functionalscript 0.38.0 → 0.40.0

package/fjs/cas/module.f.js

@@ -7,7 +7,8 @@ import { sha256 } from '../crypto/sha2/module.f.js';
 import { join, normalize, parse } from '../path/module.f.js';
 import { empty, length, maxLength, maxLengthBytes, msb, vec } from '../types/bit_vec/module.f.js';
 import { cBase32ToVec, vecToCBase32 } from '../basen/cbase32/module.f.js';
-import { foldStep, forEachStep, okStep, pure } from '../effects/module.f.js';
+import { foldStep, forEachStep, history, historyStep, okStep, pure, step } from '../effects/module.f.js';
+import { eff } from '../effects/eff/module.f.js';
 import { access, createExclusive, isNotFound, mkdir, now, randomInt, readBytes, readdir, rename, rm, stat, writeBytes, } from '../effects/node/module.f.js';
 import { toOption } from '../types/nullable/module.f.js';
 import { error, ok, unwrap } from '../types/result/module.f.js';
@@ -32,7 +33,8 @@ export const toPath = (key) => {
  * process.
  */
 export const collectRead = (stream) => {
-    const loop = (acc) => (s) => s.step((node) => {
+    const loop = (acc) => (s) => eff(s)
+        .step((node) => {
         if (node === undefined) {
             return pure(ok(acc));
         }
@@ -45,7 +47,8 @@ export const collectRead = (stream) => {
             return pure(error(`cas blob exceeds maximum vector length of ${maxLength} bits`));
         }
         return loop(msb.concat(acc)(v))(tail);
-    });
+    })
+        .value;
     return loop(empty)(stream);
 };
 /** Maximum chunk size for streaming reads: the largest `Vec` the runtime allows. */
@@ -75,13 +78,18 @@ const deadlineOf = (name) => Number(name.slice(0, name.indexOf('-')));
  * still-live lease is left alone; the fencing rename keeps even a misjudged
  * reclaim fail-safe (worst case: that upload restarts).
  */
-const gcStage = (stageDir) => now().step(t => readdir(stageDir, {}).step(([k, v]) => {
+const gcStage = (stageDir) => eff(now())
+    .step(() => readdir(stageDir, {}))
+    .step(([k, v], t) => {
     if (k === 'error') {
         return pure(undefined);
     }
     const expired = v.flatMap(d => d.isFile && deadlineOf(d.name) < t ? [d.name] : []);
-    return forEachStep((name) => rm(join(stageDir, name)).step(() => pure(undefined)))(expired);
-}));
+    return forEachStep(pure(expired), name => eff(rm(join(stageDir, name)))
+        .step(() => pure(undefined))
+        .value);
+})
+    .value;
 /**
  * Builds a content-addressable storage facade from a SHA-2 implementation.
  */
@@ -92,7 +100,7 @@ export const fileCas = (sha2) => (path) => {
     return {
         read: (hash) => {
             const p = join(path, toPath(hash));
-            const loop = (offset) => readBytes(p, offset, chunkBytes)
+            const loop = (offset) => eff(readBytes(p, offset, chunkBytes))
                 .step((result) => {
                 const [t, v] = result;
                 // A missing shard or read error is an explicit error item, never EOF.
@@ -104,7 +112,8 @@ export const fileCas = (sha2) => (path) => {
                 return length(v) === 0n
                     ? elEmpty()
                     : nonEmpty(ok(v), loop(offset + chunkBytes));
-            });
+            })
+                .value;
             return loop(0);
         },
         // Lock-free staging upload (issues/cas/staging-lease.md): stream each chunk straight
@@ -125,17 +134,20 @@ export const fileCas = (sha2) => (path) => {
                 const rel = toPath(hash);
                 const dst = join(path, rel);
                 const dstDir = join(path, ...parse(rel).slice(0, -1));
-                return mkdir(dstDir, { recursive: true })
+                return eff(mkdir(dstDir, { recursive: true }))
                     .step(() => rename(curPath, dst))
                     .step(() => rm(curPath))
                     .step(() => stat(dst))
-                    .step(st => pure(st[0] === 'ok' && st[1].size === offset ? ok(hash) : error('publish size mismatch')));
+                    .step(st => pure(st[0] === 'ok' && st[1].size === offset ? ok(hash) : error('publish size mismatch')))
+                    .value;
             };
             // Any streaming error fails closed: delete the partial file, return the error.
-            const fail = (curPath, e) => rm(curPath).step(() => pure(error(e)));
-            return gcStage(stageDir).step(() => random256.step(rnd => {
+            const fail = (curPath, e) => eff(rm(curPath))
+                .step(() => pure(error(e)))
+                .value;
+            return eff(gcStage(stageDir)).step(() => eff(random256).step(rnd => {
                 const rndStr = vecToCBase32(rnd);
-                const loop = (state, offset, curPath) => (stream) => stream
+                const loop = (state, offset, curPath) => (stream) => eff(stream)
                     .step((node) => {
                     if (node === undefined) {
                         return publish(state, offset, curPath);
@@ -145,7 +157,7 @@ export const fileCas = (sha2) => (path) => {
                         return fail(curPath, first[1]);
                     }
                     const chunk = first[1];
