functionalscript 0.37.0 → 0.39.0

package/{fs → fjs}/media/json/serializer/proof.f.js

@@ -1,25 +1,20 @@
 import { arrayWrap, boolSerialize, numberSerialize, objectWrap, stringSerialize } from './module.f.js';
 import * as list from '../../../types/list/module.f.js';
+import { assertEq } from '../../../asserts/module.f.js';
 const { toArray } = list;
 export const proof = {
     arrayWrap: [
         () => {
             const result = JSON.stringify(toArray(arrayWrap(null)));
-            if (result !== '["[","]"]') {
-                throw result;
-            }
+            assertEq(result, '["[","]"]');
         },
         () => {
             const result = JSON.stringify(toArray(arrayWrap([['a', 'b']])));
-            if (result !== '["[","a","b","]"]') {
-                throw result;
-            }
+            assertEq(result, '["[","a","b","]"]');
         },
         () => {
             const result = JSON.stringify(toArray(arrayWrap([['a'], ['b']])));
-            if (result !== '["[","a",",","b","]"]') {
-                throw result;
-            }
+            assertEq(result, '["[","a",",","b","]"]');
         }
     ],
     objectWrap: [
@@ -45,43 +40,31 @@ export const proof = {
     stringSerialize: [
         () => {
             const result = JSON.stringify(toArray(stringSerialize('abc')));
-            if (result !== '["\\"abc\\""]') {
-                throw result;
-            }
+            assertEq(result, '["\\"abc\\""]');
         },
         () => {
             const result = JSON.stringify(toArray(stringSerialize('123')));
-            if (result !== '["\\"123\\""]') {
-                throw result;
-            }
+            assertEq(result, '["\\"123\\""]');
         }
     ],
     numberSerialize: [
         () => {
             const result = JSON.stringify(toArray(numberSerialize(123)));
-            if (result !== '["123"]') {
-                throw result;
-            }
+            assertEq(result, '["123"]');
         },
         () => {
             const result = JSON.stringify(toArray(numberSerialize(10e20)));
-            if (result !== '["1e+21"]') {
-                throw result;
-            }
+            assertEq(result, '["1e+21"]');
         }
     ],
     boolSerialize: [
         () => {
             const result = JSON.stringify(toArray(boolSerialize(false)));
-            if (result !== '["false"]') {
-                throw result;
-            }
+            assertEq(result, '["false"]');
         },
         () => {
             const result = JSON.stringify(toArray(boolSerialize(true)));
-            if (result !== '["true"]') {
-                throw result;
-            }
+            assertEq(result, '["true"]');
         }
     ]
 };

package/{fs → fjs}/media/module.f.d.ts

@@ -2,15 +2,15 @@
  * Media-type detection entry point: dialect-tagged JSON recognition layered
  * on top of the byte-signature / UTF-8 detector.
  *
- * `fs/media/type` classifies raw bytes (magic-byte signatures, UTF-8
+ * `fjs/media/type` classifies raw bytes (magic-byte signatures, UTF-8
  * text-vs-binary) with no notion of a JSON dialect. `detect` here adds one
  * more classification step in front of it: when the whole blob is
- * whole-blob-valid UTF-8 text (as `fs/media/type` already determined), try
+ * whole-blob-valid UTF-8 text (as `fjs/media/type` already determined), try
  * parsing it as JSON and validating it against a known dialect's rtti schema
- * (currently just `vnd.fjs.revision` — see `fs/media/revision`). A match
+ * (currently just `vnd.fjs.revision` — see `fjs/media/revision`). A match
  * reports the dialect's derived media type; anything that isn't valid JSON,
  * or doesn't validate against a known dialect, falls through to the
- * `fs/media/type` verdict unchanged.
+ * `fjs/media/type` verdict unchanged.
  *
  * Detection is semantic, not syntactic: any JSON that satisfies a dialect's
  * schema is recognized regardless of key order, whitespace, or any other
@@ -21,7 +21,7 @@
  * form), because dialect validation needs the whole parsed value. A single
  * `Vec` already caps at `maxLength` bits (128 KiB — the same bound as the
  * existing inline-content cap), so dialect detection is naturally
- * size-bounded. The unbounded streaming detector (`fs/media/type`
+ * size-bounded. The unbounded streaming detector (`fjs/media/type`
  * `detectStream`) is untouched and stays a pure byte-signature/UTF-8
  * classifier with no dialect awareness.
  *
@@ -31,7 +31,7 @@ import type { Vec } from '../types/bit_vec/module.f.ts';
 import { type DetectMeta } from './type/module.f.ts';
 /**
  * Classifies a whole buffered `Vec`, the same three-way `{ length, mime_type,
- * type }` shape as `fs/media/type` `detectVec`, but with dialect-tagged JSON
+ * type }` shape as `fjs/media/type` `detectVec`, but with dialect-tagged JSON
  * recognized ahead of the plain `text/plain` fallback.
  */
 export declare const detect: (bytes: Vec) => DetectMeta;

