@smthrs/artifacts 1.0.0-rc.7 → 1.0.0-rc.8

package/dist/cjs/RemoteArtifacts.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/RemoteArtifacts.ts"],
-  "sourcesContent": ["/**\n * The shared artifact tier: an {@link ArtifactStore.Service} spoken over HTTP.\n *\n * The wire protocol mirrors Bazel's dumb-HTTP remote cache, class\n * `HttpCacheClient` in `com.google.devtools.build.lib.remote.http`, which\n * documents it as: \"CAS (Content Addressable Storage) blobs are stored under\n * the path `/cas/base16-key`\", uploaded with `PUT`, downloaded with `GET`. We add\n * `HEAD /cas/{digest}` for a single existence probe and\n * `POST /cas/findMissing` for the batched one, because Bazel's HTTP client has\n * no `findMissingDigests` at all \u2014 it answers \"everything is missing\" and\n * re-uploads \u2014 and a batched probe is the whole reason\n * `MissingDigestsFinder` exists in the gRPC client.\n *\n * Transport is Effect's own `HttpClient` tag. There is no lower transport in\n * this repository, and there does not need to be one: the kernel already\n * decorates that tag with `net:get`/`net:post` capability checks, so a remote\n * artifact fetch is permission-checked like every other egress.\n *\n * ## Chunked uploads\n *\n * With `chunkBytes` set, a blob past that size travels as a sequence of\n * `PUT /cas/{digest}` requests carrying `Content-Range: bytes {a}-{b}/{total}`,\n * preceded by a `HEAD /cas/{digest}` existence probe and a\n * `Content-Range: bytes *\\/{total}` probe with an empty body. This is the\n * resumable-upload shape HTTP already has: the range probe asks what prefix\n * the tier holds and `308` means \"keep going\", with a `Range: bytes=0-{last}`\n * header on the probe or on a chunk answer moving the offset.\n *\n * Only a `308` continues the sequence, and the completing chunk's `2xx` is\n * confirmed with `HEAD` before `put` reports the digest as published. A `2xx`\n * anywhere else, to the empty probe or to a chunk the tier is still owed bytes\n * after, reads as a tier that ignored `Content-Range` and stored the body it\n * was handed, which is what plain WebDAV `PUT` does. That tier, the one that\n * answers `400`, `411`, or `416`, and the one whose `HEAD` will not confirm\n * the stored length all get the same treatment: one whole-blob `PUT`, which\n * overwrites the partial body the sequence left behind. So the blob always\n * lands whole, and the cost of turning the dial on against a server that\n * never learned about it is round trips, never a digest published over bytes\n * the server does not hold.\n *\n * This repository's own hosted and self-hosted cache services are such\n * servers: neither implements the resumable sequence, and both refuse a\n * ranged `PUT` with `400`, RFC 9110 section 14.5's answer from a resource\n * that does not support partial `PUT`. Against them `chunkBytes` costs the\n * probe round trip and the blob travels whole, and both cap one request body\n * at 16 MiB, so a blob past that cap is refused with `413` in either mode.\n *\n * The endpoint and its credentials arrive as **layer construction options**.\n * They are capabilities, never step inputs: they are not hashed into a step\n * key, journaled, or returned in a recorded result. Invalid endpoint errors are\n * sanitized before they cross the boundary.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as FetchHttpClient from \"effect/http/FetchHttpClient\"\nimport * as Headers from \"effect/http/Headers\"\nimport * as HttpClient from \"effect/http/HttpClient\"\nimport * as HttpClientRequest from \"effect/http/HttpClientRequest\"\nimport type * as HttpClientResponse from \"effect/http/HttpClientResponse\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport * as Stream from \"effect/Stream\"\nimport * as ArtifactStore from \"./ArtifactStore.ts\"\n\n/**\n * How eagerly a composition materializes shared blobs into its local store.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const DownloadPolicy = Schema.Literals([\"all\", \"toplevel\", \"minimal\"] as const)\n\n/**\n * How eagerly a composition materializes remote blobs.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type DownloadPolicy = typeof DownloadPolicy.Type\n\n/**\n * Every download policy, in materialization order.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const downloadPolicies: ReadonlyArray<DownloadPolicy> = Object.freeze([\"all\", \"toplevel\", \"minimal\"])\n\n/**\n * A remote artifact tier, which is an ordinary store that also states how\n * eagerly a composition reading through it should materialize blobs locally.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Service extends ArtifactStore.Service {\n  readonly downloadPolicy: DownloadPolicy\n}\n\n/**\n * Reads the download policy a store declares, or `undefined` for a store that\n * declares none \u2014 every local store, and any foreign implementation.\n *\n * @category getters\n * @since 1.0.0-rc.0\n */\nexport const downloadPolicyOf = (store: ArtifactStore.Service): DownloadPolicy | undefined => {\n  const declared = (store as { readonly downloadPolicy?: unknown }).downloadPolicy\n  return Schema.is(DownloadPolicy)(declared) ? declared : undefined\n}\n\n/**\n * How to reach the shared artifact tier.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport interface Options {\n  /**\n   * The cache root, e.g. `https://cache.example.com`. `/cas/{digest}` and\n   * `/cas/findMissing` are resolved beneath it. A trailing slash is ignored.\n   *\n   * Four shapes are refused at construction as `invalid_configuration`, before\n   * any request leaves and therefore before `headers` can reach a wire: a value\n   * that is not a string, one no `URL` parser accepts, a scheme other than\n   * `https:` (plain `http:` is accepted only for the literal loopback hosts\n   * `localhost`, `127.0.0.1`, and `[::1]`), and an endpoint carrying\n   * userinfo, a query, or a fragment. The\n   * last rule keeps a credential out of a place nothing here would redact: an\n   * endpoint is interpolated into every request path and into span attributes.\n   *\n   * The refusal message names only the violated rule and never echoes the\n   * endpoint, so a rejected `https://user:secret@host` cannot leak its\n   * credential into a log line or a durable error.\n   */\n  readonly endpoint: string\n  /**\n   * Headers sent with every request \u2014 an `Authorization` bearer token, a\n   * tenant header, whatever the deployment's gateway wants. This is the\n   * credential seam, and it is deliberately construction-time: a credential\n   * that arrived as a step input would be hashed into a step key and persisted\n   * everywhere the journal goes.\n   *\n   * The protocol wins every collision. These headers are applied to a request\n   * first. Configured `content-type`, `content-length`, and `content-range`\n   * are removed, then computed only where the protocol needs them. Whole-blob\n   * uploads, including fallbacks, never carry `content-range`.\n   * All configured header names are redacted in HTTP spans, in addition to\n   * the host's existing redaction rules.\n   *\n   * A name that is not an HTTP token, or a value longer than 16 KiB or\n   * carrying a control character (CR and LF included), is refused at\n   * construction as `invalid_configuration`.\n   */\n  readonly headers?: Record<string, string> | undefined\n  /**\n   * The deadline on a single download, from the request leaving to the last\n   * body byte arriving. A shared tier that stops answering must fail the read\n   * rather than park it forever. `CombinedArtifacts.get` propagates a remote\n   * `ArtifactStoreError`, including a download timeout. Only opportunistic\n   * uploads from `CombinedArtifacts.put` ignore remote failures;\n   * `ArtifactSync.hydrate` separately turns a failure into replay rejection.\n   * Defaults to 60 seconds, Bazel's `--remote_timeout`\n   * default for the same REST protocol (its `RemoteOptions`: \"For the REST\n   * cache, this is both the connect and the read timeout\").\n   */\n  readonly downloadTimeout?: Duration.Input | undefined\n  /**\n   * Deadline for an upload, including every resume probe and chunk. Defaults\n   * to 60 seconds.\n   */\n  readonly uploadTimeout?: Duration.Input | undefined\n  /**\n   * Deadline for an existence probe or one `findMissing` batch, including its\n   * response body. Defaults to 60 seconds.\n   */\n  readonly requestTimeout?: Duration.Input | undefined\n  /**\n   * The largest download this client will buffer, in bytes. The body is read\n   * incrementally and abandoned the moment it exceeds the bound \u2014 and refused\n   * outright when `Content-Length` already declares the excess \u2014 so a\n   * mis-serving or hostile cache cannot make this process buffer and hash an\n   * arbitrarily large body before the digest check refuses it. Defaults to\n   * 256 MiB.\n   */\n  readonly maxDownloadBytes?: number | undefined\n  /**\n   * Largest `findMissing` response body accepted. Defaults to the protocol's\n   * 256 KiB request/response bound and may only lower that bound.\n   */\n  readonly maxFindMissingResponseBytes?: number | undefined\n  /**\n   * Above this many bytes an upload travels as a sequence of `Content-Range`\n   * `PUT`s instead of one whole-blob body, and a transfer that died partway\n   * resumes from the prefix the tier kept rather than starting over. See\n   * {@link module:RemoteArtifacts | the chunked upload protocol} below.\n   *\n   * Absent by default: every upload is one whole-blob `PUT`, which is what\n   * Bazel's dumb-HTTP client does and what every deployment already serving\n   * this protocol expects. Set it when a proxy caps request bodies, or when\n   * artifacts are large enough that losing a transfer is expensive.\n   *\n   * The repository's own hosted and self-hosted cache services answer the\n   * ranged probe with `400`, so against them this dial degrades to one\n   * whole-blob `PUT`, and their 16 MiB body cap refuses a larger blob with\n   * `413` in either mode.\n   */\n  readonly chunkBytes?: number | undefined\n  /**\n   * How eagerly a composition reading through this tier materializes blobs\n   * into its local store. This is Bazel's `--remote_download_{all,toplevel,\n   * minimal}` dial (`RemoteOutputChecker`), and it lives here because the\n   * shared tier is the thing being conserved.\n   *\n   * - `all` (the default) prefetches every referenced blob when a replay is\n   *   admitted, so the replay reads local bytes.\n   * - `toplevel` prefetches nothing and materializes a blob into the local\n   *   store on the first read that actually needs it.\n   * - `minimal` prefetches nothing and materializes nothing: a read is served\n   *   straight from the shared tier and the local store never grows.\n   *\n   * `CombinedArtifacts.get` honors the last two; `@smthrs/engine-store`'s\n   * `ArtifactSync.hydrate` honors the first.\n   */\n  readonly downloadPolicy?: DownloadPolicy | undefined\n}\n\n/**\n * The default download deadline. 60 seconds is Bazel's `--remote_timeout`\n * default, governing the same dumb-HTTP cache protocol.\n */\nconst defaultDownloadTimeout = Duration.seconds(60)\nconst defaultUploadTimeout = Duration.seconds(60)\nconst defaultRequestTimeout = Duration.seconds(60)\n\n/**\n * The default bound on a downloaded blob: 256 MiB. Artifacts are spilled step\n * values, not media libraries; a body past this size is far more likely a\n * mis-serving cache than a legitimate blob, and the dial is per-store for a\n * deployment that knows better.\n */\nconst defaultMaxDownloadBytes = 256 * 1024 * 1024\nconst maxFindMissingBatchDigests = 1_000\nconst maxFindMissingBodyBytes = 256 * 1024\nconst encoder = new TextEncoder()\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true })\n\n/**\n * The credential-free part of a transport failure: the HTTP client's reason\n * tag and the first operating-system error code (`ECONNREFUSED`, `ENOTFOUND`,\n * `CERT_HAS_EXPIRED`) in its cause chain. Never the request, the URL, the\n * headers, or free-form text, any of which may carry a credential.\n */\nconst transportReason = (cause: unknown): string | undefined => {\n  const reason = (cause as { readonly reason?: { readonly _tag?: unknown } } | null)?.reason\n  const tag = typeof reason?._tag === \"string\" ? reason._tag : undefined\n  let code: string | undefined\n  let current: unknown = reason ?? cause\n  for (let depth = 0; depth < 8 && typeof current === \"object\" && current !== null; depth++) {\n    const candidate = (current as { readonly code?: unknown }).code\n    if (typeof candidate === \"string\" && /^[A-Z][A-Z0-9_]{1,63}$/.test(candidate)) {\n      code = candidate\n      break\n    }\n    current = (current as { readonly cause?: unknown }).cause\n  }\n  const parts = [tag, code].filter((part): part is string => part !== undefined)\n  return parts.length === 0 ? undefined : parts.join(\" \")\n}\n\nconst transportFailure = (operation: string, cause?: unknown): ArtifactStore.ArtifactStoreError => {\n  const reason = transportReason(cause)\n  return new ArtifactStore.ArtifactStoreError({\n    code: \"transport_failed\",\n    message: `the remote artifact tier refused ${operation}${reason === undefined ? \"\" : ` (${reason})`}`\n  })\n}\n\nconst unexpectedStatus = (operation: string, status: number): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({\n    code: \"transport_failed\",\n    message: `the remote artifact tier answered ${operation} with HTTP ${status}`\n  })\n\nconst invalidOption = (name: string): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({\n    code: \"invalid_configuration\",\n    message: `invalid remote artifact option: ${name}`\n  })\n\n/** The batched-probe response body. */\nconst FindMissingResponse = Schema.Struct({ missing: Schema.Array(Schema.String) })\n\n/** An RFC 9110 field-name token. */\nconst headerName = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/\n\n/** Whether a header value carries a C0 control character or DEL, CR and LF included. */\nconst hasControlText = (value: string): boolean => {\n  for (let index = 0; index < value.length; index++) {\n    const unit = value.charCodeAt(index)\n    if (unit <= 0x1f || unit === 0x7f) return true\n  }\n  return false\n}\n\nconst configurationFailure = (message: string): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({ code: \"invalid_configuration\", message })\n\n/**\n * A 2xx is success, a 404 is a miss, and everything else is a transport\n * failure. Bazel's HTTP client takes the same three-way split; it is the only\n * classification a dumb-HTTP cache can support, because there is no richer\n * error envelope on the wire.\n */\nconst isOk = (response: HttpClientResponse.HttpClientResponse): boolean =>\n  response.status >= 200 && response.status < 300\n\n/**\n * Builds a remote artifact store over Effect's `HttpClient`.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const make = (\n  options: Options\n): Effect.Effect<Service, ArtifactStore.ArtifactStoreError, HttpClient.HttpClient> =>\n  Effect.gen(function*() {\n    const configured = yield* Effect.try({\n      try: () => {\n        const headers = options.headers === undefined\n          ? undefined\n          : Object.freeze(Object.fromEntries(\n            Object.entries(options.headers).map(([name, value]) => {\n              // Refused here, once, rather than on every request as an opaque\n              // transport failure: a CRLF in a value or a space in a name can\n              // never become a valid header.\n              if (typeof value !== \"string\" || value.length > 16 * 1024 || hasControlText(value)) {\n                throw new TypeError(\"header value\")\n              }\n              if (!headerName.test(name)) throw new TypeError(\"header name\")\n              return [name, value]\n            })\n          ))\n        return {\n          endpoint: options.endpoint,\n          headers,\n          downloadTimeout: options.downloadTimeout,\n          uploadTimeout: options.uploadTimeout,\n          requestTimeout: options.requestTimeout,\n          maxDownloadBytes: options.maxDownloadBytes,\n          maxFindMissingResponseBytes: options.maxFindMissingResponseBytes,\n          chunkBytes: options.chunkBytes,\n          downloadPolicy: options.downloadPolicy\n        }\n      },\n      catch: () => invalidOption(\"options\")\n    })\n    if (typeof configured.endpoint !== \"string\") return yield* Effect.fail(invalidOption(\"endpoint\"))\n    const endpoint = yield* Effect.try({\n      try: () => new URL(configured.endpoint),\n      catch: () => configurationFailure(\"invalid remote artifact endpoint\")\n    })\n    // A self-hosted cache on this machine is reachable over plain HTTP, and\n    // loopback traffic never leaves the host. Only literal loopback names are\n    // exempt: a `*.localhost` name reaches loopback only on a resolver that\n    // follows RFC 6761, and one that forwards it to DNS would carry the\n    // credential headers over plaintext to whatever host answers.\n    const loopback = endpoint.hostname === \"localhost\" || endpoint.hostname === \"127.0.0.1\" ||\n      endpoint.hostname === \"[::1]\"\n    if (endpoint.protocol !== \"https:\" && !(endpoint.protocol === \"http:\" && loopback)) {\n      return yield* Effect.fail(configurationFailure(\"remote artifact endpoint must use HTTPS\"))\n    }\n    if (endpoint.username !== \"\" || endpoint.password !== \"\" || endpoint.search !== \"\" || endpoint.hash !== \"\") {\n      return yield* Effect.fail(\n        configurationFailure(\"remote artifact endpoint must not contain credentials, a query, or a fragment\")\n      )\n    }\n    endpoint.pathname = endpoint.pathname.replace(/\\/+$/, \"\")\n    const base = endpoint.toString().replace(/\\/+$/, \"\")\n    const headers = configured.headers\n    const client = yield* HttpClient.HttpClient\n    const credentialNames = Object.keys(headers ?? {}).map((name) => name.toLowerCase())\n    /**\n     * Protocol-owned headers are computed from each request's body and range,\n     * never inherited from credentials, including on a whole-blob fallback.\n     */\n    const authorized = (request: HttpClientRequest.HttpClientRequest): HttpClientRequest.HttpClientRequest =>\n      (headers === undefined ? request : HttpClientRequest.setHeaders(request, headers)).pipe(\n        HttpClientRequest.removeHeader(\"content-type\"),\n        HttpClientRequest.removeHeader(\"content-length\"),\n        HttpClientRequest.removeHeader(\"content-range\")\n      )\n    // The address is a URL path segment, so it is refused before it is\n    // interpolated and percent-encoded when it is: an address carrying a\n    // separator or a `..` would otherwise point this client at a different\n    // resource on the configured endpoint. `ArtifactStore.validateDigest` is\n    // the same guard the filesystem tier applies to the same untrusted input \u2014\n    // a digest read back out of a durable row.\n    const casUrl = (digest: ArtifactStore.Digest) => `${base}/cas/${digest}`\n    const scopedClient = HttpClient.withScope(client)\n    /**\n     * Keep body processing inside the exchange; abort unused responses on every exit.\n     *\n     * Redirects are never followed. A fetch-based client follows them by\n     * default and strips only `Authorization` on a cross-origin hop, so a\n     * tier answering `3xx` would otherwise receive the credential headers at\n     * another origin or over plain HTTP. Manual mode hands the `3xx` back,\n     * where it is an unexpected status (or, for `308`, the resumable-upload\n     * answer this protocol already speaks).