-                    return writeBytes(curPath, offset, chunk)
+                    return eff(writeBytes(curPath, offset, chunk))
                         .step(wb => {
                         if (wb[0] === 'error') {
                             return fail(curPath, wb[1]);
@@ -153,49 +165,59 @@ export const fileCas = (sha2) => (path) => {
                         const newState = sha2.append(chunk)(state);
                         const newOffset = offset + Number(length(chunk) / 8n);
                         // Renew the lease: rename to a fresh deadline (keeps `delta` constant).
-                        return now()
-                            .step(t => {
-                            const next = join(stageDir, stageName(t + leaseDelta, rndStr));
-                            return rename(curPath, next).step(([t, v]) => t === 'error'
-                                ? fail(curPath, v)
-                                : loop(newState, newOffset, next)(tail));
-                        });
-                    });
-                });
-                return mkdir(stageDir, { recursive: true })
-                    .step(() => now()
+                        // The new path is still needed after the rename, to recurse with,
+                        // so the rename captures it rather than closing over it.
+                        const nextPath = step(now(), t => pure(join(stageDir, stageName(t + leaseDelta, rndStr))));
+                        const renamed = historyStep(history(nextPath), next => rename(curPath, next));
+                        return step(renamed, ([[rt, v], next]) => rt === 'error'
+                            ? fail(curPath, v)
+                            : loop(newState, newOffset, next)(tail));
+                    })
+                        .value;
+                })
+                    .value;
+                return eff(mkdir(stageDir, { recursive: true }))
+                    .step(() => now())
                     .step(t0 => {
                     const path0 = join(stageDir, stageName(t0 + leaseDelta, rndStr));
-                    return createExclusive(path0)
-                        .step(okStep(() => loop(sha2.init, 0, path0)(payload)));
-                }));
-            }));
+                    return eff(createExclusive(path0))
+                        .step(okStep(() => loop(sha2.init, 0, path0)(payload)))
+                        .value;
+                })
+                    .value;
+            }).value).value;
         },
         list: () => 
         // A fresh store has no `.cas` directory yet. Treat *only* that case as an
         // empty store, mirroring how `read` maps a missing shard to an error item.
         // A `.cas` that exists but cannot be read (permissions, corruption) is a
         // genuine storage error and is surfaced, not masked as "no hashes".
-        access(storePrefix).step(a => {
+        eff(access(storePrefix))
+            .step(a => {
             if (a[0] === 'error') {
                 if (isNotFound(a[1])) {
                     return pure([]);
                 }
                 throw a[1];
             }
-            return readdir(storePrefix, { recursive: true })
+            return eff(readdir(storePrefix, { recursive: true }))
                 .step(r => pure(unwrap(r).flatMap(({ name, parentPath, isFile }) => toOption(isFile
                 ? cBase32ToVec(normalize(parentPath).substring(normalizedStorePrefix.length).replaceAll('/', '') + name)
-                : null))));
-        }),
+                : null))))
+                .value;
+        })
+            .value,
         url: (hash) => join(path, toPath(hash))
     };
 };
 /** 256-bit random `Vec` built from 8 sequential `randomInt` (32-bit) calls. */
-const random256 = foldStep((_) => (acc) => randomInt().step(r => pure(msb.concat(acc)(vec(32n)(BigInt(r))))))(empty)([0, 1, 2, 3, 4, 5, 6, 7]);
+const random256 = foldStep(pure([0, 1, 2, 3, 4, 5, 6, 7]), empty, () => (acc) => eff(randomInt())
+    .step(r => pure(msb.concat(acc)(vec(32n)(BigInt(r)))))
+    .value);
 /** Streams any file at `filePath` in `<=128 KiB` chunks as a `ListEffect` of `ok` items. */
 const streamFile = (filePath) => {
-    const loop = (offset) => readBytes(filePath, offset, chunkBytes).step((result) => {
+    const loop = (offset) => eff(readBytes(filePath, offset, chunkBytes))
+        .step((result) => {
         if (result[0] === 'error') {
             return nonEmpty(result, elEmpty());
         }
@@ -203,7 +225,8 @@ const streamFile = (filePath) => {
         return length(chunk) === 0n
             ? elEmpty()
             : nonEmpty(ok(chunk), loop(offset + chunkBytes));
-    });
+    })
+        .value;
     return loop(0);
 };
 /**
@@ -224,5 +247,9 @@ cas.write(streamFile(path));
 export const casUpload = (home) => (fileName) => {
     const src = join(home, 'cas_upload', fileName);
     const c = fileCas(sha256)(home);
-    return casAddFile(c)(src).step(okStep(v => rm(src).step(() => pure(ok(v)))));
+    return eff(casAddFile(c)(src))
+        .step(okStep(v => eff(rm(src))
+        .step(() => pure(ok(v)))
+        .value))
+        .value;
 };

