functionalscript 0.35.1 → 0.36.0

package/fs/base64/module.f.js

@@ -6,7 +6,7 @@
 import { msb, length, vec, empty } from "../types/bit_vec/module.f.js";
 import { baseN } from "../base_n/module.f.js";
 const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
-const { popFront, concat } = msb;
+const { popFront } = msb;
 const { vecToString, stringToVec } = baseN(6n, alphabet);
 export const encode = (input) => {
     const len = length(input);
@@ -14,10 +14,11 @@ export const encode = (input) => {
     if (len % 8n !== 0n) {
         return null;
     }
-    const rem = len % 24n;
-    const padBits = rem === 0n ? 0n : 6n - rem % 6n;
-    const v = padBits > 0n ? concat(input)(vec(padBits)(0n)) : input;
-    let result = vecToString(v);
+    // `vecToString` (via `baseN`'s `chunkList`) already left-pads a trailing
+    // partial 6-bit chunk with zeros, so `input` needs no explicit padding —
+    // building one would risk pushing an intermediate `Vec` past `maxLength`
+    // for input already at or near that limit, for no benefit.
+    let result = vecToString(input);
     // Append `=` padding to make total length a multiple of 4.
     while (result.length % 4 !== 0) {
         result += '=';

package/fs/base64/proof.f.d.ts

@@ -9,5 +9,6 @@ export declare const proof: {
     validPadding: () => void;
     knownVectors: () => void;
     decodeOverflow: () => void;
+    encodeAtMaxLengthSucceeds: () => void;
     encodeLargeVecIsSlow: () => void;
 };

package/fs/base64/proof.f.js

@@ -1,5 +1,5 @@
 import { assertEq } from "../asserts/module.f.js";
-import { empty, vec, repeat, vec8 } from "../types/bit_vec/module.f.js";
+import { empty, vec, repeat, vec8, maxLength } from "../types/bit_vec/module.f.js";
 import { encode, decode } from "./module.f.js";
 const check = (s, v) => {
     assertEq(encode(v), s);
@@ -83,6 +83,15 @@ export const proof = {
         const oversized = 'A'.repeat(174_764);
         assertEq(decode(oversized), null);
     },
+    encodeAtMaxLengthSucceeds: () => {
+        // A `maxLength`-sized vector's trailing partial 6-bit chunk is
+        // left-padded by `vecToString` itself (see `baseN`), so `encode`
+        // never needs to build an over-`maxLength` intermediate and must not
+        // reject this boundary input. (`decode` of the resulting string
+        // still fails on this exact boundary — a separate, still-open bug;
+        // see `fs/base64/todo/decode-rejects-max-size-input.md`.)
+        assertEq(encode(vec(maxLength)(0n)), 'A'.repeat(174_763) + '=');
+    },
     // Regression guard: `encode` used to be quadratic in the input size, not
     // linear. `baseN`'s `vecToString` (`fs/base_n/module.f.ts`) popped one
     // 6-bit chunk off the front at a time via `popFront`, and each `popFront`

package/fs/cas/mcp/module.f.d.ts

@@ -1,12 +1,12 @@
 import { type Effect } from '../../effects/module.f.ts';
 import { type MemOp } from '../../effects/memory/module.f.ts';
-import { type Read, type Rm, type Write } from '../../effects/node/module.f.ts';
+import { type Read, type Write } from '../../effects/node/module.f.ts';
 import { type McpConfig, type McpHandlers } from '../../mcp/module.f.ts';
 import { type FileCasOperation } from '../module.f.ts';
 /** Arguments for `cas_add`: content to store, with optional encoding type. */
 export declare const casAddArgs: {
     readonly content: import("../../types/rtti/module.f.ts").String;
-    readonly type: import("../../types/rtti/module.f.ts").Or<["text", "base64", "url", undefined]>;
+    readonly type: import("../../types/rtti/module.f.ts").Or<["text", "base64", undefined]>;
 };
 /** Arguments for `cas_get`: the cBase32 hash to look up; optionally request inline content. */
 export declare const casGetArgs: {
@@ -18,7 +18,7 @@ export declare const casListArgs: {};
 /**
  * MCP handlers for `FileCas`.
  */
-export declare const casMcpHandlers: (home: string) => McpHandlers<FileCasOperation | Rm>;
+export declare const casMcpHandlers: (home: string) => McpHandlers<FileCasOperation>;
 /**
  * Static MCP configuration for the CAS server: advertises the `tools`
  * capability, identifies the server, and pins the protocol version.
@@ -29,4 +29,8 @@ export declare const casConfig: McpConfig;
  * the `mcpStep` for `c`, and drives the read → parse → dispatch → write loop
  * until stdin EOF.
  */
-export declare const casMcpServer: (home: string) => Effect<Read | Write | MemOp | FileCasOperation | Rm, void>;
+export declare const casMcpServer: (home: string) => Effect<Read | Write | MemOp | FileCasOperation, void>;
+export declare const proof: {
+    casMcpServer: () => void;
+    collectReadOverflow: () => void;
+};