\n     */\n    const send = <A, E, R>(\n      operation: string,\n      request: HttpClientRequest.HttpClientRequest,\n      use: (response: HttpClientResponse.HttpClientResponse) => Effect.Effect<A, E, R>\n    ): Effect.Effect<A, E | ArtifactStore.ArtifactStoreError, R> =>\n      Effect.gen(function*() {\n        const redactedNames = yield* Headers.CurrentRedactedNames\n        const requestInit = yield* Effect.serviceOption(FetchHttpClient.RequestInit)\n        return yield* scopedClient.execute(request).pipe(\n          Effect.provideService(FetchHttpClient.RequestInit, {\n            ...Option.getOrUndefined(requestInit),\n            redirect: \"manual\"\n          }),\n          Effect.mapError((cause) => transportFailure(operation, cause)),\n          Effect.flatMap(use),\n          Effect.provideService(Headers.CurrentRedactedNames, [...redactedNames, ...credentialNames]),\n          Effect.scoped\n        )\n      })\n    const parseDeadline = (name: string, input: Duration.Input | undefined, fallback: Duration.Duration) =>\n      Effect.gen(function*() {\n        const parsed = Duration.fromInput(input ?? fallback)\n        if (\n          Option.isNone(parsed) ||\n          !Number.isFinite(Duration.toMillis(parsed.value)) ||\n          Duration.toMillis(parsed.value) <= 0\n        ) {\n          return yield* Effect.fail(invalidOption(name))\n        }\n        return parsed.value\n      })\n    const downloadDeadline = yield* parseDeadline(\n      \"downloadTimeout\",\n      configured.downloadTimeout,\n      defaultDownloadTimeout\n    )\n    const uploadDeadline = yield* parseDeadline(\"uploadTimeout\", configured.uploadTimeout, defaultUploadTimeout)\n    const requestDeadline = yield* parseDeadline(\"requestTimeout\", configured.requestTimeout, defaultRequestTimeout)\n    const maxDownloadBytes = configured.maxDownloadBytes ?? defaultMaxDownloadBytes\n    if (!Number.isSafeInteger(maxDownloadBytes) || maxDownloadBytes <= 0) {\n      return yield* Effect.fail(invalidOption(\"maxDownloadBytes\"))\n    }\n    const maxFindMissingResponseBytes = configured.maxFindMissingResponseBytes ?? maxFindMissingBodyBytes\n    if (\n      !Number.isSafeInteger(maxFindMissingResponseBytes) ||\n      maxFindMissingResponseBytes <= 0 ||\n      maxFindMissingResponseBytes > maxFindMissingBodyBytes\n    ) {\n      return yield* Effect.fail(invalidOption(\"maxFindMissingResponseBytes\"))\n    }\n    const chunkBytes = configured.chunkBytes\n    if (chunkBytes !== undefined && (!Number.isSafeInteger(chunkBytes) || chunkBytes <= 0)) {\n      return yield* Effect.fail(invalidOption(\"chunkBytes\"))\n    }\n    const downloadPolicy = configured.downloadPolicy ?? \"all\"\n    if (!Schema.is(DownloadPolicy)(downloadPolicy)) {\n      return yield* Effect.fail(invalidOption(\"downloadPolicy\"))\n    }\n    const bodyTooLarge = (operation: string, received: number, bound: number): ArtifactStore.ArtifactStoreError =>\n      new ArtifactStore.ArtifactStoreError({\n        code: \"transport_failed\",\n        message: `the remote artifact tier answered ${operation} with ${received} bytes, past the ${bound}-byte bound`\n      })\n    const timedOut = (operation: string): ArtifactStore.ArtifactStoreError =>\n      new ArtifactStore.ArtifactStoreError({\n        code: \"transport_failed\",\n        message: `the remote artifact tier did not finish ${operation} within its configured deadline`\n      })\n    const within = <A, E, R>(\n      operation: string,\n      deadline: Duration.Duration,\n      effect: Effect.Effect<A, E, R>\n    ): Effect.Effect<A, E | ArtifactStore.ArtifactStoreError, R> =>\n      effect.pipe(\n        Effect.timeout(deadline),\n        Effect.catchTag(\"TimeoutError\", () => Effect.fail(timedOut(operation)))\n      )\n    /**\n     * Reads a download body incrementally, refusing it the moment it exceeds\n     * the size bound; a `Content-Length` that already declares the excess is\n     * refused before a single body byte is read. Streaming instead of\n     * buffering the whole body means the guard fires at most one chunk past\n     * the bound, never after an arbitrarily large response is in memory.\n     */\n    const readBounded = (\n      response: HttpClientResponse.HttpClientResponse,\n      operation: string,\n      bound: number\n    ) =>\n      Effect.gen(function*() {\n        const declared = response.headers[\"content-length\"]\n        if (declared !== undefined) {\n          const declaredBytes = Number(declared)\n          if (!/^\\d+$/.test(declared) || !Number.isSafeInteger(declaredBytes)) {\n            return yield* Effect.fail(transportFailure(`${operation} body`))\n          }\n          if (declaredBytes > bound) return yield* Effect.fail(bodyTooLarge(operation, declaredBytes, bound))\n        }\n        const chunks: Array<Uint8Array> = []\n        let received = 0\n        yield* Stream.runForEach(response.stream, (chunk: Uint8Array) =>\n          Effect.suspend(() => {\n            received += chunk.byteLength\n            if (received > bound) return Effect.fail(bodyTooLarge(operation, received, bound))\n            chunks.push(new Uint8Array(chunk))\n            return Effect.void\n          })).pipe(\n            Effect.catchTag(\"HttpClientError\", (cause) =>\n              // An absent body is zero bytes, not a transport refusal: the\n              // digest check in `get` is the arbiter of whether empty content\n              // is the requested artifact.\n              cause.reason._tag === \"EmptyBodyError\"\n                ? Effect.void\n                : Effect.fail(transportFailure(`${operation} body`)))\n          )\n        const bytes = new Uint8Array(received)\n        let offset = 0\n        for (const chunk of chunks) {\n          bytes.set(chunk, offset)\n          offset += chunk.byteLength\n        }\n        return bytes\n      })\n    /** The network half of `get`: request, status split, bounded body read. */\n    const download = (digest: ArtifactStore.Digest) =>\n      send(\"a download\", authorized(HttpClientRequest.get(casUrl(digest))), (response) =>\n        Effect.gen(function*() {\n          if (response.status === 404) {\n            return yield* Effect.fail(new ArtifactStore.ArtifactMissing({ code: \"artifact_missing\", digest }))\n          }\n          if (!isOk(response)) return yield* Effect.fail(unexpectedStatus(\"a download\", response.status))\n          return yield* readBounded(response, \"a download\", maxDownloadBytes)\n        }))\n\n    /** One whole-blob `PUT`: the protocol every dumb-HTTP CAS already speaks. */\n    const uploadWhole = (digest: ArtifactStore.Digest, bytes: Uint8Array) =>\n      send(\n        \"an upload\",\n        authorized(HttpClientRequest.put(casUrl(digest))).pipe(\n          HttpClientRequest.bodyUint8Array(bytes, \"application/octet-stream\")\n        ),\n        (response) => isOk(response) ? Effect.void : Effect.fail(unexpectedStatus(\"an upload\", response.status))\n      )\n\n    /**\n     * The byte after the prefix a `Range: bytes=0-{last}` header reports, or\n     * `undefined` when the answer names no prefix. Only a prefix starting at\n     * zero is usable: a tier holding a middle span has nothing this client can\n     * continue from, so it is treated as holding nothing.\n     */\n    const resumeOffset = (response: HttpClientResponse.HttpClientResponse): number | undefined => {\n      const header = response.headers[\"range\"]\n      if (header === undefined) return undefined\n      const match = /^bytes=0-(\\d+)$/.exec(header.trim())\n      if (match === null) return undefined\n      const last = Number(match[1])\n      // A prefix past the safe integer range does not survive `Number`: the\n      // decimal digits are rounded, so the offset it names is a number this\n      // client made up. It proves nothing about what the tier holds, which is\n      // the same as naming no prefix at all.\n      if (!Number.isSafeInteger(last)) return undefined\n      return last + 1\n    }\n\n    /**\n     * A tier that refuses ranged bodies, in the three ways HTTP has to say\n     * so. `411` and `416` refuse the body's framing; `400` is RFC 9110\n     * section 14.5's answer from a resource that \"does not support partial\n     * PUT requests\", and it is what both of this repository's cache services\n     * send. Falling back on it can mask no genuine `400`: the whole-blob\n     * `PUT` that follows presents the same URL, digest, and credential, so a\n     * real refusal comes straight back on that request.\n     */\n    const rejectsRanges = (status: number): boolean => status === 400 || status === 411 || status === 416\n\n    /**\n     * Whether the tier holds exactly `total` bytes under `digest`, read from\n     * the `Content-Length` of a `HEAD` answer.\n     *\n     * This is the only claim about a chunked transfer this client will make on\n     * its own behalf. A tier that answers `HEAD` without a length is not\n     * refused \u2014 it simply proves nothing, so the caller sends the blob whole.\n     */\n    const holdsWhole = (digest: ArtifactStore.Digest, total: number) =>\n      send(\"an existence probe\", authorized(HttpClientRequest.head(casUrl(digest))), (response) =>\n        Effect.sync(() => {\n          if (!isOk(response)) return false\n          const declared = response.headers[\"content-length\"]\n          return declared !== undefined && Number(declared) === total\n        }))\n\n    /**\n     * Sends `bytes` as `Content-Range` chunks, resuming from whatever prefix\n     * the tier reports. Answers `false` when the tier has not proved it stored\n     * the whole blob, which is the caller's signal to send it whole.\n     *\n     * A `2xx` answer is never by itself proof of that. A tier that ignores\n     * `Content-Range`, such as plain WebDAV `PUT`, which Bazel documents as a\n     * supported dumb-HTTP cache, answers every request in this sequence `201`\n     * while storing only the last body it was handed, which for the probe is\n     * zero bytes. So only a `308` continues the sequence, and the completing\n     * chunk's `2xx` is confirmed with `HEAD` before the caller is told the\n     * digest is published. Everything else falls back, and the whole-blob\n     * `PUT` overwrites whatever partial body the sequence left behind.\n     */\n    const uploadChunked = (digest: ArtifactStore.Digest, bytes: Uint8Array, chunk: number) =>\n      Effect.gen(function*() {\n        const total = bytes.byteLength\n        const ranged = (range: string, body: Uint8Array) =>\n          send(\n            \"an upload\",\n            authorized(HttpClientRequest.put(casUrl(digest))).pipe(\n              HttpClientRequest.bodyUint8Array(body, \"application/octet-stream\"),\n              HttpClientRequest.setHeader(\"content-range\", range)\n            ),\n            // Only status and headers are used after the response is released.\n            Effect.succeed\n          )\n        // A blob the tier already holds whole costs one `HEAD` and no body.\n        // Asking first is also what makes the probe's answer readable: a `2xx`\n        // to it can no longer mean \"already there\", so the one reading left is\n        // a tier that ignored the header and stored the empty body.\n        if (yield* holdsWhole(digest, total)) return true\n        // The probe carries no bytes: it exists to learn where to start, so\n        // that an interrupted transfer costs one round trip rather than the\n        // whole blob again.\n        const probe = yield* ranged(`bytes */${total}`, new Uint8Array(0))\n        if (isOk(probe) || rejectsRanges(probe.status)) return false\n        if (probe.status !== 308 && probe.status !== 404) {\n          return yield* Effect.fail(unexpectedStatus(\"an upload probe\", probe.status))\n        }\n        let offset = probe.status === 308 ? resumeOffset(probe) ?? 0 : 0\n        while (offset < total) {\n          const end = Math.min(offset + chunk, total)\n          const answer = yield* ranged(`bytes ${offset}-${end - 1}/${total}`, bytes.subarray(offset, end))\n          if (answer.status !== 308) {\n            // The completing chunk may answer `2xx`; anything before it may\n            // not, because a tier that is still owed bytes and reports success\n            // is a tier that is not reading the header. Both are checked\n            // against what the tier actually holds below.\n            if (end === total && isOk(answer)) break\n            if (isOk(answer) || rejectsRanges(answer.status)) return false\n            return yield* Effect.fail(unexpectedStatus(\"an upload\", answer.status))\n          }\n          // A tier that reports a longer prefix than this chunk delivered has\n          // more than we just sent, so the next chunk starts there. Never\n          // backwards: an answer naming a shorter prefix would loop forever.\n          offset = Math.max(end, resumeOffset(answer) ?? 0)\n        }\n        return yield* holdsWhole(digest, total)\n      })\n\n    const put: ArtifactStore.Service[\"put\"] = Effect.fn(\"RemoteArtifacts.put\")((bytes: Uint8Array) =>\n      Effect.flatMap(ArtifactStore.snapshotBytes(bytes), (snapshot) =>\n        Effect.gen(function*() {\n          const digest = yield* ArtifactStore.measureBytes(snapshot)\n          yield* Effect.annotateCurrentSpan({ digest })\n          yield* within(\n            \"an upload\",\n            uploadDeadline,\n            Effect.gen(function*() {\n              if (chunkBytes === undefined || snapshot.byteLength <= chunkBytes) {\n                yield* uploadWhole(digest, snapshot)\n                return\n              }\n              const transferred = yield* uploadChunked(digest, snapshot, chunkBytes)\n              if (!transferred) yield* uploadWhole(digest, snapshot)\n            })\n          )\n          return digest\n        }))\n    )\n\n    const get: ArtifactStore.Service[\"get\"] = Effect.fn(\"RemoteArtifacts.get\")((digest: string) =>\n      Effect.gen(function*() {\n        const validated = yield* ArtifactStore.validateDigest(digest)\n        yield* Effect.annotateCurrentSpan({ digest: validated })\n        // The deadline covers the whole exchange \u2014 request, headers, body \u2014\n        // because a tier that stalls mid-body is exactly as unanswering as\n        // one that never accepts the connection.\n        const bytes = yield* within(\"a download\", downloadDeadline, download(validated))\n        // The shared tier is the least trusted store there is: it is written\n        // by machines this one has never met. Verifying the address here means\n        // a mis-serving or compromised cache can waste a round trip but can\n        // never substitute content.\n        const measured = yield* ArtifactStore.measureBytes(bytes)\n        if (measured !== validated) {\n          return yield* Effect.fail(\n            new ArtifactStore.ArtifactCorruption({\n              code: \"artifact_corruption\",\n              recordedDigest: validated,\n              measuredDigest: measured\n            })\n          )\n        }\n        return bytes\n      })\n    )\n\n    const has: ArtifactStore.Service[\"has\"] = Effect.fn(\"RemoteArtifacts.has\")((digest: string) =>\n      Effect.gen(function*() {\n        const validated = yield* ArtifactStore.validateDigest(digest)\n        yield* Effect.annotateCurrentSpan({ digest: validated })\n        const response = yield* within(\n          \"an existence probe\",\n          requestDeadline,\n          send(\"an existence probe\", authorized(HttpClientRequest.head(casUrl(validated))), Effect.succeed)\n        )\n        if (response.status === 404) return false\n        if (!isOk(response)) return yield* Effect.fail(unexpectedStatus(\"an existence probe\", response.status))\n        return true\n      })\n    )\n\n    const findMissing: ArtifactStore.Service[\"findMissing\"] = Effect.fn(\"RemoteArtifacts.findMissing\")(\n      (digests: Iterable<string>) =>\n        Effect.gen(function*() {\n          const requested = [...new Set(digests)]\n          if (requested.length === 0) return []\n          // The batch travels in a JSON body rather than a path, but an\n          // unusable address is still an unusable address, and the local tier\n          // refuses the same batch wholesale rather than probing part of it.\n          const validated: Array<ArtifactStore.Digest> = []\n          for (const digest of requested) validated.push(yield* ArtifactStore.validateDigest(digest))\n          yield* Effect.annotateCurrentSpan({ count: validated.length })\n          const missing = new Set<string>()\n          for (let offset = 0; offset < validated.length; offset += maxFindMissingBatchDigests) {\n            const batch = validated.slice(offset, offset + maxFindMissingBatchDigests)\n            const requestBody = encoder.encode(JSON.stringify({ digests: batch }))\n            /* v8 ignore next 3 -- strict 64-byte digests plus the 1,000-entry batch cap make this\n             * at most 67,013 bytes; keep the protocol assertion beside serialization in case either invariant changes. */\n            if (requestBody.byteLength > maxFindMissingBodyBytes) {\n              return yield* Effect.fail(configurationFailure(\"remote artifact findMissing request exceeds 256 KiB\"))\n            }\n            const decoded = yield* within(\n              \"a batched existence probe\",\n              requestDeadline,\n              send(\n                \"a batched existence probe\",\n                authorized(HttpClientRequest.post(`${base}/cas/findMissing`)).pipe(\n                  HttpClientRequest.bodyUint8Array(requestBody, \"application/json\")\n                ),\n                (response) =>\n                  Effect.gen(function*() {\n                    if (!isOk(response)) {\n                      return yield* Effect.fail(unexpectedStatus(\"a batched existence probe\", response.status))\n                    }\n                    const bodyBytes = yield* readBounded(\n                      response,\n                      \"a batched existence probe\",\n                      maxFindMissingResponseBytes\n                    )\n                    const body = yield* Effect.try({\n                      try: () => JSON.parse(decoder.decode(bodyBytes)) as unknown,\n                      catch: () => transportFailure(\"a batched existence probe body\")\n                    })\n                    return yield* Schema.decodeUnknownEffect(FindMissingResponse)(body).pipe(\n                      Effect.mapError(() => transportFailure(\"a batched existence probe body\"))\n                    )\n                  })\n              )\n            )\n            const asked = new Set<string>(batch)\n            for (const digest of decoded.missing) if (asked.has(digest)) missing.add(digest)\n          }\n          // \"The returned set is guaranteed to be a subset of `digests`\"\n          // (`MissingDigestsFinder`). Bazel gets that from the server; we\n          // enforce it on this side too, because a server that answered with\n          // an unrequested digest would otherwise make the caller upload bytes\n          // it never asked about.\n          return validated.filter((digest) => missing.has(digest))\n        })\n    )\n\n    return { put, get, has, findMissing, downloadPolicy }\n  })\n\n/**\n * Provides a remote artifact store as the `ArtifactStore` tag.\n *\n * Composing this *alone* makes every artifact read and write a network round\n * trip. The intended production shape is\n * {@link CombinedArtifacts.layer | CombinedArtifacts}, with this as its remote\n * tier.