package/fjs/cas/proof.f.d.ts

@@ -1,12 +1,6 @@
-import { type FileCasOperation } from './module.f.ts';
-import { type Effect } from '../effects/module.f.ts';
-import { type ReadFile, type WriteFile, type Rm, type Mkdir } from '../effects/node/module.f.ts';
-type TestOp = FileCasOperation | WriteFile | ReadFile | Rm | Mkdir;
-declare const testAddBigFile: () => Effect<TestOp, void>;
-declare const testAddAndGetBigFile: () => Effect<TestOp, void>;
 export declare const proof: {
-    addBigFile: typeof testAddBigFile;
-    addAndGetBigFile: typeof testAddAndGetBigFile;
+    addBigFile: () => void;
+    addAndGetBigFile: () => void;
     casWriteRead: () => void;
     casReadMissingShard: () => void;
     casWriteMultiChunk: () => void;
@@ -14,6 +8,7 @@ export declare const proof: {
     casWriteErrorItemAborts: () => void;
     casWriteReadExceedsMaxLength: () => void;
     casWriteGcReclaimsExpired: () => void;
+    casWriteGcSkipsLiveLease: () => void;
     casUploadSuccess: () => void;
     casUploadFailureKeepsSource: () => void;
     collectReadDrainsChunks: () => void;
@@ -21,4 +16,3 @@ export declare const proof: {
     collectReadOverflow: () => void;
     casListPropagatesNonNotFoundAccessError: () => void;
 };
-export {};

