nova-nix 0.6.0.0 → 0.8.0.0

raw patch · 59 files changed

+24948/−11346 lines, 59 filesdep +asyncdep +filelockdep +networkdep ~basedep ~nova-cachePVP ok

version bump matches the API change (PVP)

Dependencies added: async, filelock, network

Dependency ranges changed: base, nova-cache

API changes (from Hackage documentation)

Files

• CHANGELOG.md +102/−0
• NOTICE +6/−0
• README.md +139/−90
• app/Main.hs +488/−193
• cbits/nn_bytecode.h +14/−3
• cbits/nn_ctxstr.c +38/−18
• cbits/nn_ctxstr.h +22/−12
• cbits/nn_env.c +18/−9
• cbits/nn_env.h +7/−5
• cbits/nn_lambda.c +30/−14
• cbits/nn_lambda.h +19/−12
• cbits/nn_symbol.c +8/−0
• cbits/nn_symbol.h +2/−1
• cbits/nn_thunk.c +22/−17
• cbits/nn_thunk.h +9/−7
• cbits/nn_winfs.c +67/−0
• cbits/nn_winfs.h +18/−0
• nova-nix.cabal +51/−19
• src/Nix/Builder.hs +822/−171
• src/Nix/Builder/Unpack.hs +186/−81
• src/Nix/Builtins.hs +71/−33
• src/Nix/Compression.hs +66/−0
• src/Nix/Config.hs +190/−0
• src/Nix/DependencyGraph.hs +13/−9
• src/Nix/Derivation.hs +177/−100
• src/Nix/Eval.hs +5425/−4162
• src/Nix/Eval/AttrPath.hs +147/−0
• src/Nix/Eval/CBytecode.hs +53/−2
• src/Nix/Eval/CCtxStr.hs +21/−19
• src/Nix/Eval/CEnv.hs +9/−7
• src/Nix/Eval/CLambda.hs +15/−13
• src/Nix/Eval/CThunk.hs +12/−9
• src/Nix/Eval/CanonPath.hs +126/−0
• src/Nix/Eval/Compile.hs +51/−25
• src/Nix/Eval/Context.hs +9/−1
• src/Nix/Eval/IO.hs +417/−190
• src/Nix/Eval/Operator.hs +117/−42
• src/Nix/Eval/StringInterp.hs +183/−28
• src/Nix/Eval/Symbol.hs +36/−2
• src/Nix/Eval/Types.hs +367/−110
• src/Nix/Expr/ClosureTrim.hs +44/−70
• src/Nix/Expr/Resolve.hs +191/−37
• src/Nix/Expr/Types.hs +9/−1
• src/Nix/Hash.hs +95/−18
• src/Nix/Parser.hs +16/−5
• src/Nix/Parser/Expr.hs +208/−27
• src/Nix/Parser/Internal.hs +37/−0
• src/Nix/Parser/Lexer.hs +493/−178
• src/Nix/Push.hs +188/−58
• src/Nix/Store.hs +1103/−282
• src/Nix/Store/CaseSensitive.hs +37/−0
• src/Nix/Store/DB.hs +103/−4
• src/Nix/Store/ExecBit.hs +119/−0
• src/Nix/Store/Lock.hs +152/−0
• src/Nix/Store/Path.hs +164/−23
• src/Nix/Store/Path/Internal.hs +38/−0
• src/Nix/Substituter.hs +1078/−411
• test/FetchurlFixture.hs +91/−0
• test/Main.hs +11209/−4828

@@ -1,5 +1,107 @@ # Changelog +## 0.8.0.0 - 2026-10-08++0.7.0.0 was published on GitHub but not uploaded to Hackage, so on Hackage this release follows 0.6.0.0. Library users upgrading from 0.6.0.0 should read the 0.7.0.0 entries below as well.++### Library API++Breaking changes for code that uses nova-nix as a library:++- **`Nix.Eval.Types.MonadEval` has five new methods with no defaults:** `adoptStorePath`, `lookupFetchCache`, `onEvalError`, `setExecutableFile` and `writeFetchCache`. Every instance defined outside this package needs them.+- **`Nix.Builder.BuildConfig` has a new strict field,** `bcExecWrappers :: Map Text FilePath`.+- **`BuildConfig` drops `bcBashPath` and `bcSandbox`, which nothing read.** Both were defined and defaulted, and no code consulted either one: the Windows stdenv takes bash from the MSYS2 seed, and no platform implements build sandboxing. A field that reads like a switch while switching nothing suggests isolation that does not exist, so it goes until there is a mechanism for it to gate (#25). Library code that set either field stops compiling and loses no behavior. (#209)+- **`Nix.Substituter.CacheConfig` replaces `ccPublicKey :: Text` with `ccPublicKeys :: [Text]`,** since a narinfo is now accepted when any trusted key verifies it.+- **The store-write cache records how each path was written.** `Nix.Eval.IO.EvalState`'s `esStoreWriteCache` maps each key to `([StorePath], StoreWriteMode)`, and `Nix.Store.materializeEvalStoreWrites` takes the same shape.+- **`Nix.Eval.StringInterp.coerceToString` takes a `CoercePath m` argument** that decides how a path is coerced at each call site.+- **`Nix.Expr.Types.Expr` has a new constructor, `EPathStr`, and `Nix.Parser.Lexer.Token` has `TokPathInterpStart`, `TokPathLit` and `TokPathEnd`,** so exhaustive matches over either need new cases.++### CLI++- **`build` selects an attribute, or takes an expression, not only a file.** `nova-nix build FILE.nix -A a.b.c` follows a dotted attribute path into the file's value, and `nova-nix build --expr 'EXPR'` builds with no file at all. A build previously took one file whose value had to be a derivation itself, so a package set could only be built by carrying a pointer file per package, which is the arrangement the nixpkgs by-name layout exists to remove. A component may be double-quoted to carry a literal dot (`-A 'foo."bar.baz"'`), matching upstream's tokenizer including the behaviours that read as accidents: quotes concatenate rather than delimit, so `foo"bar"` is the single name `foobar`, and a trailing dot is dropped rather than becoming an empty component. Three upstream behaviours are deliberately absent. A numeric component indexes a list upstream and is an ordinary attribute name here, because nothing this selects over is a list and upstream's integer-or-name test defers to a C++ numeric parse whose accepted spellings have not been checked against a running Nix. A near-miss attribute name gets no `Did you mean` line, which upstream renders from a Levenshtein search this evaluator has no suggestion channel to carry; the message itself is upstream's, only without that second line. Every selection message matched upstream byte for byte when diffed against `nix-instantiate` 2.33.2. And `-A` is not repeatable: upstream accumulates a derivation per occurrence, while a build here realizes one, so a second `-A` is an error rather than a silent last-one-wins. (#174)+- **`--exec-wrapper SYSTEM=PATH` builds a derivation whose system this machine cannot execute, through a named launcher.** `--exec-wrapper x86_64-windows=/path/to/wine` builds an `x86_64-windows` derivation on Linux through Wine. `SYSTEM` is the derivation's own `system` string, spelled exactly as a `.drv` spells it. The launcher is prepended to the builder at the spawn boundary and never enters the derivation, so the store paths a wine-hosted build produces are the same ones a Windows host produces. A derivation for the host's own platform is spawned directly whatever is configured; a derivation for any other system with no launcher named for it is refused before the builder runs, rather than spawned natively and left to fail in the loader. The option is accepted before or after `build`'s target, and repeated options accumulate across both positions with the same duplicate-system and launcher checks. (#171, #201)+- **`eval` accepts `--store` after the subcommand.** The eval sub-parser rejected `--store` where `build`, `push` and `store delete` accepted it, even though eval-side reads follow the selected store identically. (#193)+- **Substituters and trusted public keys can be configured in nix.conf and NIX_CONFIG, not only as flags.** A machine can now say once, in `nix/nix.conf` under `$XDG_CONFIG_HOME` (by default `~/.config`, or `%APPDATA%` on Windows) or in the NIX_CONFIG environment variable, which binary caches to substitute from and which public keys to trust, instead of repeating `--substituter` and `--trusted-key` on every invocation. The format matches upstream's: name = value lines, a # comment truncates the rest of the line, list values split on whitespace, the binary-caches and binary-cache-public-keys aliases are honored, and an extra- prefix appends to a list rather than replacing it. Sources are resolved in upstream's precedence order, the user file, then NIX_CONFIG, then the command line, with the command line winning; a plain assignment in a higher source replaces the accumulated value and an extra- widens it, which is the load-bearing rule for trusted-public-keys since a mishandled precedence would silently widen what the machine trusts. The trusted-key set is now flat as upstream models it: a narinfo is accepted when its signature verifies under any trusted key, and a malformed key anywhere in the set is a loud error rather than a silently skipped one. The include/!include directives and the /etc/nix and XDG_CONFIG_DIRS sources are tracked separately in #199. (#200)++### Evaluation++- **Path literals accept string interpolation (`./${v}/x`), which the nixpkgs 26.05 tree uses 89 times across 54 files.** The lexer had no representation for an interpolated path, so both ./${v}/x and /tmp/${v}/y were parse errors. The lexer now carries a path mode alongside the string modes, mirroring upstream's INPATH machinery: the head piece opens the literal, chunks and interpolations follow, and a synthesized end token closes at the first non-path character. Every semantic rule is pinned to nix-instantiate 2.33.2's observed behavior: the result is a path; pieces concatenate with no separator (mid-segment and back-to-back interpolation included) and the whole canonicalizes textually, so a dot-dot arriving at runtime collapses; a path segment coerces without a store copy, unlike string interpolation, and a string carrying store-path context is refused ("cannot be appended to a path"); and a trailing slash is a parse error ("path has a trailing slash"), now for plain path literals too, matching upstream's grammar. A search path followed by /${v} stays two expressions, as upstream parses it. The head piece is absolutized in the same pre-eval pass as plain literals, so closure capture across import keeps working. (#189)+- **An attrset coerced through outPath now copies to the store and carries context, matching upstream byte for byte.** The coercion engine handled paths with a fixed context-free case, so a path reached through an attrset's outPath (or a __toString result) rendered as raw filesystem text with no store copy and no string context, wherever the attrset stood in for the path: src = builtins.fetchGit { ... } produced empty inputSrcs and a drvPath diverging from real Nix 2.33.2 while the .outPath spelling worked, a user { outPath = ./dir; } leaked the raw path into the build environment, and the same drop reached interpolation, the + operator, and builtins.toJSON. The path behavior is now a parameter the attrset recursion carries, so every coercion site states its mode: interpolation, derivation fields, +, and toJSON copy to the store; builtins.toString stays verbatim. Verified against nix-instantiate 2.33.2: the attrset form's drvPath now matches upstream exactly. (#187)+- **A syntax error inside a lambda is reported where it happened, not as an attr-set complaint at the top of the file.** The parser decided lambda-versus-attr-set (and lambda-versus-expression) by backtracking, and a failed try discarded its error entirely, so a real failure at line 410 of a nixpkgs file surfaced as "expected '=' but got ','" at line 2, column 6: the valid comma in the file's opening formals. Two changes close it. A parsed lambda header now commits: "ident :", "ident @", and "{ formals } :" never begin anything else, so a body failure propagates from its own position instead of rewinding, which also covers the case where the other reading succeeds on a prefix (the empty attr set in "{ }: body") and the old parser complained at the stray colon. And when no reading parses at all, the error from the branch that got furthest into the input is the one reported, with end-of-input ranking past every positioned failure; upstream's LR parser never backtracks and always errors at the true site, and this is the closest a backtracking parser comes. (#181)+- **`builtins.fetchGit` remembers a pinned revision.** A fetch of a pinned `rev` is now recorded under the user's cache directory and reused while the tree it names is still in the store, since re-cloning it on every evaluation is pure waste and fatal whenever the far end is down. A bare `ref` is never cached, since it means "whatever this branch points at now". Everything that decides what comes back is in the key, `shallow` included: it does not change the tree, but it does change `revCount`, which can reach a derivation's environment. A hit re-records the store write the fetch would have made, so the path it hands back is registered before any derivation naming it is built. (#172)+- **`builtins.fetchGit` with `shallow = true` reports revCount 0 and can check out a pinned rev.** A shallow fetch counted the truncated history, so revCount was always 1 regardless of the real depth, a wrong number that can reach a derivation's environment. Upstream reports 0 under shallow (its fetcher skips computing the attribute and evaluation fills the default; observed from nix-instantiate 2.33.2, whose shallow result keeps all eight attributes with revCount = 0), and nova-nix now records and reports the same 0 without running rev-list at all. A pinned rev also becomes the fetch refspec itself, matching upstream's construction: a depth-1 fetch of a branch tip cannot contain any other revision, so asking the remote for the SHA is what lets shallow and rev compose, and what finds a rev not on the fetched ref. A server may refuse a SHA it does not advertise; that failure surfaces as git's own fetch error, the same surface upstream has. (#184)+- **`builtins.fetchGit` honors allRefs, verifies a declared narHash, refuses unsupported attributes, and cleans up after a failed fetch.** allRefs = true fetches every remote ref (upstream's refs/*:refs/* refspec), the caller's way to a pinned rev the remote refuses as a direct SHA want; the scratch clone has a worktree, unlike upstream's bare cache repo, so the fetch passes --update-head-ok, which is safe because an explicit checkout always follows. A declared narHash is verified against the fetched tree on the cache-hit and fresh paths alike, and a mismatch is an error in upstream's orientation (expected is what the fetch produced, got is the declared pin), never a silent recompute; upstream matched from nix-instantiate 2.33.2. An attribute outside the supported set (url, name, ref, rev, submodules, shallow, allRefs, narHash) is refused instead of silently dropped, which is exactly how the unhonored pins stayed invisible. A failing fetch no longer leaks its scratch clone: every throwing step runs under a new onEvalError cleanup primitive, the error half of a bracket. (#188)+- **`builtins.placeholder` is substituted at build time.