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer = (\n  options: Options\n): Layer.Layer<ArtifactStore.ArtifactStore, ArtifactStore.ArtifactStoreError, HttpClient.HttpClient> =>\n  Layer.effect(ArtifactStore.ArtifactStore)(make(options))\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuDA,eAA0B;AAC1B,aAAwB;AACxB,sBAAiC;AACjC,cAAyB;AACzB,iBAA4B;AAC5B,wBAAmC;AAEnC,YAAuB;AACvB,aAAwB;AACxB,aAAwB;AACxB,aAAwB;AACxB,oBAA+B;AAQxB,MAAM,iBAAiB,OAAO,SAAS,CAAC,OAAO,YAAY,SAAS,CAAU;AAgB9E,MAAM,mBAAkD,OAAO,OAAO,CAAC,OAAO,YAAY,SAAS,CAAC;AAoBpG,MAAM,mBAAmB,CAAC,UAA6D;AAC5F,QAAM,WAAY,MAAgD;AAClE,SAAO,OAAO,GAAG,cAAc,EAAE,QAAQ,IAAI,WAAW;AAC1D;AA2HA,MAAM,yBAAyB,SAAS,QAAQ,EAAE;AAClD,MAAM,uBAAuB,SAAS,QAAQ,EAAE;AAChD,MAAM,wBAAwB,SAAS,QAAQ,EAAE;AAQjD,MAAM,0BAA0B,MAAM,OAAO;AAC7C,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AACtC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAQxD,MAAM,kBAAkB,CAAC,UAAuC;AAC9D,QAAM,SAAU,OAAoE;AACpF,QAAM,MAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AAC7D,MAAI;AACJ,MAAI,UAAmB,UAAU;AACjC,WAAS,QAAQ,GAAG,QAAQ,KAAK,OAAO,YAAY,YAAY,YAAY,MAAM,SAAS;AACzF,UAAM,YAAa,QAAwC;AAC3D,QAAI,OAAO,cAAc,YAAY,yBAAyB,KAAK,SAAS,GAAG;AAC7E,aAAO;AACP;AAAA,IACF;AACA,cAAW,QAAyC;AAAA,EACtD;AACA,QAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,OAAO,CAAC,SAAyB,SAAS,MAAS;AAC7E,SAAO,MAAM,WAAW,IAAI,SAAY,MAAM,KAAK,GAAG;AACxD;AAEA,MAAM,mBAAmB,CAAC,WAAmB,UAAsD;AACjG,QAAM,SAAS,gBAAgB,KAAK;AACpC,SAAO,IAAI,cAAc,mBAAmB;AAAA,IAC1C,MAAM;AAAA,IACN,SAAS,oCAAoC,SAAS,GAAG,WAAW,SAAY,KAAK,KAAK,MAAM,GAAG;AAAA,EACrG,CAAC;AACH;AAEA,MAAM,mBAAmB,CAAC,WAAmB,WAC3C,IAAI,cAAc,mBAAmB;AAAA,EACnC,MAAM;AAAA,EACN,SAAS,qCAAqC,SAAS,cAAc,MAAM;AAC7E,CAAC;AAEH,MAAM,gBAAgB,CAAC,SACrB,IAAI,cAAc,mBAAmB;AAAA,EACnC,MAAM;AAAA,EACN,SAAS,mCAAmC,IAAI;AAClD,CAAC;AAGH,MAAM,sBAAsB,OAAO,OAAO,EAAE,SAAS,OAAO,MAAM,OAAO,MAAM,EAAE,CAAC;AAGlF,MAAM,aAAa;AAGnB,MAAM,iBAAiB,CAAC,UAA2B;AACjD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,MAAQ,SAAS,IAAM,QAAO;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,MAAM,uBAAuB,CAAC,YAC5B,IAAI,cAAc,mBAAmB,EAAE,MAAM,yBAAyB,QAAQ,CAAC;AAQjF,MAAM,OAAO,CAAC,aACZ,SAAS,UAAU,OAAO,SAAS,SAAS;AASvC,MAAM,OAAO,CAClB,YAEA,OAAO,IAAI,aAAY;AACrB,QAAM,aAAa,OAAO,OAAO,IAAI;AAAA,IACnC,KAAK,MAAM;AACT,YAAMA,WAAU,QAAQ,YAAY,SAChC,SACA,OAAO,OAAO,OAAO;AAAA,QACrB,OAAO,QAAQ,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAIrD,cAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,QAAQ,eAAe,KAAK,GAAG;AAClF,kBAAM,IAAI,UAAU,cAAc;AAAA,UACpC;AACA,cAAI,CAAC,WAAW,KAAK,IAAI,EAAG,OAAM,IAAI,UAAU,aAAa;AAC7D,iBAAO,CAAC,MAAM,KAAK;AAAA,QACrB,CAAC;AAAA,MACH,CAAC;AACH,aAAO;AAAA,QACL,UAAU,QAAQ;AAAA,QAClB,SAAAA;AAAA,QACA,iBAAiB,QAAQ;AAAA,QACzB,eAAe,QAAQ;AAAA,QACvB,gBAAgB,QAAQ;AAAA,QACxB,kBAAkB,QAAQ;AAAA,QAC1B,6BAA6B,QAAQ;AAAA,QACrC,YAAY,QAAQ;AAAA,QACpB,gBAAgB,QAAQ;AAAA,MAC1B;AAAA,IACF;AAAA,IACA,OAAO,MAAM,cAAc,SAAS;AAAA,EACtC,CAAC;AACD,MAAI,OAAO,WAAW,aAAa,SAAU,QAAO,OAAO,OAAO,KAAK,cAAc,UAAU,CAAC;AAChG,QAAM,WAAW,OAAO,OAAO,IAAI;AAAA,IACjC,KAAK,MAAM,IAAI,IAAI,WAAW,QAAQ;AAAA,IACtC,OAAO,MAAM,qBAAqB,kCAAkC;AAAA,EACtE,CAAC;AAMD,QAAM,WAAW,SAAS,aAAa,eAAe,SAAS,aAAa,eAC1E,SAAS,aAAa;AACxB,MAAI,SAAS,aAAa,YAAY,EAAE,SAAS,aAAa,WAAW,WAAW;AAClF,WAAO,OAAO,OAAO,KAAK,qBAAqB,yCAAyC,CAAC;AAAA,EAC3F;AACA,MAAI,SAAS,aAAa,MAAM,SAAS,aAAa,MAAM,SAAS,WAAW,MAAM,SAAS,SAAS,IAAI;AAC1G,WAAO,OAAO,OAAO;AAAA,MACnB,qBAAqB,+EAA+E;AAAA,IACtG;AAAA,EACF;AACA,WAAS,WAAW,SAAS,SAAS,QAAQ,QAAQ,EAAE;AACxD,QAAM,OAAO,SAAS,SAAS,EAAE,QAAQ,QAAQ,EAAE;AACnD,QAAM,UAAU,WAAW;AAC3B,QAAM,SAAS,OAAO,WAAW;AACjC,QAAM,kBAAkB,OAAO,KAAK,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC;AAKnF,QAAM,aAAa,CAAC,aACjB,YAAY,SAAY,UAAU,kBAAkB,WAAW,SAAS,OAAO,GAAG;AAAA,IACjF,kBAAkB,aAAa,cAAc;AAAA,IAC7C,kBAAkB,aAAa,gBAAgB;AAAA,IAC/C,kBAAkB,aAAa,eAAe;AAAA,EAChD;AAOF,QAAM,SAAS,CAAC,WAAiC,GAAG,IAAI,QAAQ,MAAM;AACtE,QAAM,eAAe,WAAW,UAAU,MAAM;AAWhD,QAAM,OAAO,CACX,WACA,SACA,QAEA,OAAO,IAAI,aAAY;AACrB,UAAM,gBAAgB,OAAO,QAAQ;AACrC,UAAM,cAAc,OAAO,OAAO,cAAc,gBAAgB,WAAW;AAC3E,WAAO,OAAO,aAAa,QAAQ,OAAO,EAAE;AAAA,MAC1C,OAAO,eAAe,gBAAgB,aAAa;AAAA,QACjD,GAAG,OAAO,eAAe,WAAW;AAAA,QACpC,UAAU;AAAA,MACZ,CAAC;AAAA,MACD,OAAO,SAAS,CAAC,UAAU,iBAAiB,WAAW,KAAK,CAAC;AAAA,MAC7D,OAAO,QAAQ,GAAG;AAAA,MAClB,OAAO,eAAe,QAAQ,sBAAsB,CAAC,GAAG,eAAe,GAAG,eAAe,CAAC;AAAA,MAC1F,OAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH,QAAM,gBAAgB,CAAC,MAAc,OAAmC,aACtE,OAAO,IAAI,aAAY;AACrB,UAAM,SAAS,SAAS,UAAU,SAAS,QAAQ;AACnD,QACE,OAAO,OAAO,MAAM,KACpB,CAAC,OAAO,SAAS,SAAS,SAAS,OAAO,KAAK,CAAC,KAChD,SAAS,SAAS,OAAO,KAAK,KAAK,GACnC;AACA,aAAO,OAAO,OAAO,KAAK,cAAc,IAAI,CAAC;AAAA,IAC/C;AACA,WAAO,OAAO;AAAA,EAChB,CAAC;AACH,QAAM,mBAAmB,OAAO;AAAA,IAC9B;AAAA,IACA,WAAW;AAAA,IACX;AAAA,EACF;AACA,QAAM,iBAAiB,OAAO,cAAc,iBAAiB,WAAW,eAAe,oBAAoB;AAC3G,QAAM,kBAAkB,OAAO,cAAc,kBAAkB,WAAW,gBAAgB,qBAAqB;AAC/G,QAAM,mBAAmB,WAAW,oBAAoB;AACxD,MAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,oBAAoB,GAAG;AACpE,WAAO,OAAO,OAAO,KAAK,cAAc,kBAAkB,CAAC;AAAA,EAC7D;AACA,QAAM,8BAA8B,WAAW,+BAA+B;AAC9E,MACE,CAAC,OAAO,cAAc,2BAA2B,KACjD,+BAA+B,KAC/B,8BAA8B,yBAC9B;AACA,WAAO,OAAO,OAAO,KAAK,cAAc,6BAA6B,CAAC;AAAA,EACxE;AACA,QAAM,aAAa,WAAW;AAC9B,MAAI,eAAe,WAAc,CAAC,OAAO,cAAc,UAAU,KAAK,cAAc,IAAI;AACtF,WAAO,OAAO,OAAO,KAAK,cAAc,YAAY,CAAC;AAAA,EACvD;AACA,QAAM,iBAAiB,WAAW,kBAAkB;AACpD,MAAI,CAAC,OAAO,GAAG,cAAc,EAAE,cAAc,GAAG;AAC9C,WAAO,OAAO,OAAO,KAAK,cAAc,gBAAgB,CAAC;AAAA,EAC3D;AACA,QAAM,eAAe,CAAC,WAAmB,UAAkB,UACzD,IAAI,cAAc,mBAAmB;AAAA,IACnC,MAAM;AAAA,IACN,SAAS,qCAAqC,SAAS,SAAS,QAAQ,oBAAoB,KAAK;AAAA,EACnG,CAAC;AACH,QAAM,WAAW,CAAC,cAChB,IAAI,cAAc,mBAAmB;AAAA,IACnC,MAAM;AAAA,IACN,SAAS,2CAA2C,SAAS;AAAA,EAC/D,CAAC;AACH,QAAM,SAAS,CACb,WACA,UACA,WAEA,OAAO;AAAA,IACL,OAAO,QAAQ,QAAQ;AAAA,IACvB,OAAO,SAAS,gBAAgB,MAAM,OAAO,KAAK,SAAS,SAAS,CAAC,CAAC;AAAA,EACxE;AAQF,QAAM,cAAc,CAClB,UACA,WACA,UAEA,OAAO,IAAI,aAAY;AACrB,UAAM,WAAW,SAAS,QAAQ,gBAAgB;AAClD,QAAI,aAAa,QAAW;AAC1B,YAAM,gBAAgB,OAAO,QAAQ;AACrC,UAAI,CAAC,QAAQ,KAAK,QAAQ,KAAK,CAAC,OAAO,cAAc,aAAa,GAAG;AACnE,eAAO,OAAO,OAAO,KAAK,iBAAiB,GAAG,SAAS,OAAO,CAAC;AAAA,MACjE;AACA,UAAI,gBAAgB,MAAO,QAAO,OAAO,OAAO,KAAK,aAAa,WAAW,eAAe,KAAK,CAAC;AAAA,IACpG;AACA,UAAM,SAA4B,CAAC;AACnC,QAAI,WAAW;AACf,WAAO,OAAO,WAAW,SAAS,QAAQ,CAAC,UACzC,OAAO,QAAQ,MAAM;AACnB,kBAAY,MAAM;AAClB,UAAI,WAAW,MAAO,QAAO,OAAO,KAAK,aAAa,WAAW,UAAU,KAAK,CAAC;AACjF,aAAO,KAAK,IAAI,WAAW,KAAK,CAAC;AACjC,aAAO,OAAO;AAAA,IAChB,CAAC,CAAC,EAAE;AAAA,MACF,OAAO,SAAS,mBAAmB,CAAC;AAAA;AAAA;AAAA;AAAA,QAIlC,MAAM,OAAO,SAAS,mBAClB,OAAO,OACP,OAAO,KAAK,iBAAiB,GAAG,SAAS,OAAO,CAAC;AAAA,OAAC;AAAA,IAC1D;AACF,UAAM,QAAQ,IAAI,WAAW,QAAQ;AACrC,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,YAAM,IAAI,OAAO,MAAM;AACvB,gBAAU,MAAM;AAAA,IAClB;AACA,WAAO;AAAA,EACT,CAAC;AAEH,QAAM,WAAW,CAAC,WAChB,KAAK,cAAc,WAAW,kBAAkB,IAAI,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,aACrE,OAAO,IAAI,aAAY;AACrB,QAAI,SAAS,WAAW,KAAK;AAC3B,aAAO,OAAO,OAAO,KAAK,IAAI,cAAc,gBAAgB,EAAE,MAAM,oBAAoB,OAAO,CAAC,CAAC;AAAA,IACnG;AACA,QAAI,CAAC,KAAK,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,iBAAiB,cAAc,SAAS,MAAM,CAAC;AAC9F,WAAO,OAAO,YAAY,UAAU,cAAc,gBAAgB;AAAA,EACpE,CAAC,CAAC;AAGN,QAAM,cAAc,CAAC,QAA8B,UACjD;AAAA,IACE;AAAA,IACA,WAAW,kBAAkB,IAAI,OAAO,MAAM,CAAC,CAAC,EAAE;AAAA,MAChD,kBAAkB,eAAe,OAAO,0BAA0B;AAAA,IACpE;AAAA,IACA,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,OAAO,OAAO,KAAK,iBAAiB,aAAa,SAAS,MAAM,CAAC;AAAA,EACzG;AAQF,QAAM,eAAe,CAAC,aAAwE;AAC5F,UAAM,SAAS,SAAS,QAAQ,OAAO;AACvC,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,QAAQ,kBAAkB,KAAK,OAAO,KAAK,CAAC;AAClD,QAAI,UAAU,KAAM,QAAO;AAC3B,UAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAK5B,QAAI,CAAC,OAAO,cAAc,IAAI,EAAG,QAAO;AACxC,WAAO,OAAO;AAAA,EAChB;AAWA,QAAM,gBAAgB,CAAC,WAA4B,WAAW,OAAO,WAAW,OAAO,WAAW;AAUlG,QAAM,aAAa,CAAC,QAA8B,UAChD,KAAK,sBAAsB,WAAW,kBAAkB,KAAK,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,aAC9E,OAAO,KAAK,MAAM;AAChB,QAAI,CAAC,KAAK,QAAQ,EAAG,QAAO;AAC5B,UAAM,WAAW,SAAS,QAAQ,gBAAgB;AAClD,WAAO,aAAa,UAAa,OAAO,QAAQ,MAAM;AAAA,EACxD,CAAC,CAAC;AAgBN,QAAM,gBAAgB,CAAC,QAA8B,OAAmB,UACtE,OAAO,IAAI,aAAY;AACrB,UAAM,QAAQ,MAAM;AACpB,UAAM,SAAS,CAAC,OAAe,SAC7B;AAAA,MACE;AAAA,MACA,WAAW,kBAAkB,IAAI,OAAO,MAAM,CAAC,CAAC,EAAE;AAAA,QAChD,kBAAkB,eAAe,MAAM,0BAA0B;AAAA,QACjE,kBAAkB,UAAU,iBAAiB,KAAK;AAAA,MACpD;AAAA;AAAA,MAEA,OAAO;AAAA,IACT;AAKF,QAAI,OAAO,WAAW,QAAQ,KAAK,EAAG,QAAO;AAI7C,UAAM,QAAQ,OAAO,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,CAAC;AACjE,QAAI,KAAK,KAAK,KAAK,cAAc,MAAM,MAAM,EAAG,QAAO;AACvD,QAAI,MAAM,WAAW,OAAO,MAAM,WAAW,KAAK;AAChD,aAAO,OAAO,OAAO,KAAK,iBAAiB,mBAAmB,MAAM,MAAM,CAAC;AAAA,IAC7E;AACA,QAAI,SAAS,MAAM,WAAW,MAAM,aAAa,KAAK,KAAK,IAAI;AAC/D,WAAO,SAAS,OAAO;AACrB,YAAM,MAAM,KAAK,IAAI,SAAS,OAAO,KAAK;AAC1C,YAAM,SAAS,OAAO,OAAO,SAAS,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,MAAM,SAAS,QAAQ,GAAG,CAAC;AAC/F,UAAI,OAAO,WAAW,KAAK;AAKzB,YAAI,QAAQ,SAAS,KAAK,MAAM,EAAG;AACnC,YAAI,KAAK,MAAM,KAAK,cAAc,OAAO,MAAM,EAAG,QAAO;AACzD,eAAO,OAAO,OAAO,KAAK,iBAAiB,aAAa,OAAO,MAAM,CAAC;AAAA,MACxE;AAIA,eAAS,KAAK,IAAI,KAAK,aAAa,MAAM,KAAK,CAAC;AAAA,IAClD;AACA,WAAO,OAAO,WAAW,QAAQ,KAAK;AAAA,EACxC,CAAC;AAEH,QAAM,MAAoC,OAAO,GAAG,qBAAqB;AAAA,IAAE,CAAC,UAC1E,OAAO,QAAQ,cAAc,cAAc,KAAK,GAAG,CAAC,aAClD,OAAO,IAAI,aAAY;AACrB,YAAM,SAAS,OAAO,cAAc,aAAa,QAAQ;AACzD,aAAO,OAAO,oBAAoB,EAAE,OAAO,CAAC;AAC5C,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,OAAO,IAAI,aAAY;AACrB,cAAI,eAAe,UAAa,SAAS,cAAc,YAAY;AACjE,mBAAO,YAAY,QAAQ,QAAQ;AACnC;AAAA,UACF;AACA,gBAAM,cAAc,OAAO,cAAc,QAAQ,UAAU,UAAU;AACrE,cAAI,CAAC,YAAa,QAAO,YAAY,QAAQ,QAAQ;AAAA,QACvD,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT,CAAC,CAAC;AAAA,EACN;AAEA,QAAM,MAAoC,OAAO,GAAG,qBAAqB;AAAA,IAAE,CAAC,WAC1E,OAAO,IAAI,aAAY;AACrB,YAAM,YAAY,OAAO,cAAc,eAAe,MAAM;AAC5D,aAAO,OAAO,oBAAoB,EAAE,QAAQ,UAAU,CAAC;AAIvD,YAAM,QAAQ,OAAO,OAAO,cAAc,kBAAkB,SAAS,SAAS,CAAC;AAK/E,YAAM,WAAW,OAAO,cAAc,aAAa,KAAK;AACxD,UAAI,aAAa,WAAW;AAC1B,eAAO,OAAO,OAAO;AAAA,UACnB,IAAI,cAAc,mBAAmB;AAAA,YACnC,MAAM;AAAA,YACN,gBAAgB;AAAA,YAChB,gBAAgB;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,MAAoC,OAAO,GAAG,qBAAqB;AAAA,IAAE,CAAC,WAC1E,OAAO,IAAI,aAAY;AACrB,YAAM,YAAY,OAAO,cAAc,eAAe,MAAM;AAC5D,aAAO,OAAO,oBAAoB,EAAE,QAAQ,UAAU,CAAC;AACvD,YAAM,WAAW,OAAO;AAAA,QACtB;AAAA,QACA;AAAA,QACA,KAAK,sBAAsB,WAAW,kBAAkB,KAAK,OAAO,SAAS,CAAC,CAAC,GAAG,OAAO,OAAO;AAAA,MAClG;AACA,UAAI,SAAS,WAAW,IAAK,QAAO;AACpC,UAAI,CAAC,KAAK,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,iBAAiB,sBAAsB,SAAS,MAAM,CAAC;AACtG,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,cAAoD,OAAO,GAAG,6BAA6B;AAAA,IAC/F,CAAC,YACC,OAAO,IAAI,aAAY;AACrB,YAAM,YAAY,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC;AACtC,UAAI,UAAU,WAAW,EAAG,QAAO,CAAC;AAIpC,YAAM,YAAyC,CAAC;AAChD,iBAAW,UAAU,UAAW,WAAU,KAAK,OAAO,cAAc,eAAe,MAAM,CAAC;AAC1F,aAAO,OAAO,oBAAoB,EAAE,OAAO,UAAU,OAAO,CAAC;AAC7D,YAAM,UAAU,oBAAI,IAAY;AAChC,eAAS,SAAS,GAAG,SAAS,UAAU,QAAQ,UAAU,4BAA4B;AACpF,cAAM,QAAQ,UAAU,MAAM,QAAQ,SAAS,0BAA0B;AACzE,cAAM,cAAc,QAAQ,OAAO,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,CAAC;AAGrE,YAAI,YAAY,aAAa,yBAAyB;AACpD,iBAAO,OAAO,OAAO,KAAK,qBAAqB,qDAAqD,CAAC;AAAA,QACvG;AACA,cAAM,UAAU,OAAO;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA,WAAW,kBAAkB,KAAK,GAAG,IAAI,kBAAkB,CAAC,EAAE;AAAA,cAC5D,kBAAkB,eAAe,aAAa,kBAAkB;AAAA,YAClE;AAAA,YACA,CAAC,aACC,OAAO,IAAI,aAAY;AACrB,kBAAI,CAAC,KAAK,QAAQ,GAAG;AACnB,uBAAO,OAAO,OAAO,KAAK,iBAAiB,6BAA6B,SAAS,MAAM,CAAC;AAAA,cAC1F;AACA,oBAAM,YAAY,OAAO;AAAA,gBACvB;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AACA,oBAAM,OAAO,OAAO,OAAO,IAAI;AAAA,gBAC7B,KAAK,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,gBAC/C,OAAO,MAAM,iBAAiB,gCAAgC;AAAA,cAChE,CAAC;AACD,qBAAO,OAAO,OAAO,oBAAoB,mBAAmB,EAAE,IAAI,EAAE;AAAA,gBAClE,OAAO,SAAS,MAAM,iBAAiB,gCAAgC,CAAC;AAAA,cAC1E;AAAA,YACF,CAAC;AAAA,UACL;AAAA,QACF;AACA,cAAM,QAAQ,IAAI,IAAY,KAAK;AACnC,mBAAW,UAAU,QAAQ,QAAS,KAAI,MAAM,IAAI,MAAM,EAAG,SAAQ,IAAI,MAAM;AAAA,MACjF;AAMA,aAAO,UAAU,OAAO,CAAC,WAAW,QAAQ,IAAI,MAAM,CAAC;AAAA,IACzD,CAAC;AAAA,EACL;AAEA,SAAO,EAAE,KAAK,KAAK,KAAK,aAAa,eAAe;AACtD,CAAC;AAcI,MAAM,QAAQ,CACnB,YAEA,MAAM,OAAO,cAAc,aAAa,EAAE,KAAK,OAAO,CAAC;",
+  "sourcesContent": ["/**\n * The shared artifact tier: an {@link ArtifactStore.Service} spoken over HTTP.\n *\n * The wire protocol mirrors Bazel's dumb-HTTP remote cache, class\n * `HttpCacheClient` in `com.google.devtools.build.lib.remote.http`, which\n * documents it as: \"CAS (Content Addressable Storage) blobs are stored under\n * the path `/cas/base16-key`\", uploaded with `PUT`, downloaded with `GET`. We add\n * `HEAD /cas/{digest}` for a single existence probe and\n * `POST /cas/findMissing` for the batched one, because Bazel's HTTP client has\n * no `findMissingDigests` at all \u2014 it answers \"everything is missing\" and\n * re-uploads \u2014 and a batched probe is the whole reason\n * `MissingDigestsFinder` exists in the gRPC client.\n *\n * Transport is Effect's own `HttpClient` tag. There is no lower transport in\n * this repository, and there does not need to be one: the kernel already\n * decorates that tag with `net:get`/`net:post` capability checks, so a remote\n * artifact fetch is permission-checked like every other egress.\n *\n * ## Chunked uploads\n *\n * With `chunkBytes` set, a blob past that size travels as a sequence of\n * `PUT /cas/{digest}` requests carrying `Content-Range: bytes {a}-{b}/{total}`,\n * preceded by a `HEAD /cas/{digest}` existence probe and a\n * `Content-Range: bytes *\\/{total}` probe with an empty body. This is the\n * resumable-upload shape HTTP already has: the range probe asks what prefix\n * the tier holds and `308` means \"keep going\", with a `Range: bytes=0-{last}`\n * header on the probe or on a chunk answer moving the offset.\n *\n * Only a `308` continues the sequence, and the completing chunk's `2xx` is\n * confirmed with `HEAD` before `put` reports the digest as published. A `2xx`\n * anywhere else, to the empty probe or to a chunk the tier is still owed bytes\n * after, reads as a tier that ignored `Content-Range` and stored the body it\n * was handed, which is what plain WebDAV `PUT` does. That tier, the one that\n * answers `400`, `411`, or `416`, and the one whose `HEAD` will not confirm\n * the stored length all get the same treatment: one whole-blob `PUT`, which\n * overwrites the partial body the sequence left behind. So the blob always\n * lands whole, and the cost of turning the dial on against a server that\n * never learned about it is round trips, never a digest published over bytes\n * the server does not hold.\n *\n * This repository's own hosted and self-hosted cache services are such\n * servers: neither implements the resumable sequence, and both refuse a\n * ranged `PUT` with `400`, RFC 9110 section 14.5's answer from a resource\n * that does not support partial `PUT`. Against them `chunkBytes` costs the\n * probe round trip and the blob travels whole, and both cap one request body\n * at 16 MiB, so a blob past that cap is refused with `413` in either mode.\n *\n * The endpoint and its credentials arrive as **layer construction options**.\n * They are capabilities, never step inputs: they are not hashed into a step\n * key, journaled, or returned in a recorded result. Invalid endpoint errors are\n * sanitized before they cross the boundary.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as FetchHttpClient from \"effect/http/FetchHttpClient\"\nimport * as Headers from \"effect/http/Headers\"\nimport * as HttpClient from \"effect/http/HttpClient\"\nimport * as HttpClientRequest from \"effect/http/HttpClientRequest\"\nimport type * as HttpClientResponse from \"effect/http/HttpClientResponse\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport * as Stream from \"effect/Stream\"\nimport * as ArtifactStore from \"./ArtifactStore.ts\"\n\n/**\n * How eagerly a composition materializes shared blobs into its local store.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const DownloadPolicy = Schema.Literals([\"all\", \"toplevel\", \"minimal\"] as const)\n\n/**\n * How eagerly a composition materializes remote blobs.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type DownloadPolicy = typeof DownloadPolicy.Type\n\n/**\n * Every download policy, in materialization order.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const downloadPolicies: ReadonlyArray<DownloadPolicy> = Object.freeze([\"all\", \"toplevel\", \"minimal\"])\n\n/**\n * A remote artifact tier, which is an ordinary store that also states how\n * eagerly a composition reading through it should materialize blobs locally.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Service extends ArtifactStore.Service {\n  readonly downloadPolicy: DownloadPolicy\n}\n\n/**\n * Reads the download policy a store declares, or `undefined` for a store that\n * declares none \u2014 every local store, and any foreign implementation.\n *\n * @category getters\n * @since 1.0.0-rc.0\n */\nexport const downloadPolicyOf = (store: ArtifactStore.Service): DownloadPolicy | undefined => {\n  const declared = (store as { readonly downloadPolicy?: unknown }).downloadPolicy\n  return Schema.is(DownloadPolicy)(declared) ? declared : undefined\n}\n\n/**\n * How to reach the shared artifact tier.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport interface Options {\n  /**\n   * The cache root, e.g. `https://cache.example.com`. `/cas/{digest}` and\n   * `/cas/findMissing` are resolved beneath it. A trailing slash is ignored.\n   *\n   * Four shapes are refused at construction as `invalid_configuration`, before\n   * any request leaves and therefore before `headers` can reach a wire: a value\n   * that is not a string, one no `URL` parser accepts, a scheme other than\n   * `https:` (plain `http:` is accepted only for the literal loopback hosts\n   * `localhost`, `127.0.0.1`, and `[::1]`), and an endpoint carrying\n   * userinfo, a query, or a fragment. The\n   * last rule keeps a credential out of a place nothing here would redact: an\n   * endpoint is interpolated into every request path and into span attributes.\n   *\n   * The refusal message names only the violated rule and never echoes the\n   * endpoint, so a rejected `https://user:secret@host` cannot leak its\n   * credential into a log line or a durable error.\n   */\n  readonly endpoint: string\n  /**\n   * Headers sent with every request \u2014 an `Authorization` bearer token, a\n   * tenant header, whatever the deployment's gateway wants. This is the\n   * credential seam, and it is deliberately construction-time: a credential\n   * that arrived as a step input would be hashed into a step key and persisted\n   * everywhere the journal goes.\n   *\n   * The protocol wins every collision. These headers are applied to a request\n   * first. Configured `content-type`, `content-length`, and `content-range`\n   * are removed, then computed only where the protocol needs them. Whole-blob\n   * uploads, including fallbacks, never carry `content-range`.\n   * All configured header names are redacted in HTTP spans, in addition to\n   * the host's existing redaction rules.\n   *\n   * A name that is not an HTTP token, or a value longer than 16 KiB or\n   * carrying a control character (CR and LF included), is refused at\n   * construction as `invalid_configuration`.\n   */\n  readonly headers?: Record<string, string> | undefined\n  /**\n   * The deadline on a single download, from the request leaving to the last\n   * body byte arriving. A shared tier that stops answering must fail the read\n   * rather than park it forever. `CombinedArtifacts.get` propagates a remote\n   * `ArtifactStoreError`, including a download timeout. Only opportunistic\n   * uploads from `CombinedArtifacts.put` ignore remote failures;\n   * `ArtifactSync.hydrate` separately turns a failure into replay rejection.\n   * Defaults to 60 seconds, Bazel's `--remote_timeout`\n   * default for the same REST protocol (its `RemoteOptions`: \"For the REST\n   * cache, this is both the connect and the read timeout\").\n   */\n  readonly downloadTimeout?: Duration.Input | undefined\n  /**\n   * Deadline for an upload, including every resume probe and chunk. Defaults\n   * to 60 seconds.\n   */\n  readonly uploadTimeout?: Duration.Input | undefined\n  /**\n   * Deadline for an existence probe or one `findMissing` batch, including its\n   * response body. Defaults to 60 seconds.\n   */\n  readonly requestTimeout?: Duration.Input | undefined\n  /**\n   * The largest download this client will buffer, in bytes. The body is read\n   * incrementally and abandoned the moment it exceeds the bound \u2014 and refused\n   * outright when `Content-Length` already declares the excess \u2014 so a\n   * mis-serving or hostile cache cannot make this process buffer and hash an\n   * arbitrarily large body before the digest check refuses it. Defaults to\n   * 256 MiB.\n   */\n  readonly maxDownloadBytes?: number | undefined\n  /**\n   * Largest `findMissing` response body accepted. Defaults to the protocol's\n   * 256 KiB request/response bound and may only lower that bound.\n   */\n  readonly maxFindMissingResponseBytes?: number | undefined\n  /**\n   * Above this many bytes an upload travels as a sequence of `Content-Range`\n   * `PUT`s instead of one whole-blob body, and a transfer that died partway\n   * resumes from the prefix the tier kept rather than starting over. See\n   * {@link module:RemoteArtifacts | the chunked upload protocol} below.\n   *\n   * Absent by default: every upload is one whole-blob `PUT`, which is what\n   * Bazel's dumb-HTTP client does and what every deployment already serving\n   * this protocol expects. Set it when a proxy caps request bodies, or when\n   * artifacts are large enough that losing a transfer is expensive.\n   *\n   * The repository's own hosted and self-hosted cache services answer the\n   * ranged probe with `400`, so against them this dial degrades to one\n   * whole-blob `PUT`, and their 16 MiB body cap refuses a larger blob with\n   * `413` in either mode.\n   */\n  readonly chunkBytes?: number | undefined\n  /**\n   * How eagerly a composition reading through this tier materializes blobs\n   * into its local store. This is Bazel's `--remote_download_{all,toplevel,\n   * minimal}` dial (`RemoteOutputChecker`), and it lives here because the\n   * shared tier is the thing being conserved.\n   *\n   * - `all` (the default) prefetches every referenced blob when a replay is\n   *   admitted, so the replay reads local bytes.\n   * - `toplevel` prefetches nothing and materializes a blob into the local\n   *   store on the first read that actually needs it.\n   * - `minimal` prefetches nothing and materializes nothing: a read is served\n   *   straight from the shared tier and the local store never grows.\n   *\n   * `CombinedArtifacts.get` honors the last two; `@smthrs/engine-store`'s\n   * `ArtifactSync.hydrate` honors the first.\n   */\n  readonly downloadPolicy?: DownloadPolicy | undefined\n}\n\n/**\n * The default download deadline. 60 seconds is Bazel's `--remote_timeout`\n * default, governing the same dumb-HTTP cache protocol.\n */\nconst defaultDownloadTimeout = Duration.seconds(60)\nconst defaultUploadTimeout = Duration.seconds(60)\nconst defaultRequestTimeout = Duration.seconds(60)\n\n/**\n * The default bound on a downloaded blob: 256 MiB. Artifacts are spilled step\n * values, not media libraries; a body past this size is far more likely a\n * mis-serving cache than a legitimate blob, and the dial is per-store for a\n * deployment that knows better.