@smthrs/engine-store 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/WorkspaceSandbox.js

@@ -0,0 +1,711 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var WorkspaceSandbox_exports = {};
+__export(WorkspaceSandbox_exports, {
+  EffectDispatcher: () => EffectDispatcher,
+  MaterializationConflict: () => MaterializationConflict,
+  Workspace: () => Workspace,
+  WorkspaceError: () => WorkspaceError,
+  WorkspaceErrorCode: () => WorkspaceErrorCode,
+  WorkspaceSandbox: () => WorkspaceSandbox,
+  isMaterializationConflict: () => isMaterializationConflict,
+  layer: () => layer,
+  layerDispatcher: () => layerDispatcher,
+  layerFileSystem: () => layerFileSystem,
+  make: () => make,
+  makeFileSystem: () => makeFileSystem,
+  makeHosted: () => makeHosted,
+  makeMemory: () => makeMemory,
+  violations: () => violations
+});
+module.exports = __toCommonJS(WorkspaceSandbox_exports);
+var ArtifactStore = __toESM(require("@smthrs/artifacts/ArtifactStore"), 1);
+var FileLease = __toESM(require("@smthrs/artifacts/FileLease"), 1);
+var import_crypto = require("@smthrs/crypto");
+var KernelFileSystem = __toESM(require("@smthrs/kernel/FileSystem"), 1);
+var import_Workspace = require("@smthrs/kernel/Workspace");
+var import_keys = require("@smthrs/keys");
+var FileSet = __toESM(require("@smthrs/plan/FileSet"), 1);
+var Cause = __toESM(require("effect/Cause"), 1);
+var Context = __toESM(require("effect/Context"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Exit = __toESM(require("effect/Exit"), 1);
+var FileSystem = __toESM(require("effect/FileSystem"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+var Metric = __toESM(require("effect/Metric"), 1);
+var Path = __toESM(require("effect/Path"), 1);
+var PlatformError = __toESM(require("effect/PlatformError"), 1);
+var RcMap = __toESM(require("effect/RcMap"), 1);
+var Ref = __toESM(require("effect/Ref"), 1);
+var Result = __toESM(require("effect/Result"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+var Scope = __toESM(require("effect/Scope"), 1);
+var Semaphore = __toESM(require("effect/Semaphore"), 1);
+var EngineStoreMetrics = __toESM(require("./EngineStoreMetrics.js"), 1);
+var FileBoundarySnapshot = __toESM(require("./internal/FileBoundarySnapshot.js"), 1);
+var FileEnumeration = __toESM(require("./internal/FileEnumeration.js"), 1);
+var import_Ordering = require("./internal/Ordering.js");
+const Workspace = Context.Service(
+  "@smthrs/engine-store/WorkspaceSandbox/Workspace"
+);
+const WorkspaceErrorCode = Schema.Literals([
+  "invalid_path",
+  "not_found",
+  "host_unavailable",
+  "path_escapes_workspace",
+  "commit_lock_timeout"
+]);
+class WorkspaceError extends Schema.TaggedError()(
+  "@smthrs/engine-store/WorkspaceError",
+  {
+    code: WorkspaceErrorCode,
+    message: Schema.String,
+    cause: Schema.optional(Schema.Defect())
+  }
+) {
+}
+class MaterializationConflict extends Schema.TaggedError()(
+  "@smthrs/engine-store/MaterializationConflict",
+  {
+    paths: Schema.Array(
+      Schema.NonEmptyString.check(Schema.isMaxLength(4096))
+    ).check(Schema.isMaxLength(1024)),
+    message: Schema.NonEmptyString.check(Schema.isMaxLength(16384))
+  }
+) {
+}
+const isMaterializationConflict = (error) => {
+  if (typeof error !== "object" || error === null) return false;
+  try {
+    if (error instanceof MaterializationConflict) return true;
+    const own = (name) => {
+      const descriptor = Object.getOwnPropertyDescriptor(error, name);
+      return descriptor !== void 0 && descriptor.enumerable && "value" in descriptor ? descriptor.value : void 0;
+    };
+    const paths = own("paths");
+    const message = own("message");
