@smthrs/platform-node 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/internal/AtomicFileSystemTransport.js

@@ -0,0 +1,242 @@
+/**
+ * The process transport beneath the atomic filesystem: resolving the
+ * configured helper to a file the confined workspace cannot have
+ * supplied, and running one isolated, bounded helper process per framed
+ * request.
+ * @since 1.0.0
+ */
+import { Effect } from "effect";
+import { spawn } from "node:child_process";
+import { accessSync, constants, lstatSync, readlinkSync, realpathSync, statSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, parse, relative, sep } from "node:path";
+import { convert, decode, failure, frameHeaderBytes } from "./AtomicFileSystemProtocol.js";
+import { AtomicHelperError } from "./AtomicHelperError.js";
+import { atomicHelperFault } from "./AtomicHelperFault.js";
+let startedHelpers = 0;
+/**
+ * Process-local helper starts, including helpers later cancelled or refused.
+ * @private
+ * @since 1.0.0
+ */
+export const started = () => startedHelpers;
+/** An inert working directory: nothing the helper could import lives there. */
+const inertDirectory = parse(process.execPath).root;
+/**
+ * True when `target` is at or below `root`. Both are absolute and already
+ * canonical. A different Windows drive produces an absolute relative result.
+ * @private
+ * @since 1.0.0
+ */
+export const inside = (root, target) => {
+    const path = relative(root, target);
+    return path === "" || (path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path));
+};
+/** Resolve symlinks without replacing a hard-linked executable's entry name. */
+const executablePath = (configured) => {
+    let current = configured;
+    for (let links = 0; links < 40; links++) {
+        if (current.endsWith("/") || current.endsWith(sep)) {
+            throw new AtomicHelperError({
+                code: "helper_path_invalid",
+                message: "atomic helper executable cannot end with a directory separator"
+            });
+        }
+        // Bun's macOS realpath can return another hard link to the final inode:
+        // A hard-linked executable can change its entry name during guarded reads.
+        // Directories cannot have those file aliases. Resolve the parent, preserve
+        // the leaf name, and explicitly follow only actual leaf symlinks.
+        const parent = realpathSync.native(dirname(current));
+        const candidate = join(parent, basename(current));
+        if (!lstatSync(candidate).isSymbolicLink())
+            return candidate;
+        const target = readlinkSync(candidate);
+        // Do not normalize `link/..` lexically; realpath must traverse it first.
+        current = isAbsolute(target) ? target : `${parent}/${target}`;
+    }
+    throw new AtomicHelperError({
+        code: "helper_path_invalid",
+        message: "atomic helper executable has too many symbolic links"
+    });
+};
+/**
+ * Resolves the configured helper to an absolute, executable regular file
+ * that the confined workspace cannot have supplied. Every failure throws, and
+ * every throw becomes a fail-closed `PermissionDenied`, so a host without a
+ * usable helper performs no filesystem operation at all.
+ * @private
+ * @since 1.0.0
+ */
+export const usableExecutable = (configured, boundaryRoot) => {
+    if (!isAbsolute(configured)) {
+        throw new AtomicHelperError({
+            code: "helper_path_invalid",
+            message: `atomic helper executable must be an absolute path, got ${JSON.stringify(configured)}`
+        });
+    }
+    // Resolved first: the checks below have to describe the file that will
+    // actually run, not the name that leads to it.
+    const resolved = executablePath(configured);
+    if (!statSync(resolved).isFile()) {
+        throw new AtomicHelperError({
+            code: "helper_not_regular_file",
+            message: `atomic helper executable is not a regular file: ${resolved}`
+        });
+    }
+    accessSync(resolved, constants.X_OK);
+    if (boundaryRoot !== undefined && inside(boundaryRoot, resolved)) {
+        throw new AtomicHelperError({
+            code: "helper_inside_workspace",
+            message: `atomic helper executable must live outside the confined workspace: ${resolved}`
+        });
+    }
+    return resolved;
+};
+/**
+ * Runs one helper over one framed request and settles with its converted
+ * answer. Every exit path kills the child, releases its pipes, and waits for
+ * the operating system to report that the process has closed.
+ * @private
+ * @since 1.0.0
+ */
+export const spawnHelper = (request, executable, payload, settings) => Effect.callback((resume) => {
+    const limits = settings.limits;
+    let settled = false;
+    const stdout = [];
+    let stdoutBytes = 0;
+    const stderr = [];
+    let stderrBytes = 0;
+    let truncated = false;
+    let writeFailure;
+    // The packaged helper runs with an inert cwd and empty environment. The
+    // configured executable is validated outside the confined root first.
+    let child;
+    try {
+        child = spawn(executable, ["--atomic-fs"], {
+            cwd: inertDirectory,
+            env: {},
+            stdio: ["pipe", "pipe", "pipe"]
+        });
+        startedHelpers++;
+    }
+    catch (cause) {
+        // libuv reports some exec failures — `ENOEXEC` for a file that is
+        // neither a script nor a binary — by throwing rather than by emitting an
+        // `error` event, so both arrivals have to end in the same refusal.
+        resume(Effect.fail(failure(request, cause)));
+        return Effect.void;
+    }
+    const closed = new Promise((resolve) => child.once("close", () => resolve()));
+    // `deadline` is armed below, after the completion it resumes through
+    // exists. Reading it here is safe because nothing calls `cleanup` before
+    // then: the one earlier exit, a spawn that threw, resumes and returns.
+    const cleanup = () => {
+        clearTimeout(deadline);
+        child.stdin.destroy();
+        child.stdout.destroy();
+        child.stderr.destroy();
+        child.kill("SIGKILL");
+    };
+    const complete = (effect) => {
+        if (settled)
+            return;
+        settled = true;
+        // Every exit path drains and kills, so an overflowing, hung, or already
+        // finished helper leaves no descriptor and no child behind.