\n */\nconst defaultMaxDownloadBytes = 256 * 1024 * 1024\nconst maxFindMissingBatchDigests = 1_000\nconst maxFindMissingBodyBytes = 256 * 1024\nconst encoder = new TextEncoder()\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true })\n\n/**\n * The credential-free part of a transport failure: the HTTP client's reason\n * tag and the first operating-system error code (`ECONNREFUSED`, `ENOTFOUND`,\n * `CERT_HAS_EXPIRED`) in its cause chain. Never the request, the URL, the\n * headers, or free-form text, any of which may carry a credential.\n */\nconst transportReason = (cause: unknown): string | undefined => {\n  const reason = (cause as { readonly reason?: { readonly _tag?: unknown } } | null)?.reason\n  const tag = typeof reason?._tag === \"string\" ? reason._tag : undefined\n  let code: string | undefined\n  let current: unknown = reason ?? cause\n  for (let depth = 0; depth < 8 && typeof current === \"object\" && current !== null; depth++) {\n    const candidate = (current as { readonly code?: unknown }).code\n    if (typeof candidate === \"string\" && /^[A-Z][A-Z0-9_]{1,63}$/.test(candidate)) {\n      code = candidate\n      break\n    }\n    current = (current as { readonly cause?: unknown }).cause\n  }\n  const parts = [tag, code].filter((part): part is string => part !== undefined)\n  return parts.length === 0 ? undefined : parts.join(\" \")\n}\n\nconst transportFailure = (operation: string, cause?: unknown): ArtifactStore.ArtifactStoreError => {\n  const reason = transportReason(cause)\n  return new ArtifactStore.ArtifactStoreError({\n    code: \"transport_failed\",\n    message: `the remote artifact tier refused ${operation}${reason === undefined ? \"\" : ` (${reason})`}`\n  })\n}\n\nconst unexpectedStatus = (operation: string, status: number): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({\n    code: \"transport_failed\",\n    message: `the remote artifact tier answered ${operation} with HTTP ${status}`\n  })\n\nconst invalidOption = (name: string): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({\n    code: \"invalid_configuration\",\n    message: `invalid remote artifact option: ${name}`\n  })\n\n/** The batched-probe response body. */\nconst FindMissingResponse = Schema.Struct({ missing: Schema.Array(Schema.String) })\n\n/** An RFC 9110 field-name token. */\nconst headerName = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/\n\n/** Whether a header value carries a C0 control character or DEL, CR and LF included. */\nconst hasControlText = (value: string): boolean => {\n  for (let index = 0; index < value.length; index++) {\n    const unit = value.charCodeAt(index)\n    if (unit <= 0x1f || unit === 0x7f) return true\n  }\n  return false\n}\n\nconst configurationFailure = (message: string): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({ code: \"invalid_configuration\", message })\n\n/**\n * A 2xx is success, a 404 is a miss, and everything else is a transport\n * failure. Bazel's HTTP client takes the same three-way split; it is the only\n * classification a dumb-HTTP cache can support, because there is no richer\n * error envelope on the wire.\n */\nconst isOk = (response: HttpClientResponse.HttpClientResponse): boolean =>\n  response.status >= 200 && response.status < 300\n\n/**\n * Builds a remote artifact store over Effect's `HttpClient`.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const make = (\n  options: Options\n): Effect.Effect<Service, ArtifactStore.ArtifactStoreError, HttpClient.HttpClient> =>\n  Effect.gen(function*() {\n    const configured = yield* Effect.try({\n      try: () => {\n        const headers = options.headers === undefined\n          ? undefined\n          : Object.freeze(Object.fromEntries(\n            Object.entries(options.headers).map(([name, value]) => {\n              // Refused here, once, rather than on every request as an opaque\n              // transport failure: a CRLF in a value or a space in a name can\n              // never become a valid header.\n              if (typeof value !== \"string\" || value.length > 16 * 1024 || hasControlText(value)) {\n                throw new TypeError(\"header value\")\n              }\n              if (!headerName.test(name)) throw new TypeError(\"header name\")\n              return [name, value]\n            })\n          ))\n        return {\n          endpoint: options.endpoint,\n          headers,\n          downloadTimeout: options.downloadTimeout,\n          uploadTimeout: options.uploadTimeout,\n          requestTimeout: options.requestTimeout,\n          maxDownloadBytes: options.maxDownloadBytes,\n          maxFindMissingResponseBytes: options.maxFindMissingResponseBytes,\n          chunkBytes: options.chunkBytes,\n          downloadPolicy: options.downloadPolicy\n        }\n      },\n      catch: () => invalidOption(\"options\")\n    })\n    if (typeof configured.endpoint !== \"string\") return yield* Effect.fail(invalidOption(\"endpoint\"))\n    const endpoint = yield* Effect.try({\n      try: () => new URL(configured.endpoint),\n      catch: () => configurationFailure(\"invalid remote artifact endpoint\")\n    })\n    // A self-hosted cache on this machine is reachable over plain HTTP, and\n    // loopback traffic never leaves the host. Only literal loopback names are\n    // exempt: a `*.localhost` name reaches loopback only on a resolver that\n    // follows RFC 6761, and one that forwards it to DNS would carry the\n    // credential headers over plaintext to whatever host answers.\n    const loopback = endpoint.hostname === \"localhost\" || endpoint.hostname === \"127.0.0.1\" ||\n      endpoint.hostname === \"[::1]\"\n    if (endpoint.protocol !== \"https:\" && !(endpoint.protocol === \"http:\" && loopback)) {\n      return yield* Effect.fail(configurationFailure(\"remote artifact endpoint must use HTTPS\"))\n    }\n    // An empty query or fragment (\"https://h/p?\") parses as \"\" yet survives\n    // serialization, so the delimiter itself is refused in the href.\n    if (\n      endpoint.username !== \"\" || endpoint.password !== \"\" || endpoint.search !== \"\" || endpoint.hash !== \"\" ||\n      endpoint.href.includes(\"?\") || endpoint.href.includes(\"#\")\n    ) {\n      return yield* Effect.fail(\n        configurationFailure(\"remote artifact endpoint must not contain credentials, a query, or a fragment\")\n      )\n    }\n    endpoint.pathname = endpoint.pathname.replace(/\\/+$/, \"\")\n    const base = endpoint.toString().replace(/\\/+$/, \"\")\n    const headers = configured.headers\n    const client = yield* HttpClient.HttpClient\n    const credentialNames = Object.keys(headers ?? {}).map((name) => name.toLowerCase())\n    /**\n     * Protocol-owned headers are computed from each request's body and range,\n     * never inherited from credentials, including on a whole-blob fallback.\n     */\n    const authorized = (request: HttpClientRequest.HttpClientRequest): HttpClientRequest.HttpClientRequest =>\n      (headers === undefined ? request : HttpClientRequest.setHeaders(request, headers)).pipe(\n        HttpClientRequest.removeHeader(\"content-type\"),\n        HttpClientRequest.removeHeader(\"content-length\"),\n        HttpClientRequest.removeHeader(\"content-range\")\n      )\n    // The address is a URL path segment, so it is refused before it is\n    // interpolated and percent-encoded when it is: an address carrying a\n    // separator or a `..` would otherwise point this client at a different\n    // resource on the configured endpoint. `ArtifactStore.validateDigest` is\n    // the same guard the filesystem tier applies to the same untrusted input \u2014\n    // a digest read back out of a durable row.\n    const casUrl = (digest: ArtifactStore.Digest) => `${base}/cas/${digest}`\n    const scopedClient = HttpClient.withScope(client)\n    /**\n     * Keep body processing inside the exchange; abort unused responses on every exit.\n     *\n     * Redirects are never followed. A fetch-based client follows them by\n     * default and strips only `Authorization` on a cross-origin hop, so a\n     * tier answering `3xx` would otherwise receive the credential headers at\n     * another origin or over plain HTTP. Manual mode hands the `3xx` back,\n     * where it is an unexpected status (or, for `308`, the resumable-upload\n     * answer this protocol already speaks).\n     */\n    const send = <A, E, R>(\n      operation: string,\n      request: HttpClientRequest.HttpClientRequest,\n      use: (response: HttpClientResponse.HttpClientResponse) => Effect.Effect<A, E, R>\n    ): Effect.Effect<A, E | ArtifactStore.ArtifactStoreError, R> =>\n      Effect.gen(function*() {\n        const redactedNames = yield* Headers.CurrentRedactedNames\n        const requestInit = yield* Effect.serviceOption(FetchHttpClient.RequestInit)\n        return yield* scopedClient.execute(request).pipe(\n          Effect.provideService(FetchHttpClient.RequestInit, {\n            ...Option.getOrUndefined(requestInit),\n            redirect: \"manual\"\n          }),\n          Effect.mapError((cause) => transportFailure(operation, cause)),\n          Effect.flatMap(use),\n          Effect.provideService(Headers.CurrentRedactedNames, [...redactedNames, ...credentialNames]),\n          Effect.scoped\n        )\n      })\n    const parseDeadline = (name: string, input: Duration.Input | undefined, fallback: Duration.Duration) =>\n      Effect.gen(function*() {\n        const parsed = Duration.fromInput(input ?? fallback)\n        if (\n          Option.isNone(parsed) ||\n          !Number.isFinite(Duration.toMillis(parsed.value)) ||\n          Duration.toMillis(parsed.value) <= 0\n        ) {\n          return yield* Effect.fail(invalidOption(name))\n        }\n        return parsed.value\n      })\n    const downloadDeadline = yield* parseDeadline(\n      \"downloadTimeout\",\n      configured.downloadTimeout,\n      defaultDownloadTimeout\n    )\n    const uploadDeadline = yield* parseDeadline(\"uploadTimeout\", configured.uploadTimeout, defaultUploadTimeout)\n    const requestDeadline = yield* parseDeadline(\"requestTimeout\", configured.requestTimeout, defaultRequestTimeout)\n    const maxDownloadBytes = configured.maxDownloadBytes ?? defaultMaxDownloadBytes\n    if (!Number.isSafeInteger(maxDownloadBytes) || maxDownloadBytes <= 0) {\n      return yield* Effect.fail(invalidOption(\"maxDownloadBytes\"))\n    }\n    const maxFindMissingResponseBytes = configured.maxFindMissingResponseBytes ?? maxFindMissingBodyBytes\n    if (\n      !Number.isSafeInteger(maxFindMissingResponseBytes) ||\n      maxFindMissingResponseBytes <= 0 ||\n      maxFindMissingResponseBytes > maxFindMissingBodyBytes\n    ) {\n      return yield* Effect.fail(invalidOption(\"maxFindMissingResponseBytes\"))\n    }\n    const chunkBytes = configured.chunkBytes\n    if (chunkBytes !== undefined && (!Number.isSafeInteger(chunkBytes) || chunkBytes <= 0)) {\n      return yield* Effect.fail(invalidOption(\"chunkBytes\"))\n    }\n    const downloadPolicy = configured.downloadPolicy ?? \"all\"\n    if (!Schema.is(DownloadPolicy)(downloadPolicy)) {\n      return yield* Effect.fail(invalidOption(\"downloadPolicy\"))\n    }\n    const bodyTooLarge = (operation: string, received: number, bound: number): ArtifactStore.ArtifactStoreError =>\n      new ArtifactStore.ArtifactStoreError({\n        code: \"transport_failed\",\n        message: `the remote artifact tier answered ${operation} with ${received} bytes, past the ${bound}-byte bound`\n      })\n    const timedOut = (operation: string): ArtifactStore.ArtifactStoreError =>\n      new ArtifactStore.ArtifactStoreError({\n        code: \"transport_failed\",\n        message: `the remote artifact tier did not finish ${operation} within its configured deadline`\n      })\n    const within = <A, E, R>(\n      operation: string,\n      deadline: Duration.Duration,\n      effect: Effect.Effect<A, E, R>\n    ): Effect.Effect<A, E | ArtifactStore.ArtifactStoreError, R> =>\n      effect.pipe(\n        Effect.timeout(deadline),\n        Effect.catchTag(\"TimeoutError\", () => Effect.fail(timedOut(operation)))\n      )\n    /**\n     * Reads a download body incrementally, refusing it the moment it exceeds\n     * the size bound; a `Content-Length` that already declares the excess is\n     * refused before a single body byte is read. Streaming instead of\n     * buffering the whole body means the guard fires at most one chunk past\n     * the bound, never after an arbitrarily large response is in memory.\n     */\n    const readBounded = (\n      response: HttpClientResponse.HttpClientResponse,\n      operation: string,\n      bound: number\n    ) =>\n      Effect.gen(function*() {\n        const declared = response.headers[\"content-length\"]\n        if (declared !== undefined) {\n          const declaredBytes = Number(declared)\n          if (!/^\\d+$/.test(declared) || !Number.isSafeInteger(declaredBytes)) {\n            return yield* Effect.fail(transportFailure(`${operation} body`))\n          }\n          if (declaredBytes > bound) return yield* Effect.fail(bodyTooLarge(operation, declaredBytes, bound))\n        }\n        const chunks: Array<Uint8Array> = []\n        let received = 0\n        yield* Stream.runForEach(response.stream, (chunk: Uint8Array) =>\n          Effect.suspend(() => {\n            received += chunk.byteLength\n            if (received > bound) return Effect.fail(bodyTooLarge(operation, received, bound))\n            chunks.push(new Uint8Array(chunk))\n            return Effect.void\n          })).pipe(\n            Effect.catchTag(\"HttpClientError\", (cause) =>\n              // An absent body is zero bytes, not a transport refusal: the\n              // digest check in `get` is the arbiter of whether empty content\n              // is the requested artifact.\n              cause.reason._tag === \"EmptyBodyError\"\n                ? Effect.void\n                : Effect.fail(transportFailure(`${operation} body`)))\n          )\n        const bytes = new Uint8Array(received)\n        let offset = 0\n        for (const chunk of chunks) {\n          bytes.set(chunk, offset)\n          offset += chunk.byteLength\n        }\n        return bytes\n      })\n    /** The network half of `get`: request, status split, bounded body read. */\n    const download = (digest: ArtifactStore.Digest) =>\n      send(\"a download\", authorized(HttpClientRequest.get(casUrl(digest))), (response) =>\n        Effect.gen(function*() {\n          if (response.status === 404) {\n            return yield* Effect.fail(new ArtifactStore.ArtifactMissing({ code: \"artifact_missing\", digest }))\n          }\n          if (!isOk(response)) return yield* Effect.fail(unexpectedStatus(\"a download\", response.status))\n          return yield* readBounded(response, \"a download\", maxDownloadBytes)\n        }))\n\n    /** One whole-blob `PUT`: the protocol every dumb-HTTP CAS already speaks. */\n    const uploadWhole = (digest: ArtifactStore.Digest, bytes: Uint8Array) =>\n      send(\n        \"an upload\",\n        authorized(HttpClientRequest.put(casUrl(digest))).pipe(\n          HttpClientRequest.bodyUint8Array(bytes, \"application/octet-stream\")\n        ),\n        (response) => isOk(response) ? Effect.void : Effect.fail(unexpectedStatus(\"an upload\", response.status))\n      )\n\n    /**\n     * The byte after the prefix a `Range: bytes=0-{last}` header reports, or\n     * `undefined` when the answer names no prefix. Only a prefix starting at\n     * zero is usable: a tier holding a middle span has nothing this client can\n     * continue from, so it is treated as holding nothing.\n     */\n    const resumeOffset = (response: HttpClientResponse.HttpClientResponse): number | undefined => {\n      const header = response.headers[\"range\"]\n      if (header === undefined) return undefined\n      const match = /^bytes=0-(\\d+)$/.exec(header.trim())\n      if (match === null) return undefined\n      const last = Number(match[1])\n      // A prefix past the safe integer range does not survive `Number`: the\n      // decimal digits are rounded, so the offset it names is a number this\n      // client made up. It proves nothing about what the tier holds, which is\n      // the same as naming no prefix at all.\n      if (!Number.isSafeInteger(last)) return undefined\n      return last + 1\n    }\n\n    /**\n     * A tier that refuses ranged bodies, in the three ways HTTP has to say\n     * so. `411` and `416` refuse the body's framing; `400` is RFC 9110\n     * section 14.5's answer from a resource that \"does not support partial\n     * PUT requests\", and it is what both of this repository's cache services\n     * send. Falling back on it can mask no genuine `400`: the whole-blob\n     * `PUT` that follows presents the same URL, digest, and credential, so a\n     * real refusal comes straight back on that request.\n     */\n    const rejectsRanges = (status: number): boolean => status === 400 || status === 411 || status === 416\n\n    /**\n     * Whether the tier holds exactly `total` bytes under `digest`, read from\n     * the `Content-Length` of a `HEAD` answer.\n     *\n     * This is the only claim about a chunked transfer this client will make on\n     * its own behalf. A tier that answers `HEAD` without a length is not\n     * refused \u2014 it simply proves nothing, so the caller sends the blob whole.\n     */\n    const holdsWhole = (digest: ArtifactStore.Digest, total: number) =>\n      send(\"an existence probe\", authorized(HttpClientRequest.head(casUrl(digest))), (response) =>\n        Effect.sync(() => {\n          if (!isOk(response)) return false\n          const declared = response.headers[\"content-length\"]\n          return declared !== undefined && Number(declared) === total\n        }))\n\n    /**\n     * Sends `bytes` as `Content-Range` chunks, resuming from whatever prefix\n     * the tier reports. Answers `false` when the tier has not proved it stored\n     * the whole blob, which is the caller's signal to send it whole.\n     *\n     * A `2xx` answer is never by itself proof of that. A tier that ignores\n     * `Content-Range`, such as plain WebDAV `PUT`, which Bazel documents as a\n     * supported dumb-HTTP cache, answers every request in this sequence `201`\n     * while storing only the last body it was handed, which for the probe is\n     * zero bytes. So only a `308` continues the sequence, and the completing\n     * chunk's `2xx` is confirmed with `HEAD` before the caller is told the\n     * digest is published. Everything else falls back, and the whole-blob\n     * `PUT` overwrites whatever partial body the sequence left behind.\n     */\n    const uploadChunked = (digest: ArtifactStore.Digest, bytes: Uint8Array, chunk: number) =>\n      Effect.gen(function*() {\n        const total = bytes.byteLength\n        const ranged = (range: string, body: Uint8Array) =>\n          send(\n            \"an upload\",\n            authorized(HttpClientRequest.put(casUrl(digest))).pipe(\n              HttpClientRequest.bodyUint8Array(body, \"application/octet-stream\"),\n              HttpClientRequest.setHeader(\"content-range\", range)\n            ),\n            // Only status and headers are used after the response is released.\n            Effect.succeed\n          )\n        // A blob the tier already holds whole costs one `HEAD` and no body.\n        // Asking first is also what makes the probe's answer readable: a `2xx`\n        // to it can no longer mean \"already there\", so the one reading left is\n        // a tier that ignored the header and stored the empty body.\n        if (yield* holdsWhole(digest, total)) return true\n        // The probe carries no bytes: it exists to learn where to start, so\n        // that an interrupted transfer costs one round trip rather than the\n        // whole blob again.\n        const probe = yield* ranged(`bytes */${total}`, new Uint8Array(0))\n        if (isOk(probe) || rejectsRanges(probe.status)) return false\n        if (probe.status !== 308 && probe.status !== 404) {\n          return yield* Effect.fail(unexpectedStatus(\"an upload probe\", probe.status))\n        }\n        let offset = probe.status === 308 ? resumeOffset(probe) ?? 0 : 0\n        while (offset < total) {\n          const end = Math.min(offset + chunk, total)\n          const answer = yield* ranged(`bytes ${offset}-${end - 1}/${total}`, bytes.subarray(offset, end))\n          if (answer.status !== 308) {\n            // The completing chunk may answer `2xx`; anything before it may\n            // not, because a tier that is still owed bytes and reports success\n            // is a tier that is not reading the header. Both are checked\n            // against what the tier actually holds below.