+    if (own("_tag") !== MaterializationConflict.identifier || typeof message !== "string" || message.length === 0 || message.length > 16384 || !Array.isArray(paths) || Object.getPrototypeOf(paths) !== Array.prototype || paths.length > 1024) return false;
+    for (let index = 0; index < paths.length; index++) {
+      const descriptor = Object.getOwnPropertyDescriptor(paths, String(index));
+      if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable || typeof descriptor.value !== "string" || descriptor.value.length === 0 || descriptor.value.length > 4096) return false;
+    }
+    if (Reflect.ownKeys(paths).some(
+      (key) => key !== "length" && (typeof key !== "string" || !/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= paths.length)
+    )) return false;
+    return Reflect.ownKeys(error).every((key) => key === "_tag" || key === "paths" || key === "message");
+  } catch {
+    return false;
+  }
+};
+const WorkspaceSandbox = Context.Service(
+  "@smthrs/engine-store/WorkspaceSandbox"
+);
+const make = (service) => WorkspaceSandbox.of(service);
+const layer = (service) => Layer.succeed(WorkspaceSandbox, make(service));
+const EffectDispatcher = Context.Service(
+  "@smthrs/engine-store/WorkspaceSandbox/EffectDispatcher"
+);
+const layerDispatcher = (dispatcher) => Layer.succeed(EffectDispatcher, EffectDispatcher.of(dispatcher));
+const decoder = new TextDecoder();
+const encoder = new TextEncoder();
+const invalidPath = (path) => new WorkspaceError({
+  code: "invalid_path",
+  message: `Workspace paths must be relative paths inside the workspace without '..': ${path}`
+});
+const normalizePath = (root, path, allowRoot = false) => {
+  const slashed = path.replaceAll("\\", "/");
+  const slashedRoot = root.replaceAll("\\", "/");
+  const rooted = slashed === slashedRoot ? "" : slashedRoot !== "" && slashed.startsWith(`${slashedRoot}/`) ? slashed.slice(slashedRoot.length + 1) : slashed;
+  const parts = rooted.split("/");
+  if (rooted.startsWith("/") || parts.some((part) => part === "..")) return Result.fail(invalidPath(path));
+  const compact = parts.filter((part) => part !== "" && part !== ".").join("/");
+  return compact === "" && !allowRoot ? Result.fail(invalidPath(path)) : Result.succeed(compact);
+};
+const covers = (entry, path) => typeof entry === "string" ? entry === path : entry._tag === "TreeArtifact" ? path === entry.path || path.startsWith(`${entry.path}/`) : FileSet.matchesGlob(entry, path);
+const resource = (path) => ({ kind: "file", id: path });
+const workspaceRelative = (root, descriptor) => {
+  const relative = (path) => {
+    const normalized = normalizePath(root, path);
+    return Result.isFailure(normalized) ? path : normalized.success;
+  };
+  return {
+    readSet: descriptor.readSet.map(
+      (entry) => FileSet.isGlob(entry) ? {
+        ...entry,
+        include: [relative(entry.include[0]), ...entry.include.slice(1).map(relative)],
+        ...entry.exclude === void 0 ? {} : { exclude: entry.exclude.map(relative) }
+      } : { ...entry, path: relative(entry.path) }
+    ),
+    writeSet: descriptor.writeSet.map(
+      (entry) => typeof entry === "string" ? relative(entry) : entry._tag === "TreeArtifact" ? { ...entry, path: relative(entry.path) } : {
+        ...entry,
+        include: [relative(entry.include[0]), ...entry.include.slice(1).map(relative)],
+        ...entry.exclude === void 0 ? {} : { exclude: entry.exclude.map(relative) }
+      }
+    ),
+    ...descriptor.removes === void 0 ? {} : { removes: descriptor.removes.map(relative) },
+    boundaryMode: descriptor.boundaryMode
+  };
+};
+const digestOf = (bytes) => Schema.decodeUnknownEffect(import_crypto.Sha256)(bytes).pipe(Effect.orDie);
+const parentDirectory = (path) => {
+  const index = path.lastIndexOf("/");
+  return index <= 0 ? void 0 : path.slice(0, index);
+};
