 1);
+var ArtifactPath = __toESM(require("./ArtifactPath.js"), 1);
+const locks = /* @__PURE__ */ new WeakMap();
+const directoryName = ".locks";
+const withDigest = (fs, directory, digest, effect, failure, coordination = "required") => (
+  // Every execution of the returned effect claims its own share of the entry,
+  // which is why the whole body is suspended rather than run when `withDigest`
+  // is called. A count taken at construction is wrong in both directions: an
+  // effect built and discarded pins an entry nothing will ever release, and one
+  // built once and run repeatedly — `ArtifactBackupLease` builds its gate once
+  // and runs it on every heartbeat — retires the entry underneath a live holder,
+  // so the next caller mints a second semaphore for the same digest and the two
+  // serialize against nothing.
+  Effect.suspend(() => {
+    let byKey = locks.get(fs);
+    if (byKey === void 0) {
+      byKey = /* @__PURE__ */ new Map();
+      locks.set(fs, byKey);
+    }
+    const key = JSON.stringify([directory, digest]);
+    let entry = byKey.get(key);
+    if (entry === void 0) {
+      entry = { semaphore: Semaphore.makeUnsafe(1), users: 0 };
+      byKey.set(key, entry);
+    }
+    entry.users += 1;
+    const held = entry;
+    const table = byKey;
+    const ready = Deferred.makeUnsafe();
+    const deadline = Deferred.await(ready).pipe(
+      Effect.timeout(FileLease.defaultAcquireWithin),
+      Effect.catchTag("TimeoutError", (cause) => Effect.fail(failure(cause))),
+      Effect.andThen(Effect.never)
+    );
+    const coordinated = coordination === "process" ? Deferred.succeed(ready, void 0).pipe(Effect.andThen(effect)) : Effect.gen(function* () {
+      const lockDirectory = `${directory}/${directoryName}`;
+      yield* ArtifactPath.guard(fs, lockDirectory).pipe(Effect.mapError(failure));
+      yield* fs.makeDirectory(lockDirectory, { recursive: true, mode: 448 }).pipe(Effect.mapError(failure));
+      const checkLockDirectory = yield* ArtifactPath.guard(fs, lockDirectory).pipe(Effect.mapError(failure));
+      return yield* FileLease.hold(fs, `${lockDirectory}/${digest}.lock`, effect, failure, {
+        label: "Artifact lock",
+        annotations: { digest },
+        onAcquired: Deferred.succeed(ready, void 0).pipe(Effect.asVoid),
+        guard: checkLockDirectory
+      });
+    });
+    return held.semaphore.withPermit(coordinated).pipe(
+      Effect.raceFirst(deadline),
+      Effect.ensuring(Effect.sync(() => {
+        held.users -= 1;
+        if (held.users === 0 && table.get(key) === held) table.delete(key);
+      }))
+    );
+  })
+);
+//# sourceMappingURL=ArtifactLocks.js.map