** `builtins.placeholder "out"` evaluates to a sentinel, since an input-addressed derivation's output path is a hash of the derivation itself and the expression cannot name a path it hasn't produced yet. The sentinel now gets replaced in a derivation's `args` and in its environment, names as well as values, at the spawn boundary, with the same per-output path `$out` already carries, so argument-passing and environment-passing builders agree on where to write. Upstream rewrites the whole `name=value` string rather than the value alone, so a placeholder in a dynamic attribute name is substituted too. This is what lets a builder that takes its destination as an argument rather than reading the environment (stage0's `hex0 input output`) be driven directly. The builder path itself is left alone: a placeholder there would name a program that does not exist yet. (#126)++### Store++- **Eval-time store writes are verified at both ends: writers rewrite a mismatched leftover, and registration refuses content that does not reproduce its path.** Every eval-side writer skipped its write when the destination existed (and the fetchurl writer wrote unconditionally, crashing on a sealed leftover), so a file truncated by an interrupted earlier run was adopted as-is, registered valid under the hash of the content it should have had, sealed read-only so nothing could repair it, and then consumed by builds. Writers now adopt an existing destination only when its bytes are the intended bytes (raw comparison for toFile and fetchurl, recursive NAR digest for source copies and builtins.path) and otherwise clear and rewrite, which is where the bytes exist to rewrite with, matching upstream's delete-then-rewrite in addTextToStore. Registration independently re-derives each recorded path from its on-disk content under the scheme that named it (the write cache now carries text, recursive, or flat alongside the references) and refuses loudly on a mismatch rather than sealing a hash the bytes do not have. (#182)+- **The eval-side materializers join the per-path lock protocol.** materializeEvalSources ran its check-then-act with no lock: two processes materializing the same source path raced the validity check, and the loser's clear-and-recopy deleted the tree the winner had just registered. Both materializers now run each path's adopt or prepare under the same cross-process path lock the builder and substituter hold, with validity re-checked once the lock is held, so a peer mid-producing a path is waited out rather than raced. The store-write materializer's batched registration stays outside the lock deliberately: registration is an upsert over content both holders verified reproduces the same path. (#192)+- **A concurrent invocation waits for the store database instead of dying on ErrorBusy.** SQLite's default busy timeout is zero, so while one process held a write transaction (a registration mid-commit), a second nova-nix crashed in under a tenth of a second with an uncaught SQLError instead of waiting its turn, which at build volume means any concurrent pair of builds or substitutions could kill one side. The connection now sets the one-hour busy timeout upstream configures at open (sqlite3_busy_timeout, sqlite.cc at 2.28.7; the pragma reaches the same API), so concurrent invocations queue on the database exactly as upstream's do. (#180)+- **The executable bit survives on Windows.** A NAR records whether each regular file is executable, and a store path's identity is the hash of that. Windows has no such bit: `getPermissions` answers from the file's extension there, so a checked-out `configure` serialised as non-executable and a tracked `foo.exe` as executable, whatever either one was, and the substituter's unpacked tree then failed to reproduce the declared hash, so any cached path holding a mis-extensioned executable was downloaded, rejected, and deleted. The bit now lives in an NTFS alternate data stream whose presence is the bit. `builtins.fetchGit` sets the marks from git's index before `.git` is stripped. On Unix nothing changes. (#128)+- **Windows NAR hashing streams instead of materializing the tree in memory.** The executable bit lives in an alternate data stream that nova-cache's own walk could not see, so on Windows narHashOfPath serialised the whole tree in memory and rewrote the flags afterwards. nova-cache 0.11.1 added the exec-bit resolver hook for exactly this: the walk now asks the ADS source of truth per regular file, with the on-disk case-hack-suffixed name, so hashing streams in chunks on every platform and the post-hoc flag-rewrite walk is gone. (#191)++### Builder++- **A build writes into its output path, not into a temp directory it is moved out of.** `$out` is now the final store path, as upstream's is. Building somewhere else and moving afterwards looks equivalent and is not: anything that records where it was built (a compiler driver, a libtool archive) recorded the temp path, which is deleted the moment the build ends, leaving a store path that isn't self-contained and that the reference scanner can note but not repair. A stale tree from an interrupted run is cleared before the builder starts rather than at registration, and a failed build takes its partial output back out of the store, an interrupted one included. (#130)+- **A partial rebuild no longer hands the builder an output that is already valid.** A multi-output derivation with one output deleted still runs one builder, which writes every output; a registered path's `NarHash` describes bytes that must not change, and it is sealed read-only besides. Such an output gets a scratch path for the duration of the build, discarded afterwards, exactly as upstream's `makeFallbackPath` does. Where upstream then rewrites the scratch path back out of the produced outputs' contents, this refuses instead: an output that recorded a scratch path fails the build and names it. That divergence is deliberate, because a dangling reference becomes a loud failure rather than a registered lie, and it is the only part of upstream's hash-rewriting machinery not reproduced here. (#130)+- **Builders run in a scrubbed environment: the ambient environment no longer flows into builds.** The child process previously inherited every host variable not overridden by the build environment, so a builder consulting an undeclared variable embedded machine-specific data in its output, undermining the reproducibility SOURCE_DATE_EPOCH exists to pin. Upstream builds in a cleared environment (initEnv begins with env.clear() and the child is exec'd with exactly that block), and nova-nix now matches: on Unix nothing ambient passes through, and on Windows, where a process block cannot be empty, exactly SystemRoot, SystemDrive, and windir pass through (SystemRoot is a hard execution requirement, verified on a clean Windows 11 machine, where the CLR's crypto provider fails to load without it), COMSPEC is synthesized from SystemRoot, and PATHEXT is pinned to .COM;.EXE;.BAT;.CMD instead of inheriting the host's resolution rules. All four temp-directory names (TMPDIR, TEMPDIR, TMP, TEMP) now point at the build directory, matching upstream's single assignment of all four; scrubbing without repointing them would send Windows temp files to the Windows directory itself. (#186)+- **A fixed-output derivation's impureEnvVars reach the scrubbed build environment.** Upstream's carve-out for fetchers that need proxies: the variables the derivation's impureEnvVars attribute lists are copied from the ambient environment into the child, gated on the derivation being fixed-output (upstream gates on the type being non-sandboxed, which for nova-nix is exactly the fixed-output case). A listed variable absent from the ambient environment is set to the empty string, not omitted, and the carve-out is written last so it wins even over the derivation's own values, both matching upstream's initEnv. Every other derivation still sees only the scrubbed allowlist. (#190)+- **On Windows a build's process tree runs in a Win32 job object, so an interrupt or a builder exit no longer orphans grandchildren.** The builder was spawned without process-tree containment, so terminateProcess reached only the direct child: on Ctrl-C or a nonzero builder exit, a builder's whole grandchild tree (bash to make to cc, or anything cmd.exe spawned) was orphaned and kept running. The build spawn now sets use_process_jobs, wrapping the tree in a job with kill-on-job-close, so terminateProcess becomes TerminateJobObject and reaps the whole tree and waitForProcess waits for all of it. This is Windows only; POSIX builds are unchanged, and there is still no build timeout. It is phase one of build sandboxing (process containment); filesystem and privilege isolation and resource limits remain tracked in #194 and #195. (#196)++### Substitution++- **Substituting a store path whose symlinks have multi-component targets now works on Windows.** A symlink target like bin/tool was stored by Windows as a reparse point with backslashes, so re-serialising the unpacked tree read it back as bin\tool, the NAR hash no longer matched the signed narinfo, and the on-disk recheck failed the substitution systematically (a hard failure, never silent corruption). nova-cache 0.11.1.1 normalises a symlink target's separators to the POSIX spelling at the NAR boundary on Windows. (#198)++### Windows packages++- **`pkgs/windows` follows the nixpkgs layout, and the package set is a fixpoint.** Packages moved to `by-name/<shard>/<pname>/package.nix` (shard = the pname's first two characters), the stdenv machinery to `stdenv/`, and the sha256-pinned MSYS2 seeds to `bootstrap/`. `pkgs/windows/lib.nix` adds `callPackageWith`, modelled on nixpkgs' `lib.customisation.callPackageWith`, and `default.nix` discovers `by-name` with `builtins.readDir` and calls each `package.nix` through it. A package now declares its dependencies as formal parameters (`{ stdenv, zlib }: ...`) and callPackage supplies them from the set, instead of each recipe reaching across the tree with a relative import; adding a package is adding a directory. The walk reads the entry type `readDir` returns, so a stray file in `by-name` is passed over rather than opened as a directory. No recipe changed beyond its dependency plumbing, but every one of them moved, so all six drvPaths change and nothing already built is reused. `pkgs/windows/hello.nix` now builds the by-name GNU Hello through the stdenv, so its executable is at `bin\hello.exe`, where `make install` puts it, rather than at the output root. (#127)+- **Windows source fetches retry ordered mirrors and verify every download.** `pkgs/windows/fetchurl.nix` accepts a non-empty `urls` list for flat fixed-output downloads. HTTP errors, incomplete responses, and hash mismatches advance to the next URL; only verified bytes enter the store. Cancellation stops the build and releases its output lock without trying another mirror. Hello, sed, and zlib use multiple pinned source locations. Their source and package output paths stay unchanged, while their derivation paths change to describe the new inputs. The bundled upstream `fetchurl.nix` remains unchanged, and single-URL calls retain its interface. (#203)++### Dependencies++- **nova-cache moves to `>= 0.11.1.1 && < 0.12`, with the xz binding pinned to its bundled sources.** The 0.11.1 releases carry four things this project consumes. The per-file executable-bit resolver (`SerialiseOptions`, `withNarSourceOpts`) is the seam the Windows alternate-data-stream executable model plugs into, streaming verifier included. The POSIX default executable answer now reads the file's own owner-execute bit as upstream's dump does, where it previously asked `access(2)` what the calling process could do, so NAR bytes stop depending on who serialised (root, ACLs, and foreign-owned files were the divergence). A symlink target's separators are normalised on Windows. And the xz codec's binding moved off the Hackage-deprecated `lzma-static` onto its successor `xz`, which prefers a pkg-config-found system liblzma; the new `constraints: xz -system-xz` line pins the bundled sources so every build links the same C regardless of the host. (#177, #191, #198)++## 0.7.0.0 - 2026-08-22++- **A copied nova-nix finds its own bundled expressions.** The `<nix/*>` search path came from Cabal's `getDataDir`, which bakes an absolute path in at configure time naming the machine that did the build. That is right for a local `cabal install` and wrong for every copied or downloaded binary: `import <nix/fetchurl.nix>` resolved to a directory that does not exist on the host running it, and the Windows package recipes all open with that line. The data dir now comes from `NIX_DATA_DIR` when set (upstream's own variable name), otherwise from `share/nova-nix` beside the executable's own `bin` directory, which is the layout a release archive ships and needs nothing configured, and otherwise from Cabal as before, so a local install is unchanged. The build matrix now checks both fallbacks against a relocated copy with Cabal's own override pointed at nothing, so a pass cannot come from the baked path.+- **Tags publish downloadable binaries, not only a Hackage sdist.** Seventeen tags had produced zero GitHub releases, because the publish workflow only ever uploaded an sdist, so the only way to get nova-nix was to build it. Each tag now also attaches a per-platform archive for Linux, macOS and Windows, carrying `bin/` beside `share/` and `pkgs/`, so an unpacked copy resolves `<nix/*>` and builds with no toolchain and nothing to configure, plus a `SHA256SUMS` file generated over the exact uploaded bytes. The recipes ride along because they are what there is to build: every path in `pkgs/` is either relative to itself or the `<nix/*>` entry `share/` already provides, so the command the README opens with runs against the unpacked copy rather than needing the repository cloned beside it. Every archive is smoke-tested before it is attached, and the release is created as a draft and only published once all four assets are present, since `releases/latest/download` is a public URL that must not exist while empty. (#12)++  Two gaps the first cut left open. The smoke test ran on the machine that built the binary, where a full GHC toolchain sits on `PATH`, so it could not tell a self-contained executable from one quietly finding its DLLs next door; the Windows archive is now run again with `PATH` cut to the system directories, which is the download's actual situation, so a dependency that starts linking zlib, zstd or libgcc dynamically fails the release instead of the first person to unpack the zip. And the Hackage upload waited only on the checks, not on the archives, so a tag whose binaries failed to build would still have taken the one step of a release that cannot be undone: a Hackage version is immutable. It waits on the packaging job now.+- **`nova-nix --version` and `--help` answer, and `--help` answers on stdout.