+        cleanup();
+        resume(Effect.andThen(Effect.promise(() => closed), effect));
+    };
+    // A wall-clock backstop, independent of every byte ceiling. Those bound
+    // what a helper may SAY; nothing bounds how long it may take to say it, and
+    // a helper that never answers would otherwise hold the fiber until the run
+    // itself is interrupted.
+    const deadline = setTimeout(() => {
+        complete(Effect.fail(failure(request, atomicHelperFault("helper_timeout", `atomic helper did not answer within ${settings.timeoutMs} ms`))));
+    }, settings.timeoutMs);
+    deadline.unref();
+    // Raw buffers, never decoded strings: a chunk boundary in the middle of a
+    // multi-byte character would otherwise be decoded as two replacement
+    // characters before the JSON parse ever saw it. Concatenating once at the
+    // end also keeps accumulation linear instead of quadratic.
+    // Retained bytes are bounded by the ceiling plus at most one pipe chunk:
+    // an overflowing chunk is sliced before it is retained, so the host never
+    // relies on the stream implementation's chunk-size convention.
+    child.stdout.on("data", (chunk) => {
+        const remaining = limits.response + frameHeaderBytes - stdoutBytes;
+        if (chunk.byteLength > remaining) {
+            if (remaining > 0) {
+                stdout.push(chunk.subarray(0, remaining));
+                stdoutBytes += remaining;
+            }
+            complete(Effect.fail(failure(request, atomicHelperFault("response_limit_exceeded", `atomic helper wrote more than ${limits.response} response bytes`))));
+            return;
+        }
+        stdoutBytes += chunk.byteLength;
+        stdout.push(chunk);
+    });
+    // stderr is bounded on its own budget: a helper that says nothing useful
+    // on stdout must not be able to exhaust the host through diagnostics.
+    // Destroying the pipe stops the helper at its next write rather than
+    // letting it produce output nobody will read.
+    child.stderr.on("data", (chunk) => {
+        // Sliced to the remaining room rather than kept whole, so the retained
+        // text is exactly the budget and not the budget plus a pipe buffer.
+        const slice = chunk.subarray(0, limits.stderr - stderrBytes);
+        stderrBytes += slice.byteLength;
+        stderr.push(slice);
+        if (stderrBytes >= limits.stderr) {
+            truncated = true;
+            child.stderr.destroy();
+        }
+    });
+    child.on("error", (cause) => complete(Effect.fail(failure(request, cause))));
+    // A helper that exits before draining stdin — an unavailable helper,
+    // a rejected request, an interrupt that killed it mid-write — makes the
+    // request write fail with EPIPE. Without a listener that is an unhandled
+    // `error` event on the pipe, which terminates the host process instead of
+    // failing one filesystem call. It is recorded rather than resumed on, so
+    // that a helper which did manage to report a real errno keeps precedence
+    // over the broken pipe its own exit caused.
+    child.stdin.on("error", (cause) => {
+        writeFailure = cause;
+    });
+    child.on("close", (code) => {
+        let envelope;
+        let malformed;
+        try {
+            envelope = decode(Buffer.concat(stdout), limits);
+        }
+        catch (cause) {
+            malformed = cause;
+        }
+        if (envelope !== undefined && !envelope.ok) {
+            // The helper's own typed rejection outranks the exit status and any
+            // transport noise: it is the only thing that knows which errno the
+            // syscall produced.
+            complete(Effect.fail(failure(request, atomicHelperFault("helper_rejected", envelope.message ?? "atomic helper rejected the operation"), envelope)));
+            return;
+        }
+        if (envelope !== undefined && code === 0) {
+            try {
+                complete(convert(request, envelope.value, limits));
+            }
+            catch (cause) {
+                complete(Effect.fail(failure(request, cause)));
+            }
+            return;
+        }
+        const text = Buffer.concat(stderr).toString("utf8");
+        complete(Effect.fail(failure(request, text !== ""
+            ? atomicHelperFault("helper_exited", `atomic helper exited ${code}: ${text}${truncated ? " (truncated)" : ""}`)
+            : writeFailure !== undefined
+                ? writeFailure
+                : malformed !== undefined
+                    ? malformed
+                    : atomicHelperFault("helper_exited", `atomic helper exited ${code}`))));
+    });
+    child.stdin.end(payload);
+    return Effect.promise(async () => {
+        cleanup();
+        await closed;
+    });
+});
+//# sourceMappingURL=AtomicFileSystemTransport.js.map

package/dist/esm/internal/AtomicFileSystemTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AtomicFileSystemTransport.js","sourceRoot":"","sources":["../../../src/internal/AtomicFileSystemTransport.