package/dist/cjs/internal/ArtifactLocks.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/ArtifactLocks.ts"],
+  "sourcesContent": ["/**\n * Per-digest coordination for filesystem publication and removal.\n *\n * The semaphore is the cheap in-process path. A `FileLease` lock file is the\n * actual workspace-wide fence: every process that can mutate the object\n * directory observes it, and a crashed owner is recovered after its heartbeat\n * expires.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Deferred from \"effect/Deferred\"\nimport * as Effect from \"effect/Effect\"\nimport type * as FileSystem from \"effect/FileSystem\"\nimport * as Semaphore from \"effect/Semaphore\"\nimport * as FileLease from \"../FileLease.ts\"\nimport * as ArtifactPath from \"./ArtifactPath.ts\"\n\ninterface Entry {\n  readonly semaphore: Semaphore.Semaphore\n  users: number\n}\n\nconst locks = new WeakMap<FileSystem.FileSystem, Map<string, Entry>>()\n\n/**\n * The subdirectory of the objects directory that holds lock files and their\n * stale-owner tombstones. Named here rather than spelled in each caller so the\n * store's crash-orphan sweep reclaims exactly what this module creates.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const directoryName = \".locks\"\n\n/**\n * Coordinates publication, freshening, and sweep deletion for one digest.\n * `process` is the explicit weaker mode for hosts without atomic create.\n *\n * @category combinators\n * @since 1.0.0-rc.0\n */\nexport const withDigest = <A, E, R, E2>(\n  fs: FileSystem.FileSystem,\n  directory: string,\n  digest: string,\n  effect: Effect.Effect<A, E, R>,\n  failure: (cause: unknown) => E2,\n  coordination: \"required\" | \"process\" = \"required\"\n): Effect.Effect<A, E | E2, R> =>\n  // Every execution of the returned effect claims its own share of the entry,\n  // which is why the whole body is suspended rather than run when `withDigest`\n  // is called. A count taken at construction is wrong in both directions: an\n  // effect built and discarded pins an entry nothing will ever release, and one\n  // built once and run repeatedly \u2014 `ArtifactBackupLease` builds its gate once\n  // and runs it on every heartbeat \u2014 retires the entry underneath a live holder,\n  // so the next caller mints a second semaphore for the same digest and the two\n  // serialize against nothing.\n  Effect.suspend(() => {\n    let byKey = locks.get(fs)\n    if (byKey === undefined) {\n      byKey = new Map()\n      locks.set(fs, byKey)\n    }\n    const key = JSON.stringify([directory, digest])\n    let entry = byKey.get(key)\n    if (entry === undefined) {\n      entry = { semaphore: Semaphore.makeUnsafe(1), users: 0 }\n      byKey.set(key, entry)\n    }\n    entry.users += 1\n    const held = entry\n    const table = byKey\n\n    // The deadline starts before the semaphore wait and ends once both locks\n    // are held. The protected operation and its release are never timed out.\n    const ready = Deferred.makeUnsafe<void>()\n    const deadline = Deferred.await(ready).pipe(\n      Effect.timeout(FileLease.defaultAcquireWithin),\n      Effect.catchTag(\"TimeoutError\", (cause) => Effect.fail(failure(cause))),\n      Effect.andThen(Effect.never)\n    )\n    const coordinated = coordination === \"process\"\n      ? Deferred.succeed(ready, undefined).pipe(Effect.andThen(effect))\n      : Effect.gen(function*() {\n        // The lock directory is refused as a symlink before and after it is\n        // created, and its identity is re-checked before every lock-file\n        // mutation, so a swap of `.locks` for a link cannot redirect lock,\n        // claim, or tombstone writes and removals elsewhere. The portable\n        // filesystem cannot make a check atomic with the mutation after it.\n        const lockDirectory = `${directory}/${directoryName}`\n        yield* ArtifactPath.guard(fs, lockDirectory).pipe(Effect.mapError(failure))\n        yield* fs.makeDirectory(lockDirectory, { recursive: true, mode: 0o700 }).pipe(Effect.mapError(failure))\n        const checkLockDirectory = yield* ArtifactPath.guard(fs, lockDirectory).pipe(Effect.mapError(failure))\n        return yield* FileLease.hold(fs, `${lockDirectory}/${digest}.lock`, effect, failure, {\n          label: \"Artifact lock\",\n          annotations: { digest },\n          onAcquired: Deferred.succeed(ready, undefined).pipe(Effect.asVoid),\n          guard: checkLockDirectory\n        })\n      })\n\n    return held.semaphore.withPermit(coordinated).pipe(\n      Effect.raceFirst(deadline),\n      Effect.ensuring(Effect.sync(() => {\n        held.users -= 1\n        if (held.users === 0 && table.get(key) === held) table.delete(key)\n      }))\n    )\n  })\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,eAA0B;AAC1B,aAAwB;AAExB,gBAA2B;AAC3B,gBAA2B;AAC3B,mBAA8B;AAO9B,MAAM,QAAQ,oBAAI,QAAmD;AAU9D,MAAM,gBAAgB;AAStB,MAAM,aAAa,CACxB,IACA,WACA,QACA,QACA,SACA,eAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUvC,OAAO,QAAQ,MAAM;AACnB,QAAI,QAAQ,MAAM,IAAI,EAAE;AACxB,QAAI,UAAU,QAAW;AACvB,cAAQ,oBAAI,IAAI;AAChB,YAAM,IAAI,IAAI,KAAK;AAAA,IACrB;AACA,UAAM,MAAM,KAAK,UAAU,CAAC,WAAW,MAAM,CAAC;AAC9C,QAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,QAAI,UAAU,QAAW;AACvB,cAAQ,EAAE,WAAW,UAAU,WAAW,CAAC,GAAG,OAAO,EAAE;AACvD,YAAM,IAAI,KAAK,KAAK;AAAA,IACtB;AACA,UAAM,SAAS;AACf,UAAM,OAAO;AACb,UAAM,QAAQ;AAId,UAAM,QAAQ,SAAS,WAAiB;AACxC,UAAM,WAAW,SAAS,MAAM,KAAK,EAAE;AAAA,MACrC,OAAO,QAAQ,UAAU,oBAAoB;AAAA,MAC7C,OAAO,SAAS,gBAAgB,CAAC,UAAU,OAAO,KAAK,QAAQ,KAAK,CAAC,CAAC;AAAA,MACtE,OAAO,QAAQ,OAAO,KAAK;AAAA,IAC7B;AACA,UAAM,cAAc,iBAAiB,YACjC,SAAS,QAAQ,OAAO,MAAS,EAAE,KAAK,OAAO,QAAQ,MAAM,CAAC,IAC9D,OAAO,IAAI,aAAY;AAMvB,YAAM,gBAAgB,GAAG,SAAS,IAAI,aAAa;AACnD,aAAO,aAAa,MAAM,IAAI,aAAa,EAAE,KAAK,OAAO,SAAS,OAAO,CAAC;AAC1E,aAAO,GAAG,cAAc,eAAe,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC,EAAE,KAAK,OAAO,SAAS,OAAO,CAAC;AACtG,YAAM,qBAAqB,OAAO,aAAa,MAAM,IAAI,aAAa,EAAE,KAAK,OAAO,SAAS,OAAO,CAAC;AACrG,aAAO,OAAO,UAAU,KAAK,IAAI,GAAG,aAAa,IAAI,MAAM,SAAS,QAAQ,SAAS;AAAA,QACnF,OAAO;AAAA,QACP,aAAa,EAAE,OAAO;AAAA,QACtB,YAAY,SAAS,QAAQ,OAAO,MAAS,EAAE,KAAK,OAAO,MAAM;AAAA,QACjE,OAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AAEH,WAAO,KAAK,UAAU,WAAW,WAAW,EAAE;AAAA,MAC5C,OAAO,UAAU,QAAQ;AAAA,MACzB,OAAO,SAAS,OAAO,KAAK,MAAM;AAChC,aAAK,SAAS;AACd,YAAI,KAAK,UAAU,KAAK,MAAM,IAAI,GAAG,MAAM,KAAM,OAAM,OAAO,GAAG;AAAA,MACnE,CAAC,CAAC;AAAA,IACJ;AAAA,EACF,CAAC;AAAA;",
+  "names": []
+}