package/{fs → fjs}/media/module.f.js

@@ -1,10 +1,10 @@
 import { fromVec } from '../text/utf8/module.f.js';
 import { detectVec } from './type/module.f.js';
 import { decodeText as decodeRevisionText, mediaType as revisionMediaType } from './revision/module.f.js';
-import { assert } from '../asserts/module.f.js';
+import { assertNotNullish } from '../asserts/module.f.js';
 /**
  * Classifies a whole buffered `Vec`, the same three-way `{ length, mime_type,
- * type }` shape as `fs/media/type` `detectVec`, but with dialect-tagged JSON
+ * type }` shape as `fjs/media/type` `detectVec`, but with dialect-tagged JSON
  * recognized ahead of the plain `text/plain` fallback.
  */
 export const detect = (bytes) => {
@@ -14,11 +14,10 @@ export const detect = (bytes) => {
     if (base.type !== 'text') {
         return base;
     }
-    const text = fromVec(bytes);
     // `detectVec`'s `type: 'text'` verdict already means `bytes` is byte-aligned,
     // whole-blob-valid UTF-8 — the same two conditions `fromVec` checks, via the
     // same decoder — so `fromVec` cannot return `null` here.
-    assert(text !== null, 'detect: type text implies fromVec succeeds');
+    const text = assertNotNullish(fromVec(bytes), 'detect: type text implies fromVec succeeds');
     const [tag] = decodeRevisionText(text);
     return tag === 'ok' ? { ...base, mime_type: revisionMediaType } : base;
 };

package/{fs → fjs}/media/proof.f.js

@@ -4,7 +4,7 @@ import { detect } from './module.f.js';
 import { dialect } from './revision/module.f.js';
 // All test strings here are ASCII, so char code === UTF-8 byte value.
 const utf8Bytes = (s) => u8ListToVec(msb)([...s].map(c => c.charCodeAt(0)));
-const revisionJson = `{"dialect":"${dialect}","subject":"8","parents":[]}`;
+const revisionJson = `{"dialect":"${dialect}","subject":"8","parents":[],"snapshot":"8","generation":0}`;
 export const proof = {
     // A valid revision blob is recognized and reported under its derived media type.
     validRevision: () => {
@@ -15,12 +15,13 @@ export const proof = {
     // Key order carries no meaning: a valid revision whose `dialect` key is
     // not first must still be detected.
     keyOrderIndependent: () => {
-        const text = `{"parents":[],"subject":"8","dialect":"${dialect}"}`;
+        const text = `{"parents":[],"subject":"8","dialect":"${dialect}","snapshot":"8","generation":0}`;
         const m = detect(utf8Bytes(text));
         assertEq(m.mime_type, 'application/vnd.fjs.revision+json');
     },
-    // Structurally invalid revision (bad multi-parent snapshot rule) falls
-    // through to the ordinary text/plain classification.
+    // A revision missing a required field (here `snapshot` and `generation`)
+    // fails validation and falls through to the ordinary text/plain
+    // classification.
     invalidRevisionFallsThrough: () => {
         const text = `{"dialect":"${dialect}","subject":"8","parents":["8","r"]}`;
         const m = detect(utf8Bytes(text));