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,MAAM,EAAsB,MAAM,QAAQ,CAAA;AACnD,OAAO,EAAuC,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAChG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAErF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAqB,MAAM,+BAA+B,CAAA;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE1D,IAAI,cAAc,GAAG,CAAC,CAAA;AAEtB;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC,cAAc,CAAA;AAEnD,+EAA+E;AAC/E,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAA;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,MAAc,EAAW,EAAE;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAC5F,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAU,EAAE;IACpD,IAAI,OAAO,GAAG,UAAU,CAAA;IACxB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,iBAAiB,CAAC;gBAC1B,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAA;QACJ,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE;YAAE,OAAO,SAAS,CAAA;QAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QACtC,yEAAyE;QACzE,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;IAC/D,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC;QAC1B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,sDAAsD;KAChE,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAE,YAAgC,EAAU,EAAE;IAC/F,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CAAC;YAC1B,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0DAA0D,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SAChG,CAAC,CAAA;IACJ,CAAC;IACD,uEAAuE;IACvE,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;IAC3C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,iBAAiB,CAAC;YAC1B,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,mDAAmD,QAAQ,EAAE;SACvE,CAAC,CAAA;IACJ,CAAC;IACD,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,iBAAiB,CAAC;YAC1B,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,sEAAsE,QAAQ,EAAE;SAC1F,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,OAAuC,EACvC,UAAkB,EAClB,OAAe,EACf,QAAiE,EAClB,EAAE,CACjD,MAAM,CAAC,QAAQ,CAAiC,CAAC,MAAM,EAAE,EAAE;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,YAAqB,CAAA;IAEzB,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,KAAqC,CAAA;IACzC,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE;YACzC,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,EAAE;YACP,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAA;QACF,cAAc,EAAE,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kEAAkE;QAClE,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACnF,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QACrB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACtB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvB,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,MAAqD,EAAE,EAAE;QACzE,IAAI,OAAO;YAAE,OAAM;QACnB,OAAO,GAAG,IAAI,CAAA;QACd,wEAAwE;QACxE,4DAA4D;QAC5D,OAAO,EAAE,CAAA;QACT,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9D,CAAC,CAAA;IACD,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;QAC/B,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAC1B,OAAO,EACP,iBAAiB,CAAC,gBAAgB,EAAE,uCAAuC,QAAQ,CAAC,SAAS,KAAK,CAAC,CACpG,CAAC,CAAC,CAAA;IACL,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,CAAA;IAChB,0EAA0E;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,2DAA2D;IAC3D,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,GAAG,gBAAgB,GAAG,WAAW,CAAA;QAClE,IAAI,KAAK,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;YACjC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;gBACzC,WAAW,IAAI,SAAS,CAAA;YAC1B,CAAC;YACD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAC1B,OAAO,EACP,iBAAiB,CACf,yBAAyB,EACzB,iCAAiC,MAAM,CAAC,QAAQ,iBAAiB,CAClE,CACF,CAAC,CAAC,CAAA;YACH,OAAM;QACR,CAAC;QACD,WAAW,IAAI,KAAK,CAAC,UAAU,CAAA;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IACF,yEAAyE;IACzE,sEAAsE;IACtE,qEAAqE;IACrE,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,CAAA;QAC5D,WAAW,IAAI,KAAK,CAAC,UAAU,CAAA;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,IAAI,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACjC,SAAS,GAAG,IAAI,CAAA;YAChB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5E,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,4CAA4C;IAC5C,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,YAAY,GAAG,KAAK,CAAA;IACtB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,IAAI,QAAkC,CAAA;QACtC,IAAI,SAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAA;QACnB,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC3C,oEAAoE;YACpE,mEAAmE;YACnE,oBAAoB;YACpB,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAC1B,OAAO,EACP,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,IAAI,sCAAsC,CAAC,EAChG,QAAQ,CACT,CAAC,CAAC,CAAA;YACH,OAAM;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,QAAQ,CAAC,OAAO,CAAI,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;YAChD,CAAC;YACD,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACnD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAC1B,OAAO,EACP,IAAI,KAAK,EAAE;YACT,CAAC,CAAC,iBAAiB,CACjB,eAAe,EACf,wBAAwB,IAAI,KAAK,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1E;YACD,CAAC,CAAC,YAAY,KAAK,SAAS;gBAC5B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,SAAS,KAAK,SAAS;oBACzB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,iBAAiB,CAAC,eAAe,EAAE,wBAAwB,IAAI,EAAE,CAAC,CACvE,CAAC,CAAC,CAAA;IACL,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QAC/B,OAAO,EAAE,CAAA;QACT,MAAM,MAAM,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["/**\n * The process transport beneath the atomic filesystem: resolving the\n * configured helper to a file the confined workspace cannot have\n * supplied, and running one isolated, bounded helper process per framed\n * request.\n * @since 1.0.0\n */\n\nimport type * as KernelFileSystem from \"@smthrs/kernel/FileSystem\"\nimport { Effect, type PlatformError } from \"effect\"\nimport { type ChildProcessWithoutNullStreams, spawn } from \"node:child_process\"\nimport { accessSync, constants, lstatSync, readlinkSync, realpathSync, statSync } from \"node:fs\"\nimport { basename, dirname, isAbsolute, join, parse, relative, sep } from \"node:path\"\nimport type { Limits } from \"../AtomicFileSystem.ts\"\nimport { convert, decode, failure, frameHeaderBytes, type HelperResult } from \"./AtomicFileSystemProtocol.ts\"\nimport { AtomicHelperError } from \"./AtomicHelperError.ts\"\nimport { atomicHelperFault } from \"./AtomicHelperFault.ts\"\n\nlet startedHelpers = 0\n\n/**\n * Process-local helper starts, including helpers later cancelled or refused.\n * @private\n * @since 1.0.0\n */\nexport const started = (): number => startedHelpers\n\n/** An inert working directory: nothing the helper could import lives there. */\nconst inertDirectory = parse(process.execPath).root\n\n/**\n * True when `target` is at or below `root`. Both are absolute and already\n * canonical. A different Windows drive produces an absolute relative result.