+const notFound = (path) => new WorkspaceError({ code: "not_found", message: `Workspace file does not exist: ${path}` });
+const transaction = (base, trace, root) => {
+  const files = new Map(base);
+  const produced = /* @__PURE__ */ new Set();
+  const resolvePath = (path, allowRoot = false) => {
+    const normalized = normalizePath(root, path, allowRoot);
+    return Result.isFailure(normalized) ? Effect.fail(normalized.failure) : Effect.succeed(normalized.success);
+  };
+  const readBytes = Effect.fn("WorkspaceSandbox.read")(function* (path) {
+    const key = yield* resolvePath(path);
+    trace.attemptedReads.push({ path: key, produced: produced.has(key) });
+    const content = files.get(key);
+    if (content === void 0) return yield* Effect.fail(notFound(key));
+    trace.inputs.push({ path: key, content });
+    return content.slice();
+  });
+  const writeBytes = Effect.fn("WorkspaceSandbox.write")(function* (path, content) {
+    const key = yield* resolvePath(path);
+    produced.add(key);
+    files.set(key, content.slice());
+  });
+  const removePath = Effect.fn("WorkspaceSandbox.remove")(function* (path) {
+    const key = yield* resolvePath(path);
+    produced.add(key);
+    files.delete(key);
+  });
+  const workspace = Workspace.of({
+    readFile: (path) => readBytes(path),
+    writeFile: (path, content) => writeBytes(path, content),
+    removeFile: (path) => removePath(path),
+    queueEffect: (effect) => Effect.sync(() => trace.effects.push(effect))
+  });
+  const refuse = (method, path) => (error) => error.code === "not_found" ? PlatformError.systemError({
+    _tag: "NotFound",
+    module: "FileSystem",
+    method,
+    description: error.message,
+    pathOrDescriptor: path
+  }) : PlatformError.badArgument({ module: "FileSystem", method, description: error.message });
+  const fileSystem = FileSystem.makeNoop({
+    // `exists` and `readDirectory` trace every PRESENCE they reveal: under a
+    // whole-tree-seeding host the map holds undeclared world state, and a
+    // probe that observes it is a read the key never folded. Absence stays
+    // untraced — under the declared-set host an undeclared path is absent by
+    // construction, the Bazel forest's own deterministic answer.
+    exists: (path) => resolvePath(path, true).pipe(
+      Effect.map((key) => {
+        if (key === "") return true;
+        if (files.has(key)) {
+          trace.attemptedReads.push({ path: key, produced: produced.has(key) });
+          return true;
+        }
+        const prefix = `${key}/`;
+        let present = false;
+        for (const candidate of files.keys()) {
+          if (!candidate.startsWith(prefix)) continue;
+          trace.attemptedReads.push({ path: candidate, produced: produced.has(candidate) });
+          present = true;
+        }
+        return present;
+      }),
+      // A path the transaction cannot even name does not exist in it; that
+      // is an answer, not a host failure.
+      Effect.catch(() => Effect.succeed(false))
+    ),
+    readFile: (path) => readBytes(path).pipe(Effect.mapError(refuse("readFile", path))),
+    readFileString: (path) => readBytes(path).pipe(
+      Effect.map((bytes) => decoder.decode(bytes)),
+      Effect.mapError(refuse("readFileString", path))
+    ),
+    writeFile: (path, data) => writeBytes(path, data).pipe(Effect.mapError(refuse("writeFile", path))),
+    writeFileString: (path, data) => writeBytes(path, encoder.encode(data)).pipe(Effect.mapError(refuse("writeFileString", path))),
+    remove: (path) => removePath(path).pipe(Effect.mapError(refuse("remove", path))),
+    // Directories are implicit in a path-keyed map: creating one is a
+    // successful no-op so a body that mirrors ordinary filesystem discipline
+    // works unchanged, and listing one is a prefix scan.