package/fs/cas/mcp/module.f.js

@@ -11,7 +11,7 @@
  *
  * | Tool       | args                          | action           | result                              |
  * |------------|-------------------------------|------------------|-------------------------------------|
- * | `cas_add`  | `{ content, type? }`          | write/upload     | hash (cBase32)                      |
+ * | `cas_add`  | `{ content, type? }`          | `c.write(...)`   | hash (cBase32)                      |
  * | `cas_get`  | `{ hash, content?: boolean }` | `c.read(key)`    | JSON `{length,mime_type,type[,content]}` |
  * | `cas_list` | `{}`                          | `c.list()`       | hashes, one per line                |
  *
@@ -23,9 +23,11 @@
  *   without any encoding step.
  * - `'base64'`: `content` is RFC 4648 base64, decoded to bytes before storage.
  *   Use this for pre-encoded binary payloads.
- * - `'url'`: `content` is a filesystem path within `$HOME/cas_upload/`; the server
- *   moves the file via the streaming move-hash-move pipeline (no size limit).
- *   Paths outside `$HOME/cas_upload/` or containing `..` are rejected for security.
+ *
+ * Inline content (either encoding) is capped at 128 KiB (`maxLength`). There is
+ * no MCP route for larger content — the server never opens a local path named by
+ * the client (see the invariant in `fs/cas/mcp/README.md`); large files go
+ * through the `cas` CLI (`cas add <path>`) instead, run directly by the user.
  *
  * ## `cas_get` output
  *
@@ -80,18 +82,18 @@
  */
 import { string, option, or, boolean } from "../../types/rtti/module.f.js";
 import { stringify } from "../../json/module.f.js";
-import { pure } from "../../effects/module.f.js";
+import { pure, decode } from "../../effects/module.f.js";
 import { create } from "../../effects/memory/module.f.js";
 import { cBase32ToVec, vecToCBase32 } from "../../cbase32/module.f.js";
 import { decode as base64Decode, encode as base64Encode } from "../../base64/module.f.js";
 import { tryUtf8 } from "../../text/module.f.js";
 import { detectStream } from "../../mime/module.f.js";
-import { empty, length as bitVecLength, maxLength, maxLengthBytes, msb } from "../../types/bit_vec/module.f.js";
+import { empty, length as bitVecLength, maxLength, maxLengthBytes, msb, vec } from "../../types/bit_vec/module.f.js";
 import { ok, error } from "../../types/result/module.f.js";
-import { rm } from "../../effects/node/module.f.js";
+import {} from "../../effects/node/module.f.js";
 import { stdioTransport } from "../../mcp/stdio/module.f.js";
 import { mcpStep, uninitializedState, toolEntry, fromRegistry, errorResult, } from "../../mcp/module.f.js";
-import { casAddFile, fileCas } from "../module.f.js";
+import { fileCas } from "../module.f.js";
 import { fromVec } from "../../text/utf8/module.f.js";
 import { identity } from "../../types/function/module.f.js";
 import { sha256 } from "../../crypto/sha2/module.f.js";
@@ -100,7 +102,7 @@ import { nonEmpty, empty as elEmpty } from "../../effects/list/module.f.js";
 /** Arguments for `cas_add`: content to store, with optional encoding type. */
 export const casAddArgs = {
     content: string,
-    type: or('text', 'base64', 'url', undefined)
+    type: or('text', 'base64', undefined)
 };
 /** Arguments for `cas_get`: the cBase32 hash to look up; optionally request inline content. */
 export const casGetArgs = {
@@ -142,24 +144,14 @@ const toJson = stringify(identity);
 /** Registry of all CAS tools. */
 const casToolRegistry = (home) => {
     const c = fileCas(sha256)(home);
-    const casUploadDir = `${home}/cas_upload`;
     return [
-        toolEntry('cas_add', 'Store content and return its hash (cBase32). Pass type:"base64" for binary; omit or pass type:"text" for UTF-8 text (default). Inline content (text/base64) is capped at 128 KiB (131072 bytes) — larger content is rejected. For larger content use type:"url" to stream a file from $HOME/cas_upload/ (no size limit).', casAddArgs, ({ type, content }) => {
-            // type:'url' — stream the file into cas, then delete the source on success
-            if (type === 'url') {
-                if (!content.startsWith(`${casUploadDir}/`) || content.includes('..')) {
-                    return pure(errorResult(`cas_add type:url paths must be within ${casUploadDir}/ — got: ${content}`));
-                }
-                return casAddFile(c)(content).step(([t, v]) => t === 'error'
-                    ? pure(errorResult(`upload failed: ${v}`))
-                    : rm(content).step(() => pure(okResult(vecToCBase32(v)))));
-            }
+        toolEntry('cas_add', 'Store content and return its hash (cBase32). Pass type:"base64" for binary; omit or pass type:"text" for UTF-8 text (default). Inline content is capped at 128 KiB (131072 bytes) — larger content is rejected. For larger content, store the file with the `cas` CLI instead: run `npx functionalscript cas add <path>` yourself if you have shell access, or give the user that exact command to run — it prints the resulting hash on stdout.', casAddArgs, ({ type, content }) => {
             // type:'text' or 'base64' — resolve content to Vec, store via c.write()
             let x = type === 'base64'
                 ? base64Decode(content)
                 : tryUtf8(content);
             return x === null
-                ? pure(errorResult('too large or malformed — use type:"url" for large content'))
+                ? pure(errorResult('too large or malformed — for large content, run `npx functionalscript cas add <path>` (or have the user run it) instead'))
                 // The resolved content fits in one chunk; feed it as a single-item stream.
                 : c.write(nonEmpty(ok(x), elEmpty())).step(([tag, hash]) => pure(tag === 'error'
                     ? errorResult('write')
@@ -235,3 +227,23 @@ export const casConfig = {
  * until stdin EOF.
  */
 export const casMcpServer = (home) => create(uninitializedState).step(key => stdioTransport(mcpStep(casConfig)(casMcpHandlers(home))(key)));
+// ── Tests ────────────────────────────────────────────────────────────────────
+export const proof = {
+    // casMcpServer is never called in integration tests because it drives a
+    // real stdio server; call it here to cover its Effect-building body.
+    casMcpServer: () => { casMcpServer('/'); },
+    // The overflow guard in collectRead (lines 125-126) is only reached when
+    // the running total of two stream chunks would exceed maxLength.  Feed a
+    // pure stream whose second chunk pushes it just over the limit so the
+    // error branch executes without any real I/O.
+    collectReadOverflow: () => {
+        const half = maxLength / 2n;
+        const v1 = vec(half)(0n);
+        const v2 = vec(half + 1n)(0n);
+        const stream = nonEmpty(ok(v1), nonEmpty(ok(v2), elEmpty()));
+        const d = decode(collectRead(stream));
+        if (!d.done || d.result[0] !== 'error') {
+            throw 'expected overflow error';
+        }
+    },
+};