\n * @private\n * @since 1.0.0\n */\nexport const inside = (root: string, target: string): boolean => {\n  const path = relative(root, target)\n  return path === \"\" || (path !== \"..\" && !path.startsWith(`..${sep}`) && !isAbsolute(path))\n}\n\n/** Resolve symlinks without replacing a hard-linked executable's entry name. */\nconst executablePath = (configured: string): string => {\n  let current = configured\n  for (let links = 0; links < 40; links++) {\n    if (current.endsWith(\"/\") || current.endsWith(sep)) {\n      throw new AtomicHelperError({\n        code: \"helper_path_invalid\",\n        message: \"atomic helper executable cannot end with a directory separator\"\n      })\n    }\n    // Bun's macOS realpath can return another hard link to the final inode:\n    // A hard-linked executable can change its entry name during guarded reads.\n    // Directories cannot have those file aliases. Resolve the parent, preserve\n    // the leaf name, and explicitly follow only actual leaf symlinks.\n    const parent = realpathSync.native(dirname(current))\n    const candidate = join(parent, basename(current))\n    if (!lstatSync(candidate).isSymbolicLink()) return candidate\n    const target = readlinkSync(candidate)\n    // Do not normalize `link/..` lexically; realpath must traverse it first.\n    current = isAbsolute(target) ? target : `${parent}/${target}`\n  }\n  throw new AtomicHelperError({\n    code: \"helper_path_invalid\",\n    message: \"atomic helper executable has too many symbolic links\"\n  })\n}\n\n/**\n * Resolves the configured helper to an absolute, executable regular file\n * that the confined workspace cannot have supplied. Every failure throws, and\n * every throw becomes a fail-closed `PermissionDenied`, so a host without a\n * usable helper performs no filesystem operation at all.\n * @private\n * @since 1.0.0\n */\nexport const usableExecutable = (configured: string, boundaryRoot: string | undefined): string => {\n  if (!isAbsolute(configured)) {\n    throw new AtomicHelperError({\n      code: \"helper_path_invalid\",\n      message: `atomic helper executable must be an absolute path, got ${JSON.stringify(configured)}`\n    })\n  }\n  // Resolved first: the checks below have to describe the file that will\n  // actually run, not the name that leads to it.\n  const resolved = executablePath(configured)\n  if (!statSync(resolved).isFile()) {\n    throw new AtomicHelperError({\n      code: \"helper_not_regular_file\",\n      message: `atomic helper executable is not a regular file: ${resolved}`\n    })\n  }\n  accessSync(resolved, constants.X_OK)\n  if (boundaryRoot !== undefined && inside(boundaryRoot, resolved)) {\n    throw new AtomicHelperError({\n      code: \"helper_inside_workspace\",\n      message: `atomic helper executable must live outside the confined workspace: ${resolved}`\n    })\n  }\n  return resolved\n}\n\n/**\n * Runs one helper over one framed request and settles with its converted\n * answer. Every exit path kills the child, releases its pipes, and waits for\n * the operating system to report that the process has closed.\n * @private\n * @since 1.0.0\n */\nexport const spawnHelper = <A>(\n  request: KernelFileSystem.AtomicRequest,\n  executable: string,\n  payload: Buffer,\n  settings: { readonly limits: Limits; readonly timeoutMs: number }\n): Effect.Effect<A, PlatformError.PlatformError> =>\n  Effect.callback<A, PlatformError.PlatformError>((resume) => {\n    const limits = settings.limits\n    let settled = false\n    const stdout: Array<Buffer> = []\n    let stdoutBytes = 0\n    const stderr: Array<Buffer> = []\n    let stderrBytes = 0\n    let truncated = false\n    let writeFailure: unknown\n\n    // The packaged helper runs with an inert cwd and empty environment. The\n    // configured executable is validated outside the confined root first.\n    let child: ChildProcessWithoutNullStreams\n    try {\n      child = spawn(executable, [\"--atomic-fs\"], {\n        cwd: inertDirectory,\n        env: {},\n        stdio: [\"pipe\", \"pipe\", \"pipe\"]\n      })\n      startedHelpers++\n    } catch (cause) {\n      // libuv reports some exec failures — `ENOEXEC` for a file that is\n      // neither a script nor a binary — by throwing rather than by emitting an\n      // `error` event, so both arrivals have to end in the same refusal.\n      resume(Effect.fail(failure(request, cause)))\n      return Effect.void\n    }\n    const closed = new Promise<void>((resolve) => child.once(\"close\", () => resolve()))\n    // `deadline` is armed below, after the completion it resumes through\n    // exists. Reading it here is safe because nothing calls `cleanup` before\n    // then: the one earlier exit, a spawn that threw, resumes and returns.\n    const cleanup = () => {\n      clearTimeout(deadline)\n      child.stdin.destroy()\n      child.stdout.destroy()\n      child.stderr.destroy()\n      child.kill(\"SIGKILL\")\n    }\n    const complete = (effect: Effect.Effect<A, PlatformError.PlatformError>) => {\n      if (settled) return\n      settled = true\n      // Every exit path drains and kills, so an overflowing, hung, or already\n      // finished helper leaves no descriptor and no child behind.\n      cleanup()\n      resume(Effect.andThen(Effect.promise(() => closed), effect))\n    }\n    // A wall-clock backstop, independent of every byte ceiling. Those bound\n    // what a helper may SAY; nothing bounds how long it may take to say it, and\n    // a helper that never answers would otherwise hold the fiber until the run\n    // itself is interrupted.