+    makeDirectory: () => Effect.void,
+    readDirectory: (path) => resolvePath(path, true).pipe(
+      Effect.map((key) => {
+        const prefix = key === "" ? "" : `${key}/`;
+        const entries = /* @__PURE__ */ new Set();
+        for (const candidate of files.keys()) {
+          if (!candidate.startsWith(prefix)) continue;
+          trace.attemptedReads.push({ path: candidate, produced: produced.has(candidate) });
+          entries.add(candidate.slice(prefix.length).split("/")[0]);
+        }
+        return [...entries].sort(import_Ordering.compareText);
+      }),
+      Effect.mapError(refuse("readDirectory", path))
+    )
+  });
+  return { files, workspace, fileSystem };
+};
+const changes = Effect.fn("WorkspaceSandbox.changes")(function* (base, current, host) {
+  const paths = [.../* @__PURE__ */ new Set([...base.keys(), ...current.keys()])].sort(import_Ordering.compareText);
+  const result = [];
+  for (const path of paths) {
+    const before = base.get(path);
+    const after = current.get(path);
+    const beforeDigest = before === void 0 ? yield* host.baseline(path) : yield* digestOf(before);
+    const afterDigest = after === void 0 ? void 0 : yield* digestOf(after);
+    if (beforeDigest === afterDigest) continue;
+    result.push({
+      path,
+      beforeDigest,
+      afterDigest,
+      ...after === void 0 ? {} : { after: yield* host.retain(after) }
+    });
+  }
+  return result;
+});
+const preflight = Effect.fn("WorkspaceSandbox.preflight")(function* (changes2, current) {
+  const conflicting = [];
+  const before = /* @__PURE__ */ new Map();
+  for (const change of changes2) {
+    const content = yield* current(change.path);
+    before.set(change.path, content);
+    const digest = content === void 0 ? void 0 : yield* digestOf(content);
+    conflicting.push(...digest === change.beforeDigest ? [] : [change.path]);
+  }
+  const conflict = conflicting.length === 0 ? void 0 : new MaterializationConflict({
+    paths: conflicting,
+    message: "Workspace state changed after the transaction's base snapshot was taken"
+  });
+  return { conflict, before };
+});
+const revisionOf = Effect.fn("WorkspaceSandbox.revision")(function* (base) {
+  const entries = [];
+  for (const [path, content] of [...base].sort((left, right) => (0, import_Ordering.compareText)(left[0], right[0]))) {
+    entries.push({ path, digest: yield* digestOf(content) });
+  }
+  return yield* Schema.decodeUnknownEffect(import_keys.DerivedKey)({ kind: "workspace-revision", entries }).pipe(Effect.orDie);
+});
+const violations = (descriptor, base, provenance) => {
+  const declaredReads = descriptor.readSet;
+  const observed = [
+    ...provenance.inputs.filter(
+      (input) => base.has(input.resource.id) && !declaredReads.some(
+        (entry) => FileSet.isGlob(entry) ? FileSet.matchesGlob(entry, input.resource.id) : entry.path === input.resource.id
+      )
+    ).map((input) => ({ kind: "undeclared-read", resource: input.resource })),
+    ...provenance.outputs.filter(
+      (output) => ![...descriptor.writeSet, ...descriptor.removes ?? []].some((entry) => covers(entry, output.resource.id))
+    ).map((output) => ({ kind: "undeclared-write", resource: output.resource }))
+  ];
+  return [
+    ...new Map(observed.map((violation) => [`${violation.kind}:${violation.resource.id}`, violation])).values()
+  ];
+};
+const makeHosted = (host) => {
+  const memo = /* @__PURE__ */ new Map();
+  const executeBody = Effect.fnUntraced(function* (execution) {
+    const boundary = FileBoundarySnapshot.make(execution.descriptor);
+    const key = execution.cacheKey;
+    if (key !== void 0) {
+      const hit = memo.get(key);
+      if (hit !== void 0) {
+        return {
+          _tag: "Accepted",
+          result: hit.result,
+          violations: hit.violations,
+          cache: { status: "hit", key }
+        };
+      }
+    }
+    const captured = yield* host.snapshot(boundary);
+    const base = new Map([...captured].map(([path, content]) => [path, content.slice()]));
+    const trace = { inputs: [], attemptedReads: [], effects: [] };
+    const isolated = transaction(base, trace, host.root);
+    const outcome = yield* execution.workflow.pipe(
+      Effect.provideService(Workspace, isolated.workspace),