package/{fs → fjs}/media/revision/module.f.d.ts

@@ -28,19 +28,46 @@ export declare const revisionSchema: {
     readonly dialect: "vnd.fjs.revision";
     readonly subject: import("../../types/rtti/module.f.ts").String;
     readonly parents: import("../../types/rtti/module.f.ts").Type1<"array", import("../../types/rtti/module.f.ts").String>;
-    readonly snapshot: import("../../types/rtti/module.f.ts").Or<readonly [import("../../types/rtti/module.f.ts").String, undefined]>;
-    readonly generation: import("../../types/rtti/module.f.ts").Or<readonly [import("../../types/rtti/module.f.ts").Number, undefined]>;
+    readonly snapshot: import("../../types/rtti/module.f.ts").String;
+    readonly generation: import("../../types/rtti/module.f.ts").Number;
     readonly archived: import("../../types/rtti/module.f.ts").Or<readonly [true, undefined]>;
 };
 /** The TypeScript type derived from {@link revisionSchema} — the single source of truth. */
 export type Revision = Ts<typeof revisionSchema>;
 /** True when `s` decodes as a cbase32 CAS hash (rejects `https://` and any other non-cbase32 string). */
 export declare const isHash: (s: string) => boolean;
-/** Either a structural validation error or a semantic (snapshot-reference) error message. */
+/** Either a structural validation error or a semantic (hash / generation) error message. */
 export type RevisionError = ValidationError | string;
+/**
+ * Checks the semantic refinements the structural schema can't express on an
+ * already shape-valid revision: every `parents` entry and the `snapshot` must
+ * decode as a cbase32 hash ({@link isHash}), and `generation` must be a
+ * non-negative *safe* integer. `subject` is not checked — it is an identity
+ * string, never a snapshot reference, so any string is valid.
+ *
+ * `generation` uses `Number.isSafeInteger`, not `Number.isInteger`: a value at
+ * or above `2 ** 53` passes `isInteger` but is no longer uniquely
+ * representable, so `1 + max(parents' generations)` — how a writer derives the
+ * next generation — can round back to the parent's value and fail to advance.
+ * Rejecting unsafe integers keeps stored generations exact.
+ *
+ * Both `snapshot` and `generation` are required by the schema, so no absence
+ * ever has to be resolved here: a revision states its content and its
+ * generation explicitly, and is fully interpretable in isolation (see the
+ * README). The former snapshot-resolution algorithm (subject-as-fallback,
+ * single-parent inheritance, multi-parent rejection) is gone.
+ *
+ * Exported separately from {@link validate} for callers that assemble a
+ * `Revision` themselves from already-typed fields (e.g. `fjs/cas/evo`'s
+ * `addRevision`): the shape is then guaranteed by TypeScript already, so only
+ * these semantic (string-only error) checks are worth re-running — routing
+ * through the combined structural-plus-semantic `validate` would add an
+ * unreachable structural-error branch on the caller's side.
+ */
+export declare const checkReferences: (r: Revision) => Result<Revision, string>;
 /**
  * Validates an already-parsed JSON value as a `revision` BLOB: structural
- * (rtti) validation followed by the snapshot-reference semantic checks.
+ * (rtti) validation followed by the hash / generation semantic checks.
  */
 export declare const validate: (value: Unknown) => Result<Revision, RevisionError>;
 /**