package/fs/cas/mcp/proof.f.d.ts

@@ -30,18 +30,11 @@ export declare const proof: {
     getMissingHashIsError: () => void;
     unknownToolIsError: () => void;
     toolErrorIsNotJsonRpcError: () => void;
-    addUrlStoresFileAndReturnsHash: () => void;
-    addUrlRoundTrips: () => void;
-    addUrlMissingFileIsError: () => void;
     getMetaReturnsLengthAndMimeType: () => void;
     getMetaBinaryBlob: () => void;
     getMetaOctetStreamForUnknownBinary: () => void;
     getMetaOctetStreamForNulBlob: () => void;
     getMetaMissingHashIsError: () => void;
     getMetaInvalidHashIsError: () => void;
-    addUrlFromSubdirectorySucceeds: () => void;
-    addUrlFromApprovedDirectorySucceeds: () => void;
-    addUrlFromRandomDirectoryIsRejected: () => void;
-    addUrlWithPathTraversalIsRejected: () => void;
     getOctetStreamWithContentIncludesBase64: () => void;
 };

package/fs/cas/mcp/proof.f.js

@@ -6,7 +6,9 @@ import { msb, u8ListToVec, vec8, repeat, length, maxLengthBytes } from "../../ty
 import { vecToCBase32 } from "../../cbase32/module.f.js";
 import { encode as base64Encode } from "../../base64/module.f.js";
 import { utf8 } from "../../text/module.f.js";
-import {} from "../module.f.js";
+import { fileCas } from "../module.f.js";
+import { sha256 } from "../../crypto/sha2/module.f.js";
+import { nonEmpty, empty as elEmpty } from "../../effects/list/module.f.js";
 import { mcpStep, uninitializedState, } from "../../mcp/module.f.js";
 import { emptyState, virtual } from "../../effects/node/virtual/module.f.js";
 import { casConfig, casMcpHandlers } from "./module.f.js";
@@ -59,6 +61,19 @@ const runSessionVirtual = (root, home = '/home/user') => (msgs) => {
     });
     return virtual({ ...emptyState, root })(effect)[1];
 };
+// Seeds a blob directly into the virtual store via `c.write`, bypassing the
+// MCP `cas_add` tool entirely — used by tests that need a stored blob larger
+// than `cas_add`'s inline limit, now that the removed `type:'url'` path is no
+// longer available to stage one through MCP. Returns the resulting root
+// `Dir` (with the new shard written) and the blob's cBase32 hash so a
+// subsequent `runSessionVirtual` call can read it back via `cas_get`.
+const seedBlob = (root, home = '/home/user') => (chunks) => {
+    const c = fileCas(sha256)(home);
+    const stream = chunks.reduceRight((tail, chunk) => nonEmpty(resultOk(chunk), tail), elEmpty());
+    const [state, result] = virtual({ ...emptyState, root })(c.write(stream));
+    assert(result[0] === 'ok', result);
+    return [state.root, vecToCBase32(result[1])];
+};
 // ── Messages ────────────────────────────────────────────────────────────────────
 const init = { jsonrpc: '2.0', method: 'initialize', id: 1,
     params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'c', version: '0' } } };
@@ -95,8 +110,9 @@ const binarySample = base64Encode(vec8(0x2an));
 // `cas_get` detects its type and returns base64 with mime_type image/png.
 const pngSample = base64Encode(u8ListToVec(msb)([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x01]));
 // Returns the RFC 4648 base64 encoding of `n` zero bytes, computed directly
-// without bigint arithmetic — safe near maxLengthBytes where base64Encode on a
-// padded Vec would trigger the encode-padding-overflow bug. Handles every n%3
+// without bigint arithmetic — independent of `base64.encode` so these tests
+// don't rely on the correctness of the function they're indirectly exercising
+// (`cas_add` decodes the string via `base64.decode`). Handles every n%3
 // residue: rem=0 → no padding, rem=1 → 'AA==', rem=2 → 'AAA='.
 const base64OfA = (n) => {
     const groups = Number(n / 3n);
@@ -117,17 +133,10 @@ const base64OfA = (n) => {
 // exactly `maxLengthBytes` (the largest single `Vec` the runtime allows), so the
 // two-chunk blob spans two read chunks without any one `Vec` exceeding the cap.
 const largeMultiChunkBlobMeta = (chunk0, chunk1, expectedType, expectedMime) => () => {
-    const root = { 'home': { 'user': { 'cas_upload': { 'big': [chunk0, chunk1] } } } };
-    const [addResp] = runSessionVirtual(root)([
-        init, initialized,
-        call(2, 'cas_add', { content: '/home/user/cas_upload/big', type: 'url' }),
-    ]).slice(2);
-    assert(!resultOf(addResp).isError);
-    const hash = textOf(addResp);