package/dist/cjs/internal/ArtifactPath.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Path checks for the portable filesystem adapter. These detect symlinks and
+ * observed replacements, but cannot make pathname mutations atomic with the
+ * check. Effect's FileSystem has no descriptor-relative rename or unlink.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Effect from "effect/Effect";
+import type * as FileSystem from "effect/FileSystem";
+import * as PlatformError from "effect/PlatformError";
+/**
+ * Checks one entry without accepting a symbolic link and returns a check that
+ * also refuses a changed identity. Missing entries are allowed for creation.
+ *
+ * @category utilities
+ * @since 1.0.0-rc.0
+ */
+export declare const guard: (fs: FileSystem.FileSystem, path: string, type?: "Directory" | "File", expected?: FileSystem.File.Info) => Effect.Effect<Effect.Effect<void, PlatformError.PlatformError>, PlatformError.PlatformError>;
+//# sourceMappingURL=ArtifactPath.d.ts.map

package/dist/cjs/internal/ArtifactPath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArtifactPath.d.ts","sourceRoot":"","sources":["../../../src/internal/ArtifactPath.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAEpD,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAA;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,GAChB,IAAI,UAAU,CAAC,UAAU,EACzB,MAAM,MAAM,EACZ,OAAM,WAAW,GAAG,MAAoB,EACxC,WAAW,UAAU,CAAC,IAAI,CAAC,IAAI,KAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,aAAa,CA8C7F,CAAA"}