package/{fs → fjs}/media/revision/module.f.js

@@ -47,45 +47,57 @@ export const revisionSchema = {
     dialect,
     subject: string,
     parents: array(hash),
-    snapshot: option(hash),
-    generation: option(number),
+    snapshot: hash,
+    generation: number,
     archived: option(true),
 };
-/** Structural-only validator: checks the shape, not the snapshot-reference semantics. */
+/** Structural-only validator: checks the shape, not the hash / generation semantics. */
 const validateShape = rttiValidate(revisionSchema);
 /** True when `s` decodes as a cbase32 CAS hash (rejects `https://` and any other non-cbase32 string). */
 export const isHash = (s) => cBase32ToVec(s) !== null;
 /**
- * Checks the snapshot-reference semantics of an already shape-valid revision:
- * every parent must be a hash; `snapshot`, when present, must be a hash;
- * when `snapshot` is absent, zero parents fall back to `subject` (which must
- * then be a hash), exactly one parent inherits that parent's snapshot, and
- * more than one parent without an explicit `snapshot` is invalid — there is
- * no single parent snapshot to inherit, and falling back to `subject` would
- * silently lose the merge result.
+ * Checks the semantic refinements the structural schema can't express on an
+ * already shape-valid revision: every `parents` entry and the `snapshot` must
+ * decode as a cbase32 hash ({@link isHash}), and `generation` must be a
+ * non-negative *safe* integer. `subject` is not checked — it is an identity
+ * string, never a snapshot reference, so any string is valid.
+ *
+ * `generation` uses `Number.isSafeInteger`, not `Number.isInteger`: a value at
+ * or above `2 ** 53` passes `isInteger` but is no longer uniquely
+ * representable, so `1 + max(parents' generations)` — how a writer derives the
+ * next generation — can round back to the parent's value and fail to advance.
+ * Rejecting unsafe integers keeps stored generations exact.
+ *
+ * Both `snapshot` and `generation` are required by the schema, so no absence
+ * ever has to be resolved here: a revision states its content and its
+ * generation explicitly, and is fully interpretable in isolation (see the
+ * README). The former snapshot-resolution algorithm (subject-as-fallback,
+ * single-parent inheritance, multi-parent rejection) is gone.
+ *
+ * Exported separately from {@link validate} for callers that assemble a
+ * `Revision` themselves from already-typed fields (e.g. `fjs/cas/evo`'s
+ * `addRevision`): the shape is then guaranteed by TypeScript already, so only
+ * these semantic (string-only error) checks are worth re-running — routing
+ * through the combined structural-plus-semantic `validate` would add an
+ * unreachable structural-error branch on the caller's side.
  */
-const checkReferences = (r) => {
+export const checkReferences = (r) => {
     for (const p of r.parents) {
         if (!isHash(p)) {
             return error(`parent is not a valid hash: ${p}`);
         }
     }
-    if (r.snapshot !== undefined) {
-        return isHash(r.snapshot) ? ok(r) : error(`snapshot is not a valid hash: ${r.snapshot}`);
-    }
-    if (r.parents.length === 0) {
-        return isHash(r.subject)
-            ? ok(r)
-            : error(`subject must be a valid hash when snapshot is absent and there are no parents: ${r.subject}`);
+    if (!isHash(r.snapshot)) {
+        return error(`snapshot is not a valid hash: ${r.snapshot}`);
     }
-    if (r.parents.length === 1) {
-        return ok(r);
+    if (!Number.isSafeInteger(r.generation) || r.generation < 0) {
+        return error(`generation must be a non-negative safe integer: ${r.generation}`);
     }
-    return error('snapshot is required when a revision has more than one parent');
+    return ok(r);
 };
 /**
  * Validates an already-parsed JSON value as a `revision` BLOB: structural
- * (rtti) validation followed by the snapshot-reference semantic checks.
+ * (rtti) validation followed by the hash / generation semantic checks.
  */
 export const validate = (value) => {
     const [t, v] = validateShape(value);
@@ -94,7 +106,7 @@ export const validate = (value) => {
     }
     return checkReferences(v);
 };
-/** Parses `text` as JSON without relying on `JSON.parse` (the shared `fs/media/json` parser/tokenizer). */
+/** Parses `text` as JSON without relying on `JSON.parse` (the shared `fjs/media/json` parser/tokenizer). */
 const parseJson = (text) => jsonParse(jsonTokenize(stringToList(text)));
 /**
  * Decodes `text` as a `revision` BLOB: JSON-parses it, then validates it per