** A downloaded binary could not say what it was. The CLI had no version handling at all, so a bug report from a machine with no toolchain had no way to name the build it came from, which is most of what a release exists to enable. `--help` did not work either, failing with `unknown argument: --help`: usage came only from a bare invocation, on stderr, exiting non-zero. Both are flags now, answered before the rest of the line is parsed, so `--version` reports the build even when the command after it is one this build does not have. The two spellings of usage keep their difference for the reason they have one: a bare invocation is a usage error and stays on stderr with a non-zero status, while `--help` is a request that succeeded and goes to stdout exiting zero, so it pipes without redirecting stderr. The version is Cabal's, the one the publish workflow's tag guard already checks a tag against, and the archive smoke test now asserts the binary agrees with it before the release is attached: the guard reads a source tree, this reads the executable actually built from it.+- **`--store` is honored on evaluation's reads, not only its writes.** The store directory reached the five eval-time write sites and none of the eleven read sites, which resolved through the platform default, so a redirected store was written to and then read from somewhere else: `builtins.readFile (builtins.toFile "a" "hi")` wrote the file into the chosen store and then failed to find it under `/nix/store`. `builtins.path`, `filterSource`, `fetchGit` followed by `import`, and every other eval-time read had the same split. Before the store directory reached evaluation at all both sides ignored the flag and were at least consistent with each other, so this was newly broken rather than long-standing. The resolver takes the store directory it should read from instead of assuming the platform one, and evaluation passes the store it was given.++  No test caught it because the integration harness built its evaluator with the platform store while handing the build a different one, so the two halves were never asked to agree. The harness now uses one store for both. (#145)+- **Every store object evaluation writes is registered, not only `builtins.toFile`'s.** `writeToStore` recorded its writes for the build driver to register; `copyPathToStore`, `addSourceNar` and `addFixedOutputFile` recorded nothing, so a path from `builtins.path`, `filterSource`, `builtins.fetchurl`, or `builtins.fetchGit` reached `drvInputSrcs` with no registration row and the build died with `registerPaths: ... references unregistered path`. That made `builtins.fetchGit`'s `outPath` unusable as a derivation input, which is the reason it computes one. Recording now happens in one place every eval-time writer goes through, rather than being repeated per builtin and forgotten in three of four.+- **The release workflow's artifact actions match the rest of CI.** `publish.yml` pinned `actions/upload-artifact@v4` and `actions/download-artifact@v4` while `ci.yml` was already on v7, so the workflow that produces every release asset was two and four majors behind the one that builds them. Both move to the current majors (upload v7, download v8), whose inputs the workflow already uses.+- **CI lints its own workflows.** Haskell, C and source encoding were all covered while `.github/workflows/` itself was validated only by GitHub agreeing to parse it after a push. `actionlint` now checks `uses:` references, `${{ }}` expressions, matrix references and job dependencies, and runs shellcheck over every `run:` block, pinned to a version rather than floating so a lint release cannot turn an unrelated pull request red.+- **A build holds its outputs' path locks, so two builds of one derivation cannot interleave.** Per-path locks made delete, materialize and register a single critical section, and the build path never joined it, while `computeBuildDir` hands both processes the same build directory. Two concurrent builds of one derivation therefore wrote into one tree and registered the result as valid: reproduced with a builder appending a line per second, where the registered output held eight interleaved lines instead of six and nothing reported an error. A build now takes every output's lock before it starts and holds them until registration commits, and re-checks validity once they are granted so a derivation another process finished while we waited is adopted rather than rebuilt over. Outputs are locked in store-path order so two processes racing a multi-output derivation request them in the same sequence, and a build holds locks for its own outputs only, so there is no cycle to deadlock on.+- **`builtins.fetchGit` validates `ref` and `rev` before they reach git, closing an eval-time command execution.** Both attributes were spliced straight into git's argument vector with no separator and no shape check, and git parses options after the remote name, so a `ref` of `--upload-pack=<cmd>` named the command git runs as the transport. With a local or `file://` url (both accepted, and the local transport is enabled in the clone's own config) git ran that command through a shell, so evaluating an untrusted expression executed it and the evaluation still succeeded with an ordinary attrset. `ref` is now checked against upstream's `refRegexS` and `rev` against its `revRegexS`, the same shapes upstream enforces before either value reaches git, and `--` separates the positional arguments in `git fetch`. Rejecting an abbreviated `rev` is upstream parity in its own right: a revision that still resolves through git's DWIM rules is not pinned. (#143)+- **The Windows stdenv builds again: no drive letter in derivation text.** `mkDerivation` passed its setup script as `/cygdrive/c${setup}`, a hardcoded drive glued in front of a canonical store path. Once the builder began rendering `/nix/store` to the machine's real store directory at the spawn boundary, the two composed into `/cygdrive/cC:\nix\store/...-setup.sh` and every `mkDerivation` package failed before the builder's first line. The same rewrite reaches environment values, so `setup.sh`'s mapping (which matched on the canonical spelling) stopped firing and put a drive-lettered path into a colon-separated `PATH`, splitting the entry in two. Derivation text is now canonical throughout, which is what its hash is computed over and the only spelling that is correct on a store that is not on C:. `setup.sh` maps native paths to the two forms its consumers need, MSYS2 `/cygdrive/<drive>` for bash and mixed `C:/` for the native mingw tools, in pure parameter expansion, so it no longer shells out to `cygpath` (which the seed's package set does not provide) and no longer infers a drive from `$NIX_STORE`. The Windows E2E job now builds GNU hello through the real stdenv: the existing job drives `cmd.exe` directly and never loaded `stdenv.nix`, which is why this went unnoticed. (#144)++- **`--store` reaches evaluation, not only the builder.** Evaluation resolved every store read and write through the platform default (`C:\nix\store` on Windows, `/nix/store` elsewhere) while the builder honored the flag, so a non-default store left evaluation writing to one directory and the build reading from another. The store directory is now carried in the evaluation state and every eval-time store path resolves through it. A derivation's own strings are rendered at the spawn boundary for the same reason: the builder path, its arguments and its environment values all carry the canonical `/nix/store` spelling that hashes depend on, and that text is mapped to the configured directory only as the process is spawned. On Windows this is what lets a store-path builder be executed at all, since a bare `/`-rooted path there resolves against the current drive rather than the store's.+- **`builtins.fetchGit` fetches a pinned revision, not just a branch tip** - `rev`, `ref`, `submodules` and `shallow` are all now read from the argument set, `git fetch`/`checkout` replace the old unconditional `--depth 1` clone, and the result is the same attrset upstream's returns: `outPath`, `rev`, `shortRev`, `revCount`, `narHash`, `lastModified`, `lastModifiedDate` and `submodules`, all read from the clone before its (and every submodule's) `.git` metadata is stripped and it is copied to the store. Checked against a real Nix on the same two repositories: identical `outPath`, `narHash`, and every other field, submodule fetches included.+- **Substitution accepts bzip2, so historical cache paths and narinfos with no Compression field at all can be fetched.** cache.nixos.org narinfos written before the xz switch declare `Compression: bzip2`, and upstream C++ Nix reads an absent or empty Compression field as bzip2, so those paths could only ever fail here: the register named the codec in its rejection but no decoder stood behind the name. Both decompression paths - streaming and the strict oracle - now dispatch it through nova-cache 0.11's bzip2 sublibrary, bounded by the declared NarSize exactly as xz and zstd are, with stream errors retried and output past the bound refused as the served object misdeclaring; there is no decoder-memory knob to set, because bzip2 carries no attacker-chosen dictionary size and its decoder state is a small constant of the format. The empty spelling now decodes rather than rejects, completing the upstream parity the register was written for. The bound rises to nova-cache >= 0.11 && < 0.12 with the bzip2 sublibrary added to the library's set, and the pinned index-state advances past the release. 0.11 also tightens the zstd codec, which the suite now pins: a truncated frame and trailing bytes after the last frame refuse with a stream error instead of yielding a short output, so truncation is caught at the codec rather than left to the NAR grammar above it. (#115)+- **Cancellation is never spent as retry budget nor as cache fallthrough.** The retry classifier already re-threw asynchronous exceptions, but the per-cache catch-all one frame up converted every exception into a substitution error, so a Ctrl-C or timeout arriving mid-download was swallowed, the cache scan continued, and the build fell through to building locally instead of aborting. The sync/async split now lives in one shared helper used by the retry classifier, the per-cache attempt, and the builder's top-level catch-all: only synchronous exceptions convert into recoverable failures, and an interrupt propagates out of the whole operation.+- **Per-store-path locks close the substitution race.** The streaming substituter deleted the destination before the first byte downloaded, with no lock and no validity re-check anywhere, so two processes sharing a store could interleave delete, materialize, and register into a valid database row pointing at deleted or torn bytes. Substitution now takes an exclusive lock on upstream's "\<store-path\>.lock" file - a raw write-access descriptor locked through filelock (flock on POSIX, LockFileEx on Windows; CC0-licensed, so nothing encumbers the Apache-2.0 distribution), because base's Handle-based locks cannot express this lock - before touching the destination, re-checks validity under the lock and adopts another process's finished path instead of deleting and redoing it (waiting on a busy lock is announced, as upstream does), and holds the lock across download, materialization, the on-disk recheck, and the caller's registration transaction, releasing it on every exit path. The protocol is upstream C++ Nix's pathlocks mechanism (src/libstore/pathlocks.cc and the substitution path in local-store.cc) exactly. One deliberate divergence, documented in Nix.Store.Lock: lock files persist instead of being marked and deleted, which removes upstream's deleted-lock-file hazard outright and needs no separate Windows path.++- **store delete joins the per-path lock protocol, and lock files are not delete targets.** The delete command ran its unregister-and-remove sequence with no lock, so a delete racing another process's substitution of the same path could remove the freshly materialized tree between the substituter's on-disk recheck and its registration commit - the exact valid-row-pointing-at-deleted-bytes race the locks close, reopened through the other door. Deletion now holds the target's path lock across the whole sequence, blocking (with the announced wait) while a substituter holds it, as upstream's deletePath does. A target naming a lock file is refused with the reason: lock files are never deleted here by design, and removing one would reopen the deleted-lock-file hazard that design removes. Names like flake.lock are legal store-path names, so the refusal consults the registration rows: only an unregistered file whose suffix-stripped name is a well-formed store basename reads as a lock file, and a registered object of the same shape deletes normally.++- **zstd, both directions: substitution accepts it, push can produce it.** The modern caches (Cachix, attic, FlakeHub) serve NARs zstd-compressed; both decompression paths - streaming and the strict oracle - now speak it through nova-cache 0.10's zstandard sublibrary, bounded by the declared NarSize like xz (the strict decompressor's resolved function moves into IO: the zstd binding's decoder is IO-native, and the shape follows the codecs). Push gains --compression none|zstd, a property of the destination cache as upstream models it - none stays the default so existing cache content stays uniform - with the compressed object named by its own file hash and the narinfo's file fields describing it. The bound rises to nova-cache 0.10 with the zstandard sublibrary and the pinned index-state advances past the release. (#111)+- **Substitution failures carry a retry class, and every failure path cleans up.** Exceptions thrown mid-stream - a dropped connection, a full disk - previously escaped both the retry budget and the partial-tree cleanup, so the single most common transient failure never retried and could orphan an unverified tree at the store path. Every attempt now converts synchronous exceptions into the pipeline's failure channel (asynchronous cancellation re-throws untouched) and removes the tree on every exit. Failures classify explicitly, matching upstream's transfer layer: transport errors, torn transfers, and truncation retry with backoff; a completed transfer that verifies wrong, a body past its ceiling, or a 4xx fails at once, since retrying a deterministic failure only delays the local-build fallback.+- **The NAR download cap derives from the signed NarSize.