package/fjs/cas/proof.f.js

@@ -2,7 +2,7 @@ import { length, maxLength, msb, vec, vec8 } from '../types/bit_vec/module.f.js'
 import { cBase32ToVec, vecToCBase32 } from '../basen/cbase32/module.f.js';
 import { computeSync, sha256 } from '../crypto/sha2/module.f.js';
 import { fileCas, casAddFile, collectRead, casUpload } from './module.f.js';
-import { decode, pure } from '../effects/module.f.js';
+import { match, pure, runPure, step } from '../effects/module.f.js';
 import { mkdir, writeFile, rm, readFile, access } from '../effects/node/module.f.js';
 import { error, ok } from '../types/result/module.f.js';
 import { emptyState, virtual } from '../effects/node/virtual/module.f.js';
@@ -10,6 +10,23 @@ import { join } from '../path/module.f.js';
 import { nonEmpty, empty } from '../effects/list/module.f.js';
 import { assert, assertEq, assertNotNullish } from '../asserts/module.f.js';
 const testDir = './test-cas-cli';
+// Names the command a `FileCasOperation` effect stops at, so a proof can assert
+// on it and resume the continuation without reading the `Do` layout. The map
+// has to list every operation the CAS can perform — that is what makes it total,
+// and what makes a new operation a compile error here rather than a silent gap.
+const casCommand = match({
+    access: () => 'access',
+    createExclusive: () => 'createExclusive',
+    mkdir: () => 'mkdir',
+    now: () => 'now',
+    randomInt: () => 'randomInt',
+    readBytes: () => 'readBytes',
+    readdir: () => 'readdir',
+    rename: () => 'rename',
+    rm: () => 'rm',
+    stat: () => 'stat',
+    writeBytes: () => 'writeBytes',
+});
 // Create a 128 KiB big file content (at the max Vec size limit)
 // This tests the boundary where files are at the chunk size limit
 const createBigFileContent = () => {
@@ -18,68 +35,54 @@ const createBigFileContent = () => {
     return vec(byteCount * 8n)(0x42424242n);
 };
 // Test adding a big file and verifying the hash
-const testAddBigFile = () => mkdir(testDir, { recursive: true }).step(() => {
-    const bigContent = createBigFileContent();
+const testAddBigFile = () => {
     const bigFilePath = `${testDir}/big-file.bin`;
-    return writeFile(bigFilePath, bigContent).step(writeRes => {
-        if (writeRes[0] === 'error') {
-            throw new Error(`Failed to write test file: ${writeRes[1]}`);
-        }
-        const cas = fileCas(sha256)(testDir);
-        return casAddFile(cas)(bigFilePath).step(addRes => {
-            if (addRes[0] === 'error') {
-                throw new Error(`Failed to add file to CAS: ${addRes[1]}`);
-            }
-            const hash = addRes[1];
-            // Verify hash is 256 bits (SHA-256)
-            if (length(hash) !== 256n) {
-                throw new Error(`Expected hash length 256 bits, got ${length(hash)}`);
-            }
-            // Verify hash can be encoded/decoded
-            const hashCBase32 = vecToCBase32(hash);
-            assertNotNullish(cBase32ToVec(hashCBase32), new Error('Failed to decode hash from base32'));
-            return rm(testDir).step(() => pure(undefined));
-        });
+    const cas = fileCas(sha256)(testDir);
+    const x0 = step(mkdir(testDir, { recursive: true }), () => writeFile(bigFilePath, createBigFileContent()));
+    const x1 = step(x0, writeRes => {
+        assert(writeRes[0] === 'ok', ['failed to write test file', writeRes]);
+        return casAddFile(cas)(bigFilePath);
     });
-});
+    const x2 = step(x1, addRes => {
+        assert(addRes[0] === 'ok', ['failed to add file to CAS', addRes]);
+        const hash = addRes[1];
+        // Verify hash is 256 bits (SHA-256)
+        assertEq(length(hash), 256n, ['expected 256-bit hash', length(hash)]);
+        // Verify hash can be encoded/decoded
+        assertNotNullish(cBase32ToVec(vecToCBase32(hash)), 'failed to decode hash from cBase32');
+        return rm(testDir);
+    });
+    return step(x2, () => pure(undefined));
+};
 // Test adding and retrieving a big file
-const testAddAndGetBigFile = () => mkdir(testDir, { recursive: true })
-    .step(() => {
+const testAddAndGetBigFile = () => {
     const bigContent = createBigFileContent();
     const bigFilePath = `${testDir}/big-file.bin`;