-    const [, metaResp] = runSessionVirtual(root)([
+    const [root, hash] = seedBlob({})([chunk0, chunk1]);
+    const [metaResp] = runSessionVirtual(root)([
         init, initialized,
-        call(2, 'cas_add', { content: '/home/user/cas_upload/big', type: 'url' }),
-        call(3, 'cas_get', { hash }),
+        call(2, 'cas_get', { hash }),
     ]).slice(2);
     assert(!resultOf(metaResp).isError);
     const meta = JSON.parse(textOf(metaResp));
@@ -145,8 +154,7 @@ const binaryChunk = repeat(maxLengthBytes)(vec8(0xffn));
 // 100,000 raw bytes of 0xFF: comfortably under `maxLengthBytes` (so `cas_get`'s
 // own `length > maxLengthBytes` guard does not fire), but base64 inflates it to
 // ceil(100_000/3)*4 = 133,336 chars — already past `maxLength` (131,072 bytes)
-// before the JSON-RPC envelope adds anything. Small enough to stay clear of the
-// separate `base64Encode`-near-`maxLength` padding bug (see `base64OfA` above).
+// before the JSON-RPC envelope adds anything.
 const oversizedBase64Chunk = repeat(100000n)(vec8(0xffn));
 // 90,000 raw bytes: base64 inflates to 120,000 chars, leaving ~11 KiB of margin
 // under `maxLength` once the envelope is added — the paired "still succeeds" case.
@@ -170,16 +178,10 @@ export const proof = {
     // "too large" error, not "no such hash" — the blob exists, it just can't be
     // buffered inline. The metadata-only path (above) still returns its size/type.
     getContentLargeBlobTooLargeError: () => {
-        const root = { 'home': { 'user': { 'cas_upload': { 'big': [asciiChunk, asciiChunk] } } } };
-        const [addResp] = runSessionVirtual(root)([
-            init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/big', type: 'url' }),
-        ]).slice(2);
-        const hash = textOf(addResp);
-        const [, getResp] = runSessionVirtual(root)([
+        const [root, hash] = seedBlob({})([asciiChunk, asciiChunk]);
+        const [getResp] = runSessionVirtual(root)([
             init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/big', type: 'url' }),
-            call(3, 'cas_get', { hash, content: true }),
+            call(2, 'cas_get', { hash, content: true }),
         ]).slice(2);
         assertEq(resultOf(getResp).isError, true);
         const text = textOf(getResp);
@@ -208,31 +210,21 @@ export const proof = {
     // `fs/base64/proof.f.ts` `encodeLargeVecIsSlow`). Now well under budget on
     // both engines.
     getContentBase64InflationOverflowWritesInternalError: () => {
-        const root = { 'home': { 'user': { 'cas_upload': { 'big': [oversizedBase64Chunk] } } } };
-        const [addResp] = runStdio(root)([
-            call(2, 'cas_add', { content: '/home/user/cas_upload/big', type: 'url' }),
-        ]);
-        const hash = textOf(addResp);
-        const [, getResp] = runStdio(root)([
-            call(2, 'cas_add', { content: '/home/user/cas_upload/big', type: 'url' }),
-            call(3, 'cas_get', { hash, content: true }),
+        const [root, hash] = seedBlob({})([oversizedBase64Chunk]);
+        const [getResp] = runStdio(root)([
+            call(2, 'cas_get', { hash, content: true }),
         ]);
         const err = getResp;
         assertEq(err.error?.code, -32603);
-        assertEq(err.id, 3);
+        assertEq(err.id, 2);
     },
     // The paired boundary case: a blob whose base64 inflation leaves enough
     // margin under `maxLength` for the envelope — confirms the fallback above
     // only triggers on genuine overflow, not on every `content:true` binary read.
     getContentBase64NearBoundarySucceeds: () => {
-        const root = { 'home': { 'user': { 'cas_upload': { 'big': [boundaryBase64Chunk] } } } };
-        const [addResp] = runStdio(root)([
-            call(2, 'cas_add', { content: '/home/user/cas_upload/big', type: 'url' }),
-        ]);
-        const hash = textOf(addResp);
-        const [, getResp] = runStdio(root)([
-            call(2, 'cas_add', { content: '/home/user/cas_upload/big', type: 'url' }),
-            call(3, 'cas_get', { hash, content: true }),
+        const [root, hash] = seedBlob({})([boundaryBase64Chunk]);
+        const [getResp] = runStdio(root)([
+            call(2, 'cas_get', { hash, content: true }),
         ]);
         assert(!resultOf(getResp).isError);
         const result = JSON.parse(textOf(getResp));