+      Effect.provideService(FileSystem.FileSystem, isolated.fileSystem),
+      Effect.exit
+    );
+    const inputs = [];
+    for (const input of trace.inputs) {
+      inputs.push({ resource: resource(input.path), digest: yield* digestOf(input.content) });
+    }
+    const descriptor = workspaceRelative(host.root, boundary);
+    const undeclaredReads = trace.attemptedReads.filter(
+      (attempt) => !attempt.produced && !descriptor.readSet.some(
+        (entry) => FileSet.isGlob(entry) ? FileSet.matchesGlob(entry, attempt.path) : entry.path === attempt.path
+      )
+    );
+    if (Exit.isFailure(outcome)) {
+      if (undeclaredReads.length > 0 && boundary.boundaryMode === "hard") {
+        return {
+          _tag: "Invalidated",
+          provenance: {
+            baseRevision: yield* revisionOf(base),
+            inputs,
+            outputs: []
+          },
+          violations: [
+            ...new Map(undeclaredReads.map((attempt) => [attempt.path, {
+              kind: "undeclared-read",
+              resource: resource(attempt.path)
+            }])).values()
+          ]
+        };
+      }
+      return yield* Effect.failCause(outcome.cause);
+    }
+    const output = outcome.value;
+    const files = yield* changes(base, isolated.files, host);
+    const provenance = {
+      baseRevision: yield* revisionOf(base),
+      inputs,
+      outputs: files.map((change) => ({
+        resource: resource(change.path),
+        operation: change.afterDigest === void 0 ? "remove" : "write",
+        digest: change.afterDigest
+      }))
+    };
+    const invalid = [
+      ...new Map([
+        ...violations(descriptor, base, provenance),
+        ...undeclaredReads.map((attempt) => ({
+          kind: "undeclared-read",
+          resource: resource(attempt.path)
+        }))
+      ].map((violation) => [`${violation.kind}:${violation.resource.id}`, violation])).values()
+    ];
+    if (invalid.length > 0 && boundary.boundaryMode === "hard") {
+      return { _tag: "Invalidated", provenance, violations: invalid };
+    }
+    const result = { output, files, provenance, effects: trace.effects };
+    if (key !== void 0) {
+      memo.set(key, { result, violations: invalid });
+    }
+    return {
+      _tag: "Accepted",
+      result,
+      violations: invalid,
+      cache: key === void 0 ? { status: "disabled" } : { status: "miss", key }
+    };
+  });
+  return make({
+    execute: Effect.fn("WorkspaceSandbox.execute")(
+      function* (execution) {
+        yield* Effect.annotateCurrentSpan({ boundaryMode: execution.descriptor.boundaryMode });
+        return yield* executeBody(execution);
+      },
+      (effect) => EngineStoreMetrics.observe({
+        timer: EngineStoreMetrics.sandboxExecutionDuration,
+        counter: EngineStoreMetrics.sandboxExecution
+      })(effect)
+    ),
+    materialize: Effect.fn("WorkspaceSandbox.materialize")(
+      function* (accepted) {
+        yield* Effect.annotateCurrentSpan({ changes: accepted.result.files.length });
+        if (accepted.result.files.length === 0) return;
+        yield* host.commit(accepted.result.files);
+      },
+      (effect) => EngineStoreMetrics.observe({
+        timer: EngineStoreMetrics.materializationDuration,
+        counter: EngineStoreMetrics.materialization
+      })(effect)
+    )
+  });
+};
+const makeMemory = (initialFiles = {}) => Effect.gen(function* () {
+  const entries = [];
+  for (const [path, content] of Object.entries(initialFiles)) {
+    const normalized = normalizePath("", path);
+    if (Result.isFailure(normalized)) return yield* Effect.fail(normalized.failure);
+    entries.push([normalized.success, typeof content === "string" ? encoder.encode(content) : content.slice()]);
+  }
+  const host = yield* Ref.make(new Map(entries));
+  const service = makeHosted({
+    root: "",
+    snapshot: () => Ref.get(host),
+    // This host seeds the transaction with the WHOLE tree, so a path the
+    // transaction did not observe is one the host genuinely did not hold:
+    // `undefined` is the honest snapshot-time answer, and a file that
+    // appeared underneath the transaction is caught by copy-back's
+    // compare-and-set rather than clobbered.