-    return writeFile(bigFilePath, bigContent)
-        .step(writeRes => {
-        if (writeRes[0] === 'error') {
-            throw new Error(`Failed to write test file: ${writeRes[1]}`);
-        }
-        const cas = fileCas(sha256)(testDir);
-        return casAddFile(cas)(bigFilePath)
-            .step(addRes => {
-            if (addRes[0] === 'error') {
-                throw new Error(`Failed to add file to CAS: ${addRes[1]}`);
-            }
-            const hash = addRes[1];
-            const storedPath = cas.url(hash);
-            // Verify file is stored at the expected location
-            return readFile(storedPath).step(readRes => {
-                if (readRes[0] === 'error') {
-                    throw new Error(`Failed to read stored file: ${readRes[1]}`);
-                }
-                const storedContent = readRes[1];
-                // Verify content is the same size as original
-                const storedLen = length(storedContent);
-                const originalLen = length(bigContent);
-                if (storedLen !== originalLen) {
-                    throw new Error(`Content size mismatch: stored ${storedLen} bits, expected ${originalLen} bits`);
-                }
-                return rm(testDir).step(() => pure(undefined));
-            });
-        });
+    const cas = fileCas(sha256)(testDir);
+    const x0 = step(mkdir(testDir, { recursive: true }), () => writeFile(bigFilePath, bigContent));
+    const x1 = step(x0, writeRes => {
+        assert(writeRes[0] === 'ok', ['failed to write test file', writeRes]);
+        return casAddFile(cas)(bigFilePath);
     });
-});
+    // Verify the file is stored at the expected location
+    const x2 = step(x1, addRes => {
+        assert(addRes[0] === 'ok', ['failed to add file to CAS', addRes]);
+        return readFile(cas.url(addRes[1]));
+    });
+    const x3 = step(x2, readRes => {
+        assert(readRes[0] === 'ok', ['failed to read stored file', readRes]);
+        // Verify content is the same size as original
+        assertEq(length(readRes[1]), length(bigContent), 'stored content size mismatch');
+        return rm(testDir);
+    });
+    return step(x3, () => pure(undefined));
+};
 export const proof = {
-    addBigFile: testAddBigFile,
-    addAndGetBigFile: testAddAndGetBigFile,
+    // Both effects must be interpreted, not merely built: an `Effect` is inert
+    // data, so returning one from a proof runs none of its continuations and
+    // asserts nothing.
+    addBigFile: () => { virtual(emptyState)(testAddBigFile()); },
+    addAndGetBigFile: () => { virtual(emptyState)(testAddAndGetBigFile()); },
     //
     casWriteRead: () => {
         // Round-trip a single-chunk payload through the real streaming CAS: `write` returns
@@ -92,7 +95,7 @@ export const proof = {
         const hash = writeResult[1];
         assertEq(length(hash), 256n, ['expected 256-bit hash', length(hash)]);
         assertEq(msb.cmp(hash)(computeSync(sha256)([content])), 0, 'write hash mismatch');
-        const drain = (acc) => (stream) => stream.step((node) => {
+        const drain = (acc) => (stream) => step(stream, (node) => {
             if (node === undefined) {
                 return pure(ok(acc));
             }
@@ -125,7 +128,7 @@ export const proof = {
         assert(writeResult[0] === 'ok', ['expected write ok', writeResult]);
         const hash = writeResult[1];
         assertEq(msb.cmp(hash)(computeSync(sha256)(chunks)), 0, 'multi-chunk write hash mismatch');
-        const drain = (acc) => (stream) => stream.step((node) => {
+        const drain = (acc) => (stream) => step(stream, (node) => {
             if (node === undefined) {
                 return pure(ok(acc));
             }
@@ -181,7 +184,7 @@ export const proof = {
         const hash = w[1];
         assertEq(msb.cmp(hash)(computeSync(sha256)(chunks)), 0, 'oversized write hash mismatch');
         // Fold the read stream straight into a fresh SHA-2 state — never one `Vec`.
-        const rehash = (state) => (stream) => stream.step((node) => {
+        const rehash = (state) => (stream) => step(stream, (node) => {
             if (node === undefined) {