package/{fs → fjs}/media/revision/proof.f.d.ts

@@ -6,15 +6,17 @@ export declare const proof: {
         arbitraryStringRejected: () => void;
     };
     validate: {
-        firstRevisionFallsBackToSubjectHash: () => void;
-        firstRevisionRejectsNonHashSubject: () => void;
-        explicitSnapshotAllowsArbitrarySubject: () => void;
-        singleParentInheritsSnapshot: () => void;
-        multiParentWithoutSnapshotRejected: () => void;
-        multiParentWithSnapshotAccepted: () => void;
+        allFieldsPresent: () => void;
+        nonHashSubjectAccepted: () => void;
+        multiParentAccepted: () => void;
+        missingSnapshotRejected: () => void;
+        nonHashSnapshotRejected: () => void;
+        missingGenerationRejected: () => void;
+        nonIntegerGenerationRejected: () => void;
+        negativeGenerationRejected: () => void;
+        unsafeIntegerGenerationRejected: () => void;
+        positiveGenerationAccepted: () => void;
         httpsRejectedInParents: () => void;
-        httpsRejectedInSnapshot: () => void;
-        httpsRejectedAsFallbackSubject: () => void;
         archivedAccepted: () => void;
         wrongDialectRejected: () => void;
         missingSubjectRejected: () => void;