+    baseline: () => Effect.succeed(void 0),
+    retain: (bytes) => Effect.succeed(bytes.slice()),
+    commit: Effect.fn("WorkspaceSandbox.commit")(function* (changes2) {
+      yield* Effect.annotateCurrentSpan({ changes: changes2.length });
+      const current = yield* Ref.get(host);
+      const { conflict } = yield* preflight(changes2, (path) => Effect.succeed(current.get(path)));
+      if (conflict !== void 0) {
+        yield* Metric.update(EngineStoreMetrics.materializationConflicts, 1);
+        return yield* Effect.fail(conflict);
+      }
+      const next = new Map(current);
+      for (const change of changes2) {
+        if (change.afterDigest === void 0) next.delete(change.path);
+        else next.set(change.path, change.after.slice());
+      }
+      yield* Ref.set(host, next);
+    })
+  });
+  return {
+    service,
+    files: Ref.get(host).pipe(
+      Effect.map(
+        (current) => [...current].map(([path, content]) => ({ path, content })).sort((left, right) => (0, import_Ordering.compareText)(left.path, right.path))
+      )
+    )
+  };
+});
+const CommitLocks = Context.Service(
+  "@smthrs/engine-store/WorkspaceSandbox/CommitLocks"
+);
+const locksLayer = Layer.effect(CommitLocks, RcMap.make({ lookup: (_root) => Semaphore.make(1) }));
+const lockOwners = Layer.makeMemoMapUnsafe();
+const coordinateCommit = (root, write) => Effect.scoped(Effect.gen(function* () {
+  const services = yield* Layer.buildWithMemoMap(locksLayer, lockOwners, yield* Scope.Scope);
+  const lock = yield* RcMap.get(Context.get(services, CommitLocks), root);
+  return yield* lock.withPermit(write);
+}));
+const commitLockName = ".smithers-workspace-lock";
+const engineStateName = ".flows";
+const defaultMaxInlineBytes = 1024 * 1024;
+const hostFailure = (cause) => new WorkspaceError({
+  code: "host_unavailable",
+  message: "the host filesystem could not serve the workspace transaction",
+  cause
+});
+const artifactFailure = (cause) => new WorkspaceError({
+  code: "host_unavailable",
+  message: `the artifact store could not serve the workspace transaction: ${cause.message}`,
+  cause
+});
+const confinementCodes = /* @__PURE__ */ new Set(["ELOOP", "ENOTDIR", "EPERM"]);
+const refusedByConfinement = (error) => error.reason._tag !== "BadArgument" && typeof error.reason.cause === "object" && error.reason.cause !== null && confinementCodes.has(error.reason.cause.code);
+const copyBackFailure = (path) => (error) => refusedByConfinement(error) ? new WorkspaceError({
+  code: "path_escapes_workspace",
+  message: `materializing ${path} was refused: it does not name a workspace entry reachable without following a link (${error.message})`,
+  cause: error
+}) : hostFailure(error);
+const lockFailure = (cause) => Cause.isTimeoutError(cause) ? new WorkspaceError({
+  code: "commit_lock_timeout",
+  message: `another writer held ${commitLockName} for the whole acquisition deadline; a lock whose owner stopped is reclaimed once its heartbeat is ${FileLease.defaultStaleAfterMs} ms old`,
+  cause
+}) : copyBackFailure(commitLockName)(cause);
+const foldPath = (path) => path.normalize("NFKC").toUpperCase().toLowerCase().normalize("NFKC");
+const shortNameAlias = /^[^.~]{0,7}~\d{1,7}(\.[^.]{0,3})?$/u;
+const isShortNameAlias = (segment) => {
+  const base = segment.split(".")[0];
+  return base.length <= 8 && shortNameAlias.test(segment);
+};
+const makeFileSystem = (fs, platformPath, artifacts, workspaceRoot, options = {}) => {
+  const maxInlineBytes = options.maxInlineBytes ?? defaultMaxInlineBytes;
+  const root = workspaceRoot.replaceAll(/\/+$/g, "");
+  const reserved = [
+    commitLockName,
+    engineStateName,
+    ...(options.reservedPaths ?? []).map((path) => path.replace(/^(\.\/)+/, "").replaceAll(/\/+$/g, ""))
+  ].filter((path) => path !== "" && path !== ".").map((name) => ({ name, segments: foldPath(name).split("/") }));
+  const reservedAt = (path) => {
+    const segments = foldPath(path).split("/");
+    const within = reserved.filter((entry) => entry.segments.length <= segments.length);
+    const exact = within.find((entry) => entry.segments.every((segment, index) => segments[index] === segment));
+    if (exact !== void 0) return `the workspace path ${exact.name} is reserved`;
+    const alias = within.find(
+      (entry) => (
+        // `within` holds only entries no longer than the path, so every index is present.