package/dist/cjs/internal/ArtifactPath.js

@@ -0,0 +1,74 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ArtifactPath_exports = {};
+__export(ArtifactPath_exports, {
+  guard: () => guard
+});
+module.exports = __toCommonJS(ArtifactPath_exports);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Option = __toESM(require("effect/Option"), 1);
+var PlatformError = __toESM(require("effect/PlatformError"), 1);
+const guard = (fs, path, type = "Directory", expected) => {
+  const refused = () => PlatformError.systemError({
+    _tag: "PermissionDenied",
+    module: "ArtifactPath",
+    method: "guard",
+    pathOrDescriptor: path,
+    description: "artifact path is a symlink, has the wrong type, or was replaced"
+  });
+  const inspect = Effect.gen(function* () {
+    const linked = yield* fs.readLink(path).pipe(
+      Effect.as(true),
+      Effect.catch((cause) => {
+        const underlying = cause.cause;
+        return cause.reason._tag === "NotFound" || typeof underlying === "object" && underlying !== null && "code" in underlying && underlying.code === "EINVAL" ? Effect.succeed(false) : Effect.fail(cause);
+      })
+    );
+    if (linked) return yield* Effect.fail(refused());
+    const info = yield* fs.stat(path).pipe(
+      Effect.map(Option.some),
+      Effect.catch((cause) => cause.reason._tag === "NotFound" ? Effect.succeed(Option.none()) : Effect.fail(cause))
+    );
+    if (Option.isSome(info) && info.value.type !== type) return yield* Effect.fail(refused());
+    return info;
+  });
+  const unchanged = (before, after) => {
+    if (Option.isNone(before)) return Effect.void;
+    if (Option.isNone(after) || before.value.dev !== after.value.dev || Option.getOrUndefined(before.value.ino) !== Option.getOrUndefined(after.value.ino)) {
+      return Effect.fail(refused());
+    }
+    return Effect.void;
+  };
+  return Effect.gen(function* () {
+    const before = yield* inspect;
+    yield* unchanged(Option.fromUndefinedOr(expected), before);
+    return Effect.flatMap(inspect, (after) => unchanged(before, after));
+  });
+};
+//# sourceMappingURL=ArtifactPath.js.map