** The compressed-body cap was keyed to the narinfo's FileSize, which the Ed25519 fingerprint does not cover, so a rewritten FileSize on a validly-signed narinfo could buy an unbounded download. The cap is now a ceiling computed from the signed NarSize plus a small framing-overhead margin, and the unsigned FileSize may only lower it, never raise it. Caches that omit FileSize (on-the-fly compressors) gain the same margin, so incompressible NARs whose compressed body slightly exceeds NarSize substitute where they previously aborted.+- **An empty Compression field means bzip2, never identity.** Upstream decodes an absent or empty Compression as bzip2, the field's historical default, and nova-cache's parser matches that coercion; treating the empty string as identity diverged from it. The compression vocabulary now lives in one register (Nix.Compression) parsed once at the narinfo boundary, so the streaming and strict dispatch cannot drift.+- **Substitution streams: download, decompress, hash, parse, and unpack in one bounded pass.** The substituter realized every NAR in memory before touching disk - an RSS spike the size of the path being fetched, documented in place since the first cut. The pipeline now drives nova-cache's streaming pieces end to end: the HTTP body feeds the bounded xz source, the incremental hash, the chunk-fed NAR parser, and a new streaming store sink that materializes events as they arrive, so memory is bounded by decoder buffers and the parser's structural-string cap, never by archive or file size. Disk writes therefore begin before the hash can be known - upstream's ordering exactly - and any failure or mismatch removes the tree it wrote; the on-disk recheck streams too. One divergence, documented at the sink: sibling names colliding on a folding filesystem always take upstream's case-hack renaming, never the NTFS true-name path, which can only be enabled on an empty directory the stream cannot pre-scan. (#107)+- **Substitution from cache.nixos.org works: xz NARs decompress.** The default cache serves every NAR xz-compressed, and decompressorFor rejected the value up front, so the shipped configuration could never substitute a single path. nova-cache 0.9's bounded decoder is wired in via its public nova-cache:xz sublibrary - an ordinary solver-visible dependency, no flags on either side; the bound rises to >= 0.9 && < 0.10 and the pinned index-state advances past the release - with output capped at the narinfo's signed NarSize and decoder memory at nova-cache's default, so a hostile stream expands to nothing the narinfo did not promise. Unsupported compression values still reject before any download is paid for. Verified against production data: recorded cache.nixos.org narinfos parse, validate, and signature-verify offline in the suite, and a real path substitutes end to end from the live cache. (#27)+- **nova-cache 0.8.0.0.** The bound rises to >= 0.8 && < 0.9 and the pinned index-state advances past the release. NAR parsing now rejects the full Windows reserved-device set at the parse boundary - COM0/LPT0, space-padded device stems ("NUL .txt"), and the superscript-digit forms - the same names materialization already refused, so the refusal moves earlier and the two guards agree. 0.8 also brings the streaming NAR interface and the NarSize-bounded xz decoder that foreign-cache substitution builds on next.+- **builtin:unpack resolves srcs through the store dir.** The srcs env value carries eval's canonical /nix/store spelling; unpack opened it verbatim, and on Windows a bare /-rooted path resolves against the current drive - the build worked only when the process happened to run from C:. Found by the e2e job's first flights (#100) on GitHub's D:-workspace runners. Each srcs entry now parses as a store path and renders through the configured store dir (the identity on Unix), a non-store-path entry fails loudly, and the e2e job no longer pins its working directory. (#101)+- **Toolchain: GHC 9.14.1 (the first GHC LTS release)** - CI, the release pipeline, and the README badge move from GHC 9.8.4 to 9.14.1. GHC 9.14 opens GHC's new LTS scheme (a minimum of two years of bugfix releases), and under that scheme every earlier series stops receiving fixes, so no version in between had a future. Dependency bounds already admitted the newer compiler and the full set resolves on it. The project targets the LTS alone: base >= 4.22, and foldl' comes from the Prelude, so its eleven redundant Data.List imports are gone. The deprecated pattern namespace specifier stays for now - hlint cannot yet parse the data replacement GHC suggests - with its deprecation warning muted in the cabal file until hlint learns the new spelling.+- **`builtins.toFile` writes are registered before a build that names them.** `writeToStore` computed a content-addressed path and wrote the bytes during evaluation, but nothing registered it, so a derivation naming a `toFile` output as an input died with `registerPaths: ... references unregistered path ...`. The write is recorded in eval state and registered in one batch by the build driver, before building - the same treatment `materializeEvalSources` already gives path literals eval coerces into the store, batched so a text path referencing another resolves. The write is idempotent too: the path is the hash of the bytes, so a file already there already holds them, and skipping the rewrite avoids a permission error on a second evaluation once registration makes the path read-only.+- **A path literal resolves against the file it is written in, not the file being evaluated when it is forced.** Relative path literals were rewritten to absolute ones only for `import`ed and `scopedImport`ed files; the top-level file and `--expr` were left to resolve at force time against whatever directory the evaluator happened to be in. Those differ whenever a literal outlives the scope it was written in, and `builtins.scopedImport { q = ./data.txt; } ./sub/useq.nix` is the short way to see it: `q` is forced during `sub/useq.nix`'s evaluation, so `./data.txt` named `sub/data.txt`, and `builtins.readFile` on it returned the wrong file's contents into whatever consumed them. Resolution is now part of parsing, which is where upstream does it (`absPath(path, state->basePath...)` in the `PATH` production through 2.24, `CanonPath(literal, state->basePath.path).abs()` in 2.35, unchanged in between), so `parseNix` takes the directory to resolve against and no caller can skip the step. A second bug fell out of widening it: `~/x` was treated as relative and joined to the importing file's directory, burying the tilde mid-path where nothing expands it, so `~/x` inside an imported file resolved to `<dir>/~/x`. Home-relative literals are now left for the evaluator, which expands them against `HOME`.+- **A value that needs no evaluation is shown, not reported as a thunk.** Printing an unforced list or attr set showed `<thunk>` for entries that were already values: `[ "a" "b" ]` came back as `[ <thunk> <thunk> ]` where upstream prints the strings, `[ ./x ]` and `[ [ ] ]` the same, and every attr set value regardless of what it was, so `{ a = 1; }` reported a thunk over the literal `1`. The cause was that the decision was made on how a value is represented at runtime (an integer fits an immediate slot, a string does not) rather than on what the expression is, which is what upstream asks: `maybeThunk` is overridden by `ExprInt`, `ExprFloat`, `ExprString` and `ExprPath` to hand back a value already built, and both `ExprList::eval` and the non-recursive branch of `ExprAttrs::eval` go through it. String and URI literals, path literals, and the empty list join the integers and booleans that were already answered directly, and a non-recursive attr set resolves its values the same way; recursive sets and `let` still defer, because the frame their variables point into is still being tied. Path literals can only be answered here because parsing now resolves them, so what reaches the evaluator is already absolute; a `~/` literal still defers, since expanding it reads the environment. Checked against a real `nix-instantiate` 2.24.9 in CI rather than against a reading of its source, and the same overrides are byte-identical in 2.35.2.++  Empty containers print as `[ ]` and `{ }` rather than with the two spaces a join of no elements left between the brackets.+ ## 0.6.0.0 - 2026-06-12  ### Milestone: A Stage-1 stdenv That Builds Real Software

@@ -0,0 +1,6 @@+nova-nix+Copyright 2026 Novavero AI Inc. and contributors++This product is licensed under the Apache License, Version 2.0.+A copy of the License is provided in the LICENSE file, or at+http://www.apache.org/licenses/LICENSE-2.0

@@ -1,141 +1,190 @@-<div align="center">-<h1>nova-nix</h1>-<p><strong>A Windows-native Nix, from scratch.</strong></p>-<p>Parser, lazy evaluator, content-addressed store, derivation builder, and binary-cache substituter - in Haskell and C99. Runs natively on Windows, macOS, and Linux. No WSL, no Cygwin.</p>+# nova-nix  [![CI](https://github.com/Novavero-AI/nova-nix/actions/workflows/ci.yml/badge.svg)](https://github.com/Novavero-AI/nova-nix/actions/workflows/ci.yml) [![Hackage](https://img.shields.io/hackage/v/nova-nix.svg)](https://hackage.haskell.org/package/nova-nix)-![GHC](https://img.shields.io/badge/GHC-9.8-purple)-![License](https://img.shields.io/badge/license-Apache--2.0-blue)+[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE) -</div>+nova-nix is an implementation of [Nix](https://nixos.org) for Windows, written+in Haskell with a C99 data layer. It also builds and runs on macOS and Linux.+It has its own parser, evaluator, store, builder and binary-cache substituter,+and does not need an existing Nix installation. ----+nova-nix is experimental. Read [Limitations](#limitations) before relying on+it.  ## Status -nova-nix builds natively on Windows. The toolchain is itself a store path (fetched, hash-verified, and unpacked through derivations), and the builder runs it directly:+- **Evaluation matches upstream Nix on the cases CI checks.** On a pinned+  nixpkgs 24.11 revision, `hello.drvPath` and a dependent derivation evaluate+  to the same store paths as Nix 2.24.9, and 23 smaller evaluation cases+  produce the same output. CI runs this comparison on every change. A matching+  `drvPath` means the whole build-time closure behind it matches too. How much+  of the rest of nixpkgs evaluates has not been measured yet ([#29]).+- **Windows builds run natively.** CI builds GNU Hello on a Windows runner+  through a stage-1 stdenv. Its toolchain is 17 MinGW-w64 packages and 22+  MSYS2 packages, each fetched as a fixed-output derivation pinned by SHA-256+  and unpacked into the store. sed, zlib and a small library-linking example+  also have recipes, but CI does not build them. Replacing these binary seeds+  with a toolchain built from source is tracked in [#26].+- **Binary caches work in both directions.** `nova-nix push` uploads a+  closure, and `build --substituter` downloads signed NARs instead of+  building. CI checks the round trip on Linux against a local nova-cache+  server. -```console-$ nova-nix build pkgs\windows\hello.nix-  [build]  mingw-w64-x86_64-gcc-16.1.0-5-any.pkg.tar.zst-  ...      (17 fixed-output fetches, one per MSYS2 package)-  [build]  mingw-w64-seed-  [build]  hello-C:\nix\store\zr07i99kqnv48q29n706qxar7h1gfins-hello+### Limitations -$ C:\nix\store\zr07i99kqnv48q29n706qxar7h1gfins-hello\hello.exe-Hello from the first native Windows Nix build.-```+- No flakes, no `nix-shell` or `nix develop`, and no daemon or multi-user mode.+- No garbage collection yet ([#24]). `nova-nix store delete` removes+  individual paths.+- On Windows a build's process tree runs in a job object, so stopping a build+  stops everything it started. There is no filesystem or network isolation+  yet ([#25]).+- nova-nix itself needs neither WSL nor Cygwin, but the current Windows stdenv+  runs its build scripts with MSYS2's bash.+- Store paths that contain symlinks need Windows Developer Mode or an elevated+  shell. nova-nix creates native symlinks and fails rather than falling back+  to a copy. -The seed (`pkgs/windows/seed.nix`) is stage 0 of a native Windows stdenv: the sha256-pinned runtime closure of MinGW-w64 GCC, merged into one toolchain root by in-process fetch and unpack builtins.+## Install -It also evaluates real nixpkgs. `import <nixpkgs> {}` resolves the top-level package set (~23,000 attributes) to weak head normal form, and a package evaluates through the stdenv bootstrap down to a derivation:+Each [release](https://github.com/Novavero-AI/nova-nix/releases/latest) has an+archive per platform: -```console-$ NIX_PATH=nixpkgs=/path/to/nixpkgs \-    nova-nix eval --expr '(import <nixpkgs> { system = "x86_64-linux"; }).hello.drvPath'-"/nix/store/gciipqhqkdlqqn803zd4a389v86ran45-hello-2.12.1.drv"-```+| Platform | Archive |+| --- | --- |+| Linux x86_64 | [`nova-nix-linux-x64.tar.gz`](https://github.com/Novavero-AI/nova-nix/releases/latest/download/nova-nix-linux-x64.tar.gz) |+| macOS arm64 | [`nova-nix-macos-arm64.tar.gz`](https://github.com/Novavero-AI/nova-nix/releases/latest/download/nova-nix-macos-arm64.tar.gz) |+| Windows x86_64 | [`nova-nix-windows-x64.zip`](https://github.com/Novavero-AI/nova-nix/releases/latest/download/nova-nix-windows-x64.zip) | -That `drvPath`, and the 253-derivation closure behind it, byte-matches upstream `nix-instantiate` - verified in CI on the same nixpkgs tree. It targets the Nix 2.24 language.+Each archive unpacks to a single directory holding `bin/`, `share/nova-nix/`+and `pkgs/`. `share/nova-nix/` provides the `<nix/*>` search path, so the+binary works wherever the directory is unpacked, and `pkgs/` holds the package+recipes. Check the download against the `SHA256SUMS` file attached to the same+release. -## Quickstart+In a GitHub Actions workflow: -```bash-git clone https://github.com/Novavero-AI/nova-nix.git-cd nova-nix-cabal build+```yaml+- uses: Novavero-AI/install-nova-nix@v1+- run: nova-nix eval --expr '1 + 2' ``` +## Usage+ ```console $ nova-nix eval --expr '1 + 2' 3--$ nova-nix eval --expr 'builtins.map (x: x * x) [ 1 2 3 4 5 ]'+$ nova-nix eval --strict --expr 'builtins.map (x: x * x) [ 1 2 3 4 5 ]' [ 1 4 9 16 25 ]--$ nova-nix eval FILE.nix                       # evaluate a file-$ nova-nix build FILE.nix                       # build a derivation-$ nova-nix push --cache URL --key-file KEY --all # publish the store to a cache-$ nova-nix --nix-path nixpkgs=/path eval FILE.nix ``` -## Binary cache--Built outputs are content-addressed, so they can be served and substituted like any Nix store path. `nova-nix push` uploads a path and its closure to a cache (NAR before narinfo, skipping what the cache already has, signed server-side); `build --substituter` pulls from one before compiling.