+        entry.segments.every((segment, index) => segments[index] === segment || isShortNameAlias(segments[index]))
+      )
+    );
+    if (alias === void 0) return void 0;
+    const spelling = path.split("/").slice(0, alias.segments.length).join("/");
+    return `the workspace path ${spelling} may be a short-name alias of a reserved path`;
+  };
+  const hostPath = (path) => root === "" ? path : `${root}/${path}`;
+  const readFrom = (host, path, onError) => host.readFile(path).pipe(
+    Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(void 0)),
+    Effect.mapError(onError)
+  );
+  const readIfPresent = Effect.fn("WorkspaceSandbox.readIfPresent")(function* (path) {
+    return yield* readFrom(fs, path, hostFailure);
+  });
+  const canonicalRoot = fs.realPath(root === "" ? "." : root).pipe(
+    Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(void 0)),
+    Effect.mapError(hostFailure)
+  );
+  const withCommitLock = (changes2, effect) => Effect.gen(function* () {
+    for (const change of changes2) {
+      const hit = reservedAt(change.path);
+      if (hit !== void 0) return yield* Effect.fail(hostFailure(hit));
+    }
+    yield* fs.makeDirectory(root === "" ? "." : root, { recursive: true }).pipe(Effect.mapError(hostFailure));
+    const host = yield* KernelFileSystem.confined(fs, root).pipe(
+      Effect.provideService(Path.Path, platformPath),
+      Effect.mapError(hostFailure)
+    );
+    const canonical = yield* canonicalRoot;
+    const leaseHost = { ...host, utimes: fs.utimes };
+    return yield* coordinateCommit(
+      canonical ?? root,
+      FileLease.withLease(leaseHost, hostPath(commitLockName), effect(host), lockFailure, {
+        label: "Workspace commit lock",
+        annotations: { root: canonical ?? root }
+      })
+    );
+  });
+  const commitWith = Effect.fn("WorkspaceSandbox.commit")(function* (host, changes2) {
+    yield* Effect.annotateCurrentSpan({ changes: changes2.length });
+    const { before, conflict } = yield* preflight(
+      changes2,
+      (path) => readFrom(host, hostPath(path), copyBackFailure(path))
+    );
+    if (conflict !== void 0) {
+      yield* Metric.update(EngineStoreMetrics.materializationConflicts, 1);
+      return yield* Effect.fail(conflict);
+    }
+    const resolved = /* @__PURE__ */ new Map();
+    for (const change of changes2) {
+      if (change.afterDigest === void 0) continue;
+      const bytes = change.after ?? (yield* artifacts.get(`${change.afterDigest}`).pipe(
+        Effect.mapError(
+          (error) => error._tag === "@smthrs/artifacts/ArtifactStoreError" ? artifactFailure(error) : new WorkspaceError({
+            code: "not_found",
+            message: `the retained bytes for ${change.path} are unavailable: ${error.message}`,
+            cause: error
+          })
+        )
+      ));
+      resolved.set(change.path, bytes);
+    }
+    const applied = [];
+    const apply = Effect.gen(function* () {
+      for (const change of changes2) {
+        applied.push(change);
+        const target = hostPath(change.path);
+        if (change.afterDigest === void 0) {
+          yield* host.remove(target).pipe(Effect.mapError(copyBackFailure(change.path)));
+          continue;
+        }
+        const parent = parentDirectory(target);
+        if (parent !== void 0) {
+          yield* host.makeDirectory(parent, { recursive: true }).pipe(
+            Effect.mapError(copyBackFailure(change.path))
+          );
+        }
+        yield* host.writeFile(target, resolved.get(change.path)).pipe(
+          Effect.mapError(copyBackFailure(change.path))
+        );
+      }
+    });
+    const rollback = Effect.gen(function* () {
+      for (const change of [...applied].reverse()) {
+        const target = hostPath(change.path);
+        const previous = before.get(change.path);