package/dist/cjs/internal/ArtifactPath.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/ArtifactPath.ts"],
+  "sourcesContent": ["/**\n * Path checks for the portable filesystem adapter. These detect symlinks and\n * observed replacements, but cannot make pathname mutations atomic with the\n * check. Effect's FileSystem has no descriptor-relative rename or unlink.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Effect from \"effect/Effect\"\nimport type * as FileSystem from \"effect/FileSystem\"\nimport * as Option from \"effect/Option\"\nimport * as PlatformError from \"effect/PlatformError\"\n\n/**\n * Checks one entry without accepting a symbolic link and returns a check that\n * also refuses a changed identity. Missing entries are allowed for creation.\n *\n * @category utilities\n * @since 1.0.0-rc.0\n */\nexport const guard = (\n  fs: FileSystem.FileSystem,\n  path: string,\n  type: \"Directory\" | \"File\" = \"Directory\",\n  expected?: FileSystem.File.Info\n): Effect.Effect<Effect.Effect<void, PlatformError.PlatformError>, PlatformError.PlatformError> => {\n  const refused = () =>\n    PlatformError.systemError({\n      _tag: \"PermissionDenied\",\n      module: \"ArtifactPath\",\n      method: \"guard\",\n      pathOrDescriptor: path,\n      description: \"artifact path is a symlink, has the wrong type, or was replaced\"\n    })\n  const inspect = Effect.gen(function*() {\n    const linked = yield* fs.readLink(path).pipe(\n      Effect.as(true),\n      Effect.catch((cause) => {\n        // Node readlink uses EINVAL for an existing entry that is not a link.\n        // Other failures, including an unsupported host capability, fail closed.\n        const underlying = cause.cause\n        return cause.reason._tag === \"NotFound\" ||\n            (typeof underlying === \"object\" && underlying !== null && \"code\" in underlying &&\n              underlying.code === \"EINVAL\")\n          ? Effect.succeed(false)\n          : Effect.fail(cause)\n      })\n    )\n    if (linked) return yield* Effect.fail(refused())\n    const info = yield* fs.stat(path).pipe(\n      Effect.map(Option.some),\n      Effect.catch((cause) => cause.reason._tag === \"NotFound\" ? Effect.succeed(Option.none()) : Effect.fail(cause))\n    )\n    if (Option.isSome(info) && info.value.type !== type) return yield* Effect.fail(refused())\n    return info\n  })\n  const unchanged = (before: Option.Option<FileSystem.File.Info>, after: Option.Option<FileSystem.File.Info>) => {\n    if (Option.isNone(before)) return Effect.void\n    if (\n      Option.isNone(after) || before.value.dev !== after.value.dev ||\n      Option.getOrUndefined(before.value.ino) !== Option.getOrUndefined(after.value.ino)\n    ) {\n      return Effect.fail(refused())\n    }\n    return Effect.void\n  }\n  return Effect.gen(function*() {\n    const before = yield* inspect\n    yield* unchanged(Option.fromUndefinedOr(expected), before)\n    return Effect.flatMap(inspect, (after) => unchanged(before, after))\n  })\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,aAAwB;AAExB,aAAwB;AACxB,oBAA+B;AASxB,MAAM,QAAQ,CACnB,IACA,MACA,OAA6B,aAC7B,aACiG;AACjG,QAAM,UAAU,MACd,cAAc,YAAY;AAAA,IACxB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,kBAAkB;AAAA,IAClB,aAAa;AAAA,EACf,CAAC;AACH,QAAM,UAAU,OAAO,IAAI,aAAY;AACrC,UAAM,SAAS,OAAO,GAAG,SAAS,IAAI,EAAE;AAAA,MACtC,OAAO,GAAG,IAAI;AAAA,MACd,OAAO,MAAM,CAAC,UAAU;AAGtB,cAAM,aAAa,MAAM;AACzB,eAAO,MAAM,OAAO,SAAS,cACxB,OAAO,eAAe,YAAY,eAAe,QAAQ,UAAU,cAClE,WAAW,SAAS,WACtB,OAAO,QAAQ,KAAK,IACpB,OAAO,KAAK,KAAK;AAAA,MACvB,CAAC;AAAA,IACH;AACA,QAAI,OAAQ,QAAO,OAAO,OAAO,KAAK,QAAQ,CAAC;AAC/C,UAAM,OAAO,OAAO,GAAG,KAAK,IAAI,EAAE;AAAA,MAChC,OAAO,IAAI,OAAO,IAAI;AAAA,MACtB,OAAO,MAAM,CAAC,UAAU,MAAM,OAAO,SAAS,aAAa,OAAO,QAAQ,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,CAAC;AAAA,IAC/G;AACA,QAAI,OAAO,OAAO,IAAI,KAAK,KAAK,MAAM,SAAS,KAAM,QAAO,OAAO,OAAO,KAAK,QAAQ,CAAC;AACxF,WAAO;AAAA,EACT,CAAC;AACD,QAAM,YAAY,CAAC,QAA6C,UAA+C;AAC7G,QAAI,OAAO,OAAO,MAAM,EAAG,QAAO,OAAO;AACzC,QACE,OAAO,OAAO,KAAK,KAAK,OAAO,MAAM,QAAQ,MAAM,MAAM,OACzD,OAAO,eAAe,OAAO,MAAM,GAAG,MAAM,OAAO,eAAe,MAAM,MAAM,GAAG,GACjF;AACA,aAAO,OAAO,KAAK,QAAQ,CAAC;AAAA,IAC9B;AACA,WAAO,OAAO;AAAA,EAChB;AACA,SAAO,OAAO,IAAI,aAAY;AAC5B,UAAM,SAAS,OAAO;AACtB,WAAO,UAAU,OAAO,gBAAgB,QAAQ,GAAG,MAAM;AACzD,WAAO,OAAO,QAAQ,SAAS,CAAC,UAAU,UAAU,QAAQ,KAAK,CAAC;AAAA,EACpE,CAAC;AACH;",
+  "names": []
+}