@@ -243,25 +235,21 @@ export const proof = {
     // (33,000 bytes) well under `maxLengthBytes`, but each quote costs 2 bytes on
     // the inner CAS-JSON escape and 4 bytes once the outer JSON-RPC envelope
     // re-escapes that backslash-quote pair — no `cas_get`-level size guard could
-    // see this coming, only the transport's real encode attempt can. Uploaded via
-    // `type: 'url'` (a file, not an inlined JSON string) so the test exercises
-    // `cas_get`'s response-side escaping without also paying for parsing a huge
-    // inline `content` argument on the request side. Confirms `writeResponse`'s
+    // see this coming, only the transport's real encode attempt can. Seeded
+    // directly into the store via `seedBlob` (not an inlined `cas_add` JSON
+    // string) so the test exercises `cas_get`'s response-side escaping without
+    // also paying for parsing a huge inline `content` argument on the request
+    // side. Confirms `writeResponse`'s
     // `tryUtf8` fallback (not a crash) handles double-escaping overflow, again
     // preserving the request's `id`.
     getContentDoubleEscapedOverflowWritesInternalError: () => {
-        const root = { 'home': { 'user': { 'cas_upload': { 'q': [quotesChunk] } } } };
-        const [addResp] = runStdio(root)([
-            call(2, 'cas_add', { content: '/home/user/cas_upload/q', type: 'url' }),
-        ]);
-        const hash = textOf(addResp);
-        const [, getResp] = runStdio(root)([
-            call(2, 'cas_add', { content: '/home/user/cas_upload/q', type: 'url' }),
-            call(3, 'cas_get', { hash, content: true }),
+        const [root, hash] = seedBlob({})([quotesChunk]);
+        const [getResp] = runStdio(root)([
+            call(2, 'cas_get', { hash, content: true }),
         ]);
         const err = getResp;
         assertEq(err.error?.code, -32603);
-        assertEq(err.id, 3);
+        assertEq(err.id, 2);
     },
     toolsListAdvertisesThreeTools: () => {
         const [resp] = runSessionVirtual({})([init, initialized, list(2)]).slice(2);
@@ -370,6 +358,7 @@ export const proof = {
         const [resp] = session(call(2, 'cas_add', { content: 'A'.repeat(174_764), type: 'base64' }));
         assertEq(resultOf(resp).isError, true);
         assert(textOf(resp).includes('too large or malformed'));
+        assert(textOf(resp).includes('cas add'));
     },
     // One ASCII byte past maxLengthBytes — tryUtf8 returns null and cas_add
     // surfaces an error.
@@ -377,6 +366,7 @@ export const proof = {
         const [resp] = session(call(2, 'cas_add', { content: 'a'.repeat(Number(maxLengthBytes) + 1) }));
         assertEq(resultOf(resp).isError, true);
         assert(textOf(resp).includes('too large or malformed'));
+        assert(textOf(resp).includes('cas add'));
     },
     // Exactly maxLengthBytes (131,072) ASCII bytes — tryUtf8 returns a non-null
     // Vec (len === maxLength, not over), so cas_add stores cleanly.
@@ -394,6 +384,7 @@ export const proof = {
         const [resp] = session(call(2, 'cas_add', { content: base64OfA(maxLengthBytes), type: 'base64' }));
         assertEq(resultOf(resp).isError, true);
         assert(textOf(resp).includes('too large or malformed'));
+        assert(textOf(resp).includes('cas add'));
     },
     getUnterminatedHashIsError: () => {
         const [resp] = session(call(2, 'cas_get', { hash: '0' }));
@@ -425,60 +416,11 @@ export const proof = {
         assert(!('error' in resp));
         assert('result' in resp);
     },
-    // cas_add with type:'url' streams a file from /home/user/cas_upload/ into CAS.
-    addUrlStoresFileAndReturnsHash: () => {
-        const fileContent = utf8('hello from file');
-        const root = { 'home': { 'user': { 'cas_upload': { 'hello.txt': [fileContent] } } } };
-        const [addUrlResp] = runSessionVirtual(root)([
-            init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/hello.txt', type: 'url' }),
-        ]).slice(2);
-        assert(!resultOf(addUrlResp).isError);
-        assert(textOf(addUrlResp).length > 0);
-    },
-    addUrlRoundTrips: () => {
-        const fileContent = utf8('round-trip content');
-        const root = { 'home': { 'user': { 'cas_upload': { 'rt.txt': [fileContent] } } } };
-        // First pass: add to get the hash (deterministic for same content).