+        if (previous === void 0) {
+          yield* host.remove(target, { force: true }).pipe(Effect.mapError(copyBackFailure(change.path)));
+        } else {
+          yield* host.writeFile(target, previous).pipe(Effect.mapError(copyBackFailure(change.path)));
+        }
+      }
+    });
+    yield* apply.pipe(
+      Effect.catchCause(
+        (cause) => Effect.gen(function* () {
+          const restored = yield* Effect.exit(rollback);
+          if (Exit.isSuccess(restored)) return yield* Effect.failCause(cause);
+          const reasons = restored.cause.reasons.filter(Cause.isFailReason).map((reason) => reason.error.message);
+          return yield* Effect.failCause(
+            Cause.combine(
+              cause,
+              Cause.fail(
+                new WorkspaceError({
+                  code: "host_unavailable",
+                  message: `copy-back failed mid-apply and rollback could not restore the workspace: ${reasons.join("; ")}`,
+                  cause: restored.cause
+                })
+              )
+            )
+          );
+        })
+      ),
+      // Interruption inside the apply window is a mid-sequence abort the
+      // journal exists to prevent; the window is bounded local work, so it
+      // closes before the fiber answers the interrupt.
+      Effect.uninterruptible
+    );
+  });
+  return makeHosted({
+    root,
+    snapshot: Effect.fn("WorkspaceSandbox.snapshot")(function* (descriptor) {
+      yield* Effect.annotateCurrentSpan({
+        reads: descriptor.readSet.length,
+        boundaryMode: descriptor.boundaryMode
+      });
+      const base = /* @__PURE__ */ new Map();
+      for (const entry of descriptor.readSet) {
+        const paths = FileSet.isGlob(entry) ? yield* FileEnumeration.expandGlob(fs, entry, {
+          resolve: (path) => path === "" ? root === "" ? "." : root : hostPath(path)
+        }).pipe(Effect.mapError(hostFailure)) : [entry.path];
+        for (const path of paths) {
+          const normalized = normalizePath(root, path);
+          if (Result.isFailure(normalized)) return yield* Effect.fail(normalized.failure);
+          const content = yield* readIfPresent(hostPath(normalized.success));
+          if (content !== void 0) base.set(normalized.success, content);
+        }
+      }
+      for (const path of descriptor.removes ?? []) {
+        const normalized = normalizePath(root, path);
+        if (Result.isFailure(normalized)) return yield* Effect.fail(normalized.failure);
+        const content = yield* readIfPresent(hostPath(normalized.success));
+        if (content !== void 0) base.set(normalized.success, content);
+      }
+      return base;
+    }),
+    baseline: Effect.fn("WorkspaceSandbox.baseline")(function* (path) {
+      const content = yield* readIfPresent(hostPath(path));
+      return content === void 0 ? void 0 : yield* digestOf(content);
+    }),
+    // The bytes now live at the change's `afterDigest`; the change itself
+    // carries only the reference, exactly as oversized `StepBoundary`
+    // evidence does.
+    retain: (bytes) => bytes.length <= maxInlineBytes ? Effect.succeed(bytes) : artifacts.put(bytes).pipe(Effect.mapError(artifactFailure), Effect.as(void 0)),
+    commit: (changes2) => withCommitLock(changes2, (host) => commitWith(host, changes2))
+  });
+};
+const layerFileSystem = (options = {}) => Layer.effect(
+  WorkspaceSandbox,
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const platformPath = yield* Path.Path;
+    const artifacts = yield* ArtifactStore.ArtifactStore;
+    const workspace = yield* import_Workspace.Workspace;
+    yield* KernelFileSystem.requireConfinable(fs, workspace.root).pipe(Effect.mapError(hostFailure));
+    return makeFileSystem(fs, platformPath, artifacts, workspace.root, options);
+  })
+);
+//# sourceMappingURL=WorkspaceSandbox.js.map