\n            if (end === total && isOk(answer)) break\n            if (isOk(answer) || rejectsRanges(answer.status)) return false\n            return yield* Effect.fail(unexpectedStatus(\"an upload\", answer.status))\n          }\n          // A tier that reports a longer prefix than this chunk delivered has\n          // more than we just sent, so the next chunk starts there. Never\n          // backwards: an answer naming a shorter prefix would loop forever.\n          offset = Math.max(end, resumeOffset(answer) ?? 0)\n        }\n        return yield* holdsWhole(digest, total)\n      })\n\n    const put: ArtifactStore.Service[\"put\"] = Effect.fn(\"RemoteArtifacts.put\")((bytes: Uint8Array) =>\n      Effect.flatMap(ArtifactStore.snapshotBytes(bytes), (snapshot) =>\n        Effect.gen(function*() {\n          const digest = yield* ArtifactStore.measureBytes(snapshot)\n          yield* Effect.annotateCurrentSpan({ digest })\n          yield* within(\n            \"an upload\",\n            uploadDeadline,\n            Effect.gen(function*() {\n              if (chunkBytes === undefined || snapshot.byteLength <= chunkBytes) {\n                yield* uploadWhole(digest, snapshot)\n                return\n              }\n              const transferred = yield* uploadChunked(digest, snapshot, chunkBytes)\n              if (!transferred) yield* uploadWhole(digest, snapshot)\n            })\n          )\n          return digest\n        }))\n    )\n\n    const get: ArtifactStore.Service[\"get\"] = Effect.fn(\"RemoteArtifacts.get\")((digest: string) =>\n      Effect.gen(function*() {\n        const validated = yield* ArtifactStore.validateDigest(digest)\n        yield* Effect.annotateCurrentSpan({ digest: validated })\n        // The deadline covers the whole exchange \u2014 request, headers, body \u2014\n        // because a tier that stalls mid-body is exactly as unanswering as\n        // one that never accepts the connection.\n        const bytes = yield* within(\"a download\", downloadDeadline, download(validated))\n        // The shared tier is the least trusted store there is: it is written\n        // by machines this one has never met. Verifying the address here means\n        // a mis-serving or compromised cache can waste a round trip but can\n        // never substitute content.\n        const measured = yield* ArtifactStore.measureBytes(bytes)\n        if (measured !== validated) {\n          return yield* Effect.fail(\n            new ArtifactStore.ArtifactCorruption({\n              code: \"artifact_corruption\",\n              recordedDigest: validated,\n              measuredDigest: measured\n            })\n          )\n        }\n        return bytes\n      })\n    )\n\n    const has: ArtifactStore.Service[\"has\"] = Effect.fn(\"RemoteArtifacts.has\")((digest: string) =>\n      Effect.gen(function*() {\n        const validated = yield* ArtifactStore.validateDigest(digest)\n        yield* Effect.annotateCurrentSpan({ digest: validated })\n        const response = yield* within(\n          \"an existence probe\",\n          requestDeadline,\n          send(\"an existence probe\", authorized(HttpClientRequest.head(casUrl(validated))), Effect.succeed)\n        )\n        if (response.status === 404) return false\n        if (!isOk(response)) return yield* Effect.fail(unexpectedStatus(\"an existence probe\", response.status))\n        return true\n      })\n    )\n\n    const findMissing: ArtifactStore.Service[\"findMissing\"] = Effect.fn(\"RemoteArtifacts.findMissing\")(\n      (digests: Iterable<string>) =>\n        Effect.gen(function*() {\n          const requested = [...new Set(digests)]\n          if (requested.length === 0) return []\n          // The batch travels in a JSON body rather than a path, but an\n          // unusable address is still an unusable address, and the local tier\n          // refuses the same batch wholesale rather than probing part of it.\n          const validated: Array<ArtifactStore.Digest> = []\n          for (const digest of requested) validated.push(yield* ArtifactStore.validateDigest(digest))\n          yield* Effect.annotateCurrentSpan({ count: validated.length })\n          const missing = new Set<string>()\n          for (let offset = 0; offset < validated.length; offset += maxFindMissingBatchDigests) {\n            const batch = validated.slice(offset, offset + maxFindMissingBatchDigests)\n            const requestBody = encoder.encode(JSON.stringify({ digests: batch }))\n            /* v8 ignore next 3 -- strict 64-byte digests plus the 1,000-entry batch cap make this\n             * at most 67,013 bytes; keep the protocol assertion beside serialization in case either invariant changes. */\n            if (requestBody.byteLength > maxFindMissingBodyBytes) {\n              return yield* Effect.fail(configurationFailure(\"remote artifact findMissing request exceeds 256 KiB\"))\n            }\n            const decoded = yield* within(\n              \"a batched existence probe\",\n              requestDeadline,\n              send(\n                \"a batched existence probe\",\n                authorized(HttpClientRequest.post(`${base}/cas/findMissing`)).pipe(\n                  HttpClientRequest.bodyUint8Array(requestBody, \"application/json\")\n                ),\n                (response) =>\n                  Effect.gen(function*() {\n                    if (!isOk(response)) {\n                      return yield* Effect.fail(unexpectedStatus(\"a batched existence probe\", response.status))\n                    }\n                    const bodyBytes = yield* readBounded(\n                      response,\n                      \"a batched existence probe\",\n                      maxFindMissingResponseBytes\n                    )\n                    const body = yield* Effect.try({\n                      try: () => JSON.parse(decoder.decode(bodyBytes)) as unknown,\n                      catch: () => transportFailure(\"a batched existence probe body\")\n                    })\n                    return yield* Schema.decodeUnknownEffect(FindMissingResponse)(body).pipe(\n                      Effect.mapError(() => transportFailure(\"a batched existence probe body\"))\n                    )\n                  })\n              )\n            )\n            const asked = new Set<string>(batch)\n            for (const digest of decoded.missing) if (asked.has(digest)) missing.add(digest)\n          }\n          // \"The returned set is guaranteed to be a subset of `digests`\"\n          // (`MissingDigestsFinder`). Bazel gets that from the server; we\n          // enforce it on this side too, because a server that answered with\n          // an unrequested digest would otherwise make the caller upload bytes\n          // it never asked about.\n          return validated.filter((digest) => missing.has(digest))\n        })\n    )\n\n    return { put, get, has, findMissing, downloadPolicy }\n  })\n\n/**\n * Provides a remote artifact store as the `ArtifactStore` tag.\n *\n * Composing this *alone* makes every artifact read and write a network round\n * trip. The intended production shape is\n * {@link CombinedArtifacts.layer | CombinedArtifacts}, with this as its remote\n * tier.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layer = (\n  options: Options\n): Layer.Layer<ArtifactStore.ArtifactStore, ArtifactStore.ArtifactStoreError, HttpClient.HttpClient> =>\n  Layer.effect(ArtifactStore.ArtifactStore)(make(options))\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuDA,eAA0B;AAC1B,aAAwB;AACxB,sBAAiC;AACjC,cAAyB;AACzB,iBAA4B;AAC5B,wBAAmC;AAEnC,YAAuB;AACvB,aAAwB;AACxB,aAAwB;AACxB,aAAwB;AACxB,oBAA+B;AAQxB,MAAM,iBAAiB,OAAO,SAAS,CAAC,OAAO,YAAY,SAAS,CAAU;AAgB9E,MAAM,mBAAkD,OAAO,OAAO,CAAC,OAAO,YAAY,SAAS,CAAC;AAoBpG,MAAM,mBAAmB,CAAC,UAA6D;AAC5F,QAAM,WAAY,MAAgD;AAClE,SAAO,OAAO,GAAG,cAAc,EAAE,QAAQ,IAAI,WAAW;AAC1D;AA2HA,MAAM,yBAAyB,SAAS,QAAQ,EAAE;AAClD,MAAM,uBAAuB,SAAS,QAAQ,EAAE;AAChD,MAAM,wBAAwB,SAAS,QAAQ,EAAE;AAQjD,MAAM,0BAA0B,MAAM,OAAO;AAC7C,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AACtC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAQxD,MAAM,kBAAkB,CAAC,UAAuC;AAC9D,QAAM,SAAU,OAAoE;AACpF,QAAM,MAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AAC7D,MAAI;AACJ,MAAI,UAAmB,UAAU;AACjC,WAAS,QAAQ,GAAG,QAAQ,KAAK,OAAO,YAAY,YAAY,YAAY,MAAM,SAAS;AACzF,UAAM,YAAa,QAAwC;AAC3D,QAAI,OAAO,cAAc,YAAY,yBAAyB,KAAK,SAAS,GAAG;AAC7E,aAAO;AACP;AAAA,IACF;AACA,cAAW,QAAyC;AAAA,EACtD;AACA,QAAM,QAAQ,CAAC,KAAK,IAAI,EAAE,OAAO,CAAC,SAAyB,SAAS,MAAS;AAC7E,SAAO,MAAM,WAAW,IAAI,SAAY,MAAM,KAAK,GAAG;AACxD;AAEA,MAAM,mBAAmB,CAAC,WAAmB,UAAsD;AACjG,QAAM,SAAS,gBAAgB,KAAK;AACpC,SAAO,IAAI,cAAc,mBAAmB;AAAA,IAC1C,MAAM;AAAA,IACN,SAAS,oCAAoC,SAAS,GAAG,WAAW,SAAY,KAAK,KAAK,MAAM,GAAG;AAAA,EACrG,CAAC;AACH;AAEA,MAAM,mBAAmB,CAAC,WAAmB,WAC3C,IAAI,cAAc,mBAAmB;AAAA,EACnC,MAAM;AAAA,EACN,SAAS,qCAAqC,SAAS,cAAc,MAAM;AAC7E,CAAC;AAEH,MAAM,gBAAgB,CAAC,SACrB,IAAI,cAAc,mBAAmB;AAAA,EACnC,MAAM;AAAA,EACN,SAAS,mCAAmC,IAAI;AAClD,CAAC;AAGH,MAAM,sBAAsB,OAAO,OAAO,EAAE,SAAS,OAAO,MAAM,OAAO,MAAM,EAAE,CAAC;AAGlF,MAAM,aAAa;AAGnB,MAAM,iBAAiB,CAAC,UAA2B;AACjD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,MAAQ,SAAS,IAAM,QAAO;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,MAAM,uBAAuB,CAAC,YAC5B,IAAI,cAAc,mBAAmB,EAAE,MAAM,yBAAyB,QAAQ,CAAC;AAQjF,MAAM,OAAO,CAAC,aACZ,SAAS,UAAU,OAAO,SAAS,SAAS;AASvC,MAAM,OAAO,CAClB,YAEA,OAAO,IAAI,aAAY;AACrB,QAAM,aAAa,OAAO,OAAO,IAAI;AAAA,IACnC,KAAK,MAAM;AACT,YAAMA,WAAU,QAAQ,YAAY,SAChC,SACA,OAAO,OAAO,OAAO;AAAA,QACrB,OAAO,QAAQ,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAIrD,cAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,QAAQ,eAAe,KAAK,GAAG;AAClF,kBAAM,IAAI,UAAU,cAAc;AAAA,UACpC;AACA,cAAI,CAAC,WAAW,KAAK,IAAI,EAAG,OAAM,IAAI,UAAU,aAAa;AAC7D,iBAAO,CAAC,MAAM,KAAK;AAAA,QACrB,CAAC;AAAA,MACH,CAAC;AACH,aAAO;AAAA,QACL,UAAU,QAAQ;AAAA,QAClB,SAAAA;AAAA,QACA,iBAAiB,QAAQ;AAAA,QACzB,eAAe,QAAQ;AAAA,QACvB,gBAAgB,QAAQ;AAAA,QACxB,kBAAkB,QAAQ;AAAA,QAC1B,6BAA6B,QAAQ;AAAA,QACrC,YAAY,QAAQ;AAAA,QACpB,gBAAgB,QAAQ;AAAA,MAC1B;AAAA,IACF;AAAA,IACA,OAAO,MAAM,cAAc,SAAS;AAAA,EACtC,CAAC;AACD,MAAI,OAAO,WAAW,aAAa,SAAU,QAAO,OAAO,OAAO,KAAK,cAAc,UAAU,CAAC;AAChG,QAAM,WAAW,OAAO,OAAO,IAAI;AAAA,IACjC,KAAK,MAAM,IAAI,IAAI,WAAW,QAAQ;AAAA,IACtC,OAAO,MAAM,qBAAqB,kCAAkC;AAAA,EACtE,CAAC;AAMD,QAAM,WAAW,SAAS,aAAa,eAAe,SAAS,aAAa,eAC1E,SAAS,aAAa;AACxB,MAAI,SAAS,aAAa,YAAY,EAAE,SAAS,aAAa,WAAW,WAAW;AAClF,WAAO,OAAO,OAAO,KAAK,qBAAqB,yCAAyC,CAAC;AAAA,EAC3F;AAGA,MACE,SAAS,aAAa,MAAM,SAAS,aAAa,MAAM,SAAS,WAAW,MAAM,SAAS,SAAS,MACpG,SAAS,KAAK,SAAS,GAAG,KAAK,SAAS,KAAK,SAAS,GAAG,GACzD;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,qBAAqB,+EAA+E;AAAA,IACtG;AAAA,EACF;AACA,WAAS,WAAW,SAAS,SAAS,QAAQ,QAAQ,EAAE;AACxD,QAAM,OAAO,SAAS,SAAS,EAAE,QAAQ,QAAQ,EAAE;AACnD,QAAM,UAAU,WAAW;AAC3B,QAAM,SAAS,OAAO,WAAW;AACjC,QAAM,kBAAkB,OAAO,KAAK,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC;AAKnF,QAAM,aAAa,CAAC,aACjB,YAAY,SAAY,UAAU,kBAAkB,WAAW,SAAS,OAAO,GAAG;AAAA,IACjF,kBAAkB,aAAa,cAAc;AAAA,IAC7C,kBAAkB,aAAa,gBAAgB;AAAA,IAC/C,kBAAkB,aAAa,eAAe;AAAA,EAChD;AAOF,QAAM,SAAS,CAAC,WAAiC,GAAG,IAAI,QAAQ,MAAM;AACtE,QAAM,eAAe,WAAW,UAAU,MAAM;AAWhD,QAAM,OAAO,CACX,WACA,SACA,QAEA,OAAO,IAAI,aAAY;AACrB,UAAM,gBAAgB,OAAO,QAAQ;AACrC,UAAM,cAAc,OAAO,OAAO,cAAc,gBAAgB,WAAW;AAC3E,WAAO,OAAO,aAAa,QAAQ,OAAO,EAAE;AAAA,MAC1C,OAAO,eAAe,gBAAgB,aAAa;AAAA,QACjD,GAAG,OAAO,eAAe,WAAW;AAAA,QACpC,UAAU;AAAA,MACZ,CAAC;AAAA,MACD,OAAO,SAAS,CAAC,UAAU,iBAAiB,WAAW,KAAK,CAAC;AAAA,MAC7D,OAAO,QAAQ,GAAG;AAAA,MAClB,OAAO,eAAe,QAAQ,sBAAsB,CAAC,GAAG,eAAe,GAAG,eAAe,CAAC;AAAA,MAC1F,OAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH,QAAM,gBAAgB,CAAC,MAAc,OAAmC,aACtE,OAAO,IAAI,aAAY;AACrB,UAAM,SAAS,SAAS,UAAU,SAAS,QAAQ;AACnD,QACE,OAAO,OAAO,MAAM,KACpB,CAAC,OAAO,SAAS,SAAS,SAAS,OAAO,KAAK,CAAC,KAChD,SAAS,SAAS,OAAO,KAAK,KAAK,GACnC;AACA,aAAO,OAAO,OAAO,KAAK,cAAc,IAAI,CAAC;AAAA,IAC/C;AACA,WAAO,OAAO;AAAA,EAChB,CAAC;AACH,QAAM,mBAAmB,OAAO;AAAA,IAC9B;AAAA,IACA,WAAW;AAAA,IACX;AAAA,EACF;AACA,QAAM,iBAAiB,OAAO,cAAc,iBAAiB,WAAW,eAAe,oBAAoB;AAC3G,QAAM,kBAAkB,OAAO,cAAc,kBAAkB,WAAW,gBAAgB,qBAAqB;AAC/G,QAAM,mBAAmB,WAAW,oBAAoB;AACxD,MAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,oBAAoB,GAAG;AACpE,WAAO,OAAO,OAAO,KAAK,cAAc,kBAAkB,CAAC;AAAA,EAC7D;AACA,QAAM,8BAA8B,WAAW,+BAA+B;AAC9E,MACE,CAAC,OAAO,cAAc,2BAA2B,KACjD,+BAA+B,KAC/B,8BAA8B,yBAC9B;AACA,WAAO,OAAO,OAAO,KAAK,cAAc,6BAA6B,CAAC;AAAA,EACxE;AACA,QAAM,aAAa,WAAW;AAC9B,MAAI,eAAe,WAAc,CAAC,OAAO,cAAc,UAAU,KAAK,cAAc,IAAI;AACtF,WAAO,OAAO,OAAO,KAAK,cAAc,YAAY,CAAC;AAAA,EACvD;AACA,QAAM,iBAAiB,WAAW,kBAAkB;AACpD,MAAI,CAAC,OAAO,GAAG,cAAc,EAAE,cAAc,GAAG;AAC9C,WAAO,OAAO,OAAO,KAAK,cAAc,gBAAgB,CAAC;AAAA,EAC3D;AACA,QAAM,eAAe,CAAC,WAAmB,UAAkB,UACzD,IAAI,cAAc,mBAAmB;AAAA,IACnC,MAAM;AAAA,IACN,SAAS,qCAAqC,SAAS,SAAS,QAAQ,oBAAoB,KAAK;AAAA,EACnG,CAAC;AACH,QAAM,WAAW,CAAC,cAChB,IAAI,cAAc,mBAAmB;AAAA,IACnC,MAAM;AAAA,IACN,SAAS,2CAA2C,SAAS;AAAA,EAC/D,CAAC;AACH,QAAM,SAAS,CACb,WACA,UACA,WAEA,OAAO;AAAA,IACL,OAAO,QAAQ,QAAQ;AAAA,IACvB,OAAO,SAAS,gBAAgB,MAAM,OAAO,KAAK,SAAS,SAAS,CAAC,CAAC;AAAA,EACxE;AAQF,QAAM,cAAc,CAClB,UACA,WACA,UAEA,OAAO,IAAI,aAAY;AACrB,UAAM,WAAW,SAAS,QAAQ,gBAAgB;AAClD,QAAI,aAAa,QAAW;AAC1B,YAAM,gBAAgB,OAAO,QAAQ;AACrC,UAAI,CAAC,QAAQ,KAAK,QAAQ,KAAK,CAAC,OAAO,cAAc,aAAa,GAAG;AACnE,eAAO,OAAO,OAAO,KAAK,iBAAiB,GAAG,SAAS,OAAO,CAAC;AAAA,MACjE;AACA,UAAI,gBAAgB,MAAO,QAAO,OAAO,OAAO,KAAK,aAAa,WAAW,eAAe,KAAK,CAAC;AAAA,IACpG;AACA,UAAM,SAA4B,CAAC;AACnC,QAAI,WAAW;AACf,WAAO,OAAO,WAAW,SAAS,QAAQ,CAAC,UACzC,OAAO,QAAQ,MAAM;AACnB,kBAAY,MAAM;AAClB,UAAI,WAAW,MAAO,QAAO,OAAO,KAAK,aAAa,WAAW,UAAU,KAAK,CAAC;AACjF,aAAO,KAAK,IAAI,WAAW,KAAK,CAAC;AACjC,aAAO,OAAO;AAAA,IAChB,CAAC,CAAC,EAAE;AAAA,MACF,OAAO,SAAS,mBAAmB,CAAC;AAAA;AAAA;AAAA;AAAA,QAIlC,MAAM,OAAO,SAAS,mBAClB,OAAO,OACP,OAAO,KAAK,iBAAiB,GAAG,SAAS,OAAO,CAAC;AAAA,OAAC;AAAA,IAC1D;AACF,UAAM,QAAQ,IAAI,WAAW,QAAQ;AACrC,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,YAAM,IAAI,OAAO,MAAM;AACvB,gBAAU,MAAM;AAAA,IAClB;AACA,WAAO;AAAA,EACT,CAAC;AAEH,QAAM,WAAW,CAAC,WAChB,KAAK,cAAc,WAAW,kBAAkB,IAAI,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,aACrE,OAAO,IAAI,aAAY;AACrB,QAAI,SAAS,WAAW,KAAK;AAC3B,aAAO,OAAO,OAAO,KAAK,IAAI,cAAc,gBAAgB,EAAE,MAAM,oBAAoB,OAAO,CAAC,CAAC;AAAA,IACnG;AACA,QAAI,CAAC,KAAK,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,iBAAiB,cAAc,SAAS,MAAM,CAAC;AAC9F,WAAO,OAAO,YAAY,UAAU,cAAc,gBAAgB;AAAA,EACpE,CAAC,CAAC;AAGN,QAAM,cAAc,CAAC,QAA8B,UACjD;AAAA,IACE;AAAA,IACA,WAAW,kBAAkB,IAAI,OAAO,MAAM,CAAC,CAAC,EAAE;AAAA,MAChD,kBAAkB,eAAe,OAAO,0BAA0B;AAAA,IACpE;AAAA,IACA,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,OAAO,OAAO,KAAK,iBAAiB,aAAa,SAAS,MAAM,CAAC;AAAA,EACzG;AAQF,QAAM,eAAe,CAAC,aAAwE;AAC5F,UAAM,SAAS,SAAS,QAAQ,OAAO;AACvC,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,QAAQ,kBAAkB,KAAK,OAAO,KAAK,CAAC;AAClD,QAAI,UAAU,KAAM,QAAO;AAC3B,UAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAK5B,QAAI,CAAC,OAAO,cAAc,IAAI,EAAG,QAAO;AACxC,WAAO,OAAO;AAAA,EAChB;AAWA,QAAM,gBAAgB,CAAC,WAA4B,WAAW,OAAO,WAAW,OAAO,WAAW;AAUlG,QAAM,aAAa,CAAC,QAA8B,UAChD,KAAK,sBAAsB,WAAW,kBAAkB,KAAK,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,aAC9E,OAAO,KAAK,MAAM;AAChB,QAAI,CAAC,KAAK,QAAQ,EAAG,QAAO;AAC5B,UAAM,WAAW,SAAS,QAAQ,gBAAgB;AAClD,WAAO,aAAa,UAAa,OAAO,QAAQ,MAAM;AAAA,EACxD,CAAC,CAAC;AAgBN,QAAM,gBAAgB,CAAC,QAA8B,OAAmB,UACtE,OAAO,IAAI,aAAY;AACrB,UAAM,QAAQ,MAAM;AACpB,UAAM,SAAS,CAAC,OAAe,SAC7B;AAAA,MACE;AAAA,MACA,WAAW,kBAAkB,IAAI,OAAO,MAAM,CAAC,CAAC,EAAE;AAAA,QAChD,kBAAkB,eAAe,MAAM,0BAA0B;AAAA,QACjE,kBAAkB,UAAU,iBAAiB,KAAK;AAAA,MACpD;AAAA;AAAA,MAEA,OAAO;AAAA,IACT;AAKF,QAAI,OAAO,WAAW,QAAQ,KAAK,EAAG,QAAO;AAI7C,UAAM,QAAQ,OAAO,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,CAAC;AACjE,QAAI,KAAK,KAAK,KAAK,cAAc,MAAM,MAAM,EAAG,QAAO;AACvD,QAAI,MAAM,WAAW,OAAO,MAAM,WAAW,KAAK;AAChD,aAAO,OAAO,OAAO,KAAK,iBAAiB,mBAAmB,MAAM,MAAM,CAAC;AAAA,IAC7E;AACA,QAAI,SAAS,MAAM,WAAW,MAAM,aAAa,KAAK,KAAK,IAAI;AAC/D,WAAO,SAAS,OAAO;AACrB,YAAM,MAAM,KAAK,IAAI,SAAS,OAAO,KAAK;AAC1C,YAAM,SAAS,OAAO,OAAO,SAAS,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,MAAM,SAAS,QAAQ,GAAG,CAAC;AAC/F,UAAI,OAAO,WAAW,KAAK;AAKzB,YAAI,QAAQ,SAAS,KAAK,MAAM,EAAG;AACnC,YAAI,KAAK,MAAM,KAAK,cAAc,OAAO,MAAM,EAAG,QAAO;AACzD,eAAO,OAAO,OAAO,KAAK,iBAAiB,aAAa,OAAO,MAAM,CAAC;AAAA,MACxE;AAIA,eAAS,KAAK,IAAI,KAAK,aAAa,MAAM,KAAK,CAAC;AAAA,IAClD;AACA,WAAO,OAAO,WAAW,QAAQ,KAAK;AAAA,EACxC,CAAC;AAEH,QAAM,MAAoC,OAAO,GAAG,qBAAqB;AAAA,IAAE,CAAC,UAC1E,OAAO,QAAQ,cAAc,cAAc,KAAK,GAAG,CAAC,aAClD,OAAO,IAAI,aAAY;AACrB,YAAM,SAAS,OAAO,cAAc,aAAa,QAAQ;AACzD,aAAO,OAAO,oBAAoB,EAAE,OAAO,CAAC;AAC5C,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,OAAO,IAAI,aAAY;AACrB,cAAI,eAAe,UAAa,SAAS,cAAc,YAAY;AACjE,mBAAO,YAAY,QAAQ,QAAQ;AACnC;AAAA,UACF;AACA,gBAAM,cAAc,OAAO,cAAc,QAAQ,UAAU,UAAU;AACrE,cAAI,CAAC,YAAa,QAAO,YAAY,QAAQ,QAAQ;AAAA,QACvD,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT,CAAC,CAAC;AAAA,EACN;AAEA,QAAM,MAAoC,OAAO,GAAG,qBAAqB;AAAA,IAAE,CAAC,WAC1E,OAAO,IAAI,aAAY;AACrB,YAAM,YAAY,OAAO,cAAc,eAAe,MAAM;AAC5D,aAAO,OAAO,oBAAoB,EAAE,QAAQ,UAAU,CAAC;AAIvD,YAAM,QAAQ,OAAO,OAAO,cAAc,kBAAkB,SAAS,SAAS,CAAC;AAK/E,YAAM,WAAW,OAAO,cAAc,aAAa,KAAK;AACxD,UAAI,aAAa,WAAW;AAC1B,eAAO,OAAO,OAAO;AAAA,UACnB,IAAI,cAAc,mBAAmB;AAAA,YACnC,MAAM;AAAA,YACN,gBAAgB;AAAA,YAChB,gBAAgB;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,MAAoC,OAAO,GAAG,qBAAqB;AAAA,IAAE,CAAC,WAC1E,OAAO,IAAI,aAAY;AACrB,YAAM,YAAY,OAAO,cAAc,eAAe,MAAM;AAC5D,aAAO,OAAO,oBAAoB,EAAE,QAAQ,UAAU,CAAC;AACvD,YAAM,WAAW,OAAO;AAAA,QACtB;AAAA,QACA;AAAA,QACA,KAAK,sBAAsB,WAAW,kBAAkB,KAAK,OAAO,SAAS,CAAC,CAAC,GAAG,OAAO,OAAO;AAAA,MAClG;AACA,UAAI,SAAS,WAAW,IAAK,QAAO;AACpC,UAAI,CAAC,KAAK,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,iBAAiB,sBAAsB,SAAS,MAAM,CAAC;AACtG,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,cAAoD,OAAO,GAAG,6BAA6B;AAAA,IAC/F,CAAC,YACC,OAAO,IAAI,aAAY;AACrB,YAAM,YAAY,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC;AACtC,UAAI,UAAU,WAAW,EAAG,QAAO,CAAC;AAIpC,YAAM,YAAyC,CAAC;AAChD,iBAAW,UAAU,UAAW,WAAU,KAAK,OAAO,cAAc,eAAe,MAAM,CAAC;AAC1F,aAAO,OAAO,oBAAoB,EAAE,OAAO,UAAU,OAAO,CAAC;AAC7D,YAAM,UAAU,oBAAI,IAAY;AAChC,eAAS,SAAS,GAAG,SAAS,UAAU,QAAQ,UAAU,4BAA4B;AACpF,cAAM,QAAQ,UAAU,MAAM,QAAQ,SAAS,0BAA0B;AACzE,cAAM,cAAc,QAAQ,OAAO,KAAK,UAAU,EAAE,SAAS,MAAM,CAAC,CAAC;AAGrE,YAAI,YAAY,aAAa,yBAAyB;AACpD,iBAAO,OAAO,OAAO,KAAK,qBAAqB,qDAAqD,CAAC;AAAA,QACvG;AACA,cAAM,UAAU,OAAO;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA,WAAW,kBAAkB,KAAK,GAAG,IAAI,kBAAkB,CAAC,EAAE;AAAA,cAC5D,kBAAkB,eAAe,aAAa,kBAAkB;AAAA,YAClE;AAAA,YACA,CAAC,aACC,OAAO,IAAI,aAAY;AACrB,kBAAI,CAAC,KAAK,QAAQ,GAAG;AACnB,uBAAO,OAAO,OAAO,KAAK,iBAAiB,6BAA6B,SAAS,MAAM,CAAC;AAAA,cAC1F;AACA,oBAAM,YAAY,OAAO;AAAA,gBACvB;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AACA,oBAAM,OAAO,OAAO,OAAO,IAAI;AAAA,gBAC7B,KAAK,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,gBAC/C,OAAO,MAAM,iBAAiB,gCAAgC;AAAA,cAChE,CAAC;AACD,qBAAO,OAAO,OAAO,oBAAoB,mBAAmB,EAAE,IAAI,EAAE;AAAA,gBAClE,OAAO,SAAS,MAAM,iBAAiB,gCAAgC,CAAC;AAAA,cAC1E;AAAA,YACF,CAAC;AAAA,UACL;AAAA,QACF;AACA,cAAM,QAAQ,IAAI,IAAY,KAAK;AACnC,mBAAW,UAAU,QAAQ,QAAS,KAAI,MAAM,IAAI,MAAM,EAAG,SAAQ,IAAI,MAAM;AAAA,MACjF;AAMA,aAAO,UAAU,OAAO,CAAC,WAAW,QAAQ,IAAI,MAAM,CAAC;AAAA,IACzD,CAAC;AAAA,EACL;AAEA,SAAO,EAAE,KAAK,KAAK,KAAK,aAAa,eAAe;AACtD,CAAC;AAcI,MAAM,QAAQ,CACnB,YAEA,MAAM,OAAO,cAAc,aAAa,EAAE,KAAK,OAAO,CAAC;",
   "names": ["headers"]
 }

package/dist/esm/ArtifactBackupLease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ArtifactBackupLease.d.ts","sourceRoot":"","sources":["../../src/ArtifactBackupLease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,UAAU,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAqDvC;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EACnC,IAAI,UAAU,CAAC,UAAU,EACzB,WAAW,MAAM,EACjB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,EAAE,KAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CA0GzB,CAAA;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EACtC,IAAI,UAAU,CAAC,UAAU,EACzB,WAAW,MAAM,EACjB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,EAAE,KAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CASzC,CAAA"}
+{"version":3,"file":"ArtifactBackupLease.d.ts","sourceRoot":"","sources":["../../src/ArtifactBackupLease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,UAAU,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAqDvC;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EACnC,IAAI,UAAU,CAAC,UAAU,EACzB,WAAW,MAAM,EACjB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,EAAE,KAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAoHzB,CAAA;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EACtC,IAAI,UAAU,CAAC,UAAU,EACzB,WAAW,MAAM,EACjB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,EAAE,KAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CASzC,CAAA"}

package/dist/esm/ArtifactBackupLease.js

@@ -72,24 +72,33 @@ export const withLease = (fs, directory, effect, failure) => Effect.gen(function
     // Install marker cleanup before acquisition, including gate release. The
     // marker write and ownership bookkeeping complete in one interruption mask.