- ```console-$ nova-nix build pkgs\windows\hello.nix \-    --store C:\scratch\store \-    --substituter https://cache.novavero.ai \-    --trusted-key cache.novavero.ai-1:9gQ7tLWMM+2tdC9H5sKMJltDIPfD7X2GWlZe8Aa8hHQ=-  [subst]  mingw-w64-x86_64-gcc-16.1.0-5-any.pkg.tar.zst-  ...      (signed download instead of a rebuild)-  [subst]  hello+$ nova-nix eval FILE.nix                          # evaluate a file+$ nova-nix build FILE.nix -A ATTR                 # build an attribute of it+$ nova-nix build FILE.nix --substituter URL --trusted-key KEY  # try a cache first+$ nova-nix push --cache URL --key-file KEY --all  # upload the store to a cache+$ nova-nix --help ``` -A public instance runs at `cache.novavero.ai`, seeded with the MinGW-w64 toolchain and the `hello` build.--## How it works--Six layers - Haskell for logic, C99 for data:--1. **Parser** (`Nix.Parser`, `Nix.Expr`) - hand-rolled recursive descent; the full Nix grammar to a 19-constructor AST.-2. **Evaluator** (`Nix.Eval`) - the AST compiles to a flat 24-opcode bytecode that a lazy, thunk-memoizing evaluator runs. Recursive `let`/`rec` are knot-tied; reference cycles are caught by blackhole detection. The evaluator is polymorphic over its effect via `MonadEval`: `PureEval` for tests, `EvalIO` for the real thing.-3. **Data layer** (`cbits/nn_*.c`) - nine arena-allocated C99 modules (interned symbols, sorted attrsets, thunks, environments, lists, context strings, bytecode, lambdas) hold evaluation data off the GHC heap. Haskell calls C to create and query it; C never calls back.-4. **Store** (`Nix.Store`) - content-addressed `/nix/store` (`C:\nix\store` on Windows) with SQLite metadata and reference scanning.-5. **Builder** (`Nix.Builder`) - dependency graph, topological sort, and binary-cache substitution before local builds.-6. **Substituter** (`Nix.Substituter`) - the HTTP binary-cache protocol: narinfo parsing, Ed25519 verification, NAR download and unpack. Built on [nova-cache](https://github.com/Novavero-AI/nova-cache).--Two decisions shape the rest. **Haskell owns evaluation, C owns data layout** - bulk eval state lives off the GHC heap, so large evaluations don't thrash the collector. And **`derivation` is a lazy wrapper over the eager `derivationStrict` primop** (as in Nix's `corepkgs/derivation.nix`), so referencing a package never forces its build closure.+Evaluating a package from nixpkgs, on the 24.11 revision CI pins: -## Windows-native+```console+$ NIX_PATH=nixpkgs=/path/to/nixpkgs nova-nix eval --expr \+    '(import <nixpkgs> { system = "x86_64-linux"; config = {}; overlays = []; }).hello.drvPath'+"/nix/store/gciipqhqkdlqqn803zd4a389v86ran45-hello-2.12.1.drv"+``` -| Unix assumption | How nova-nix handles it |-|---|---|-| `/nix/store` | `C:\nix\store` - every path is parameterized, never hardcoded |-| `fork`/`exec` | `CreateProcess` via `System.Process` |-| Symlinks | Developer-mode symlinks, with junction / copy fallback |-| 260-char path limit | `\\?\` extended-length prefixes |-| A system `bash` | the builder ships `bash.exe` in the store (MSYS2) |+Building GNU Hello on Windows, from the unpacked release directory: -## Roadmap+```console+> bin\nova-nix build pkgs\windows\hello.nix+...+C:\nix\store\<hash>-hello+> C:\nix\store\<hash>-hello\bin\hello.exe+Hello, world!+``` -**Done** - parser, lazy bytecode evaluator, the Nix `builtins` set, the C99 data layer, content-addressed store, derivation builder, binary-cache substituter and `push`, `import <nixpkgs> {}` evaluation, derivation-hash parity with upstream Nix (`hello`'s 253-derivation closure byte-matches `nix-instantiate`), and native Windows builds from a store-pinned MinGW-w64 toolchain (stage 0), published to and substituted from a binary cache.+The first build fetches 40 pinned archives (the 39 toolchain packages and the+Hello source), then builds the MSYS2 seed, the MinGW-w64 seed and Hello. -**In progress** - an experimental stage-1 stdenv: a store-pinned MSYS2 userland seed and a lean `setup.sh` + `mkDerivation`, so a package builds from just `{ name; src; }`. It wires inter-package dependencies (`buildInputs`), routes compilation through a `gcc` wrapper (hermetic flags, deterministic links), and bundles non-system DLLs so outputs run standalone. Proven by building GNU hello, GNU sed, and zlib from source, and by linking a program against a library built the same way.+## How it works -**Next**+- **Parser** (`Nix.Parser`): a hand-written recursive-descent parser for the+  Nix 2.24 language.+- **Evaluator** (`Nix.Eval`): the AST compiles to a small bytecode that a lazy+  evaluator runs, memoizing thunks and detecting infinite recursion. The+  evaluator is generic over `MonadEval`, with a pure instance for tests and an+  IO instance for real evaluation. `derivation` is a lazy wrapper over the+  strict `derivationStrict` primop, as in upstream's+  `src/libexpr/primops/derivation.nix`, so referring to a package does not+  force its build closure.+- **Data layer** (`cbits/`): attribute sets, lists, thunks, environments,+  symbols, context strings, lambdas and bytecode are C99 structures outside+  the GHC heap, freed together when an evaluation session ends. Haskell calls+  into C, and C never calls back.+- **Store** (`Nix.Store`): a content-addressed store at `/nix/store`, or+  `C:\nix\store` on Windows, with SQLite metadata, reference scanning and+  per-path locks that follow upstream's protocol.+- **Builder** (`Nix.Builder`): orders derivations by their dependencies, tries+  substitution first, and runs each builder in a scrubbed environment.+- **Substituter** (`Nix.Substituter`): the HTTP binary-cache protocol, with+  Ed25519 signature checks and xz, zstd and bzip2 decompression, built on+  [nova-cache](https://github.com/Novavero-AI/nova-cache). -- Grow the native package set - more real-world libraries and programs built from source through the stdenv.-- Parity across more of nixpkgs - extend the byte-match check beyond `hello`'s closure.-- Cache - serve large NARs from object storage, and compress them.+On Windows, derivations keep the canonical `/nix/store` spelling that hashes+are computed over, and it is mapped to the real store directory only when a+builder is started. NTFS has no executable bit, so nova-nix keeps it in an+alternate data stream. A store path therefore serializes to the same NAR, with+the same hash, as it does on other platforms. -## Library usage+## Library  ```haskell-import Nix.Parser (parseNix)-import Nix.Eval (PureEval (..), eval)+{-# LANGUAGE OverloadedStrings #-}++import Control.Exception (bracket_) import Nix.Builtins (builtinEnv)+import Nix.Eval (eval, runPureEval)+import Nix.Eval.Arena (arenaDestroy, arenaInit)+import Nix.Parser (parseNix)  main :: IO ()-main = case parseNix "<expr>" "let x = 5; in x * 2 + 1" of-  Left err   -> print err-  Right expr -> print (runPureEval (eval (builtinEnv 0 []) expr))  -- Right (VInt 11)+main = bracket_ arenaInit arenaDestroy $+  -- The first argument is what relative path literals resolve against.+  case parseNix "/tmp" "<expr>" "let x = 5; in x * 2 + 1" of+    Left err -> print err+    Right expr -> print (runPureEval (eval (builtinEnv 0 []) expr)) ``` -The evaluator is polymorphic over `MonadEval`: `PureEval` for deterministic tests, `EvalIO` for filesystem access.+This prints `Right (VInt 11)`. Evaluation needs the C data layer, so it must+run between `arenaInit` and `arenaDestroy`. -## Build & test+## Building from source +Tested with GHC 9.14.1. CI uses the latest cabal-install release. You only+need this to work on nova-nix itself, not to use a release.+ ```bash+git clone https://github.com/Novavero-AI/nova-nix.git+cd nova-nix+cabal update cabal build cabal test ``` -Requires GHC 9.8+ and cabal-install 3.10+.+## Contributing ----+See [CONTRIBUTING.md](CONTRIBUTING.md). Planned work is on the+[Nova roadmap](https://github.com/orgs/Novavero-AI/projects/1) project. Please+report security issues privately through+[GitHub's vulnerability reporting](https://github.com/Novavero-AI/nova-nix/security/advisories/new)+rather than in a public issue. -<p align="center"><sub>Apache-2.0 - <a href="https://github.com/Novavero-AI">Novavero AI Inc.</a></sub></p>+## License++Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).++[#24]: https://github.com/Novavero-AI/nova-nix/issues/24+[#25]: https://github.com/Novavero-AI/nova-nix/issues/25+[#26]: https://github.com/Novavero-AI/nova-nix/issues/26+[#29]: https://github.com/Novavero-AI/nova-nix/issues/29

@@ -1,47 +1,49 @@--- | nova-nix CLI entry point.------ Commands:------ @--- nova-nix eval  FILE.nix                  Evaluate a .nix file, print result--- nova-nix eval  --expr 'EXPR'             Evaluate an inline expression--- nova-nix build FILE.nix                  Build a derivation from a .nix file--- nova-nix push  --cache URL --all         Push store paths to a binary cache--- @------ Flags:+{-# LANGUAGE ScopedTypeVariables #-}++-- | nova-nix CLI entry point: parse the argument vector, dispatch one+-- command, map its outcome to an exit code. ----- @--- --nix-path NAME=PATH   Add a search path entry (repeatable, merged with NIX_PATH)--- --expr EXPR            Evaluate an inline expression instead of a file--- @+-- The command and flag tables are deliberately not repeated here.+-- 'usageLines' is the one place they live, and both @--help@ and the+-- usage-error path print it, so the flag that adds itself to the parser+-- documents itself in the same edit.  A second copy in this header went+-- nine flags and two commands stale before anyone noticed, because+-- nothing renders it: Haddock builds library targets by default, and+-- this module is in the executable stanza. module Main (main) where +import Control.Exception (IOException, displayException, try) import Control.Monad (void, (>=>))+import qualified Data.ByteString as BS+import qualified Data.ByteString.Char8 as BC import Data.IORef (readIORef) import qualified Data.Map.Strict as Map import Data.Maybe (catMaybes) import qualified Data.Text as T+import qualified Data.Text.Encoding as TE import qualified Data.Text.IO as TIO-import Nix.Builder (BuildConfig (..), BuildResult (..), buildWithDeps, defaultBuildConfig)+import Data.Version (showVersion)+import Nix.Builder (BuildConfig (..), BuildResult (..), buildWithDeps, defaultBuildConfig, execWrapperConfig) import Nix.Builtins (builtinEnv, parseNixPath)+import Nix.Config (NixConfig (..))+import qualified Nix.Config as Config import Nix.Derivation (Derivation (..), DerivationOutput (..), toATerm) import Nix.Eval (MonadEval, NixValue (..), Thunk (..), attrSetFromMap, attrSetLookup, attrSetToAscList, attrSetToMap, eval, evaluated, force, readThunkValue) import Nix.Eval.Arena (arenaInit)+import Nix.Eval.AttrPath (selectAttrPath) import Nix.Eval.IO (EvalState (..), newEvalState, runEvalIO)-import Nix.Eval.Types (clistFromThunks, clistThunks, thunkToCPtr)+import Nix.Eval.Types (bytesToTextLossy, clistFromThunks, clistThunks, thunkToCPtr) import Nix.Parser (parseNix, readFileAutoEncoding)-import Nix.Push (PushConfig (..), PushSummary (..), loadApiKeyFile, pushPaths)-import Nix.Store (Store (..), closeStore, isValid, openStore, queryAllValidPaths, registerPaths, registrationFor, setReadOnly, writeDrv, writeDrvAterm)-import Nix.Store.Path (StoreDir (..), StorePath (..), defaultStoreDir, parseStorePath, platformStoreDir, storePathHashLen, storePathToFilePath)+import Nix.Push (PushCompression (..), PushConfig (..), PushSummary (..), loadApiKeyFile, parsePushCompression, pushCompressionValues, pushPaths)+import Nix.Store (DeleteOutcome (..), Store (..), closeStore, deleteStorePathRaw, materializeEvalSources, materializeEvalStoreWrites, openStore, queryAllValidPaths, resolveDeleteTarget, writeDrv, writeDrvClosure)+import Nix.Store.Path (StoreDir (..), StorePath, defaultStoreDir, parseStorePath, parseStorePathBaseName, platformStoreDir, storePathToFilePath) import Nix.Substituter (CacheConfig (..))-import Paths_nova_nix (getDataDir)-import System.Directory (canonicalizePath, copyFile, createDirectoryIfMissing, doesDirectoryExist, getCurrentDirectory, getTemporaryDirectory, listDirectory)-import System.Environment (getArgs)+import Paths_nova_nix (getDataDir, version)+import System.Directory (Permissions (executable), XdgDirectory (XdgConfig), canonicalizePath, doesFileExist, findExecutable, getCurrentDirectory, getPermissions, getTemporaryDirectory, getXdgDirectory)+import System.Environment (getArgs, getExecutablePath, lookupEnv) import System.Exit (exitFailure)-import System.FilePath (takeDirectory)-import qualified System.FilePath as FP-import System.IO (BufferMode (..), hPutStrLn, hSetBuffering, stderr, stdout)+import System.FilePath (takeDirectory, takeFileName, (</>))+import System.IO (BufferMode (..), hPutStrLn, hSetBuffering, hSetEncoding, stderr, stdout, utf8)  -- --------------------------------------------------------------------------- -- Argument parsing@@ -58,32 +60,69 @@     optSubstituter :: !(Maybe String),     -- | Trusted public key (@name:base64@) for the substituter.     optTrustedKey :: !(Maybe String),+    -- | @SYSTEM=PATH@ launchers for derivations this machine cannot execute+    -- directly, e.g. @x86_64-windows=/path/to/wine@.+    optExecWrappers :: ![String],     optCommand :: !Command   }  data Command   = CmdEvalFile !FilePath   | CmdEvalExpr !T.Text-  | CmdBuild !FilePath+  | CmdBuild !BuildTarget !(Maybe T.Text)   | CmdPush !PushArgs-  | CmdHelp+  | CmdStoreDelete ![String]+  | -- | No command given.  Usage on stderr, non-zero: a bare invocation is+    -- a usage error, and a caller testing the exit status must see one.+    CmdUsage+  | -- | @--help@.  The same text on stdout, zero: it is a request that+    -- succeeded, and pipeable without redirecting stderr.+    CmdHelp+  | CmdVersion +-- | Where a build's expression comes from.+data BuildTarget+  = -- | A @.nix@ file.  Relative paths inside it resolve beside the file.+    TargetFile !FilePath+  | -- | An inline expression.  Relative paths inside it resolve against the+    -- working directory, since there is no file to sit beside.+    TargetExpr !T.Text++-- | Arguments to the build command, while the target is still unknown.+data BuildArgs = BuildArgs+  { baTarget :: !(Maybe BuildTarget),+    baAttrPath :: !(Maybe T.Text)+  }++-- | Build arguments before any flag is parsed.+emptyBuildArgs :: BuildArgs+emptyBuildArgs = BuildArgs Nothing Nothing+ -- | Arguments to the push command. data PushArgs = PushArgs   { paCacheUrl :: !(Maybe String),     paKeyFile :: !(Maybe FilePath),+    paCompressionArg :: !(Maybe String),     paAll :: !Bool,     paPaths :: ![String]   }  -- | Push arguments before any flag is parsed. emptyPushArgs :: PushArgs-emptyPushArgs = PushArgs Nothing Nothing False []+emptyPushArgs = PushArgs Nothing Nothing Nothing False [] -parseArgs :: [String] -> CliOpts-parseArgs = go (CliOpts [] False False Nothing Nothing Nothing CmdHelp)+-- | Parse the command line.  