                 return pure(ok(sha256.end(state)));
             }
@@ -212,6 +215,23 @@ export const proof = {
         const [, present] = virtual(state1)(access(stalePath));
         assert(present[0] === 'error', 'expected GC to reclaim the expired staging file');
     },
+    casWriteGcSkipsLiveLease: () => {
+        // A staging file whose deadline is still in the future is left alone by the GC
+        // that `write` runs before staging its own file.
+        const livePath = join('.', '.cas', '_stage', '0000000000002000000-live');
+        const state0 = {
+            ...emptyState,
+            epochNs: 1_000_000,
+            root: { '.cas': { '_stage': { '0000000000002000000-live': [vec8(0x99n)] } } },
+        };
+        const content = vec8(0x2an);
+        const c = fileCas(sha256)('.');
+        const x = c.write(nonEmpty(ok(content), empty()));
+        const [state1, w] = virtual(state0)(x);
+        assert(w[0] === 'ok', ['expected write ok', w]);
+        const [, present] = virtual(state1)(access(livePath));
+        assert(present[0] === 'ok', 'expected GC to leave the live staging file alone');
+    },
     casUploadSuccess: () => {
         // A successful upload returns the hash and deletes the source file from cas_upload/.
         const content = vec8(0x2an);
@@ -239,18 +259,19 @@ export const proof = {
         // The common path: every chunk is `ok`, so collectRead concatenates them all
         // and returns the whole blob as one `Vec`.
         const stream = nonEmpty(ok(vec8(0x11n)), nonEmpty(ok(vec8(0x22n)), empty()));
-        const d = decode(collectRead(stream));
-        assert(d.done, 'expected collectRead to finish without issuing a command');
-        assertEq(d.result[0], 'ok');
+        const o = runPure(collectRead(stream));
+        assert(o.length === 1, 'expected collectRead to finish without issuing a command');
+        assertEq(o[0][0], 'ok');
     },
     collectReadPropagatesErrorItem: () => {
         // An error item mid-stream short-circuits collectRead with that same error.
         const boom = error('boom');
         const stream = nonEmpty(ok(vec8(0x11n)), nonEmpty(boom, empty()));
-        const d = decode(collectRead(stream));
-        assert(d.done, 'expected collectRead to finish without issuing a command');
-        assertEq(d.result[0], 'error');
-        assertEq(d.result[1], 'boom');
+        const o = runPure(collectRead(stream));
+        assert(o.length === 1, 'expected collectRead to finish without issuing a command');
+        const [r] = o;
+        assertEq(r[0], 'error');
+        assertEq(r[1], 'boom');
     },
     // A single `Vec` cannot exceed `maxLength` bits — feed a pure stream whose second
     // chunk pushes the running total just over the limit so the overflow guard fires
@@ -260,22 +281,21 @@ export const proof = {
         const v1 = vec(half)(0n);
         const v2 = vec(half + 1n)(0n);
         const stream = nonEmpty(ok(v1), nonEmpty(ok(v2), empty()));
-        const d = decode(collectRead(stream));
-        assert(d.done, 'expected collectRead to finish without issuing a command');
-        assertEq(d.result[0], 'error');
+        const o = runPure(collectRead(stream));
+        assert(o.length === 1, 'expected collectRead to finish without issuing a command');
+        assertEq(o[0][0], 'error');
     },
     casListPropagatesNonNotFoundAccessError: () => {
         // A non-ENOENT `access` failure (permissions, corruption) is a genuine storage
         // error and must propagate out of `list`, not be swallowed as an empty store.
         const c = fileCas(sha256)('.');
         const boom = { code: 'EACCES' };
-        const d = decode(c.list());
-        assert(!d.done, 'expected list() to issue an access command first');
-        assertEq(d.command, 'access');
-        const continuation = d.continuation;
+        const r = casCommand(c.list());
+        assert(r[0] === 'cont', 'expected list() to issue an access command first');
+        assertEq(r[1], 'access');
         let threw;
         try {
-            continuation(error(boom));
+            r[2](error(boom));
         }
         catch (e) {
             threw = e;