package/fjs/media/revision/proof.f.js

@@ -0,0 +1,140 @@
+import { assert, assertEq } from '../../asserts/module.f.js';
+import { dialect, mediaType, isHash, validate, decodeText } from './module.f.js';
+// Valid cbase32 hashes (round-tripped in fjs/basen/cbase32/proof.f.ts): single
+// cbase32 symbols, cheap to write inline here.
+const h1 = '8';
+const h2 = 'r';
+// A shape-valid revision: every required field present (`snapshot` and
+// `generation` included), with `extra` overriding or adding fields per test.
+const revisionOf = (extra) => ({
+    dialect,
+    subject: h1,
+    parents: [],
+    snapshot: h2,
+    generation: 0,
+    ...extra,
+});
+export const proof = {
+    dialectAndMediaType: () => {
+        assertEq(dialect, 'vnd.fjs.revision');
+        assertEq(mediaType, 'application/vnd.fjs.revision+json');
+    },
+    isHash: {
+        validHash: () => assert(isHash(h1)),
+        httpsRejected: () => assert(!isHash('https://example.com/blob/abc')),
+        arbitraryStringRejected: () => assert(!isHash('not-a-hash!')),
+    },
+    validate: {
+        // A fully explicit revision validates.
+        allFieldsPresent: () => {
+            const [t] = validate(revisionOf({}));
+            assertEq(t, 'ok');
+        },
+        // `subject` is a pure identity string, never a snapshot reference: a
+        // zero-parent revision whose `subject` is not a hash is now valid,
+        // because `snapshot` is always stated explicitly.
+        nonHashSubjectAccepted: () => {
+            const r = validate(revisionOf({ subject: 'my-config' }));
+            assert(r[0] === 'ok', ['expected ok', r]);
+            assertEq(r[1].subject, 'my-config');
+        },
+        // A merge revision (more than one parent) is valid like any other —
+        // there is no "multiple parents without snapshot" case left, because
+        // `snapshot` is required.
+        multiParentAccepted: () => {
+            const r = validate(revisionOf({ subject: 'my-config', parents: [h1, h2], snapshot: h2 }));
+            assert(r[0] === 'ok', ['expected ok', r]);
+            assertEq(r[1].snapshot, h2);
+        },
+        // `snapshot` is required: absent is a shape error.
+        missingSnapshotRejected: () => {
+            const [t] = validate({ dialect, subject: h1, parents: [], generation: 0 });
+            assertEq(t, 'error');
+        },
+        // `snapshot` must decode as a hash — `https://` bridge URLs rejected.
+        nonHashSnapshotRejected: () => {
+            const [t] = validate(revisionOf({ snapshot: 'https://example.com/x' }));
+            assertEq(t, 'error');
+        },
+        // `generation` is required: absent is a shape error.
+        missingGenerationRejected: () => {
+            const [t] = validate({ dialect, subject: h1, parents: [], snapshot: h2 });
+            assertEq(t, 'error');
+        },
+        // `generation` must be an integer: a fractional value is rejected.
+        nonIntegerGenerationRejected: () => {
+            const [t] = validate(revisionOf({ generation: 1.5 }));
+            assertEq(t, 'error');
+        },
+        // `generation` must be non-negative.
+        negativeGenerationRejected: () => {
+            const [t] = validate(revisionOf({ generation: -1 }));
+            assertEq(t, 'error');
+        },
+        // `generation` must be a *safe* integer: at `2 ** 53` and above the
+        // value is no longer uniquely representable, so `1 + max(...)` could
+        // fail to advance — such a blob is rejected (`Number.isInteger` would
+        // accept it; `Number.isSafeInteger` does not).
+        unsafeIntegerGenerationRejected: () => {
+            const [t] = validate(revisionOf({ generation: 2 ** 53 }));
+            assertEq(t, 'error');
+        },
+        // A positive integer generation is accepted.
+        positiveGenerationAccepted: () => {
+            const r = validate(revisionOf({ parents: [h1], generation: 3 }));
+            assert(r[0] === 'ok', ['expected ok', r]);
+            assertEq(r[1].generation, 3);
+        },
+        // `https://` bridge URLs are rejected wherever a hash is required.
+        httpsRejectedInParents: () => {
+            const [t] = validate(revisionOf({ parents: ['https://example.com/x'] }));
+            assertEq(t, 'error');
+        },
+        // `archived` follows the presence-only `option(true)` idiom.
+        archivedAccepted: () => {
+            const [t] = validate(revisionOf({ archived: true }));
+            assertEq(t, 'ok');
+        },
+        // Wrong dialect tag: structural validation rejects it outright.
+        wrongDialectRejected: () => {
+            const [t] = validate({ dialect: 'vnd.fjs.other', subject: h1, parents: [], snapshot: h2, generation: 0 });
+            assertEq(t, 'error');
+        },
+        // Missing required fields: rejected.
+        missingSubjectRejected: () => {
+            const [t] = validate({ dialect, parents: [], snapshot: h2, generation: 0 });
+            assertEq(t, 'error');
+        },
+        // rtti structs are open: extra fields don't break validation — the
+        // additive forward-compatibility path the versioning rule relies on.
+        extraFieldsAccepted: () => {
+            const [t] = validate(revisionOf({ future: 'field' }));
+            assertEq(t, 'ok');
+        },
+    },
+    decodeText: {
+        validJson: () => {
+            const r = decodeText(JSON.stringify(revisionOf({})));
+            assert(r[0] === 'ok', ['expected ok', r]);
+            assertEq(r[1].subject, h1);
+        },
+        // Key order carries no meaning: detection parses the JSON and
+        // validates the parsed value, so `dialect` need not be first.
+        keyOrderIndependent: () => {
+            const text = `{"generation":0,"snapshot":"${h2}","parents":[],"subject":"${h1}","dialect":"${dialect}"}`;
+            const [t] = decodeText(text);
+            assertEq(t, 'ok');
+        },
+        malformedJsonRejected: () => {
+            const [t] = decodeText('{not json');
+            assertEq(t, 'error');
+        },
+        // Ordinary JSON that isn't a revision at all falls through as an error
+        // here — `fjs/media`'s composed detector is what falls back to the
+        // ordinary detector; this module only reports validity.
+        ordinaryJsonRejected: () => {
+            const [t] = decodeText('{"hello":"world"}');
+            assertEq(t, 'error');
+        },
+    },
+};

package/{fs → fjs}/media/type/module.f.js

@@ -34,7 +34,7 @@
  */
 import { msb, fromSentinel, length, u8List } from '../../types/bit_vec/module.f.js';
 import { iterable } from '../../types/list/module.f.js';
-import { pure } from '../../effects/module.f.js';
+import { pure, step } from '../../effects/module.f.js';
 import { ok, error } from '../../types/result/module.f.js';
 import { isValidCodePoint, isTextCodePoint } from '../../text/code_point/module.f.js';
 import { utf8ByteToCodePointOp } from '../../text/utf8/module.f.js';
@@ -216,7 +216,7 @@ export const detectVec = (bytes) => finish(push(detectInit)(bytes));
  * item short-circuits into the `IoResult` error.
  */
 export const detectStream = (stream) => {
-    const loop = (s) => (l) => l.step((node) => {
+    const loop = (s) => (l) => step(l, (node) => {
         if (node === undefined) {
             return pure(ok(finish(s)));
         }