-        const [addResp] = runSessionVirtual(root)([
-            init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/rt.txt', type: 'url' }),
-        ]).slice(2);
-        const hash = textOf(addResp);
-        // Second pass: add again + get in one session (file re-present in fresh virtual state).
-        const [, getResp] = runSessionVirtual(root)([
-            init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/rt.txt', type: 'url' }),
-            call(3, 'cas_get', { hash, content: true }),
-        ]).slice(2);
-        assert(!resultOf(getResp).isError);
-        const result = JSON.parse(textOf(getResp));
-        assertEq(result.type, 'text');
-        assertEq(result.content, 'round-trip content');
-    },
-    addUrlMissingFileIsError: () => {
-        const [resp] = runSessionVirtual({})([
-            init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/nonexistent.txt', type: 'url' }),
-        ]).slice(2);
-        assertEq(resultOf(resp).isError, true);
-    },
     // cas_get without content:true returns only metadata.
     getMetaReturnsLengthAndMimeType: () => {
-        const fileContent = utf8('text content');
-        const root = { 'home': { 'user': { 'cas_upload': { 'f': [fileContent] } } } };
-        // First pass: add to get the hash.
-        const [addResp] = runSessionVirtual(root)([
-            init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/f', type: 'url' }),
-        ]).slice(2);
+        const [addResp] = session(call(2, 'cas_add', { content: 'text content' }));
         const hash = textOf(addResp);
-        // Second pass: add + get metadata.
-        const [, metaResp] = runSessionVirtual(root)([
-            init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/f', type: 'url' }),
-            call(3, 'cas_get', { hash }),
-        ]).slice(2);
+        const [, metaResp] = session(call(2, 'cas_add', { content: 'text content' }), call(3, 'cas_get', { hash }));
         assert(!resultOf(metaResp).isError);
         const meta = JSON.parse(textOf(metaResp));
         assertEq(meta.mime_type, 'text/plain');
@@ -531,40 +473,6 @@ export const proof = {
         const [resp] = session(call(2, 'cas_get', { hash: 'bad!' }));
         assertEq(resultOf(resp).isError, true);
     },
-    // cas_add type:'url' with a subdirectory path flattens slashes to '-' in staging.
-    addUrlFromSubdirectorySucceeds: () => {
-        const fileContent = utf8('nested file content');
-        const root = { 'home': { 'user': { 'cas_upload': { 'subdir': { 'file.txt': [fileContent] } } } } };
-        const [resp] = runSessionVirtual(root)([
-            init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/subdir/file.txt', type: 'url' }),
-        ]).slice(2);
-        assert(!resultOf(resp).isError);
-        assert(textOf(resp).length > 0);
-    },
-    // cas_add with type:'url' accepts paths within /home/user/cas_upload/
-    addUrlFromApprovedDirectorySucceeds: () => {
-        const fileContent = utf8('approved file');
-        const root = { 'home': { 'user': { 'cas_upload': { 'test.txt': [fileContent] } } } };
-        const [resp] = runSessionVirtual(root)([
-            init, initialized,
-            call(2, 'cas_add', { content: '/home/user/cas_upload/test.txt', type: 'url' }),
-        ]).slice(2);
-        assert(!resultOf(resp).isError);
-        assert(textOf(resp).length > 0);
-    },
-    // cas_add with type:'url' rejects paths outside /home/user/cas_upload/
-    addUrlFromRandomDirectoryIsRejected: () => {
-        const [resp] = session(call(2, 'cas_add', { content: '/tmp/secret.txt', type: 'url' }));
-        assert(resultOf(resp).isError === true);
-        assert(textOf(resp).includes('/home/user/cas_upload/'));
-    },
-    // cas_add with type:'url' rejects path traversal attempts with ..
-    addUrlWithPathTraversalIsRejected: () => {
-        const [resp] = session(call(2, 'cas_add', { content: '/home/user/cas_upload/../../etc/passwd', type: 'url' }));
-        assert(resultOf(resp).isError === true);
-        assert(textOf(resp).includes('/home/user/cas_upload/'));
-    },
     // cas_get with content:true on octet-stream (no magic bytes, not UTF-8) returns inline base64.
     getOctetStreamWithContentIncludesBase64: () => {
         const binaryContent = u8ListToVec(msb)([0xFF, 0xFE, 0x00, 0x01]);