package/dist/cjs/measureBytes.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Measuring artifact bytes: the SHA-256 content address of one immutable
+ * snapshot, computed through the injected `Crypto` service.
+ *
+ * @since 1.0.0-rc.0
+ */
+import type * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import type { Digest } from "./ArtifactStore.ts";
+import { ArtifactStoreError } from "./ArtifactStoreError.ts";
+/**
+ * Measures one immutable byte snapshot without ever retaining it in an error.
+ *
+ * @category utilities
+ * @since 1.0.0-rc.0
+ */
+export declare const measureBytes: (bytes: Uint8Array) => Effect.Effect<Digest, ArtifactStoreError, Crypto.Crypto>;
+//# sourceMappingURL=measureBytes.d.ts.map

package/dist/cjs/measureBytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"measureBytes.d.ts","sourceRoot":"","sources":["../../src/measureBytes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAS5D;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAC7C,CAAA"}

package/dist/cjs/measureBytes.js

@@ -0,0 +1,43 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var measureBytes_exports = {};
+__export(measureBytes_exports, {
+  measureBytes: () => measureBytes
+});
+module.exports = __toCommonJS(measureBytes_exports);
+var import_crypto = require("@smthrs/crypto");
+var Effect = __toESM(require("effect/Effect"), 1);
+var import_ArtifactStoreError = require("./ArtifactStoreError.js");
+const digestFailure = (cause) => new import_ArtifactStoreError.ArtifactStoreError({
+  code: "digest_failed",
+  message: "the Crypto service failed to compute an artifact digest",
+  cause
+});
+const measureBytes = (bytes) => import_crypto.Sha256.digest(bytes).pipe(Effect.mapError(digestFailure));
+//# sourceMappingURL=measureBytes.js.map

package/dist/cjs/measureBytes.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/measureBytes.ts"],
+  "sourcesContent": ["/**\n * Measuring artifact bytes: the SHA-256 content address of one immutable\n * snapshot, computed through the injected `Crypto` service.\n *\n * @since 1.0.0-rc.0\n */\n\nimport { Sha256 } from \"@smthrs/crypto\"\nimport type * as Crypto from \"effect/Crypto\"\nimport * as Effect from \"effect/Effect\"\nimport type { Digest } from \"./ArtifactStore.ts\"\nimport { ArtifactStoreError } from \"./ArtifactStoreError.ts\"\n\nconst digestFailure = (cause: unknown): ArtifactStoreError =>\n  new ArtifactStoreError({\n    code: \"digest_failed\",\n    message: \"the Crypto service failed to compute an artifact digest\",\n    cause\n  })\n\n/**\n * Measures one immutable byte snapshot without ever retaining it in an error.\n *\n * @category utilities\n * @since 1.0.0-rc.0\n */\nexport const measureBytes = (bytes: Uint8Array): Effect.Effect<Digest, ArtifactStoreError, Crypto.Crypto> =>\n  Sha256.digest(bytes).pipe(Effect.mapError(digestFailure))\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,oBAAuB;AAEvB,aAAwB;AAExB,gCAAmC;AAEnC,MAAM,gBAAgB,CAAC,UACrB,IAAI,6CAAmB;AAAA,EACrB,MAAM;AAAA,EACN,SAAS;AAAA,EACT;AACF,CAAC;AAQI,MAAM,eAAe,CAAC,UAC3B,qBAAO,OAAO,KAAK,EAAE,KAAK,OAAO,SAAS,aAAa,CAAC;",
+  "names": []
+}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/snapshotBytes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Snapshotting caller-owned artifact bytes, so a caller that reuses its buffer
+ * cannot change what is measured or stored.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Effect from "effect/Effect";
+import { ArtifactStoreError } from "./ArtifactStoreError.ts";
+/**
+ * Copies a caller-owned buffer when the returned Effect begins.
+ *
+ * A host that refuses the copy — a detached buffer, an allocation past what the
+ * runtime will give — fails as `unavailable`, the code for a host refusal.
+ *
+ * @category utilities
+ * @since 1.0.0-rc.0
+ */
+export declare const snapshotBytes: (bytes: Uint8Array) => Effect.Effect<Uint8Array, ArtifactStoreError>;
+//# sourceMappingURL=snapshotBytes.d.ts.map

package/dist/cjs/snapshotBytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshotBytes.d.ts","sourceRoot":"","sources":["../../src/snapshotBytes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAY5D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAI1F,CAAA"}