A malformed invocation is an error, never a+-- silent drop: an unknown or typo'd flag once ended parsing and quietly+-- discarded everything after it (e.g. a requested @--substituter@).+parseArgs :: [String] -> Either String CliOpts+parseArgs = go (CliOpts [] False False Nothing Nothing Nothing [] CmdUsage)   where-    go opts [] = opts+    go opts [] = Right opts+    -- Answered before anything else is looked at, and the rest of the line+    -- is not parsed: --version must report the build even when the command+    -- after it is one this build does not have.+    go opts ("--version" : _) = Right opts {optCommand = CmdVersion}+    go opts ("--help" : _) = Right opts {optCommand = CmdHelp}     go opts ("--nix-path" : val : rest) =       go (opts {optNixPaths = optNixPaths opts ++ [T.pack val]}) rest     go opts ("--strict" : rest) =@@ -96,34 +135,153 @@       go (opts {optSubstituter = Just url}) rest     go opts ("--trusted-key" : key : rest) =       go (opts {optTrustedKey = Just key}) rest+    go opts ("--exec-wrapper" : spec : rest) =+      go (opts {optExecWrappers = optExecWrappers opts ++ [spec]}) rest     go opts ("eval" : rest) = goEval opts rest-    go opts ("build" : path : rest) =-      go (opts {optCommand = CmdBuild path}) rest+    go opts ("build" : rest) = goBuild opts emptyBuildArgs rest     go opts ("push" : rest) = goPush opts emptyPushArgs rest-    go opts _ = opts+    go opts ("store" : rest) = goStore opts rest+    go _ [flag]+      | flag `elem` valueFlags = Left (flag ++ " requires a value")+    go _ (arg : _) = Left ("unknown argument: " ++ arg ++ " (run nova-nix --help for usage)")     -- Sub-parser for eval: handles --strict and --expr interleaved with the file arg.-    goEval opts [] = opts+    goEval opts [] = Right opts     goEval opts ("--strict" : rest) = goEval (opts {optStrict = True}) rest     goEval opts ("--aterm" : rest) = goEval (opts {optAterm = True}) rest     goEval opts ("--nix-path" : val : rest) =       goEval (opts {optNixPaths = optNixPaths opts ++ [T.pack val]}) rest+    -- Accepted here as well as at the top level, like build and push:+    -- eval-side reads follow the selected store, so the flag means as+    -- much after the subcommand as before it.+    goEval opts ("--store" : dir : rest) =+      goEval (opts {optStore = Just dir}) rest     goEval opts ("--expr" : expr : rest) =       go (opts {optCommand = CmdEvalExpr (T.pack expr)}) rest+    goEval _ [flag]+      | flag `elem` valueFlags = Left (flag ++ " requires a value")+    goEval _ (arg@('-' : _) : _) = Left ("unknown eval flag: " ++ arg)     goEval opts (path : rest) =       go (opts {optCommand = CmdEvalFile path}) rest+    -- Sub-parser for build: the target, -A, and the shared flags in any+    -- order.  The shared flags are handled here rather than deferred back to+    -- 'go' so that one can follow the file argument, which is where a caller+    -- reaches for it, and so that -A is still recognised after it.+    goBuild opts buildArgs [] = finishBuild opts buildArgs+    -- Answered here as well as at the top level: a sub-parser that rejected+    -- them would make 'build --help' a usage error rather than a request.+    goBuild opts _ ("--help" : _) = Right opts {optCommand = CmdHelp}+    goBuild opts _ ("--version" : _) = Right opts {optCommand = CmdVersion}+    goBuild opts buildArgs ("--store" : dir : rest) =+      goBuild (opts {optStore = Just dir}) buildArgs rest+    goBuild opts buildArgs ("--substituter" : url : rest) =+      goBuild (opts {optSubstituter = Just url}) buildArgs rest+    goBuild opts buildArgs ("--trusted-key" : key : rest) =+      goBuild (opts {optTrustedKey = Just key}) buildArgs rest+    goBuild opts buildArgs ("--nix-path" : val : rest) =+      goBuild (opts {optNixPaths = optNixPaths opts ++ [T.pack val]}) buildArgs rest+    goBuild opts buildArgs ("--exec-wrapper" : spec : rest) =+      goBuild (opts {optExecWrappers = optExecWrappers opts ++ [spec]}) buildArgs rest+    goBuild opts buildArgs ("--expr" : expr : rest) =+      withTarget opts buildArgs (TargetExpr (T.pack expr)) rest+    goBuild opts buildArgs (flag : path : rest)+      | flag `elem` attrFlags = case baAttrPath buildArgs of+          Just _ -> Left "build accepts one attribute path"+          Nothing -> goBuild opts (buildArgs {baAttrPath = Just (T.pack path)}) rest+    goBuild _ _ [flag]+      | flag `elem` valueFlags = Left (flag ++ " requires a value")+    goBuild _ _ (arg@('-' : _) : _) = Left ("unknown build flag: " ++ arg)+    goBuild opts buildArgs (path : rest) =+      withTarget opts buildArgs (TargetFile path) rest+    -- A build evaluates one expression, so a second target is a mistake+    -- worth naming rather than a silent last-one-wins.+    withTarget opts buildArgs target rest = case baTarget buildArgs of+      Just _ -> Left "build takes one FILE.nix or one --expr, not both"+      Nothing -> goBuild opts (buildArgs {baTarget = Just target}) rest+    finishBuild opts buildArgs = case baTarget buildArgs of+      Nothing -> Left "build requires a FILE.nix argument or --expr EXPR"+      Just target -> Right opts {optCommand = CmdBuild target (baAttrPath buildArgs)}     -- Sub-parser for push: flags and explicit store paths in any order.-    goPush opts pushArgs [] = opts {optCommand = CmdPush pushArgs}+    goPush opts pushArgs [] = Right opts {optCommand = CmdPush pushArgs}     goPush opts pushArgs ("--store" : dir : rest) =       goPush (opts {optStore = Just dir}) pushArgs rest     goPush opts pushArgs ("--cache" : url : rest) =       goPush opts (pushArgs {paCacheUrl = Just url}) rest     goPush opts pushArgs ("--key-file" : path : rest) =       goPush opts (pushArgs {paKeyFile = Just path}) rest+    goPush opts pushArgs ("--compression" : value : rest) =+      goPush opts (pushArgs {paCompressionArg = Just value}) rest     goPush opts pushArgs ("--all" : rest) =       goPush opts (pushArgs {paAll = True}) rest+    goPush _ _ [flag]+      | flag `elem` valueFlags = Left (flag ++ " requires a value")+    goPush _ _ (arg@('-' : _) : _) = Left ("unknown push flag: " ++ arg)     goPush opts pushArgs (path : rest) =       goPush opts (pushArgs {paPaths = paPaths pushArgs ++ [path]}) rest+    -- Sub-parser for store maintenance verbs.+    goStore _ [] = Left "store: expected a subcommand (delete)"+    goStore opts ("delete" : rest) = goStoreDelete opts [] rest+    goStore _ (sub : _) = Left ("unknown store subcommand: " ++ sub ++ " (expected: delete)")+    goStoreDelete opts paths []+      | null paths = Left "store delete: name at least one store path"+      | otherwise = Right opts {optCommand = CmdStoreDelete paths}+    goStoreDelete opts paths ("--store" : dir : rest) =+      goStoreDelete (opts {optStore = Just dir}) paths rest+    goStoreDelete _ _ [flag]+      | flag `elem` valueFlags = Left (flag ++ " requires a value")+    goStoreDelete _ _ (arg@('-' : _) : _) = Left ("unknown store delete flag: " ++ arg)+    goStoreDelete opts paths (path : rest) =+      goStoreDelete opts (paths ++ [path]) rest+    -- Flags that consume the following argument as their value.+    valueFlags =+      ["--nix-path", "--store", "--substituter", "--trusted-key", "--exec-wrapper", "--expr", "--cache", "--key-file", "--compression"]+        ++ attrFlags+    -- Attribute selection, under both of upstream's spellings.+    attrFlags = ["-A", "--attr"] +-- | Upstream C++ Nix's name for this directory, so an operator who knows+-- one knows the other.+nixDataDirVar :: String+nixDataDirVar = "NIX_DATA_DIR"++-- | The environment variable carrying inline nix.conf settings, above the+-- config files and below the command line in precedence.+nixConfigVar :: String+nixConfigVar = "NIX_CONFIG"++-- | Where a release archive keeps the bundled expressions, relative to the+-- directory holding @bin@.+bundledDataSubdir :: FilePath+bundledDataSubdir = "share" </> "nova-nix"++-- | The one file a data dir must contain, used to tell a real one from a+-- directory that merely exists.+dataDirMarker :: FilePath+dataDirMarker = "nix" </> "fetchurl.nix"++-- | Locate the bundled @\<nix/*\>@ expressions.+--+-- Cabal bakes an absolute @datadir@ into the binary at configure time.  That+-- is right for a @cabal install@ on this machine and wrong for every copied+-- or downloaded one, because the path names the machine that did the build:+-- a released binary would resolve @\<nix/fetchurl.nix\>@ to a directory that+-- does not exist on the host running it.+--+-- @NIX_DATA_DIR@ wins when set, since an operator setting upstream's own+-- variable means it.  Otherwise a release layout (@bin/@ beside @share/@)+-- answers from the executable's own location, which needs no configuration+-- at all.  The Cabal path remains the fallback, so a local install is+-- unaffected.+resolveDataDir :: IO FilePath+resolveDataDir = do+  fromEnv <- lookupEnv nixDataDirVar+  case fromEnv of+    Just dir | not (null dir) -> pure dir+    _ -> do+      exeDir <- takeDirectory <$> getExecutablePath+      let bundled = takeDirectory exeDir </> bundledDataSubdir+      bundledUsable <- doesFileExist (bundled </> dataDirMarker)+      if bundledUsable then pure bundled else getDataDir+ -- | Merge --nix-path entries, bundled data dir, and NIX_PATH search paths. -- The data dir is appended last so user paths take priority. mergeSearchPaths :: [T.Text] -> FilePath -> [Thunk] -> [Thunk]@@ -137,53 +295,105 @@ main :: IO () main = do   hSetBuffering stdout LineBuffering+  -- UTF-8 on both output handles regardless of the console code page:+  -- locale encodings THROW on any character they cannot represent, so a+  -- store path or eval result containing one would otherwise abort the+  -- whole invocation mid-print on legacy Windows consoles.+  hSetEncoding stdout utf8+  hSetEncoding stderr utf8   -- Initialize C data layer (symbol interning, thunk arena, env allocator)   arenaInit   args <- getArgs-  dataDir <- getDataDir-  let opts = parseArgs args+  dataDir <- resolveDataDir+  opts <- either (failWith . T.pack) pure (parseArgs args)   case optCommand opts of-    CmdEvalFile filePath -> evalFile (optStrict opts) (optNixPaths opts) dataDir filePath+    CmdEvalFile filePath -> evalFile (chosenStoreDir opts) (optStrict opts) (optNixPaths opts) dataDir filePath     CmdEvalExpr expr-      | optAterm opts -> evalExprAterm (optNixPaths opts) dataDir expr-      | otherwise -> evalExpr (optStrict opts) (optNixPaths opts) dataDir expr-    CmdBuild filePath -> buildFile opts dataDir filePath+      | optAterm opts -> evalExprAterm (chosenStoreDir opts) (optNixPaths opts) dataDir expr+      | otherwise -> evalExpr (chosenStoreDir opts) (optStrict opts) (optNixPaths opts) dataDir expr+    CmdBuild target attrPath -> buildCommand opts dataDir target attrPath     CmdPush pushArgs -> pushCommand opts pushArgs-    CmdHelp -> do-      hPutStrLn stderr "Usage: nova-nix [--nix-path NAME=PATH] <command>"-      hPutStrLn stderr ""-      hPutStrLn stderr "Commands:"-      hPutStrLn stderr "  eval FILE.nix          Evaluate a .nix file, print result"-      hPutStrLn stderr "  eval --expr 'EXPR'     Evaluate an inline expression"-      hPutStrLn stderr "  build FILE.nix         Build a derivation from a .nix file"-      hPutStrLn stderr "  push --cache URL       Push store paths (and their closures) to a binary cache"-      hPutStrLn stderr ""-      hPutStrLn stderr "Flags:"-      hPutStrLn stderr "  --strict               Deep-force all thunks before printing (warning: OOM on large results)"-      hPutStrLn stderr "  --aterm                With eval --expr, print the derivation's .drv ATerm"-      hPutStrLn stderr "  --nix-path NAME=PATH   Add search path (repeatable, merged with NIX_PATH)"-      hPutStrLn stderr "  --all                  With push: select every valid path in the store"-      hPutStrLn stderr "  --key-file PATH        With push: file holding the cache API key"-      hPutStrLn stderr "  --store DIR            Use DIR as the store (default: the platform store)"-      hPutStrLn stderr "  --substituter URL      Try this binary cache before building"-      hPutStrLn stderr "  --trusted-key K        Public key (name:base64) for the substituter"-      exitFailure+    CmdStoreDelete paths -> storeDeleteCommand opts paths+    CmdUsage -> mapM_ (hPutStrLn stderr) usageLines >> exitFailure+    CmdHelp -> mapM_ putStrLn usageLines+    CmdVersion -> putStrLn versionLine +-- | What @--version@ reports.  Cabal's version, which is the one the publish+-- workflow's tag guard checks a tag against, so a downloaded binary names+-- exactly the release it came from and a bug report can say which build.+versionLine :: String+versionLine = "nova-nix " <> showVersion version++-- | The usage text, returned rather than printed: a bare invocation is a+-- usage error (stderr, non-zero) while @--help@ is a request that succeeded+-- (stdout, zero), and the words are the same either way.+usageLines :: [String]+usageLines =+  [ "Usage: nova-nix [--nix-path NAME=PATH] <command>",+    "",+    "Commands:",+    "  eval FILE.nix          Evaluate a .nix file, print result",+    "  eval --expr 'EXPR'     Evaluate an inline expression",+    "  build FILE.nix         Build a derivation from a .nix file",+    "  build --expr 'EXPR'    Build a derivation from an inline expression",+    "  push --cache URL       Push store paths (and their closures) to a binary cache",+    "  store delete PATH...   Remove store paths, refused while other valid paths reference them",+    "",+    "Flags:",+    "  --strict               Deep-force all thunks before printing (warning: OOM on large results)",+    "  --aterm                With eval --expr, print the derivation's .drv ATerm",+    "  -A, --attr ATTRPATH    With build: select a dotted attribute path (a.b.c)",+    "  --nix-path NAME=PATH   Add search path (repeatable, merged with NIX_PATH)",+    "  --all                  With push: select every valid path in the store",+    "  --key-file PATH        With push: file holding the cache API key",+    "  --compression KIND     With push: artifact packaging (" <> T.unpack pushCompressionValues <> "; default none)",+    "  --exec-wrapper S=PATH  Run system S's derivations through PATH (repeatable),",+    "                         e.g. --exec-wrapper x86_64-windows=/usr/bin/wine",+    "  --store DIR            Use DIR as the store (default: the platform store)",+    "  --substituter URL      Try this binary cache before building",+    "  --trusted-key K        Public key (name:base64) for the substituter",+    "",+    "  substituters and trusted-public-keys also read from",+    "  $XDG_CONFIG_HOME/nix/nix.conf and $NIX_CONFIG; the flags above",+    "  add to whatever those configure.",+    "",+    "  --help                 Print this text and exit",+    "  --version              Print the version and exit"+  ]++-- | Canonicalize and read a source file.  