package/fs/cas/module.f.js

@@ -7,7 +7,7 @@ import { sha256 } from "../crypto/sha2/module.f.js";
 import { join, normalize, parse } from "../path/module.f.js";
 import { empty, length, maxLengthBytes, msb, vec } from "../types/bit_vec/module.f.js";
 import { cBase32ToVec, vecToCBase32 } from "../cbase32/module.f.js";
-import { foldStep, forEachStep, pure } from "../effects/module.f.js";
+import { foldStep, forEachStep, okStep, pure } from "../effects/module.f.js";
 import { access, createExclusive, isNotFound, mkdir, now, randomInt, readBytes, readdir, rename, rm, stat, writeBytes, } from "../effects/node/module.f.js";
 import { toOption } from "../types/nullable/module.f.js";
 import { error, ok, unwrap } from "../types/result/module.f.js";
@@ -141,9 +141,7 @@ export const fileCas = (sha2) => (path) => {
                     .step(t0 => {
                     const path0 = join(stageDir, stageName(t0 + leaseDelta, rndStr));
                     return createExclusive(path0)
-                        .step(([c, e]) => c === 'error'
-                        ? pure(error(e))
-                        : loop(sha2.init, 0, path0)(payload));
+                        .step(okStep(() => loop(sha2.init, 0, path0)(payload)));
                 }));
             }));
         },
@@ -200,10 +198,5 @@ cas.write(streamFile(path));
 export const casUpload = (home) => (fileName) => {
     const src = join(home, 'cas_upload', fileName);
     const c = fileCas(sha256)(home);
-    return casAddFile(c)(src).step((result) => {
-        if (result[0] === 'error') {
-            return pure(result);
-        }
-        return rm(src).step(() => pure(result));
-    });
+    return casAddFile(c)(src).step(okStep(v => rm(src).step(() => pure(ok(v)))));
 };