\n    const deadline = setTimeout(() => {\n      complete(Effect.fail(failure(\n        request,\n        atomicHelperFault(\"helper_timeout\", `atomic helper did not answer within ${settings.timeoutMs} ms`)\n      )))\n    }, settings.timeoutMs)\n    deadline.unref()\n    // Raw buffers, never decoded strings: a chunk boundary in the middle of a\n    // multi-byte character would otherwise be decoded as two replacement\n    // characters before the JSON parse ever saw it. Concatenating once at the\n    // end also keeps accumulation linear instead of quadratic.\n    // Retained bytes are bounded by the ceiling plus at most one pipe chunk:\n    // an overflowing chunk is sliced before it is retained, so the host never\n    // relies on the stream implementation's chunk-size convention.\n    child.stdout.on(\"data\", (chunk: Buffer) => {\n      const remaining = limits.response + frameHeaderBytes - stdoutBytes\n      if (chunk.byteLength > remaining) {\n        if (remaining > 0) {\n          stdout.push(chunk.subarray(0, remaining))\n          stdoutBytes += remaining\n        }\n        complete(Effect.fail(failure(\n          request,\n          atomicHelperFault(\n            \"response_limit_exceeded\",\n            `atomic helper wrote more than ${limits.response} response bytes`\n          )\n        )))\n        return\n      }\n      stdoutBytes += chunk.byteLength\n      stdout.push(chunk)\n    })\n    // stderr is bounded on its own budget: a helper that says nothing useful\n    // on stdout must not be able to exhaust the host through diagnostics.\n    // Destroying the pipe stops the helper at its next write rather than\n    // letting it produce output nobody will read.\n    child.stderr.on(\"data\", (chunk: Buffer) => {\n      // Sliced to the remaining room rather than kept whole, so the retained\n      // text is exactly the budget and not the budget plus a pipe buffer.\n      const slice = chunk.subarray(0, limits.stderr - stderrBytes)\n      stderrBytes += slice.byteLength\n      stderr.push(slice)\n      if (stderrBytes >= limits.stderr) {\n        truncated = true\n        child.stderr.destroy()\n      }\n    })\n    child.on(\"error\", (cause) => complete(Effect.fail(failure(request, cause))))\n    // A helper that exits before draining stdin — an unavailable helper,\n    // a rejected request, an interrupt that killed it mid-write — makes the\n    // request write fail with EPIPE. Without a listener that is an unhandled\n    // `error` event on the pipe, which terminates the host process instead of\n    // failing one filesystem call. It is recorded rather than resumed on, so\n    // that a helper which did manage to report a real errno keeps precedence\n    // over the broken pipe its own exit caused.\n    child.stdin.on(\"error\", (cause) => {\n      writeFailure = cause\n    })\n    child.on(\"close\", (code) => {\n      let envelope: HelperResult | undefined\n      let malformed: unknown\n      try {\n        envelope = decode(Buffer.concat(stdout), limits)\n      } catch (cause) {\n        malformed = cause\n      }\n      if (envelope !== undefined && !envelope.ok) {\n        // The helper's own typed rejection outranks the exit status and any\n        // transport noise: it is the only thing that knows which errno the\n        // syscall produced.\n        complete(Effect.fail(failure(\n          request,\n          atomicHelperFault(\"helper_rejected\", envelope.message ?? \"atomic helper rejected the operation\"),\n          envelope\n        )))\n        return\n      }\n      if (envelope !== undefined && code === 0) {\n        try {\n          complete(convert<A>(request, envelope.value, limits))\n        } catch (cause) {\n          complete(Effect.fail(failure(request, cause)))\n        }\n        return\n      }\n      const text = Buffer.concat(stderr).toString(\"utf8\")\n      complete(Effect.fail(failure(\n        request,\n        text !== \"\"\n          ? atomicHelperFault(\n            \"helper_exited\",\n            `atomic helper exited ${code}: ${text}${truncated ? \" (truncated)\" : \"\"}`\n          )\n          : writeFailure !== undefined\n          ? writeFailure\n          : malformed !== undefined\n          ? malformed\n          : atomicHelperFault(\"helper_exited\", `atomic helper exited ${code}`)\n      )))\n    })\n    child.stdin.end(payload)\n    return Effect.promise(async () => {\n      cleanup()\n      await closed\n    })\n  })\n"]}

package/dist/esm/internal/AtomicHelperError.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The configuration failures of the atomic filesystem helper: a layer option
+ * outside its bounds, a request that cannot be serialized, and a helper that
+ * cannot be found, is not usable, or is not trusted. A caller classifies one
+ * by `_tag` and `code` instead of reading its message.
+ * @since 1.0.0
+ */
+import { Schema } from "effect";
+/**
+ * Why the atomic helper could not be configured or resolved.
+ * @category models
+ * @since 1.0.0
+ */
+export declare const AtomicHelperErrorCode: Schema.Literals<readonly ["limit_invalid", "concurrency_invalid", "timeout_invalid", "request_not_serializable", "helper_missing", "helper_unusable", "helper_path_invalid", "helper_not_regular_file", "helper_inside_workspace", "staging_directory_not_private", "staging_unavailable"]>;
+/**
+ * The stable code of an {@link AtomicHelperError}.
+ * @category models
+ * @since 1.0.0
+ */
+export type AtomicHelperErrorCode = typeof AtomicHelperErrorCode.Type;
+declare const AtomicHelperError_base: Schema.Class<AtomicHelperError, Schema.TaggedStruct<"@smthrs/platform-node/AtomicHelperError", {
+    readonly code: Schema.Literals<readonly ["limit_invalid", "concurrency_invalid", "timeout_invalid", "request_not_serializable", "helper_missing", "helper_unusable", "helper_path_invalid", "helper_not_regular_file", "helper_inside_workspace", "staging_directory_not_private", "staging_unavailable"]>;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The atomic helper is misconfigured, missing, or untrusted. `message` names
+ * what was searched and how to install the helper where that applies.