The canonicalization matters:+-- relative path literals inside the file resolve against the file's+-- directory ('esBaseDir'), and a relative base dir would be re-prefixed on+-- every resolution (doubling it).  An unreadable argument (missing file,+-- a directory, no permission) is a clean CLI error, never an uncaught+-- exception.  Only 'IOException' is caught: an interrupt or any other+-- async exception must abort the run, not print as a read failure.+readSourceFile :: FilePath -> IO (FilePath, T.Text)+readSourceFile rawPath = do+  attempt <- try $ do+    path <- canonicalizePath rawPath+    source <- readFileAutoEncoding path+    pure (path, source)+  case attempt of+    Left (e :: IOException) ->+      failWith ("cannot read " <> T.pack rawPath <> ": " <> T.pack (displayException e))+    Right ok -> pure ok++-- | What a parse error names when the source came from @--expr@ and there is+-- no file to point at.+exprSourceName :: T.Text+exprSourceName = "<expr>"+ -- | Evaluate a .nix file and print the result.------ The file argument is canonicalized first: relative path literals inside the--- file resolve against the file's directory ('esBaseDir'), and a relative base--- dir would be re-prefixed on every resolution (doubling it).-evalFile :: Bool -> [T.Text] -> FilePath -> FilePath -> IO ()-evalFile strict extraPaths dataDir rawFilePath = do-  filePath <- canonicalizePath rawFilePath-  source <- readFileAutoEncoding filePath-  case parseNix (T.pack filePath) source of+evalFile :: StoreDir -> Bool -> [T.Text] -> FilePath -> FilePath -> IO ()+evalFile storeDir strict extraPaths dataDir rawFilePath = do+  (filePath, source) <- readSourceFile rawFilePath+  case parseNix (takeDirectory filePath) (T.pack filePath) source of     Left err -> do       hPutStrLn stderr ("parse error: " ++ show err)       exitFailure     Right expr -> do-      st0 <- newEvalState (takeDirectory filePath)+      st0 <- newEvalState storeDir (takeDirectory filePath)       let searchPaths = mergeSearchPaths extraPaths dataDir (esSearchPaths st0)           st = st0 {esSearchPaths = searchPaths}       result <-@@ -196,15 +406,15 @@         Right forced -> TIO.putStrLn (prettyValue forced)  -- | Evaluate an inline expression and print the result.-evalExpr :: Bool -> [T.Text] -> FilePath -> T.Text -> IO ()-evalExpr strict extraPaths dataDir source = do-  case parseNix "<expr>" source of+evalExpr :: StoreDir -> Bool -> [T.Text] -> FilePath -> T.Text -> IO ()+evalExpr storeDir strict extraPaths dataDir source = do+  cwd <- getCurrentDirectory+  case parseNix cwd exprSourceName source of     Left err -> do       hPutStrLn stderr ("parse error: " ++ show err)       exitFailure     Right expr -> do-      cwd <- getCurrentDirectory-      st0 <- newEvalState cwd+      st0 <- newEvalState storeDir cwd       let searchPaths = mergeSearchPaths extraPaths dataDir (esSearchPaths st0)           st = st0 {esSearchPaths = searchPaths}       result <-@@ -218,25 +428,20 @@  -- | Evaluate an inline expression to a derivation and print its ATerm (.drv -- contents), for diffing nova-nix's serialization against upstream Nix.-evalExprAterm :: [T.Text] -> FilePath -> T.Text -> IO ()-evalExprAterm extraPaths dataDir source =-  case parseNix "<expr>" source of+evalExprAterm :: StoreDir -> [T.Text] -> FilePath -> T.Text -> IO ()+evalExprAterm storeDir extraPaths dataDir source = do+  cwd <- getCurrentDirectory+  case parseNix cwd exprSourceName source of     Left err -> do       hPutStrLn stderr ("parse error: " ++ show err)       exitFailure     Right expr -> do-      cwd <- getCurrentDirectory-      st0 <- newEvalState cwd+      st0 <- newEvalState storeDir cwd       let searchPaths = mergeSearchPaths extraPaths dataDir (esSearchPaths st0)           st = st0 {esSearchPaths = searchPaths}       result <- runEvalIO st $ do         val <- eval (builtinEnv (esTimestamp st) searchPaths) expr-        case val of-          VAttrs attrs ->-            mapM_-              (\k -> maybe (pure ()) (void . force) (attrSetLookup k attrs))-              ["_derivation", "drvPath"]-          _ -> pure ()+        forceDerivationAttrs val         pure val       case result of         Left err -> do@@ -244,51 +449,86 @@           exitFailure         Right val -> do           (drv, _) <- extractDerivation val-          TIO.putStrLn (toATerm drv)+          -- Raw ATerm bytes (BC.putStrLn bypasses the handle encoding),+          -- so the printed .drv diffs byte-exactly against upstream's.+          BC.putStrLn (toATerm drv)  -- | Parse, evaluate, extract derivation, build, and print result. -- The file argument is canonicalized for the same reason as in 'evalFile'.-buildFile :: CliOpts -> FilePath -> FilePath -> IO ()-buildFile opts dataDir rawFilePath = do-  caches <- either failWith pure (substituterConfig (optSubstituter opts) (optTrustedKey opts))-  filePath <- canonicalizePath rawFilePath-  source <- readFileAutoEncoding filePath-  case parseNix (T.pack filePath) source of+-- | Where a build reads its expression, and the directory relative paths+-- inside it resolve against.+loadBuildSource :: BuildTarget -> IO (FilePath, T.Text, T.Text)+loadBuildSource (TargetFile rawFilePath) = do+  (filePath, source) <- readSourceFile rawFilePath+  pure (takeDirectory filePath, T.pack filePath, source)+loadBuildSource (TargetExpr source) = do+  cwd <- getCurrentDirectory+  pure (cwd, exprSourceName, source)++-- | Force the attributes 'extractDerivation' goes on to read.  @derivation@+-- is a lazy wrapper, and 'readThunkValue' answers 'Nothing' for a thunk that+-- was never forced, so skipping this reports a real derivation as not one.+forceDerivationAttrs :: (MonadEval m) => NixValue -> m ()+forceDerivationAttrs val = case val of+  VAttrs attrs ->+    mapM_+      (\k -> maybe (pure ()) (void . force) (attrSetLookup k attrs))+      derivationAttrKeys+  _ -> pure ()++-- | What a build needs forced: the marker, the wrapper, and the path whose+-- closure the build driver writes.+derivationAttrKeys :: [T.Text]+derivationAttrKeys = ["type", "_derivation", "drvPath"]++buildCommand :: CliOpts -> FilePath -> BuildTarget -> Maybe T.Text -> IO ()+buildCommand opts dataDir target attrPath = do+  let storeDir = chosenStoreDir opts+  configSources <- loadConfigSources+  caches <- either failWith pure (resolveCaches configSources (optSubstituter opts) (optTrustedKey opts))+  wrappers <- either failWith pure (execWrapperConfig (optExecWrappers opts)) >>= checkExecWrappers+  (baseDir, sourceName, source) <- loadBuildSource target+  case parseNix baseDir sourceName source of     Left err -> do       hPutStrLn stderr ("parse error: " ++ show err)       exitFailure     Right expr -> do-      st0 <- newEvalState (takeDirectory filePath)+      st0 <- newEvalState storeDir baseDir       let searchPaths = mergeSearchPaths (optNixPaths opts) dataDir (esSearchPaths st0)           st = st0 {esSearchPaths = searchPaths}       result <- runEvalIO st $ do-        val <- eval (builtinEnv (esTimestamp st) searchPaths) expr-        -- 'derivation' is a lazy wrapper now; force the attrs extractDerivation-        -- reads (a build legitimately needs the drvPath + closure).-        case val of-          VAttrs attrs ->-            mapM_-              (\k -> maybe (pure ()) (void . force) (attrSetLookup k attrs))-              ["_derivation", "drvPath"]-          _ -> pure ()-        pure val+        root <- eval (builtinEnv (esTimestamp st) searchPaths) expr+        selected <- case attrPath of+          Nothing -> pure (Right root)+          Just path -> selectAttrPath path root+        -- Forced after selection, not before: forcing the root leaves the+        -- selected value's own attributes unforced, and extractDerivation+        -- then reports a real derivation as not being one.+        either (pure . Left) (\val -> Right val <$ forceDerivationAttrs val) selected       case result of         Left err -> do           TIO.hPutStrLn stderr ("eval error: " <> err)           exitFailure-        Right val -> do+        Right (Left selectionErr) -> do+          TIO.hPutStrLn stderr ("error: " <> selectionErr)+          exitFailure+        Right (Right val) -> do           (drv, drvSP) <- extractDerivation val           -- The full .drv closure (root + every transitive input) recorded           -- during evaluation; written to the store before building.           drvClosure <- readIORef (esDrvClosure st)           sourceCache <- readIORef (esSourcePathCache st)+          storeWrites <- readIORef (esStoreWriteCache st)           store <- openStore (chosenStoreDir opts)           -- Materialize eval-coerced source paths (src = ./file, path           -- interpolation): evaluation computes their store paths as text           -- only - the parity runner's store is not writable - so the build           -- driver performs the copy and registration.           materializeEvalSources store sourceCache-          buildResult <- buildAndRegister store caches drvClosure drv drvSP+          -- builtins.toFile wrote these during evaluation but could not+          -- register them; a derivation naming one needs them valid first.+          materializeEvalStoreWrites store storeWrites+          buildResult <- buildAndRegister store caches wrappers drvClosure drv drvSP           closeStore store           case buildResult of             BuildSuccess sp ->@@ -309,7 +549,6 @@     _ -> do       hPutStrLn stderr "error: result is not a derivation (no type = \"derivation\")"       exitFailure-  -- Extract the Derivation struct from _derivation   drv <- case attrSetLookup "_derivation" attrs of     Just thunk | Just (VDerivation d) <- readThunkValue thunk -> pure d     _ -> do@@ -317,12 +556,16 @@       exitFailure   -- Extract drvPath - this is the store path of the .drv file itself,   -- computed by hashing the ATerm serialization during evaluation.+  -- Store paths are ASCII, so the byte payload decodes strictly.   drvSP <- case attrSetLookup "drvPath" attrs of-    Just thunk | Just (VStr path _) <- readThunkValue thunk -> case parseStorePath defaultStoreDir path of-      Just sp -> pure sp-      Nothing -> do-        TIO.hPutStrLn stderr ("error: invalid drvPath: " <> path)-        exitFailure+    Just thunk+      | Just (VStr pathBytes _) <- readThunkValue thunk,+        Right path <- TE.decodeUtf8' pathBytes ->+          case parseStorePath defaultStoreDir path of+            Just sp -> pure sp+            Nothing -> do+              TIO.hPutStrLn stderr ("error: invalid drvPath: " <> path)+              exitFailure     _ -> do       hPutStrLn stderr "error: derivation result missing drvPath"       exitFailure@@ -335,31 +578,91 @@ chosenStoreDir :: CliOpts -> StoreDir chosenStoreDir opts = maybe platformStoreDir StoreDir (optStore opts) --- | Default priority for a CLI-configured substituter (cache.nixos.org is 40).+-- | Default priority for a config- or CLI-configured substituter+-- (cache.nixos.org is 40). substituterPriority :: Int substituterPriority = 50 --- | Build the cache list from @--substituter@\/@--trusted-key@.  Both or--- neither: a substituter without a trusted key would skip signature--- verification, and a key without a substituter is a mistake.-substituterConfig :: Maybe String -> Maybe String -> Either T.Text [CacheConfig]-substituterConfig Nothing Nothing = Right []-substituterConfig Nothing (Just _) = Left "--trusted-key requires --substituter"-substituterConfig (Just _) Nothing = Left "--substituter requires --trusted-key (name:base64)"-substituterConfig (Just url) (Just key) =-  Right-    [ CacheConfig-        { ccUrl = T.dropWhileEnd (== '/') (T.pack url),-          ccPublicKey = T.pack key,-          ccPriority = substituterPriority-        }-    ]+-- | Turn resolved settings into the cache list.  One 'CacheConfig' per+-- substituter, each carrying the whole trusted-key set: upstream's keys+-- are not bound to a substituter, so a narinfo from any cache is accepted+-- by any trusted key.  A substituter with no trusted key anywhere is not+-- refused here (it simply accepts nothing at the signature gate), matching+-- upstream, where @substituters@ and @trusted-public-keys@ are independent.+configToCaches :: NixConfig -> [CacheConfig]+configToCaches config =+  [ CacheConfig+      { ccUrl = T.dropWhileEnd (== '/') url,+        ccPublicKeys = ncTrustedPublicKeys config,+        ccPriority = substituterPriority+      }+  | url <- ncSubstituters config+  ] +-- | Resolve the caches from the config sources plus the CLI flags.  The+-- sources are ordered weakest first (user file, then @NIX_CONFIG@); the+-- CLI @--substituter@ and @--trusted-key@ append on top, the highest+-- precedence, so a flag adds to the configured set rather than being+-- overridden by it.+resolveCaches :: [T.Text] -> Maybe String -> Maybe String -> Either T.Text [CacheConfig]+resolveCaches sources mUrl mKey = do+  base <- Config.resolveConfig sources+  let withCli =+        base+          { ncSubstituters = ncSubstituters base ++ maybe [] (\url -> [T.pack url]) mUrl,+            ncTrustedPublicKeys = ncTrustedPublicKeys base ++ maybe [] (\key -> [T.pack key]) mKey+          }+  pure (configToCaches withCli)++-- | The nix.conf sources, weakest first: the user file, then @NIX_CONFIG@.+-- Reading is best effort - a missing or unreadable file is simply absent -+-- but a file that IS read and does not parse is a hard error downstream,+-- so a malformed security-relevant setting cannot pass for no setting.+loadConfigSources :: IO [T.Text]+loadConfigSources = do+  userFile <- readUserConfigFile+  nixConfigEnv <- lookupEnv nixConfigVar+  pure (catMaybes [userFile, T.pack <$> nixConfigEnv])++-- | Read @$XDG_CONFIG_HOME\/nix\/nix.conf@ (the user config file), or+-- 'Nothing' when it is absent or unreadable.+readUserConfigFile :: IO (Maybe T.Text)+readUserConfigFile = do+  dir <- getXdgDirectory XdgConfig "nix"+  let path = dir </> "nix.conf"+  present <- doesFileExist path+  if not present+    then pure Nothing+    else do+      result <- try (BS.readFile path) :: IO (Either IOException BS.ByteString)+      pure (either (const Nothing) (Just . TE.decodeUtf8Lenient) result)++-- | Resolve every launcher before any building starts, so a typo'd path is+-- a configuration error now rather than a build failure after the whole+-- closure has been realized.  