     return yield* Effect.acquireUseRelease(Effect.void, () => acquire.pipe(Effect.andThen(Effect.scoped(Effect.gen(function* () {
-        yield* Effect.forkScoped(Effect.forever(Effect.sleep(heartbeatEvery).pipe(Effect.andThen(gate(fs, directory, fs.readFileString(marker).pipe(Effect.map(Option.some), Effect.catch((cause) => isReason(cause, "NotFound") ? Effect.succeed(Option.none()) : Effect.fail(cause)), Effect.flatMap((found) => {
-            // A missing or foreign marker means a sweep judged this
-            // lease stale and reaped it: deletion is no longer
-            // fenced while the backup still copies. The sibling
-            // `internal/ArtifactLocks.ts` heartbeat reports the same
-            // loss the same way.
-            if (Option.getOrUndefined(found) !== owner) {
-                return Effect.logWarning("Artifact backup lease was reclaimed while its backup was still running");
+        yield* Effect.forkScoped(Effect.gen(function* () {
+            while (true) {
+                yield* Effect.sleep(heartbeatEvery);
+                const reclaimed = yield* gate(fs, directory, fs.readFileString(marker).pipe(Effect.map(Option.some), Effect.catch((cause) => isReason(cause, "NotFound") ? Effect.succeed(Option.none()) : Effect.fail(cause)), Effect.flatMap((found) => {
+                    // A missing or foreign marker means a sweep judged this
+                    // lease stale and reaped it: deletion is no longer
+                    // fenced while the backup still copies. The sibling
+                    // `internal/ArtifactLocks.ts` heartbeat reports the same
+                    // loss the same way. A reaped marker is never handed
+                    // back, so the loss is reported once and the heartbeat
+                    // ends instead of repeating it every tick.
+                    if (Option.getOrUndefined(found) !== owner) {
+                        return Effect.as(Effect.logWarning("Artifact backup lease was reclaimed while its backup was still running"), true);
+                    }
+                    return Effect.flatMap(Clock.currentTimeMillis, (now) => {
+                        const timestamp = new Date(now);
+                        return Effect.as(fs.utimes(marker, timestamp, timestamp), false);
+                    });
+                }), Effect.mapError(failure)), failure).pipe(
+                // A failed heartbeat is retried on the next tick, but a
+                // minute of them lets the marker go stale, so each one is
+                // reported rather than dropped.
+                Effect.catch((cause) => Effect.as(Effect.logWarning("Artifact backup lease heartbeat failed", cause), false)));
+                if (reclaimed)
+                    return;
             }
-            return Effect.flatMap(Clock.currentTimeMillis, (now) => {
-                const timestamp = new Date(now);
-                return fs.utimes(marker, timestamp, timestamp);
-            });
-        }), Effect.mapError(failure)), failure)), 
-        // A failed heartbeat is retried on the next tick, but a
-        // minute of them lets the marker go stale, so each one is
-        // reported rather than dropped.
-        Effect.catch((cause) => Effect.logWarning("Artifact backup lease heartbeat failed", cause)))));
+        }));
         return yield* effect;
     })))), () => ownsMarker
         ? gate(fs, directory, fs.readFileString(marker).pipe(Effect.flatMap((found) => found === owner ? fs.remove(marker) : Effect.void), 

package/dist/esm/ArtifactBackupLease.js.map

@@ -1 +1 @@
-{"version":3,"file":"ArtifactBackupLease.js","sourceRoot":"","sources":["../../src/ArtifactBackupLease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAE5D,MAAM,UAAU,GAAG,eAAe,CAAA;AAClC,MAAM,QAAQ,GAAG,oBAAoB,CAAA;AACrC,MAAM,cAAc,GAAG,YAAY,CAAA;AACnC,MAAM,YAAY,GAAG,MAAM,CAAA;AAC3B,MAAM,aAAa,GAAG,WAAW,CAAA;AACjC,MAAM,UAAU,GAAG,WAAW,CAAA;AAE9B,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,GAAiC,EAAW,EAAE,CAC9E,KAAK,YAAY,aAAa,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAA;AAE3E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3F,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAA;AACzF,CAAC,CAAC,CAAA;AAEF,MAAM,IAAI,GAAG,CACX,EAAyB,EACzB,SAAiB,EACjB,MAA8B,EAC9B,OAA+B,EACF,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;AAEpG,MAAM,YAAY,GAAG,CACnB,EAAyB,EACzB,SAAiB,EACjB,OAA8B,EACH,EAAE,CAC7B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAyD,EAAE,CAC5E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC1F,CACF,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,YAAY;QAAE,OAAO,IAAI,CAAA;IACnF,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CACzB,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAA0B,EAAE,CAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACxE,CACF,CAAA;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,EAAyB,EACzB,SAAiB,EACjB,MAA8B,EAC9B,OAA+B,EACF,EAAE,CAC/B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAA;IAC1B,MAAM,MAAM,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;IAC3C,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IAEtF,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAC1B,EAAE,EACF,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC;oBAAE,OAAO,KAAK,CAAA;gBAC7D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,CAClC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBAC9B,UAAU,GAAG,IAAI,CAAA;oBACjB,OAAO,IAAI,CAAA;gBACb,CAAC,CAAC,CAAC,EACH,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAA8B,EAAE,CACjD,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACvF,CACF,CACF,CAAA;YACH,CAAC,CAAC,EACF,OAAO,CACR,CAAA;YACD,IAAI,QAAQ;gBAAE,OAAM;YACpB,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACjC,CAAC;IACH,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAC7B,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CAAA;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACpC,MAAM,CAAC,IAAI,EACX,GAAG,EAAE,CACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CACzB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAC/B,MAAM,CAAC,OAAO,CAAC,IAAI,CACjB,EAAE,EACF,SAAS,EACT,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CACzF,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACvB,wDAAwD;YACxD,mDAAmD;YACnD,oDAAoD;YACpD,yDAAyD;YACzD,qBAAqB;YACrB,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC3C,OAAO,MAAM,CAAC,UAAU,CACtB,wEAAwE,CACzE,CAAA;YACH,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC/B,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;YAChD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CACzB,EACD,OAAO,CACR,CAAC;QACF,wDAAwD;QACxD,0DAA0D;QAC1D,gCAAgC;QAChC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC,CAC5F,CACF,CACF,CAAA;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAA;IACtB,CAAC,CAAC,CAAC,CACJ,CAAC,EACJ,GAAG,EAAE,CACH,UAAU;QACR,CAAC,CAAC,IAAI,CACJ,EAAE,EACF,SAAS,EACT,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5E,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,2BAA2B;QAC3B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAoD,EAAE,CACvE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAC/D,CACF,EACD,OAAO,CACR,CAAC,IAAI,CACJ,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC,CAC1F;QACD,CAAC,CAAC,MAAM,CAAC,IAAI,CAClB,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,EAAyB,EACzB,SAAiB,EACjB,MAA8B,EAC9B,OAA+B,EACa,EAAE,CAC9C,IAAI,CACF,EAAE,EACF,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAK,CAAA;IACxE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC,CAAC,EACF,OAAO,CACR,CAAA","sourcesContent":["/**\n * Cross-process exclusion between a filesystem artifact backup and garbage\n * collection.\n *\n * A backup holds one heartbeat-backed marker for the duration of its database\n * snapshot and blob copy. Sweep deletion checks that marker while holding the\n * same short-lived global gate. Publication remains unconstrained: new blobs\n * may appear during a backup, but a blob already referenced by the frozen\n * database cannot disappear underneath it.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Clock from \"effect/Clock\"\nimport * as Effect from \"effect/Effect\"\nimport type * as FileSystem from \"effect/FileSystem\"\nimport * as Option from \"effect/Option\"\nimport * as PlatformError from \"effect/PlatformError\"\nimport * as Random from \"effect/Random\"\nimport * as ArtifactLocks from \"./internal/ArtifactLocks.ts\"\n\nconst markerName = \".backup-lease\"\nconst gateName = \".backup-lease-gate\"\nconst heartbeatEvery = \"10 seconds\"\nconst staleAfterMs = 60_000\nconst acquireWithin = \"2 minutes\"\nconst retryEvery = \"25 millis\"\n\nconst isReason = (cause: unknown, tag: PlatformError.SystemErrorTag): boolean =>\n  cause instanceof PlatformError.PlatformError && cause.reason._tag === tag\n\nconst token = Effect.gen(function*() {\n  const first = yield* Random.nextIntBetween(0, Number.MAX_SAFE_INTEGER, { halfOpen: true })\n  const second = yield* Random.nextIntBetween(0, Number.MAX_SAFE_INTEGER, { halfOpen: true })\n  return `${first.toString(36)}-${second.toString(36)}-${yield* Clock.currentTimeMillis}`\n})\n\nconst gate = <A, E, R, E2>(\n  fs: FileSystem.FileSystem,\n  directory: string,\n  effect: Effect.Effect<A, E, R>,\n  failure: (cause: unknown) => E2\n): Effect.Effect<A, E | E2, R> => ArtifactLocks.withDigest(fs, directory, gateName, effect, failure)\n\nconst activeMarker = <E>(\n  fs: FileSystem.FileSystem,\n  directory: string,\n  failure: (cause: unknown) => E\n): Effect.Effect<boolean, E> =>\n  Effect.gen(function*() {\n    const path = `${directory}/${markerName}`\n    const info = yield* fs.stat(path).pipe(\n      Effect.map(Option.some),\n      Effect.catch((cause): Effect.Effect<Option.Option<FileSystem.File.Info>, E> =>\n        isReason(cause, \"NotFound\") ? Effect.succeed(Option.none()) : Effect.fail(failure(cause))\n      )\n    )\n    if (Option.isNone(info)) return false\n    const modified = Option.getOrUndefined(info.value.mtime)\n    const now = yield* Clock.currentTimeMillis\n    if (modified === undefined || now - modified.getTime() <= staleAfterMs) return true\n    yield* fs.remove(path).pipe(\n      Effect.catch((cause): Effect.Effect<void, E> =>\n        isReason(cause, \"NotFound\") ? Effect.void : Effect.fail(failure(cause))\n      )\n    )\n    return false\n  })\n\n/**\n * Runs `effect` while sweep deletion is fenced across every process using\n * this objects directory. A crashed holder is recovered after its heartbeat\n * becomes stale.\n *\n * @category combinators\n * @since 1.0.0-rc.0\n */\nexport const withLease = <A, E, R, E2>(\n  fs: FileSystem.FileSystem,\n  directory: string,\n  effect: Effect.Effect<A, E, R>,\n  failure: (cause: unknown) => E2\n): Effect.Effect<A, E | E2, R> =>\n  Effect.gen(function*() {\n    const owner = yield* token\n    const marker = `${directory}/${markerName}`\n    yield* fs.makeDirectory(directory, { recursive: true }).pipe(Effect.mapError(failure))\n\n    let ownsMarker = false\n    const acquire = Effect.gen(function*() {\n      while (true) {\n        const acquired = yield* gate(\n          fs,\n          directory,\n          Effect.gen(function*() {\n            if (yield* activeMarker(fs, directory, failure)) return false\n            return yield* Effect.uninterruptible(\n              fs.writeFileString(marker, owner, { flag: \"wx\", mode: 0o600 }).pipe(\n                Effect.andThen(Effect.sync(() => {\n                  ownsMarker = true\n                  return true\n                })),\n                Effect.catch((cause): Effect.Effect<boolean, E2> =>\n                  isReason(cause, \"AlreadyExists\") ? Effect.succeed(false) : Effect.fail(failure(cause))\n                )\n              )\n            )\n          }),\n          failure\n        )\n        if (acquired) return\n        yield* Effect.sleep(retryEvery)\n      }\n    }).pipe(\n      Effect.timeout(acquireWithin),\n      Effect.catchTag(\"TimeoutError\", (cause) => Effect.fail(failure(cause)))\n    )\n\n    // Install marker cleanup before acquisition, including gate release. The\n    // marker write and ownership bookkeeping complete in one interruption mask.\n    return yield* Effect.acquireUseRelease(\n      Effect.void,\n      () =>\n        acquire.pipe(Effect.andThen(\n          Effect.scoped(Effect.gen(function*() {\n            yield* Effect.forkScoped(\n              Effect.forever(\n                Effect.sleep(heartbeatEvery).pipe(\n                  Effect.andThen(gate(\n                    fs,\n                    directory,\n                    fs.readFileString(marker).pipe(\n                      Effect.map(Option.some),\n                      Effect.catch((cause) =>\n                        isReason(cause, \"NotFound\") ? Effect.succeed(Option.none<string>()) : Effect.fail(cause)\n                      ),\n                      Effect.flatMap((found) => {\n                        // A missing or foreign marker means a sweep judged this\n                        // lease stale and reaped it: deletion is no longer\n                        // fenced while the backup still copies. The sibling\n                        // `internal/ArtifactLocks.ts` heartbeat reports the same\n                        // loss the same way.\n                        if (Option.getOrUndefined(found) !== owner) {\n                          return Effect.logWarning(\n                            \"Artifact backup lease was reclaimed while its backup was still running\"\n                          )\n                        }\n                        return Effect.flatMap(Clock.currentTimeMillis, (now) => {\n                          const timestamp = new Date(now)\n                          return fs.utimes(marker, timestamp, timestamp)\n                        })\n                      }),\n                      Effect.mapError(failure)\n                    ),\n                    failure\n                  )),\n                  // A failed heartbeat is retried on the next tick, but a\n                  // minute of them lets the marker go stale, so each one is\n                  // reported rather than dropped.\n                  Effect.catch((cause) => Effect.logWarning(\"Artifact backup lease heartbeat failed\", cause))\n                )\n              )\n            )\n            return yield* effect\n          }))\n        )),\n      () =>\n        ownsMarker\n          ? gate(\n            fs,\n            directory,\n            fs.readFileString(marker).pipe(\n              Effect.flatMap((found) => found === owner ? fs.remove(marker) : Effect.void),\n              // A backup whose heartbeat lapsed has its marker reaped by whoever\n              // noticed, so `NotFound` is the ordinary end of a slow lease, not a\n              // fault: there is nothing left to release and nothing left to leak.\n              // The sibling release in `internal/ArtifactLocks.ts` classifies the\n              // same cause the same way.\n              Effect.catch((cause): Effect.Effect<void, PlatformError.PlatformError> =>\n                isReason(cause, \"NotFound\") ? Effect.void : Effect.fail(cause)\n              )\n            ),\n            failure\n          ).pipe(\n            Effect.catch((cause) => Effect.logWarning(\"Artifact backup lease release failed\", cause))\n          )\n          : Effect.void\n    )\n  })\n\n/**\n * Runs one sweep deletion only when no live backup lease exists. The marker\n * check and `effect` share the global gate, closing the check/delete race.\n * `None` means a backup deliberately fenced the operation.\n *\n * @category combinators\n * @since 1.0.0-rc.0\n */\nexport const unlessActive = <A, E, R, E2>(\n  fs: FileSystem.FileSystem,\n  directory: string,\n  effect: Effect.Effect<A, E, R>,\n  failure: (cause: unknown) => E2\n): Effect.Effect<Option.Option<A>, E | E2, R> =>\n  gate(\n    fs,\n    directory,\n    Effect.gen(function*() {\n      if (yield* activeMarker(fs, directory, failure)) return Option.none<A>()\n      return Option.some(yield* effect)\n    }),\n    failure\n  )\n"]}
+{"version":3,"file":"ArtifactBackupLease.js","sourceRoot":"","sources":["../../src/ArtifactBackupLease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAE5D,MAAM,UAAU,GAAG,eAAe,CAAA;AAClC,MAAM,QAAQ,GAAG,oBAAoB,CAAA;AACrC,MAAM,cAAc,GAAG,YAAY,CAAA;AACnC,MAAM,YAAY,GAAG,MAAM,CAAA;AAC3B,MAAM,aAAa,GAAG,WAAW,CAAA;AACjC,MAAM,UAAU,GAAG,WAAW,CAAA;AAE9B,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,GAAiC,EAAW,EAAE,CAC9E,KAAK,YAAY,aAAa,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAA;AAE3E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3F,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAA;AACzF,CAAC,CAAC,CAAA;AAEF,MAAM,IAAI,GAAG,CACX,EAAyB,EACzB,SAAiB,EACjB,MAA8B,EAC9B,OAA+B,EACF,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;AAEpG,MAAM,YAAY,GAAG,CACnB,EAAyB,EACzB,SAAiB,EACjB,OAA8B,EACH,EAAE,CAC7B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAyD,EAAE,CAC5E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC1F,CACF,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,YAAY;QAAE,OAAO,IAAI,CAAA;IACnF,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CACzB,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAA0B,EAAE,CAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACxE,CACF,CAAA;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,EAAyB,EACzB,SAAiB,EACjB,MAA8B,EAC9B,OAA+B,EACF,EAAE,CAC/B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAA;IAC1B,MAAM,MAAM,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;IAC3C,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IAEtF,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAC1B,EAAE,EACF,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC;oBAAE,OAAO,KAAK,CAAA;gBAC7D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,CAClC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBAC9B,UAAU,GAAG,IAAI,CAAA;oBACjB,OAAO,IAAI,CAAA;gBACb,CAAC,CAAC,CAAC,EACH,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAA8B,EAAE,CACjD,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACvF,CACF,CACF,CAAA;YACH,CAAC,CAAC,EACF,OAAO,CACR,CAAA;YACD,IAAI,QAAQ;gBAAE,OAAM;YACpB,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACjC,CAAC;IACH,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAC7B,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CAAA;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACpC,MAAM,CAAC,IAAI,EACX,GAAG,EAAE,CACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CACzB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,OAAO,IAAI,EAAE,CAAC;gBACZ,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;gBACnC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,IAAI,CAC3B,EAAE,EACF,SAAS,EACT,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CACzF,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;oBACvB,wDAAwD;oBACxD,mDAAmD;oBACnD,oDAAoD;oBACpD,yDAAyD;oBACzD,qDAAqD;oBACrD,uDAAuD;oBACvD,2CAA2C;oBAC3C,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;wBAC3C,OAAO,MAAM,CAAC,EAAE,CACd,MAAM,CAAC,UAAU,CACf,wEAAwE,CACzE,EACD,IAAI,CACL,CAAA;oBACH,CAAC;oBACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE;wBACrD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;wBAC/B,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAA;oBAClE,CAAC,CAAC,CAAA;gBACJ,CAAC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CACzB,EACD,OAAO,CACR,CAAC,IAAI;gBACJ,wDAAwD;gBACxD,0DAA0D;gBAC1D,gCAAgC;gBAChC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,wCAAwC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CACrF,CACF,CAAA;gBACD,IAAI,SAAS;oBAAE,OAAM;YACvB,CAAC;QACH,CAAC,CAAC,CACH,CAAA;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAA;IACtB,CAAC,CAAC,CAAC,CACJ,CAAC,EACJ,GAAG,EAAE,CACH,UAAU;QACR,CAAC,CAAC,IAAI,CACJ,EAAE,EACF,SAAS,EACT,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5E,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,2BAA2B;QAC3B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAoD,EAAE,CACvE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAC/D,CACF,EACD,OAAO,CACR,CAAC,IAAI,CACJ,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC,CAC1F;QACD,CAAC,CAAC,MAAM,CAAC,IAAI,CAClB,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,EAAyB,EACzB,SAAiB,EACjB,MAA8B,EAC9B,OAA+B,EACa,EAAE,CAC9C,IAAI,CACF,EAAE,EACF,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAK,CAAA;IACxE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC,CAAC,EACF,OAAO,CACR,CAAA","sourcesContent":["/**\n * Cross-process exclusion between a filesystem artifact backup and garbage\n * collection.\n *\n * A backup holds one heartbeat-backed marker for the duration of its database\n * snapshot and blob copy. Sweep deletion checks that marker while holding the\n * same short-lived global gate. Publication remains unconstrained: new blobs\n * may appear during a backup, but a blob already referenced by the frozen\n * database cannot disappear underneath it.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Clock from \"effect/Clock\"\nimport * as Effect from \"effect/Effect\"\nimport type * as FileSystem from \"effect/FileSystem\"\nimport * as Option from \"effect/Option\"\nimport * as PlatformError from \"effect/PlatformError\"\nimport * as Random from \"effect/Random\"\nimport * as ArtifactLocks from \"./internal/ArtifactLocks.ts\"\n\nconst markerName = \".backup-lease\"\nconst gateName = \".backup-lease-gate\"\nconst heartbeatEvery = \"10 seconds\"\nconst staleAfterMs = 60_000\nconst acquireWithin = \"2 minutes\"\nconst retryEvery = \"25 millis\"\n\nconst isReason = (cause: unknown, tag: PlatformError.SystemErrorTag): boolean =>\n  cause instanceof PlatformError.PlatformError && cause.reason._tag === tag\n\nconst token = Effect.gen(function*() {\n  const first = yield* Random.nextIntBetween(0, Number.MAX_SAFE_INTEGER, { halfOpen: true })\n  const second = yield* Random.nextIntBetween(0, Number.MAX_SAFE_INTEGER, { halfOpen: true })\n  return `${first.toString(36)}-${second.toString(36)}-${yield* Clock.currentTimeMillis}`\n})\n\nconst gate = <A, E, R, E2>(\n  fs: FileSystem.FileSystem,\n  directory: string,\n  effect: Effect.Effect<A, E, R>,\n  failure: (cause: unknown) => E2\n): Effect.Effect<A, E | E2, R> => ArtifactLocks.withDigest(fs, directory, gateName, effect, failure)\n\nconst activeMarker = <E>(\n  fs: FileSystem.FileSystem,\n  directory: string,\n  failure: (cause: unknown) => E\n): Effect.Effect<boolean, E> =>\n  Effect.gen(function*() {\n    const path = `${directory}/${markerName}`\n    const info = yield* fs.stat(path).pipe(\n      Effect.map(Option.some),\n      Effect.catch((cause): Effect.Effect<Option.Option<FileSystem.File.Info>, E> =>\n        isReason(cause, \"NotFound\") ? Effect.succeed(Option.none()) : Effect.fail(failure(cause))\n      )\n    )\n    if (Option.isNone(info)) return false\n    const modified = Option.getOrUndefined(info.value.mtime)\n    const now = yield* Clock.currentTimeMillis\n    if (modified === undefined || now - modified.getTime() <= staleAfterMs) return true\n    yield* fs.remove(path).pipe(\n      Effect.catch((cause): Effect.Effect<void, E> =>\n        isReason(cause, \"NotFound\") ? Effect.void : Effect.fail(failure(cause))\n      )\n    )\n    return false\n  })\n\n/**\n * Runs `effect` while sweep deletion is fenced across every process using\n * this objects directory. A crashed holder is recovered after its heartbeat\n * becomes stale.\n *\n * @category combinators\n * @since 1.0.0-rc.0\n */\nexport const withLease = <A, E, R, E2>(\n  fs: FileSystem.FileSystem,\n  directory: string,\n  effect: Effect.Effect<A, E, R>,\n  failure: (cause: unknown) => E2\n): Effect.Effect<A, E | E2, R> =>\n  Effect.gen(function*() {\n    const owner = yield* token\n    const marker = `${directory}/${markerName}`\n    yield* fs.makeDirectory(directory, { recursive: true }).pipe(Effect.mapError(failure))\n\n    let ownsMarker = false\n    const acquire = Effect.gen(function*() {\n      while (true) {\n        const acquired = yield* gate(\n          fs,\n          directory,\n          Effect.gen(function*() {\n            if (yield* activeMarker(fs, directory, failure)) return false\n            return yield* Effect.uninterruptible(\n              fs.writeFileString(marker, owner, { flag: \"wx\", mode: 0o600 }).pipe(\n                Effect.andThen(Effect.sync(() => {\n                  ownsMarker = true\n                  return true\n                })),\n                Effect.catch((cause): Effect.Effect<boolean, E2> =>\n                  isReason(cause, \"AlreadyExists\") ? Effect.succeed(false) : Effect.fail(failure(cause))\n                )\n              )\n            )\n          }),\n          failure\n        )\n        if (acquired) return\n        yield* Effect.sleep(retryEvery)\n      }\n    }).pipe(\n      Effect.timeout(acquireWithin),\n      Effect.catchTag(\"TimeoutError\", (cause) => Effect.fail(failure(cause)))\n    )\n\n    // Install marker cleanup before acquisition, including gate release. The\n    // marker write and ownership bookkeeping complete in one interruption mask.