+ * @category errors
+ * @since 1.0.0
+ */
+export declare class AtomicHelperError extends AtomicHelperError_base {
+    readonly name = "AtomicHelperError";
+}
+export {};
+//# sourceMappingURL=AtomicHelperError.d.ts.map

package/dist/esm/internal/AtomicHelperError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AtomicHelperError.d.ts","sourceRoot":"","sources":["../../../src/internal/AtomicHelperError.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,6RAYhC,CAAA;AAEF;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;;;;;AAErE;;;;;GAKG;AACH,qBAAa,iBACX,SAAQ,sBAGN;IAEF,SAAkB,IAAI,uBAAsB;CAC7C"}

package/dist/esm/internal/AtomicHelperError.js

@@ -0,0 +1,39 @@
+/**
+ * The configuration failures of the atomic filesystem helper: a layer option
+ * outside its bounds, a request that cannot be serialized, and a helper that
+ * cannot be found, is not usable, or is not trusted. A caller classifies one
+ * by `_tag` and `code` instead of reading its message.
+ * @since 1.0.0
+ */
+import { Schema } from "effect";
+/**
+ * Why the atomic helper could not be configured or resolved.
+ * @category models
+ * @since 1.0.0
+ */
+export const AtomicHelperErrorCode = Schema.Literals([
+    "limit_invalid",
+    "concurrency_invalid",
+    "timeout_invalid",
+    "request_not_serializable",
+    "helper_missing",
+    "helper_unusable",
+    "helper_path_invalid",
+    "helper_not_regular_file",
+    "helper_inside_workspace",
+    "staging_directory_not_private",
+    "staging_unavailable"
+]);
+/**
+ * The atomic helper is misconfigured, missing, or untrusted. `message` names
+ * what was searched and how to install the helper where that applies.
+ * @category errors
+ * @since 1.0.0
+ */
+export class AtomicHelperError extends Schema.TaggedError()("@smthrs/platform-node/AtomicHelperError", {
+    code: AtomicHelperErrorCode,
+    message: Schema.String
+}) {
+    name = "AtomicHelperError";
+}
+//# sourceMappingURL=AtomicHelperError.js.map

package/dist/esm/internal/AtomicHelperError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AtomicHelperError.js","sourceRoot":"","sources":["../../../src/internal/AtomicHelperError.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnD,eAAe;IACf,qBAAqB;IACrB,iBAAiB;IACjB,0BAA0B;IAC1B,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,yBAAyB;IACzB,yBAAyB;IACzB,+BAA+B;IAC/B,qBAAqB;CACtB,CAAC,CAAA;AASF;;;;;GAKG;AACH,MAAM,OAAO,iBACX,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAAC,yCAAyC,EAAE;IACzF,IAAI,EAAE,qBAAqB;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;IAEgB,IAAI,GAAG,mBAAmB,CAAA;CAC7C","sourcesContent":["/**\n * The configuration failures of the atomic filesystem helper: a layer option\n * outside its bounds, a request that cannot be serialized, and a helper that\n * cannot be found, is not usable, or is not trusted. A caller classifies one\n * by `_tag` and `code` instead of reading its message.\n * @since 1.0.0\n */\n\nimport { Schema } from \"effect\"\n\n/**\n * Why the atomic helper could not be configured or resolved.\n * @category models\n * @since 1.0.0\n */\nexport const AtomicHelperErrorCode = Schema.Literals([\n  \"limit_invalid\",\n  \"concurrency_invalid\",\n  \"timeout_invalid\",\n  \"request_not_serializable\",\n  \"helper_missing\",\n  \"helper_unusable\",\n  \"helper_path_invalid\",\n  \"helper_not_regular_file\",\n  \"helper_inside_workspace\",\n  \"staging_directory_not_private\",\n  \"staging_unavailable\"\n])\n\n/**\n * The stable code of an {@link AtomicHelperError}.\n * @category models\n * @since 1.0.0\n */\nexport type AtomicHelperErrorCode = typeof AtomicHelperErrorCode.Type\n\n/**\n * The atomic helper is misconfigured, missing, or untrusted. `message` names\n * what was searched and how to install the helper where that applies.\n * @category errors\n * @since 1.0.0\n */\nexport class AtomicHelperError\n  extends Schema.TaggedError<AtomicHelperError>()(\"@smthrs/platform-node/AtomicHelperError\", {\n    code: AtomicHelperErrorCode,\n    message: Schema.String\n  })\n{\n  override readonly name = \"AtomicHelperError\"\n}\n"]}

package/dist/esm/internal/AtomicHelperFault.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The atomic helper broke its protocol or its transport failed: a response that
+ * is not framed, a field of the wrong shape, an answer over a bound, a helper
+ * that never answered, or one that exited. `AtomicFileSystemProtocol.failure`
+ * reports one as the `cause` of a `PlatformError`, so a caller classifies it by
+ * `_tag` and `code`. {@link AtomicHelperRejection} carries the errno a helper
+ * itself reported.
+ * @since 1.0.0
+ */
+import { Schema } from "effect";
+/**
+ * Which rule of the helper protocol or transport was broken.
+ * @category models
+ * @since 1.0.0
+ */
+export declare const AtomicHelperFaultCode: Schema.Literals<readonly ["response_unframed", "response_tag_unknown", "response_length_invalid", "response_length_mismatch", "envelope_malformed", "field_malformed", "file_type_unknown", "payload_malformed", "read_limit_exceeded", "entries_malformed", "batch_malformed", "digest_malformed", "result_malformed", "operation_unsupported", "helper_timeout", "response_limit_exceeded", "helper_rejected", "helper_exited"]>;
+/**
+ * The stable code of an {@link AtomicHelperFault}.