package/fjs/ci/bun/module.f.js

@@ -5,11 +5,11 @@
  * @module
  */
 import { bun } from '../config/module.f.js';
-import { clean, install, test, uses } from '../common/module.f.js';
-export const bunSteps = (version) => clean([
+import { install, test, uses } from '../common/module.f.js';
+export const bunSteps = (version) => [
     install(uses('oven-sh/setup-bun', { 'bun-version': bun })),
     install({ run: `bun install -g functionalscript@${version}` }),
     test({ run: 'bun install --frozen-lockfile' }),
     test({ run: `bunx functionalscript@${version} t` }),
     test({ run: 'bun test --coverage' }),
-]);
+];

package/fjs/ci/common/module.f.d.ts

@@ -1,7 +1,7 @@
 /**
  * Shared CI types and helpers: GitHub Actions step/job RTTI schemas, the
  * `MetaStep` representation used by tool-specific modules, and assemblers like
- * `install`, `test`, `clean`, `ubuntu`, and `toSteps`.
+ * `install`, `test`, `ubuntu`, and `toSteps`.
  *
  * @module
  */
@@ -83,7 +83,6 @@ export type MetaStep = {
 export declare const uses: (name: keyof typeof actions, w?: Record<string, string>) => Step;
 export declare const install: (step: Step) => MetaStep;
 export declare const test: (step: Step) => MetaStep;
-export declare const clean: (steps: readonly MetaStep[]) => readonly MetaStep[];
 export declare const toSteps: (m: readonly MetaStep[]) => readonly Step[];
 export declare const ubuntu: (ms: readonly MetaStep[]) => Job;
 export declare const ubuntuArm: (ms: readonly MetaStep[]) => Job;

package/fjs/ci/common/module.f.js

@@ -1,7 +1,7 @@
 /**
  * Shared CI types and helpers: GitHub Actions step/job RTTI schemas, the
  * `MetaStep` representation used by tool-specific modules, and assemblers like
- * `install`, `test`, `clean`, `ubuntu`, and `toSteps`.
+ * `install`, `test`, `ubuntu`, and `toSteps`.
  *
  * @module
  */
@@ -37,10 +37,6 @@ export const uses = (name, w) => ({
 });
 export const install = (step) => ({ type: 'install', step });
 export const test = (step) => ({ type: 'test', step });
-export const clean = (steps) => [
-    ...steps,
-    test({ run: 'git reset --hard HEAD && git clean -fdx' })
-];
 export const toSteps = (m) => {
     const filter = (st) => m.flatMap((mt) => mt.type === st ? [mt.step] : []);
     const aptGet = m.flatMap(v => v.type === 'apt-get' ? [v.package] : []).join(' ');

package/fjs/ci/config/module.f.d.ts

@@ -1,7 +1,6 @@
 /**
  * Centralized version pins and OS images used by the CI generator: runner
- * images, tool versions (Bun, Deno, Playwright, Rust, Node, Wasmtime, Wasmer,
- * TSGO).
+ * images, tool versions (Bun, Deno, Rust, Node, Wasmtime, Wasmer, TSGO).
  *
  * @module
  */
@@ -19,24 +18,28 @@ export declare const images: {
         readonly arm: 'windows-11-arm';
     };
 };
-export declare const functionalscript: '0.37.0';
+export declare const functionalscript: '0.38.0';
 export declare const bun = "1.3.14";
-export declare const deno = "2.9.3";
-export declare const playwright = "1.61.1";
+export declare const deno = "2.9.4";
 export declare const node: {
-    readonly default: '26.5.0';
+    readonly default: '26.5.1';
     readonly node22: '22.23.1';
     readonly node24: '24.18.0';
 };
+export declare const nixpkgs: {
+    readonly ref: 'nixos-26.05';
+    readonly commit: '21ea275a7c46aef9d4d6ddc962e6d562e9d94183';
+};
 export declare const wasmtime = "47.0.2";
-export declare const wasmer = "7.2.0";
+export declare const wasmer = "7.2.1";
 export declare const actions: {
-    readonly 'actions/checkout': 'v7';
+    readonly 'actions/checkout': 'v7.0.1';
     readonly 'actions/setup-node': 'v7.0.0';
     readonly 'actions/cache': 'v6.1.0';
     readonly 'denoland/setup-deno': 'v2.0.5';
     readonly 'oven-sh/setup-bun': 'v2.2.0';
     readonly 'bytecodealliance/actions/wasmtime/setup': 'v1.1.3';
     readonly 'wasmerio/setup-wasmer': 'v3.1';
+    readonly 'cachix/install-nix-action': 'v31.11.0';
     readonly 'dtolnay/rust-toolchain': '1.97.1';
 };