\n    return yield* Effect.acquireUseRelease(\n      Effect.void,\n      () =>\n        acquire.pipe(Effect.andThen(\n          Effect.scoped(Effect.gen(function*() {\n            yield* Effect.forkScoped(\n              Effect.gen(function*() {\n                while (true) {\n                  yield* Effect.sleep(heartbeatEvery)\n                  const reclaimed = yield* gate(\n                    fs,\n                    directory,\n                    fs.readFileString(marker).pipe(\n                      Effect.map(Option.some),\n                      Effect.catch((cause) =>\n                        isReason(cause, \"NotFound\") ? Effect.succeed(Option.none<string>()) : Effect.fail(cause)\n                      ),\n                      Effect.flatMap((found) => {\n                        // A missing or foreign marker means a sweep judged this\n                        // lease stale and reaped it: deletion is no longer\n                        // fenced while the backup still copies. The sibling\n                        // `internal/ArtifactLocks.ts` heartbeat reports the same\n                        // loss the same way. A reaped marker is never handed\n                        // back, so the loss is reported once and the heartbeat\n                        // ends instead of repeating it every tick.\n                        if (Option.getOrUndefined(found) !== owner) {\n                          return Effect.as(\n                            Effect.logWarning(\n                              \"Artifact backup lease was reclaimed while its backup was still running\"\n                            ),\n                            true\n                          )\n                        }\n                        return Effect.flatMap(Clock.currentTimeMillis, (now) => {\n                          const timestamp = new Date(now)\n                          return Effect.as(fs.utimes(marker, timestamp, timestamp), false)\n                        })\n                      }),\n                      Effect.mapError(failure)\n                    ),\n                    failure\n                  ).pipe(\n                    // A failed heartbeat is retried on the next tick, but a\n                    // minute of them lets the marker go stale, so each one is\n                    // reported rather than dropped.\n                    Effect.catch((cause) =>\n                      Effect.as(Effect.logWarning(\"Artifact backup lease heartbeat failed\", cause), false)\n                    )\n                  )\n                  if (reclaimed) return\n                }\n              })\n            )\n            return yield* effect\n          }))\n        )),\n      () =>\n        ownsMarker\n          ? gate(\n            fs,\n            directory,\n            fs.readFileString(marker).pipe(\n              Effect.flatMap((found) => found === owner ? fs.remove(marker) : Effect.void),\n              // A backup whose heartbeat lapsed has its marker reaped by whoever\n              // noticed, so `NotFound` is the ordinary end of a slow lease, not a\n              // fault: there is nothing left to release and nothing left to leak.\n              // The sibling release in `internal/ArtifactLocks.ts` classifies the\n              // same cause the same way.\n              Effect.catch((cause): Effect.Effect<void, PlatformError.PlatformError> =>\n                isReason(cause, \"NotFound\") ? Effect.void : Effect.fail(cause)\n              )\n            ),\n            failure\n          ).pipe(\n            Effect.catch((cause) => Effect.logWarning(\"Artifact backup lease release failed\", cause))\n          )\n          : Effect.void\n    )\n  })\n\n/**\n * Runs one sweep deletion only when no live backup lease exists. The marker\n * check and `effect` share the global gate, closing the check/delete race.\n * `None` means a backup deliberately fenced the operation.\n *\n * @category combinators\n * @since 1.0.0-rc.0\n */\nexport const unlessActive = <A, E, R, E2>(\n  fs: FileSystem.FileSystem,\n  directory: string,\n  effect: Effect.Effect<A, E, R>,\n  failure: (cause: unknown) => E2\n): Effect.Effect<Option.Option<A>, E | E2, R> =>\n  gate(\n    fs,\n    directory,\n    Effect.gen(function*() {\n      if (yield* activeMarker(fs, directory, failure)) return Option.none<A>()\n      return Option.some(yield* effect)\n    }),\n    failure\n  )\n"]}

package/dist/esm/ArtifactSweep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ArtifactSweep.d.ts","sourceRoot":"","sources":["../../src/ArtifactSweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAIrC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAInD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;IACpF;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,EAAE,CACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,aAAa,KACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAC9D;;AAED;;;;;;;;;GASG;AACH,qBAAa,aAAc,SAAQ,kBAA4E;CAAG;AAelH;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAA;CAC3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,cAAc,GACzB,IAAI,UAAU,CAAC,UAAU,EACzB,UAAS,YAAiB,KACzB,OAiHF,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAC1B,UAAS,YAAiB,KACzB,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CAC2C,CAAA;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,GAAI,YAAW,OAAO,CAAC,OAAO,CAAM,KAAG,OAI1D,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,GAAI,YAAW,OAAO,CAAC,OAAO,CAAM,KAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CACnC,CAAA"}
+{"version":3,"file":"ArtifactSweep.d.ts","sourceRoot":"","sources":["../../src/ArtifactSweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAIrC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAInD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;IACpF;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,EAAE,CACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,aAAa,KACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAC9D;;AAED;;;;;;;;;GASG;AACH,qBAAa,aAAc,SAAQ,kBAA4E;CAAG;AAelH;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAA;CAC3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,cAAc,GACzB,IAAI,UAAU,CAAC,UAAU,EACzB,UAAS,YAAiB,KACzB,OA2HF,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAC1B,UAAS,YAAiB,KACzB,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CAC2C,CAAA;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,GAAI,YAAW,OAAO,CAAC,OAAO,CAAM,KAAG,OAI1D,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,GAAI,YAAW,OAAO,CAAC,OAAO,CAAM,KAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CACnC,CAAA"}

package/dist/esm/ArtifactSweep.js

@@ -132,6 +132,15 @@ export const makeFileSystem = (fs, options = {}) => {
     });
     const remove = Effect.fn("ArtifactSweep.remove")((digest, removeOptions) => Effect.gen(function* () {
         const validated = yield* ArtifactStore.validateDigest(digest);
+        const bound = removeOptions?.ifUnmodifiedSinceMs;
+        // NaN fails every comparison, so the fence below would read it as "not
+        // modified since" and delete a blob a concurrent put just freshened.
+        if (bound !== undefined && (typeof bound !== "number" || Number.isNaN(bound))) {
+            return yield* Effect.fail(new ArtifactStore.ArtifactStoreError({
+                code: "invalid_configuration",
+                message: "invalid sweep option: ifUnmodifiedSinceMs"
+            }));
+        }
         yield* Effect.annotateCurrentSpan({ digest: validated });
         const checkRoot = yield* ArtifactPath.guard(fs, directory).pipe(Effect.mapError(hostFailure));
         const checkParent = yield* ArtifactPath.guard(fs, `${directory}/${validated.slice(0, 2)}`).pipe(Effect.mapError(hostFailure));
@@ -144,7 +153,6 @@ export const makeFileSystem = (fs, options = {}) => {
                 yield* checkRoot.pipe(Effect.mapError(hostFailure));
                 yield* checkParent.pipe(Effect.mapError(hostFailure));
                 const checkBlob = yield* ArtifactPath.guard(fs, path, "File").pipe(Effect.mapError(hostFailure));
-                const bound = removeOptions?.ifUnmodifiedSinceMs;
                 if (bound !== undefined) {
                     const info = yield* fs.stat(path).pipe(Effect.option);
                     // Already gone is a completed deletion, and an unmeasurable mtime is

package/dist/esm/ArtifactSweep.js.map

@@ -1 +1 @@
-{"version":3,"file":"ArtifactSweep.js","sourceRoot":"","sources":["../../src/ArtifactSweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,mBAAmB,MAAM,0BAA0B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAC5D,OAAO,KAAK,YAAY,MAAM,4BAA4B,CAAA;AAuE1D;;;;;;;;;GASG;AACH,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAA0B,CAAC,iCAAiC,CAAC;CAAG;AAElH,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,KAAe,EAAoC,EAAE,CACnF,IAAI,aAAa,CAAC,kBAAkB,CAAC;IACnC,IAAI,EAAE,aAAa;IACnB,OAAO;IACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;CAC1C,CAAC,CAAA;AAEJ,MAAM,WAAW,GAAG,CAAC,KAAc,EAAoC,EAAE,CACvE,KAAK,CAAC,kDAAkD,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;AAEjF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAW,EAAE,CAC7C,KAAK,YAAY,aAAa,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAA;AA6BlF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,EAAyB,EACzB,UAAwB,EAAE,EACjB,EAAE;IACX,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;IACnG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,UAAU,CAAA;IACvD,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAA;IAE3F,MAAM,SAAS,GAAyB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1D,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAmB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CACnH,CAAA;QACD,MAAM,OAAO,GAAkB,EAAE,CAAA;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAQ;YAC3C,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;YACnD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACxF,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,IAAI,CACrE,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAmB,CAAC,CAChD,CAAA;YACD,KAAK,MAAM,KAAK,IAAI,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;YACzC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;YACzC,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;YACzC,iEAAiE;YACjE,4DAA4D;YAC5D,kEAAkE;YAClE,kDAAkD;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACtC,KAAK,CAAC,CAAC,SAAS,CAAA;gBAChB,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC,CAAA;gBACpD,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;gBAC9D,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC,CAAA;YAChD,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACtB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,SAAS,CAAA;YACvE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACrD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO;gBACL,MAAM;gBACN,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE;gBAC7B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;aACnC,CAAA;QACH,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAsB,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,CAC5F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC7D,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QAC7F,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAC7F,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC7B,CAAA;QACD,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,CACpC,EAAE,EACF,SAAS,EACT,SAAS,EACT,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,UAAU,EAAE;YACd,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAC1C,EACH,WAAW,EACX,YAAY,CACb,CAAA;QAED,SAAS,UAAU;YACjB,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;gBAChC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACnD,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACrD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBAChG,MAAM,KAAK,GAAG,aAAa,EAAE,mBAAmB,CAAA;gBAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;oBACrD,qEAAqE;oBACrE,mDAAmD;oBACnD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;wBAAE,OAAO,KAAK,CAAA;oBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;oBACrD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK;wBAAE,OAAO,KAAK,CAAA;gBAClE,CAAC;gBACD,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACnD,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACrD,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACnD,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAChC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;gBACf,oEAAoE;gBACpE,yDAAyD;gBACzD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAClB,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,EAC3F,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC/F,CACF,CACF,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AAC9B,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAAwB,EAAE,EACgC,EAAE,CAC5D,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;AAErG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,YAA8B,EAAE,EAAW,EAAE,CAAC,CAAC;IACtE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5F,GAAG,SAAS;CACb,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,YAA8B,EAAE,EAA8B,EAAE,CACxF,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA","sourcesContent":["/**\n * The sweep half of artifact garbage collection: enumerate this host's blobs\n * and delete one, fenced by its age.\n *\n * This surface is deliberately NOT part of `ArtifactStore.Service`. The store\n * contract is shared by memory, filesystem, and network tiers, and a remote\n * tier can neither enumerate its address space nor accept a delete — Bazel\n * draws the same line: its disk-cache collector\n * (class `DiskCacheGarbageCollector` in\n * `com.google.devtools.build.lib.remote.disk`) walks the local directory, while\n * the remote tier owns its own retention. Only the\n * host-local filesystem store implements this.\n *\n * The *policy* — which digests are live, how old a dead blob must be before it\n * goes — belongs to the engine composition, which is the only place the\n * durable roots (attempt rows, cache entries) are visible. This module ships\n * mechanics alone; `@smthrs/engine-store` owns the mark policy and grace\n * period.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport * as FileSystem from \"effect/FileSystem\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport * as PlatformError from \"effect/PlatformError\"\nimport * as ArtifactBackupLease from \"./ArtifactBackupLease.ts\"\nimport * as ArtifactStore from \"./ArtifactStore.ts\"\nimport * as ArtifactLocks from \"./internal/ArtifactLocks.ts\"\nimport * as ArtifactPath from \"./internal/ArtifactPath.ts\"\n\n/**\n * One enumerated blob: its content address, when it was last written or\n * freshened, and its size.\n *\n * `modifiedAtMs` is the age evidence a sweep fences on — the same signal git\n * (`git prune --expire`) and Bazel's disk-cache collector read, because it is\n * the one timestamp a filesystem maintains without any bookkeeping of ours.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport interface BlobStat {\n  readonly digest: string\n  readonly modifiedAtMs: number\n  readonly sizeBytes: number\n}\n\n/**\n * Fencing predicate for a sweep deletion.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport interface RemoveOptions {\n  /**\n   * Deletes the blob only while its mtime is still at or before this bound.\n   * A blob freshened after the caller computed its live set — a concurrent\n   * `put` re-referencing the same bytes — fails the fence and survives, the\n   * same shape as `CacheStore.evict`'s `ifRecordedBy`: the guard rides in the\n   * delete, never in a prior read alone.\n   */\n  readonly ifUnmodifiedSinceMs?: number | undefined\n}\n\n/**\n * Host-local blob enumeration and fenced deletion.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport interface Service {\n  /**\n   * Every content-addressed blob this host's store currently holds. In-flight\n   * `.tmp-*` scratch files, foreign files, and blobs whose age cannot be\n   * measured are excluded — what the sweep cannot judge it must not touch.\n   */\n  readonly inventory: Effect.Effect<Array<BlobStat>, ArtifactStore.ArtifactStoreError>\n  /**\n   * Deletes the blob at `digest`, returning whether bytes were removed. A\n   * missing blob reports `false` rather than failing, so a crashed and\n   * re-run sweep converges instead of erroring on its own progress.\n   *\n   * `false` covers three outcomes a caller cannot tell apart, all of which mean\n   * \"nothing was reclaimed, and retrying later is safe\": the blob was already\n   * gone, it failed the `ifUnmodifiedSinceMs` fence, or a live backup lease\n   * fenced the deletion (see `ArtifactBackupLease`). The last one is not\n   * progress — the blob is still there — so a collector that counts reclaimed\n   * bytes must not count it, and the next pass after the backup finishes\n   * removes it.\n   */\n  readonly remove: (\n    digest: string,\n    options?: RemoveOptions\n  ) => Effect.Effect<boolean, ArtifactStore.ArtifactStoreError>\n}\n\n/**\n * Service tag for host-local artifact sweeping.\n *\n * The identity string equals this module's package path, per the house rule\n * that a new identity is the defining module path.\n *\n * @category services\n * @since 1.0.0-rc.0\n * @slop\n */\nexport class ArtifactSweep extends Context.Service<ArtifactSweep, Service>()(\"@smthrs/artifacts/ArtifactSweep\") {}\n\nconst error = (message: string, cause?: unknown): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({\n    code: \"unavailable\",\n    message,\n    ...(cause === undefined ? {} : { cause })\n  })\n\nconst hostFailure = (cause: unknown): ArtifactStore.ArtifactStoreError =>\n  error(`the host filesystem refused a sweep operation: ${String(cause)}`, cause)\n\nconst isNotFound = (cause: unknown): boolean =>\n  cause instanceof PlatformError.PlatformError && cause.reason._tag === \"NotFound\"\n\n/**\n * How the sweep reaches the objects directory.\n *\n * Deliberately not `ArtifactStore.FileSystemOptions`: the sweep never writes a\n * blob, so `durability` would be an accepted argument it ignores. Both fields\n * must match the store built over the same directory — see `coordination`.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface SweepOptions {\n  /**\n   * The objects directory to enumerate, the one the paired\n   * `ArtifactStore.makeFileSystem` publishes into. Defaults to\n   * `ArtifactStore.defaultDirectory`.\n   */\n  readonly directory?: string | undefined\n  /**\n   * `required` takes the same per-digest lock file a publishing writer takes,\n   * and consults the backup lease, before deleting. It fences nothing unless\n   * the paired store was built with `required` too: a store on `process` never\n   * takes the lock this sweep waits on, so the fence would read as armed while\n   * protecting nothing. `process` is the explicit weaker browser/test mode.\n   */\n  readonly coordination?: \"required\" | \"process\" | undefined\n}\n\n/**\n * Builds the filesystem-backed sweep surface over the same objects directory\n * an `ArtifactStore.makeFileSystem` publishes into.\n *\n * Enumeration is conservative by construction. Only paths in the store's\n * canonical fanout shape — `xx/<digest>` with `xx` equal to the digest's\n * two-hex prefix — are blobs; anything else in the directory (a temp file, a\n * lock file, a foreign file, a fanout directory itself) is skipped, never\n * deleted. A blob that vanishes between listing and stat was removed by someone\n * else and is likewise skipped.\n *\n * Pair it with the store over the SAME `directory` and the SAME `coordination`.\n * Nothing checks the pairing, and a mismatch is silent: a sweep on `required`\n * beside a store on `process` deletes blobs no writer is fenced against.\n *\n * Under `required`, one deletion costs two lock acquisitions — the per-digest\n * lock, then the workspace-global backup-lease gate — which is roughly ten\n * filesystem operations and two forked heartbeat fibers per blob. The gate is\n * one file for the whole workspace, so concurrent deletions serialize through\n * it. That is the price of never deleting a blob a running backup already\n * recorded; size a collection window with it in mind.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const makeFileSystem = (\n  fs: FileSystem.FileSystem,\n  options: SweepOptions = {}\n): Service => {\n  const directory = (options.directory ?? ArtifactStore.defaultDirectory).replace(/([^/])\\/+$/, \"$1\")\n  const coordination = options.coordination ?? \"required\"\n  const blobPath = (digest: string): string => `${directory}/${digest.slice(0, 2)}/${digest}`\n\n  const inventory: Service[\"inventory\"] = Effect.gen(function*() {\n    // A store that never published anything has no directory; that is an\n    // empty inventory, not a failure.\n    const checkRoot = yield* ArtifactPath.guard(fs, directory).pipe(Effect.mapError(hostFailure))\n    const parents = yield* fs.readDirectory(directory).pipe(\n      Effect.catch((cause) => isNotFound(cause) ? Effect.succeed([] as Array<string>) : Effect.fail(hostFailure(cause)))\n    )\n    const entries: Array<string> = []\n    for (const parent of parents) {\n      if (!/^[0-9a-f]{2}$/.test(parent)) continue\n      yield* checkRoot.pipe(Effect.mapError(hostFailure))\n      const safe = yield* ArtifactPath.guard(fs, `${directory}/${parent}`).pipe(Effect.option)\n      if (Option.isNone(safe)) continue\n      const children = yield* fs.readDirectory(`${directory}/${parent}`).pipe(\n        Effect.orElseSucceed(() => [] as Array<string>)\n      )\n      for (const child of children) entries.push(`${parent}/${child}`)\n    }\n    const candidates = entries.filter((entry) => {\n      if (entry.includes(\".tmp-\")) return false\n      const separator = entry.indexOf(\"/\")\n      const fan = entry.slice(0, separator)\n      const digest = entry.slice(separator + 1)\n      return /^[0-9a-f]{64}$/.test(digest) && fan === digest.slice(0, 2)\n    })\n    const blobs = yield* Effect.forEach(candidates, (entry) =>\n      Effect.gen(function*() {\n        const separator = entry.indexOf(\"/\")\n        const fan = entry.slice(0, separator)\n        const digest = entry.slice(separator + 1)\n        // The stat is per-candidate and tolerant: a blob another process\n        // removed between the listing and here simply is not in the\n        // inventory, and one whose mtime the host cannot report offers no\n        // age evidence, so the sweep must never judge it.\n        const info = yield* Effect.gen(function*() {\n          yield* checkRoot\n          yield* ArtifactPath.guard(fs, `${directory}/${fan}`)\n          yield* ArtifactPath.guard(fs, `${directory}/${entry}`, \"File\")\n          return yield* fs.stat(`${directory}/${entry}`)\n        }).pipe(Effect.option)\n        if (Option.isNone(info) || info.value.type !== \"File\") return undefined\n        const mtime = Option.getOrUndefined(info.value.mtime)\n        if (mtime === undefined) return undefined\n        return {\n          digest,\n          modifiedAtMs: mtime.getTime(),\n          sizeBytes: Number(info.value.size)\n        }\n      }), { concurrency: 16 })\n    return blobs.filter((blob) => blob !== undefined)\n  })\n\n  const remove: Service[\"remove\"] = Effect.fn(\"ArtifactSweep.remove\")((digest, removeOptions) =>\n    Effect.gen(function*() {\n      const validated = yield* ArtifactStore.validateDigest(digest)\n      yield* Effect.annotateCurrentSpan({ digest: validated })\n      const checkRoot = yield* ArtifactPath.guard(fs, directory).pipe(Effect.mapError(hostFailure))\n      const checkParent = yield* ArtifactPath.guard(fs, `${directory}/${validated.slice(0, 2)}`).pipe(\n        Effect.mapError(hostFailure)\n      )\n      return yield* ArtifactLocks.withDigest(\n        fs,\n        directory,\n        validated,\n        coordination === \"process\"\n          ? removeBlob()\n          : ArtifactBackupLease.unlessActive(fs, directory, removeBlob(), hostFailure).pipe(\n            Effect.map(Option.getOrElse(() => false))\n          ),\n        hostFailure,\n        coordination\n      )\n\n      function removeBlob(): Effect.Effect<boolean, ArtifactStore.ArtifactStoreError> {\n        return Effect.gen(function*() {\n          const path = blobPath(validated)\n          yield* checkRoot.pipe(Effect.mapError(hostFailure))\n          yield* checkParent.pipe(Effect.mapError(hostFailure))\n          const checkBlob = yield* ArtifactPath.guard(fs, path, \"File\").pipe(Effect.mapError(hostFailure))\n          const bound = removeOptions?.ifUnmodifiedSinceMs\n          if (bound !== undefined) {\n            const info = yield* fs.stat(path).pipe(Effect.option)\n            // Already gone is a completed deletion, and an unmeasurable mtime is\n            // no proof of age: both refuse rather than delete.\n            if (Option.isNone(info)) return false\n            const mtime = Option.getOrUndefined(info.value.mtime)\n            if (mtime === undefined || mtime.getTime() > bound) return false\n          }\n          yield* checkRoot.pipe(Effect.mapError(hostFailure))\n          yield* checkParent.pipe(Effect.mapError(hostFailure))\n          yield* checkBlob.pipe(Effect.mapError(hostFailure))\n          return yield* fs.remove(path).pipe(\n            Effect.as(true),\n            // The blob may have been removed between the fence and here; only a\n            // refusal over bytes that still exist is a host failure.\n            Effect.catch((cause) =>\n              fs.exists(path).pipe(\n                Effect.mapError((probeCause) => hostFailure({ remove: cause, existenceProbe: probeCause })),\n                Effect.flatMap((present) => present ? Effect.fail(hostFailure(cause)) : Effect.succeed(false))\n              )\n            )\n          )\n        })\n      }\n    })\n  )\n\n  return { inventory, remove }\n}\n\n/**\n * Provides the filesystem-backed sweep surface.\n *\n * Give it the same `directory` and `coordination` as the `ArtifactStore` layer\n * it sweeps behind; see {@link makeFileSystem}.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layerFileSystem = (\n  options: SweepOptions = {}\n): Layer.Layer<ArtifactSweep, never, FileSystem.FileSystem> =>\n  Layer.effect(ArtifactSweep)(Effect.map(FileSystem.FileSystem, (fs) => makeFileSystem(fs, options)))\n\n/**\n * Builds a sweep surface whose every operation fails as unavailable, with\n * per-method overrides.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const makeNoop = (overrides: Partial<Service> = {}): Service => ({\n  inventory: Effect.fail(error(\"inventory is unavailable\")),\n  remove: Effect.fn(\"ArtifactSweep.remove\")(() => Effect.fail(error(\"remove is unavailable\"))),\n  ...overrides\n})\n\n/**\n * Provides a no-op sweep surface.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layerNoop = (overrides: Partial<Service> = {}): Layer.Layer<ArtifactSweep> =>\n  Layer.succeed(ArtifactSweep)(makeNoop(overrides))\n"]}