+ * @category models
+ * @since 1.0.0
+ */
+export type AtomicHelperFaultCode = typeof AtomicHelperFaultCode.Type;
+declare const AtomicHelperFault_base: Schema.Class<AtomicHelperFault, Schema.TaggedStruct<"@smthrs/platform-node/AtomicHelperFault", {
+    readonly code: Schema.Literals<readonly ["response_unframed", "response_tag_unknown", "response_length_invalid", "response_length_mismatch", "envelope_malformed", "field_malformed", "file_type_unknown", "payload_malformed", "read_limit_exceeded", "entries_malformed", "batch_malformed", "digest_malformed", "result_malformed", "operation_unsupported", "helper_timeout", "response_limit_exceeded", "helper_rejected", "helper_exited"]>;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The helper's response or process broke the protocol. The helper is treated as
+ * untrusted, so the operation fails closed.
+ * @category errors
+ * @since 1.0.0
+ */
+export declare class AtomicHelperFault extends AtomicHelperFault_base {
+    readonly name = "AtomicHelperFault";
+}
+/**
+ * A helper fault with a stable code.
+ * @category constructors
+ * @since 1.0.0
+ */
+export declare const atomicHelperFault: (code: AtomicHelperFaultCode, message: string) => AtomicHelperFault;
+declare const AtomicHelperRejection_base: Schema.Class<AtomicHelperRejection, Schema.TaggedStruct<"@smthrs/platform-node/AtomicHelperRejection", {
+    readonly code: Schema.String;
+    readonly syscall: Schema.optional<Schema.String>;
+    readonly message: Schema.String;
+    readonly cause: Schema.optional<Schema.Unknown>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The errno a helper reported for a syscall it ran, in the shape the native
+ * Node adapter's errors carry so callers that read `code` and `syscall` see the
+ * same contract.
+ * @category errors
+ * @since 1.0.0
+ */
+export declare class AtomicHelperRejection extends AtomicHelperRejection_base {
+    readonly name = "AtomicHelperRejection";
+}
+export {};
+//# sourceMappingURL=AtomicHelperFault.d.ts.map

package/dist/esm/internal/AtomicHelperFault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AtomicHelperFault.d.ts","sourceRoot":"","sources":["../../../src/internal/AtomicHelperFault.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,oaAmBhC,CAAA;AAEF;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;;;;;AAErE;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,sBAGtC;IACC,SAAkB,IAAI,uBAAsB;CAC7C;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,qBAAqB,EAAE,SAAS,MAAM,KAAG,iBACvC,CAAA;;;;;;;AAE1C;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,0BAQ1C;IACC,SAAkB,IAAI,2BAA0B;CACjD"}

package/dist/esm/internal/AtomicHelperFault.js

@@ -0,0 +1,66 @@
+/**
+ * The atomic helper broke its protocol or its transport failed: a response that
+ * is not framed, a field of the wrong shape, an answer over a bound, a helper
+ * that never answered, or one that exited. `AtomicFileSystemProtocol.failure`
+ * reports one as the `cause` of a `PlatformError`, so a caller classifies it by
+ * `_tag` and `code`. {@link AtomicHelperRejection} carries the errno a helper
+ * itself reported.
+ * @since 1.0.0
+ */
+import { Schema } from "effect";
+/**
+ * Which rule of the helper protocol or transport was broken.
+ * @category models
+ * @since 1.0.0
+ */
+export const AtomicHelperFaultCode = Schema.Literals([
+    "response_unframed",
+    "response_tag_unknown",
+    "response_length_invalid",
+    "response_length_mismatch",
+    "envelope_malformed",
+    "field_malformed",
+    "file_type_unknown",
+    "payload_malformed",
+    "read_limit_exceeded",
+    "entries_malformed",
+    "batch_malformed",
+    "digest_malformed",
+    "result_malformed",
+    "operation_unsupported",
+    "helper_timeout",
+    "response_limit_exceeded",
+    "helper_rejected",
+    "helper_exited"
+]);
+/**
+ * The helper's response or process broke the protocol. The helper is treated as
+ * untrusted, so the operation fails closed.
+ * @category errors
+ * @since 1.0.0
+ */
+export class AtomicHelperFault extends Schema.TaggedError()("@smthrs/platform-node/AtomicHelperFault", { code: AtomicHelperFaultCode, message: Schema.String }) {
+    name = "AtomicHelperFault";
+}
+/**
+ * A helper fault with a stable code.
+ * @category constructors
+ * @since 1.0.0
+ */
+export const atomicHelperFault = (code, message) => new AtomicHelperFault({ code, message });
+/**
+ * The errno a helper reported for a syscall it ran, in the shape the native
+ * Node adapter's errors carry so callers that read `code` and `syscall` see the
+ * same contract.