package/{fs → fjs}/media/type/proof.f.js

@@ -1,6 +1,6 @@
 import { assert, assertEq } from '../../asserts/module.f.js';
 import { msb, u8ListToVec, vec8, repeat, empty } from '../../types/bit_vec/module.f.js';
-import { decode } from '../../effects/module.f.js';
+import { runPure } from '../../effects/module.f.js';
 import { nonEmpty, empty as emptyList } from '../../effects/list/module.f.js';
 import { ok } from '../../types/result/module.f.js';
 import { detect, detectStream, detectVec } from './module.f.js';
@@ -8,22 +8,14 @@ import { detect, detectStream, detectVec } from './module.f.js';
 // store would hold the leading bytes of a stored blob.
 const bytes = (...b) => u8ListToVec(msb)(b);
 // ── Streaming detector helpers ──────────────────────────────────────────────────
-// Evaluates a fully pure effect (no operations) to its result.
-const runPure = (e) => {
-    const d = decode(e);
-    if (!d.done) {
-        throw 'effect is not pure';
-    }
-    return d.result;
-};
 // Builds a CAS-style read stream from a sequence of ok(chunk) items.
 const stream = (...chunks) => chunks.reduceRight((tail, c) => nonEmpty(ok(c), tail), emptyList());
 // Runs the streaming detector over the given chunks and unwraps the metadata.
 const detectChunks = (...chunks) => {
-    const r = runPure(detectStream(stream(...chunks)));
-    if (r[0] === 'error') {
-        throw r[1];
-    }
+    const o = runPure(detectStream(stream(...chunks)));
+    assert(o.length === 1, 'effect is not pure');
+    const [r] = o;
+    assert(r[0] !== 'error', r[1]);
     return r[1];
 };
 export const proof = {
@@ -177,8 +169,9 @@ export const proof = {
         // A read `error` item short-circuits into the IoResult error.
         readErrorSurfaces: () => {
             const errStream = nonEmpty(['error', 'boom'], emptyList());
-            const r = runPure(detectStream(errStream));
-            assert(r[0] === 'error');
+            const o = runPure(detectStream(errStream));
+            assert(o.length === 1, 'effect is not pure');
+            assert(o[0][0] === 'error');
         },
         // Empty stream: zero-length text/plain.
         empty: () => {

package/{fs → fjs}/module.f.js

@@ -10,7 +10,8 @@ import { main as ciMain } from './ci/module.f.js';
 import { import_ } from './effects/node/module.f.js';
 import { dispatch } from './cli/module.f.js';
 import { casMcpServer } from './cas/mcp/module.f.js';
-import { pure } from './effects/module.f.js';
+import { pure, step } from './effects/module.f.js';
+import { unwrap } from './types/result/module.f.js';
 const commands = [
     {
         names: ['test', 't'],
@@ -29,8 +30,8 @@ const commands = [
     },
     {
         names: ['mcp', 'm'],
-        description: 'Run an MCP server over stdio exposing the CAS as tools',
-        handler: ({ home }) => casMcpServer(home).step(() => pure(0)),
+        description: 'Run an MCP server over stdio exposing the CAS and Evo (subjects/heads) as tools',
+        handler: ({ home }) => step(casMcpServer(home), () => pure(0)),
     },
     {
         names: ['ci', 'i'],
@@ -42,12 +43,7 @@ const commands = [
         description: 'Run a FunctionalScript module as a NodeProgram',
         handler: options => {
             const [file, ...args] = options.args;
-            return import_(file).step(([s, v]) => {
-                if (s === 'error') {
-                    throw v;
-                }
-                return v.main({ ...options, args });
-            });
+            return step(import_(file), x => unwrap(x).main({ ...options, args }));
         },
     },
 ];