package/fs/ci/config/module.f.d.ts

@@ -19,9 +19,9 @@ export declare const images: {
         readonly arm: "windows-11-arm";
     };
 };
-export declare const functionalscript: "0.33.0";
+export declare const functionalscript: "0.35.2";
 export declare const bun = "1.3.14";
-export declare const deno = "2.9.0";
+export declare const deno = "2.9.1";
 export declare const playwright = "1.61.1";
 export declare const node: {
     readonly default: "26.4.0";
@@ -29,15 +29,15 @@ export declare const node: {
     readonly node24: "24.18.0";
 };
 export declare const wasmtime = "46.0.1";
-export declare const wasmer = "7.1.0";
-export declare const tsgo = "7.0.0-dev.20260627.2";
+export declare const wasmer = "7.2.0";
+export declare const tsgo = "7.0.0-dev.20260707.2";
 export declare const actions: {
     readonly 'actions/checkout': "v7";
     readonly 'actions/setup-node': "v6.4.0";
     readonly 'actions/cache': "v6.1.0";
-    readonly 'denoland/setup-deno': "v2.0.4";
+    readonly 'denoland/setup-deno': "v2.0.5";
     readonly 'oven-sh/setup-bun': "v2.2.0";
-    readonly 'bytecodealliance/actions/wasmtime/setup': "v1";
+    readonly 'bytecodealliance/actions/wasmtime/setup': "v1.1.3";
     readonly 'wasmerio/setup-wasmer': "v3.1";
-    readonly 'dtolnay/rust-toolchain': "1.96.0";
+    readonly 'dtolnay/rust-toolchain': "1.96.1";
 };

package/fs/ci/config/module.f.js

@@ -22,13 +22,13 @@ export const images = {
 };
 // Bootstrap package version used by generated smoke tests. Keep this on a
 // published FunctionalScript release; do not tie it to package.json's current
-// in-repo version. A separate maintenance job advances this pin.
+// in-repo version.
 // https://www.npmjs.com/package/functionalscript
-export const functionalscript = '0.33.0';
+export const functionalscript = '0.35.2';
 // https://bun.sh/
 export const bun = '1.3.14';
 // https://deno.com/
-export const deno = '2.9.0';
+export const deno = '2.9.1';
 // https://www.npmjs.com/package/playwright
 export const playwright = '1.61.1';
 // https://nodejs.org/en/download
@@ -40,9 +40,9 @@ export const node = {
 // https://github.com/bytecodealliance/wasmtime/releases
 export const wasmtime = '46.0.1';
 // https://github.com/wasmerio/wasmer/releases
-export const wasmer = '7.1.0';
+export const wasmer = '7.2.0';
 // https://www.npmjs.com/package/@typescript/native-preview?activeTab=versions
-export const tsgo = '7.0.0-dev.20260627.2';
+export const tsgo = '7.0.0-dev.20260707.2';
 // GitHub Action versions used by CI step builders. The key is the action
 // `owner/name`; call sites compose the full ref as
 // `` `${name}@${actions[name]}` ``.
@@ -55,13 +55,13 @@ export const actions = {
     // https://github.com/marketplace/actions/cache
     'actions/cache': 'v6.1.0',
     // https://github.com/marketplace/actions/setup-deno
-    'denoland/setup-deno': 'v2.0.4',
+    'denoland/setup-deno': 'v2.0.5',
     // https://github.com/marketplace/actions/setup-bun
     'oven-sh/setup-bun': 'v2.2.0',
     // https://github.com/bytecodealliance/actions
-    'bytecodealliance/actions/wasmtime/setup': 'v1',
+    'bytecodealliance/actions/wasmtime/setup': 'v1.1.3',
     // https://github.com/wasmerio/setup-wasmer
     'wasmerio/setup-wasmer': 'v3.1',
     // https://rust-lang.org/ - value is Rust version, not action version
-    'dtolnay/rust-toolchain': '1.96.0',
+    'dtolnay/rust-toolchain': '1.96.1',
 };