+ * @category errors
+ * @since 1.0.0
+ */
+export class AtomicHelperRejection extends Schema.TaggedError()("@smthrs/platform-node/AtomicHelperRejection", {
+    code: Schema.String,
+    syscall: Schema.optional(Schema.String),
+    message: Schema.String,
+    cause: Schema.optional(Schema.Unknown)
+}) {
+    name = "AtomicHelperRejection";
+}
+//# sourceMappingURL=AtomicHelperFault.js.map

package/dist/esm/internal/AtomicHelperFault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AtomicHelperFault.js","sourceRoot":"","sources":["../../../src/internal/AtomicHelperFault.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnD,mBAAmB;IACnB,sBAAsB;IACtB,yBAAyB;IACzB,0BAA0B;IAC1B,oBAAoB;IACpB,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,eAAe;CAChB,CAAC,CAAA;AASF;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,yCAAyC,EACzC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CACxD;IACmB,IAAI,GAAG,mBAAmB,CAAA;CAC7C;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAA2B,EAAE,OAAe,EAAqB,EAAE,CACnG,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;AAE1C;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CACpF,6CAA6C,EAC7C;IACE,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;CACvC,CACF;IACmB,IAAI,GAAG,uBAAuB,CAAA;CACjD","sourcesContent":["/**\n * The atomic helper broke its protocol or its transport failed: a response that\n * is not framed, a field of the wrong shape, an answer over a bound, a helper\n * that never answered, or one that exited. `AtomicFileSystemProtocol.failure`\n * reports one as the `cause` of a `PlatformError`, so a caller classifies it by\n * `_tag` and `code`. {@link AtomicHelperRejection} carries the errno a helper\n * itself reported.\n * @since 1.0.0\n */\n\nimport { Schema } from \"effect\"\n\n/**\n * Which rule of the helper protocol or transport was broken.\n * @category models\n * @since 1.0.0\n */\nexport const AtomicHelperFaultCode = Schema.Literals([\n  \"response_unframed\",\n  \"response_tag_unknown\",\n  \"response_length_invalid\",\n  \"response_length_mismatch\",\n  \"envelope_malformed\",\n  \"field_malformed\",\n  \"file_type_unknown\",\n  \"payload_malformed\",\n  \"read_limit_exceeded\",\n  \"entries_malformed\",\n  \"batch_malformed\",\n  \"digest_malformed\",\n  \"result_malformed\",\n  \"operation_unsupported\",\n  \"helper_timeout\",\n  \"response_limit_exceeded\",\n  \"helper_rejected\",\n  \"helper_exited\"\n])\n\n/**\n * The stable code of an {@link AtomicHelperFault}.\n * @category models\n * @since 1.0.0\n */\nexport type AtomicHelperFaultCode = typeof AtomicHelperFaultCode.Type\n\n/**\n * The helper's response or process broke the protocol. The helper is treated as\n * untrusted, so the operation fails closed.\n * @category errors\n * @since 1.0.0\n */\nexport class AtomicHelperFault extends Schema.TaggedError<AtomicHelperFault>()(\n  \"@smthrs/platform-node/AtomicHelperFault\",\n  { code: AtomicHelperFaultCode, message: Schema.String }\n) {\n  override readonly name = \"AtomicHelperFault\"\n}\n\n/**\n * A helper fault with a stable code.\n * @category constructors\n * @since 1.0.0\n */\nexport const atomicHelperFault = (code: AtomicHelperFaultCode, message: string): AtomicHelperFault =>\n  new AtomicHelperFault({ code, message })\n\n/**\n * The errno a helper reported for a syscall it ran, in the shape the native\n * Node adapter's errors carry so callers that read `code` and `syscall` see the\n * same contract.\n * @category errors\n * @since 1.0.0\n */\nexport class AtomicHelperRejection extends Schema.TaggedError<AtomicHelperRejection>()(\n  \"@smthrs/platform-node/AtomicHelperRejection\",\n  {\n    code: Schema.String,\n    syscall: Schema.optional(Schema.String),\n    message: Schema.String,\n    cause: Schema.optional(Schema.Unknown)\n  }\n) {\n  override readonly name = \"AtomicHelperRejection\"\n}\n"]}

package/dist/esm/internal/PipedProcess.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Native I/O ownership for transient commands and prepared process owners.
+ * @since 1.0.0
+ */
+import * as Effect from "effect/Effect";
+import * as PlatformError from "effect/PlatformError";
+import type * as Scope from "effect/Scope";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { type ChildProcessHandle } from "effect/unstable/process/ChildProcessSpawner";
+/**
+ * Windows owners receive caller streams above the reserved CRT standard slots.
+ * @private
+ * @since 1.0.0
+ */
+export declare const standardFdsOf: (handle: ChildProcessHandle) => ReadonlyArray<number | "ignore"> | undefined;
+/**
+ * Converts native errors without losing their errno or signal.
+ * @private
+ * @since 1.0.0
+ */
+export declare const failure: (method: string, cause: unknown) => PlatformError.PlatformError;
+/**
+ * Native standard-command I/O, including configured streams and custom pipes.
+ * Lifetime error listeners remain on every owned pipe after any consumer is
+ * interrupted, so a pending native write cannot raise an unhandled late EPIPE.
+ * Consumers still receive the original error through NodeStream/NodeSink.
+ * This adapter also preserves native Windows verbatim arguments.
+ *
+ * It never sends a negative-pid signal. POSIX tree cleanup belongs to the
+ * prepared supervisor, which remains alive while it signals its own group.
+ * @private
+ * @since 1.0.0
+ */
+export declare const spawn: (command: ChildProcess.StandardCommand, windowsVerbatimArguments: boolean | undefined, owner?: boolean) => Effect.Effect<ChildProcessHandle, PlatformError.PlatformError, Scope.Scope>;
+//# sourceMappingURL=PipedProcess.d.ts.map

package/dist/esm/internal/PipedProcess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PipedProcess.d.ts","sourceRoot":"","sources":["../../../src/internal/PipedProcess.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAA;AAG1C,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,KAAK,kBAAkB,EAAmC,MAAM,6CAA6C,CAAA;AAMtH;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,kBAAkB,KAAG,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,SAChE,CAAA;AAa9B;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,OAAO,OAAO,KAAG,aAAa,CAAC,aAUtE,CAAA;AAyCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,GAChB,SAAS,YAAY,CAAC,eAAe,EACrC,0BAA0B,OAAO,GAAG,SAAS,EAC7C,eAAa,KACZ,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,CAsPzE,CAAA"}