package/fjs/ci/config/module.f.js

@@ -1,7 +1,6 @@
 /**
  * Centralized version pins and OS images used by the CI generator: runner
- * images, tool versions (Bun, Deno, Playwright, Rust, Node, Wasmtime, Wasmer,
- * TSGO).
+ * images, tool versions (Bun, Deno, Rust, Node, Wasmtime, Wasmer, TSGO).
  *
  * @module
  */
@@ -24,30 +23,43 @@ export const images = {
 // published FunctionalScript release; do not tie it to package.json's current
 // in-repo version.
 // https://www.npmjs.com/package/functionalscript
-export const functionalscript = '0.37.0';
+export const functionalscript = '0.38.0';
 // https://bun.sh/
 export const bun = '1.3.14';
 // https://deno.com/
-export const deno = '2.9.3';
-// https://www.npmjs.com/package/playwright
-export const playwright = '1.61.1';
+export const deno = '2.9.4';
+// The Node versions the pinned Nixpkgs snapshot below provides — read from
+// `pkgs/development/web/nodejs/v{22,24,26}.nix` at that commit. Every runtime
+// uses these: `setup-node` on the GitHub-hosted runners and the generated
+// flakes on the Nix jobs, which assert the version they actually get. Nixpkgs
+// usually trails nodejs.org, so bump the snapshot first and copy the versions
+// it offers rather than the latest release.
 // https://nodejs.org/en/download
 export const node = {
-    default: '26.5.0',
+    default: '26.5.1',
     node22: '22.23.1',
     node24: '24.18.0',
 };
+// Official Nixpkgs snapshot used by the generated CI flakes. `ref` is the
+// stable channel the commit is accepted from; `commit` is the exact revision
+// every generated `flake.nix` pins. The Node versions above come from this
+// snapshot, so the two move together.
+// https://channels.nixos.org/nixos-26.05/git-revision
+export const nixpkgs = {
+    ref: 'nixos-26.05',
+    commit: '21ea275a7c46aef9d4d6ddc962e6d562e9d94183',
+};
 // https://github.com/bytecodealliance/wasmtime/releases
 export const wasmtime = '47.0.2';
 // https://github.com/wasmerio/wasmer/releases
-export const wasmer = '7.2.0';
+export const wasmer = '7.2.1';
 // GitHub Action versions used by CI step builders. The key is the action
 // `owner/name`; call sites compose the full ref as
 // `` `${name}@${actions[name]}` ``.
 // Note: dtolnay/rust-toolchain value is a Rust version, not an action version.
 export const actions = {
     // https://github.com/marketplace/actions/checkout
-    'actions/checkout': 'v7',
+    'actions/checkout': 'v7.0.1',
     // https://github.com/marketplace/actions/setup-node-js-environment
     'actions/setup-node': 'v7.0.0',
     // https://github.com/marketplace/actions/cache
@@ -60,6 +72,9 @@ export const actions = {
     'bytecodealliance/actions/wasmtime/setup': 'v1.1.3',
     // https://github.com/wasmerio/setup-wasmer
     'wasmerio/setup-wasmer': 'v3.1',
+    // https://github.com/marketplace/actions/install-nix
+    // Enables the `nix-command` and `flakes` experimental features by default.
+    'cachix/install-nix-action': 'v31.11.0',
     // https://rust-lang.org/ - value is Rust version, not action version
     'dtolnay/rust-toolchain': '1.97.1',
 };