+{"version":3,"file":"ArtifactSweep.js","sourceRoot":"","sources":["../../src/ArtifactSweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,mBAAmB,MAAM,0BAA0B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAC5D,OAAO,KAAK,YAAY,MAAM,4BAA4B,CAAA;AAuE1D;;;;;;;;;GASG;AACH,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAA0B,CAAC,iCAAiC,CAAC;CAAG;AAElH,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,KAAe,EAAoC,EAAE,CACnF,IAAI,aAAa,CAAC,kBAAkB,CAAC;IACnC,IAAI,EAAE,aAAa;IACnB,OAAO;IACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;CAC1C,CAAC,CAAA;AAEJ,MAAM,WAAW,GAAG,CAAC,KAAc,EAAoC,EAAE,CACvE,KAAK,CAAC,kDAAkD,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;AAEjF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAW,EAAE,CAC7C,KAAK,YAAY,aAAa,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAA;AA6BlF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,EAAyB,EACzB,UAAwB,EAAE,EACjB,EAAE;IACX,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;IACnG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,UAAU,CAAA;IACvD,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAA;IAE3F,MAAM,SAAS,GAAyB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1D,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAmB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CACnH,CAAA;QACD,MAAM,OAAO,GAAkB,EAAE,CAAA;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAQ;YAC3C,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;YACnD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACxF,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,IAAI,CACrE,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAmB,CAAC,CAChD,CAAA;YACD,KAAK,MAAM,KAAK,IAAI,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;YACzC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;YACzC,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;YACzC,iEAAiE;YACjE,4DAA4D;YAC5D,kEAAkE;YAClE,kDAAkD;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACtC,KAAK,CAAC,CAAC,SAAS,CAAA;gBAChB,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC,CAAA;gBACpD,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;gBAC9D,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC,CAAA;YAChD,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACtB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,SAAS,CAAA;YACvE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACrD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO;gBACL,MAAM;gBACN,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE;gBAC7B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;aACnC,CAAA;QACH,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAsB,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,CAC5F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,KAAK,GAAG,aAAa,EAAE,mBAAmB,CAAA;QAChD,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,aAAa,CAAC,kBAAkB,CAAC;gBACnC,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,2CAA2C;aACrD,CAAC,CACH,CAAA;QACH,CAAC;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACxD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QAC7F,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAC7F,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC7B,CAAA;QACD,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,CACpC,EAAE,EACF,SAAS,EACT,SAAS,EACT,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,UAAU,EAAE;YACd,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAC1C,EACH,WAAW,EACX,YAAY,CACb,CAAA;QAED,SAAS,UAAU;YACjB,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;gBAChC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACnD,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACrD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBAChG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;oBACrD,qEAAqE;oBACrE,mDAAmD;oBACnD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;wBAAE,OAAO,KAAK,CAAA;oBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;oBACrD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK;wBAAE,OAAO,KAAK,CAAA;gBAClE,CAAC;gBACD,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACnD,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACrD,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACnD,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAChC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;gBACf,oEAAoE;gBACpE,yDAAyD;gBACzD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAClB,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,EAC3F,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC/F,CACF,CACF,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AAC9B,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAAwB,EAAE,EACgC,EAAE,CAC5D,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;AAErG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,YAA8B,EAAE,EAAW,EAAE,CAAC,CAAC;IACtE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5F,GAAG,SAAS;CACb,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,YAA8B,EAAE,EAA8B,EAAE,CACxF,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA","sourcesContent":["/**\n * The sweep half of artifact garbage collection: enumerate this host's blobs\n * and delete one, fenced by its age.\n *\n * This surface is deliberately NOT part of `ArtifactStore.Service`. The store\n * contract is shared by memory, filesystem, and network tiers, and a remote\n * tier can neither enumerate its address space nor accept a delete — Bazel\n * draws the same line: its disk-cache collector\n * (class `DiskCacheGarbageCollector` in\n * `com.google.devtools.build.lib.remote.disk`) walks the local directory, while\n * the remote tier owns its own retention. Only the\n * host-local filesystem store implements this.\n *\n * The *policy* — which digests are live, how old a dead blob must be before it\n * goes — belongs to the engine composition, which is the only place the\n * durable roots (attempt rows, cache entries) are visible. This module ships\n * mechanics alone; `@smthrs/engine-store` owns the mark policy and grace\n * period.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport * as FileSystem from \"effect/FileSystem\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport * as PlatformError from \"effect/PlatformError\"\nimport * as ArtifactBackupLease from \"./ArtifactBackupLease.ts\"\nimport * as ArtifactStore from \"./ArtifactStore.ts\"\nimport * as ArtifactLocks from \"./internal/ArtifactLocks.ts\"\nimport * as ArtifactPath from \"./internal/ArtifactPath.ts\"\n\n/**\n * One enumerated blob: its content address, when it was last written or\n * freshened, and its size.\n *\n * `modifiedAtMs` is the age evidence a sweep fences on — the same signal git\n * (`git prune --expire`) and Bazel's disk-cache collector read, because it is\n * the one timestamp a filesystem maintains without any bookkeeping of ours.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport interface BlobStat {\n  readonly digest: string\n  readonly modifiedAtMs: number\n  readonly sizeBytes: number\n}\n\n/**\n * Fencing predicate for a sweep deletion.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport interface RemoveOptions {\n  /**\n   * Deletes the blob only while its mtime is still at or before this bound.\n   * A blob freshened after the caller computed its live set — a concurrent\n   * `put` re-referencing the same bytes — fails the fence and survives, the\n   * same shape as `CacheStore.evict`'s `ifRecordedBy`: the guard rides in the\n   * delete, never in a prior read alone.\n   */\n  readonly ifUnmodifiedSinceMs?: number | undefined\n}\n\n/**\n * Host-local blob enumeration and fenced deletion.\n *\n * @category models\n * @since 1.0.0-rc.0\n * @slop\n */\nexport interface Service {\n  /**\n   * Every content-addressed blob this host's store currently holds. In-flight\n   * `.tmp-*` scratch files, foreign files, and blobs whose age cannot be\n   * measured are excluded — what the sweep cannot judge it must not touch.\n   */\n  readonly inventory: Effect.Effect<Array<BlobStat>, ArtifactStore.ArtifactStoreError>\n  /**\n   * Deletes the blob at `digest`, returning whether bytes were removed. A\n   * missing blob reports `false` rather than failing, so a crashed and\n   * re-run sweep converges instead of erroring on its own progress.\n   *\n   * `false` covers three outcomes a caller cannot tell apart, all of which mean\n   * \"nothing was reclaimed, and retrying later is safe\": the blob was already\n   * gone, it failed the `ifUnmodifiedSinceMs` fence, or a live backup lease\n   * fenced the deletion (see `ArtifactBackupLease`). The last one is not\n   * progress — the blob is still there — so a collector that counts reclaimed\n   * bytes must not count it, and the next pass after the backup finishes\n   * removes it.\n   */\n  readonly remove: (\n    digest: string,\n    options?: RemoveOptions\n  ) => Effect.Effect<boolean, ArtifactStore.ArtifactStoreError>\n}\n\n/**\n * Service tag for host-local artifact sweeping.\n *\n * The identity string equals this module's package path, per the house rule\n * that a new identity is the defining module path.\n *\n * @category services\n * @since 1.0.0-rc.0\n * @slop\n */\nexport class ArtifactSweep extends Context.Service<ArtifactSweep, Service>()(\"@smthrs/artifacts/ArtifactSweep\") {}\n\nconst error = (message: string, cause?: unknown): ArtifactStore.ArtifactStoreError =>\n  new ArtifactStore.ArtifactStoreError({\n    code: \"unavailable\",\n    message,\n    ...(cause === undefined ? {} : { cause })\n  })\n\nconst hostFailure = (cause: unknown): ArtifactStore.ArtifactStoreError =>\n  error(`the host filesystem refused a sweep operation: ${String(cause)}`, cause)\n\nconst isNotFound = (cause: unknown): boolean =>\n  cause instanceof PlatformError.PlatformError && cause.reason._tag === \"NotFound\"\n\n/**\n * How the sweep reaches the objects directory.\n *\n * Deliberately not `ArtifactStore.FileSystemOptions`: the sweep never writes a\n * blob, so `durability` would be an accepted argument it ignores. Both fields\n * must match the store built over the same directory — see `coordination`.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface SweepOptions {\n  /**\n   * The objects directory to enumerate, the one the paired\n   * `ArtifactStore.makeFileSystem` publishes into. Defaults to\n   * `ArtifactStore.defaultDirectory`.\n   */\n  readonly directory?: string | undefined\n  /**\n   * `required` takes the same per-digest lock file a publishing writer takes,\n   * and consults the backup lease, before deleting. It fences nothing unless\n   * the paired store was built with `required` too: a store on `process` never\n   * takes the lock this sweep waits on, so the fence would read as armed while\n   * protecting nothing. `process` is the explicit weaker browser/test mode.\n   */\n  readonly coordination?: \"required\" | \"process\" | undefined\n}\n\n/**\n * Builds the filesystem-backed sweep surface over the same objects directory\n * an `ArtifactStore.makeFileSystem` publishes into.\n *\n * Enumeration is conservative by construction. Only paths in the store's\n * canonical fanout shape — `xx/<digest>` with `xx` equal to the digest's\n * two-hex prefix — are blobs; anything else in the directory (a temp file, a\n * lock file, a foreign file, a fanout directory itself) is skipped, never\n * deleted. A blob that vanishes between listing and stat was removed by someone\n * else and is likewise skipped.\n *\n * Pair it with the store over the SAME `directory` and the SAME `coordination`.\n * Nothing checks the pairing, and a mismatch is silent: a sweep on `required`\n * beside a store on `process` deletes blobs no writer is fenced against.\n *\n * Under `required`, one deletion costs two lock acquisitions — the per-digest\n * lock, then the workspace-global backup-lease gate — which is roughly ten\n * filesystem operations and two forked heartbeat fibers per blob. The gate is\n * one file for the whole workspace, so concurrent deletions serialize through\n * it. That is the price of never deleting a blob a running backup already\n * recorded; size a collection window with it in mind.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const makeFileSystem = (\n  fs: FileSystem.FileSystem,\n  options: SweepOptions = {}\n): Service => {\n  const directory = (options.directory ?? ArtifactStore.defaultDirectory).replace(/([^/])\\/+$/, \"$1\")\n  const coordination = options.coordination ?? \"required\"\n  const blobPath = (digest: string): string => `${directory}/${digest.slice(0, 2)}/${digest}`\n\n  const inventory: Service[\"inventory\"] = Effect.gen(function*() {\n    // A store that never published anything has no directory; that is an\n    // empty inventory, not a failure.\n    const checkRoot = yield* ArtifactPath.guard(fs, directory).pipe(Effect.mapError(hostFailure))\n    const parents = yield* fs.readDirectory(directory).pipe(\n      Effect.catch((cause) => isNotFound(cause) ? Effect.succeed([] as Array<string>) : Effect.fail(hostFailure(cause)))\n    )\n    const entries: Array<string> = []\n    for (const parent of parents) {\n      if (!/^[0-9a-f]{2}$/.test(parent)) continue\n      yield* checkRoot.pipe(Effect.mapError(hostFailure))\n      const safe = yield* ArtifactPath.guard(fs, `${directory}/${parent}`).pipe(Effect.option)\n      if (Option.isNone(safe)) continue\n      const children = yield* fs.readDirectory(`${directory}/${parent}`).pipe(\n        Effect.orElseSucceed(() => [] as Array<string>)\n      )\n      for (const child of children) entries.push(`${parent}/${child}`)\n    }\n    const candidates = entries.filter((entry) => {\n      if (entry.includes(\".tmp-\")) return false\n      const separator = entry.indexOf(\"/\")\n      const fan = entry.slice(0, separator)\n      const digest = entry.slice(separator + 1)\n      return /^[0-9a-f]{64}$/.test(digest) && fan === digest.slice(0, 2)\n    })\n    const blobs = yield* Effect.forEach(candidates, (entry) =>\n      Effect.gen(function*() {\n        const separator = entry.indexOf(\"/\")\n        const fan = entry.slice(0, separator)\n        const digest = entry.slice(separator + 1)\n        // The stat is per-candidate and tolerant: a blob another process\n        // removed between the listing and here simply is not in the\n        // inventory, and one whose mtime the host cannot report offers no\n        // age evidence, so the sweep must never judge it.\n        const info = yield* Effect.gen(function*() {\n          yield* checkRoot\n          yield* ArtifactPath.guard(fs, `${directory}/${fan}`)\n          yield* ArtifactPath.guard(fs, `${directory}/${entry}`, \"File\")\n          return yield* fs.stat(`${directory}/${entry}`)\n        }).pipe(Effect.option)\n        if (Option.isNone(info) || info.value.type !== \"File\") return undefined\n        const mtime = Option.getOrUndefined(info.value.mtime)\n        if (mtime === undefined) return undefined\n        return {\n          digest,\n          modifiedAtMs: mtime.getTime(),\n          sizeBytes: Number(info.value.size)\n        }\n      }), { concurrency: 16 })\n    return blobs.filter((blob) => blob !== undefined)\n  })\n\n  const remove: Service[\"remove\"] = Effect.fn(\"ArtifactSweep.remove\")((digest, removeOptions) =>\n    Effect.gen(function*() {\n      const validated = yield* ArtifactStore.validateDigest(digest)\n      const bound = removeOptions?.ifUnmodifiedSinceMs\n      // NaN fails every comparison, so the fence below would read it as \"not\n      // modified since\" and delete a blob a concurrent put just freshened.\n      if (bound !== undefined && (typeof bound !== \"number\" || Number.isNaN(bound))) {\n        return yield* Effect.fail(\n          new ArtifactStore.ArtifactStoreError({\n            code: \"invalid_configuration\",\n            message: \"invalid sweep option: ifUnmodifiedSinceMs\"\n          })\n        )\n      }\n      yield* Effect.annotateCurrentSpan({ digest: validated })\n      const checkRoot = yield* ArtifactPath.guard(fs, directory).pipe(Effect.mapError(hostFailure))\n      const checkParent = yield* ArtifactPath.guard(fs, `${directory}/${validated.slice(0, 2)}`).pipe(\n        Effect.mapError(hostFailure)\n      )\n      return yield* ArtifactLocks.withDigest(\n        fs,\n        directory,\n        validated,\n        coordination === \"process\"\n          ? removeBlob()\n          : ArtifactBackupLease.unlessActive(fs, directory, removeBlob(), hostFailure).pipe(\n            Effect.map(Option.getOrElse(() => false))\n          ),\n        hostFailure,\n        coordination\n      )\n\n      function removeBlob(): Effect.Effect<boolean, ArtifactStore.ArtifactStoreError> {\n        return Effect.gen(function*() {\n          const path = blobPath(validated)\n          yield* checkRoot.pipe(Effect.mapError(hostFailure))\n          yield* checkParent.pipe(Effect.mapError(hostFailure))\n          const checkBlob = yield* ArtifactPath.guard(fs, path, \"File\").pipe(Effect.mapError(hostFailure))\n          if (bound !== undefined) {\n            const info = yield* fs.stat(path).pipe(Effect.option)\n            // Already gone is a completed deletion, and an unmeasurable mtime is\n            // no proof of age: both refuse rather than delete.\n            if (Option.isNone(info)) return false\n            const mtime = Option.getOrUndefined(info.value.mtime)\n            if (mtime === undefined || mtime.getTime() > bound) return false\n          }\n          yield* checkRoot.pipe(Effect.mapError(hostFailure))\n          yield* checkParent.pipe(Effect.mapError(hostFailure))\n          yield* checkBlob.pipe(Effect.mapError(hostFailure))\n          return yield* fs.remove(path).pipe(\n            Effect.as(true),\n            // The blob may have been removed between the fence and here; only a\n            // refusal over bytes that still exist is a host failure.\n            Effect.catch((cause) =>\n              fs.exists(path).pipe(\n                Effect.mapError((probeCause) => hostFailure({ remove: cause, existenceProbe: probeCause })),\n                Effect.flatMap((present) => present ? Effect.fail(hostFailure(cause)) : Effect.succeed(false))\n              )\n            )\n          )\n        })\n      }\n    })\n  )\n\n  return { inventory, remove }\n}\n\n/**\n * Provides the filesystem-backed sweep surface.\n *\n * Give it the same `directory` and `coordination` as the `ArtifactStore` layer\n * it sweeps behind; see {@link makeFileSystem}.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layerFileSystem = (\n  options: SweepOptions = {}\n): Layer.Layer<ArtifactSweep, never, FileSystem.FileSystem> =>\n  Layer.effect(ArtifactSweep)(Effect.map(FileSystem.FileSystem, (fs) => makeFileSystem(fs, options)))\n\n/**\n * Builds a sweep surface whose every operation fails as unavailable, with\n * per-method overrides.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const makeNoop = (overrides: Partial<Service> = {}): Service => ({\n  inventory: Effect.fail(error(\"inventory is unavailable\")),\n  remove: Effect.fn(\"ArtifactSweep.remove\")(() => Effect.fail(error(\"remove is unavailable\"))),\n  ...overrides\n})\n\n/**\n * Provides a no-op sweep surface.\n *\n * @category layers\n * @since 1.0.0-rc.0\n * @slop\n */\nexport const layerNoop = (overrides: Partial<Service> = {}): Layer.Layer<ArtifactSweep> =>\n  Layer.succeed(ArtifactSweep)(makeNoop(overrides))\n"]}

package/dist/esm/FileLease.d.ts

@@ -34,7 +34,7 @@
  *
  * @since 1.0.0-rc.1
  */
-import type * as Duration from "effect/Duration";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import type * as FileSystem from "effect/FileSystem";
 /**
@@ -50,7 +50,11 @@ export interface Options {
     readonly annotations?: Readonly<Record<string, unknown>> | undefined;
     /** How often the holder refreshes the lock's mtime. Defaults to 10 seconds. */
     readonly heartbeatEvery?: Duration.Input | undefined;
-    /** Age past which a lock or claim is stale. Defaults to 60 000 ms. */
+    /**
+     * Age past which a lock or claim is stale. Defaults to 60 000 ms. Must be a
+     * finite positive number longer than `heartbeatEvery`; anything else fails
+     * the lease through `failure` before the lock is touched.
+     */
     readonly staleAfterMs?: number | undefined;
     /** How long acquisition may wait. Defaults to 2 minutes. */
     readonly acquireWithin?: Duration.Input | undefined;

package/dist/esm/FileLease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FileLease.d.ts","sourceRoot":"","sources":["../../src/FileLease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAKpD;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAA;IACpE,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IACpD,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IACnD,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC;IACjE,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAA;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;CAC1D;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,KAAmB,CAAA;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAczC;;;;;;;;GAQG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAC9B,IAAI,UAAU,CAAC,UAAU,EACzB,UAAU,MAAM,EAChB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,EAAE,EAC/B,UAAS,WAAgB,KACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CA4NzB,CAAA;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EACnC,IAAI,UAAU,CAAC,UAAU,EACzB,UAAU,MAAM,EAChB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,EAAE,EAC/B,UAAS,OAAY,KACpB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAYzB,CAAA"}
+{"version":3,"file":"FileLease.d.ts","sourceRoot":"","sources":["../../src/FileLease.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAKpD;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAA;IACpE,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IACpD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;IACnD,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAA;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC;IACjE,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAA;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;CAC1D;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,KAAmB,CAAA;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAczC;;;;;;;;GAQG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAC9B,IAAI,UAAU,CAAC,UAAU,EACzB,UAAU,MAAM,EAChB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,EAAE,EAC/B,UAAS,WAAgB,KACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAyOzB,CAAA;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EACnC,IAAI,UAAU,CAAC,UAAU,EACzB,UAAU,MAAM,EAChB,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,EAAE,EAC/B,UAAS,OAAY,KACpB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAYzB,CAAA"}