A bare name resolves through @PATH@, the way+-- a shell would; anything else has to be an executable file where it says.+checkExecWrappers :: Map.Map T.Text FilePath -> IO (Map.Map T.Text FilePath)+checkExecWrappers = Map.traverseWithKey check+  where+    check system path+      | path == takeFileName path =+          findExecutable path+            >>= maybe (failWith ("--exec-wrapper " <> system <> ": " <> T.pack path <> " is not on PATH")) pure+      | otherwise = do+          there <- doesFileExist path+          if not there+            then failWith ("--exec-wrapper " <> system <> ": " <> T.pack path <> " does not exist")+            else do+              perms <- getPermissions path+              if executable perms+                then pure path+                else failWith ("--exec-wrapper " <> system <> ": " <> T.pack path <> " is not executable")+ -- | Write the .drv file to the store and build with dependency resolution. -- The drvPath is the store path of the .drv file itself, extracted from -- the evaluation result alongside the Derivation struct.-buildAndRegister :: Store -> [CacheConfig] -> Map.Map T.Text T.Text -> Derivation -> StorePath -> IO BuildResult-buildAndRegister store caches drvClosure drv drvSP = do+buildAndRegister :: Store -> [CacheConfig] -> Map.Map T.Text FilePath -> Map.Map T.Text BS.ByteString -> Derivation -> StorePath -> IO BuildResult+buildAndRegister store caches wrappers drvClosure drv drvSP = do   -- Materialize the full input-.drv closure (every transitive dependency's   -- recipe) to the store.  buildWithDeps reads these back to construct the   -- dependency graph; without them it cannot realize any non-leaf derivation.@@ -372,7 +675,8 @@   let config =         (defaultBuildConfig (stDir store))           { bcTmpDir = tmpDir,-            bcCaches = caches+            bcCaches = caches,+            bcExecWrappers = wrappers           }   buildWithDeps config store drv drvSP @@ -395,6 +699,9 @@     Just path -> do       loaded <- loadApiKeyFile path       either failWith (pure . Just) loaded+  compression <- case paCompressionArg pushArgs of+    Nothing -> pure PushNone+    Just value -> either (failWith . ("push: " <>)) pure (parsePushCompression (T.pack value))   store <- openStore (chosenStoreDir opts)   rootsResult <- resolvePushRoots store pushArgs   case rootsResult of@@ -402,7 +709,7 @@       closeStore store       failWith err     Right roots -> do-      result <- pushPaths (PushConfig cacheUrl apiKey) store roots+      result <- pushPaths (PushConfig cacheUrl apiKey compression) store roots       closeStore store       case result of         Left err -> failWith ("push failed: " <> err)@@ -415,6 +722,32 @@                 <> " already cached"             ) +-- | Delete store paths: registration rows and on-disk trees.  Paths are+-- processed in argument order and the first failure stops the run, so a+-- reference chain deletes leaf-first in one invocation.+storeDeleteCommand :: CliOpts -> [String] -> IO ()+storeDeleteCommand opts rawPaths = do+  store <- openStore (chosenStoreDir opts)+  result <- deleteEach store rawPaths+  closeStore store+  either failWith pure result+  where+    deleteEach _ [] = pure (Right ())+    deleteEach store (raw : rest) =+      case resolveDeleteTarget (stDir store) (T.pack raw) of+        Left err -> pure (Left ("store delete: " <> err))+        Right basename -> do+          outcome <- deleteStorePathRaw store basename+          case outcome of+            Left err -> pure (Left ("store delete: " <> err))+            Right removed -> do+              TIO.putStrLn ("deleted " <> basename <> describeOutcome removed)+              deleteEach store rest+    describeOutcome removed+      | doRowRemoved removed && doTreeRemoved removed = ""+      | doRowRemoved removed = " (no tree on disk)"+      | otherwise = " (unregistered tree)"+ -- | Resolve push roots: every valid path with @--all@, otherwise each named -- path.  Named paths may be full store paths in either store-dir form, or a -- bare @hash-name@ basename.@@ -425,25 +758,24 @@       pure (traverse parseDbPath pathTexts)   | otherwise = pure (traverse parseArgPath (paPaths pushArgs))   where+    -- DB rows are rendered with the OPENED store's dir - parsing against+    -- platformStoreDir made 'push --all --store DIR' fail on every row of+    -- a non-default store.     parseDbPath txt =-      maybe (Left ("unparseable store DB path: " <> txt)) Right (parseStorePath platformStoreDir txt)+      maybe (Left ("unparseable store DB path: " <> txt)) Right (parseStorePath (stDir store) txt)     parseArgPath raw =       let txt = T.pack raw           attempts =-            [ parseStorePath platformStoreDir txt,+            [ parseStorePath (stDir store) txt,+              parseStorePath platformStoreDir txt,               parseStorePath defaultStoreDir txt,-              parseBareBasename txt+              -- A bare basename passes the same charset gate as every+              -- other spelling: push targets are real store paths.+              parseStorePathBaseName txt             ]        in case catMaybes attempts of             (sp : _) -> Right sp             [] -> Left ("not a store path: " <> txt)-    parseBareBasename txt-      | T.length txt >= storePathHashLen + 2,-        (hashPart, rest) <- T.splitAt storePathHashLen txt,-        Just ('-', name) <- T.uncons rest,-        not (T.null name) =-          Just (StorePath hashPart name)-      | otherwise = Nothing  -- | Print an error to stderr and exit. failWith :: T.Text -> IO a@@ -451,51 +783,6 @@   TIO.hPutStrLn stderr msg   exitFailure --- | Copy eval-coerced source paths into the store and register them.  The--- evaluator's source-path cache maps each coerced filesystem path to its--- @source@ fixed-output store path (text only - eval performs no store--- writes).  Each entry not already valid is copied in, made read-only, and--- registered with its real NAR hash.  A copied source carries no references.-materializeEvalSources :: Store -> Map.Map T.Text T.Text -> IO ()-materializeEvalSources store sourceCache = do-  regs <- catMaybes <$> mapM adopt (Map.toList sourceCache)-  registerPaths (stDB store) regs-  where-    adopt (rawPath, spText) =-      case parseStorePath defaultStoreDir spText of-        Nothing -> pure Nothing-        Just sp -> do-          valid <- isValid store sp-          if valid-            then pure Nothing-            else do-              let dest = storePathToFilePath (stDir store) sp-              copyPathInto (T.unpack rawPath) dest-              setReadOnly dest-              Just <$> registrationFor store sp Nothing []---- | Recursively copy a file or directory tree to a destination path.-copyPathInto :: FilePath -> FilePath -> IO ()-copyPathInto src dest = do-  isDir <- doesDirectoryExist src-  if isDir-    then do-      createDirectoryIfMissing True dest-      names <- listDirectory src-      mapM_ (\name -> copyPathInto (src FP.</> name) (dest FP.</> name)) names-    else copyFile src dest---- | Write every recorded @.drv@ ATerm (keyed by its store-path text) to the--- store.  Keys come from evaluation via 'storePathToText' so they always parse;--- an unparseable key is skipped defensively.-writeDrvClosure :: Store -> Map.Map T.Text T.Text -> IO ()-writeDrvClosure store = mapM_ writeOne . Map.toList-  where-    writeOne (pathText, aterm) =-      case parseStorePath defaultStoreDir pathText of-        Just sp -> writeDrvAterm store sp aterm-        Nothing -> pure ()- -- --------------------------------------------------------------------------- -- Output formatting -- ---------------------------------------------------------------------------@@ -532,14 +819,14 @@ prettyValue (VBool True) = "true" prettyValue (VBool False) = "false" prettyValue VNull = "null"-prettyValue (VStr s _) = "\"" <> escapeNixString s <> "\""+prettyValue (VStr s _) = "\"" <> escapeNixString (bytesToTextLossy s) <> "\"" prettyValue (VPath p) = p prettyValue (VList cl) =-  "[ " <> T.intercalate " " (map (prettyThunk . Thunk) (clistThunks cl)) <> " ]"+  wrapNixSeq "[" "]" (map (prettyThunk . Thunk) (clistThunks cl)) prettyValue (VAttrs attrs) =   let entries = attrSetToAscList attrs       rendered = map (\(k, t) -> k <> " = " <> prettyThunk t <> ";") entries-   in "{ " <> T.intercalate " " rendered <> " }"+   in wrapNixSeq "{" "}" rendered prettyValue (VLambda {}) = "<lambda>" prettyValue (VBuiltin name _) = "<builtin " <> name <> ">" prettyValue (VCompiledRegex _) = "<compiled-regex>"@@ -547,6 +834,14 @@   case drvOutputs drv of     (out : _) -> "<derivation " <> T.pack (storePathToFilePath platformStoreDir (doPath out)) <> ">"     [] -> "<derivation>"++-- | Render a bracketed sequence the way upstream prints one: the brackets are+-- separated from the contents by a space, and an empty sequence is @[ ]@ or+-- @{ }@ rather than the two spaces that a bare join of no elements leaves+-- between them.+wrapNixSeq :: T.Text -> T.Text -> [T.Text] -> T.Text+wrapNixSeq open close [] = open <> " " <> close+wrapNixSeq open close parts = open <> " " <> T.intercalate " " parts <> " " <> close  -- | Pretty-print a thunk.  After deep-forcing, all thunks should be -- computed thunks render their value; pending thunks render as a placeholder.

@@ -48,6 +48,7 @@ #define NN_OP_UNARY         21 #define NN_OP_BINARY        22 #define NN_OP_SEARCH_PATH   23+#define NN_OP_PATH_STR      24  /* --- UnaryOp flags (NN_OP_UNARY) --- */ @@ -104,7 +105,13 @@ typedef struct nn_op {     uint8_t  opcode;     /* Which Expr constructor */     uint8_t  flags;      /* Sub-type: BinaryOp, UnaryOp, formal type, etc. */-    uint16_t short_arg;  /* Small immediate: count, bool flag, etc. */+    uint16_t short_arg;  /* Small immediate: count, bool flag, etc.+                            Payload counts use a spill convention so the+                            op stays 16 bytes: 0xFFFF here means the true+                            count is the FIRST uint32 of the op's data+                            region and the payload starts one word later+                            (emit/decode live on the Haskell side:+                            Nix.Eval.CBytecode.cbcCountedPayload). */     uint32_t arg1;       /* Child index, symbol, data offset, lo32, etc. */     uint32_t arg2;       /* Child index, symbol, hi32, etc. */     uint32_t arg3;       /* Child index, data offset, etc. */@@ -122,11 +129,15 @@  /* --- Emit --- */ -/* Append one instruction.  Returns the instruction index. */+/* Append one instruction.  Returns the instruction index, or+ * UINT32_MAX when the array cannot grow (allocation failure or the+ * uint32 index ceiling) - the caller must check before using the+ * result as an index. */ uint32_t nn_bc_emit(uint8_t opcode, uint8_t flags, uint16_t short_arg,                     uint32_t arg1, uint32_t arg2, uint32_t arg3); -/* Append one uint32 to the data buffer.  Returns the data offset. */+/* Append one uint32 to the data buffer.  Returns the data offset, or+ * UINT32_MAX on failure (same contract as nn_bc_emit). */ uint32_t nn_bc_emit_data(uint32_t value);  /* --- Read instructions --- */

@@ -43,10 +43,16 @@ /* --- Lifecycle --- */  nn_ctxstr_t *-nn_ctxstr_new(uint32_t text, uint16_t ctx_count)+nn_ctxstr_new(uint32_t text, uint32_t ctx_count) {-    size_t size = sizeof(nn_ctxstr_t) + (size_t)ctx_count * sizeof(nn_sce_t);-    nn_ctxstr_t *s = (nn_ctxstr_t *)malloc(size);+    /* The count is input-reachable (it scales with the evaluated+     * expression); computing the size in uint64_t and capping it at the+     * UINT32_MAX byte limit used across the C layer keeps the malloc+     * argument from wrapping size_t on any platform. */+    uint64_t bytes64 = sizeof(nn_ctxstr_t)+                     + (uint64_t)ctx_count * sizeof(nn_sce_t);+    if (bytes64 > UINT32_MAX) return NULL;+    nn_ctxstr_t *s = (nn_ctxstr_t *)malloc((size_t)bytes64);     if (!s) return NULL;     s->text = text;     s->ctx_count = ctx_count;@@ -70,11 +76,16 @@  /* --- Element setters --- */ +/* Element bounds stay live under NDEBUG: the fill index derives from+ * input-sized data crossing the FFI, so a violated bound must drop the+ * write, not run past the sized array. */+ void-nn_ctxstr_set_plain(nn_ctxstr_t *s, uint16_t idx,+nn_ctxstr_set_plain(nn_ctxstr_t *s, uint32_t idx,                     uint32_t sp_hash, uint32_t sp_name) {-    NN_ASSERT(idx < s->ctx_count, "nn_ctxstr_set_plain: idx out of bounds");+    NN_ASSERT(s != NULL && idx < s->ctx_count, "nn_ctxstr_set_plain: idx out of bounds");+    if (s == NULL || idx >= s->ctx_count) return;     s->ctx[idx].tag = NN_SCE_PLAIN;     s->ctx[idx].sp_hash = sp_hash;     s->ctx[idx].sp_name = sp_name;@@ -82,11 +93,12 @@ }  void-nn_ctxstr_set_drv_output(nn_ctxstr_t *s, uint16_t idx,+nn_ctxstr_set_drv_output(nn_ctxstr_t *s, uint32_t idx,                          uint32_t sp_hash, uint32_t sp_name,                          uint32_t output) {-    NN_ASSERT(idx < s->ctx_count, "nn_ctxstr_set_drv_output: idx out of bounds");+    NN_ASSERT(s != NULL && idx < s->ctx_count, "nn_ctxstr_set_drv_output: idx out of bounds");+    if (s == NULL || idx >= s->ctx_count) return;     s->ctx[idx].tag = NN_SCE_DRV_OUTPUT;     s->ctx[idx].sp_hash = sp_hash;     s->ctx[idx].sp_name = sp_name;@@ -94,10 +106,11 @@ }  void-nn_ctxstr_set_all_outputs(nn_ctxstr_t *s, uint16_t idx,+nn_ctxstr_set_all_outputs(nn_ctxstr_t *s, uint32_t idx,                           uint32_t sp_hash, uint32_t sp_name) {-    NN_ASSERT(idx < s->ctx_count, "nn_ctxstr_set_all_outputs: idx out of bounds");+    NN_ASSERT(s != NULL && idx < s->ctx_count, "nn_ctxstr_set_all_outputs: idx out of bounds");+    if (s == NULL || idx >= s->ctx_count) return;     s->ctx[idx].tag = NN_SCE_ALL_OUTPUTS;     s->ctx[idx].sp_hash = sp_hash;     s->ctx[idx].sp_name = sp_name;@@ -112,36 +125,43 @@     return s->text; } -uint16_t+uint32_t nn_ctxstr_ctx_count(const nn_ctxstr_t *s) {     return s->ctx_count; } +/* Element reads keep their bound live under NDEBUG (see setters);+ * a violated bound returns 0 rather than reading out of bounds. */+ uint8_t-nn_ctxstr_elem_tag(const nn_ctxstr_t *s, uint16_t idx)+nn_ctxstr_elem_tag(const nn_ctxstr_t *s, uint32_t idx) {-    NN_ASSERT(idx < s->ctx_count, "nn_ctxstr_elem_tag: idx out of bounds");+    NN_ASSERT(s != NULL && idx < s->ctx_count, "nn_ctxstr_elem_tag: idx out of bounds");+    if (s == NULL || idx >= s->ctx_count) return 0;     return s->ctx[idx].tag; }  uint32_t-nn_ctxstr_elem_hash(const nn_ctxstr_t *s, uint16_t idx)+nn_ctxstr_elem_hash(const nn_ctxstr_t *s, uint32_t idx) {-    NN_ASSERT(idx < s->ctx_count, "nn_ctxstr_elem_hash: idx out of bounds");+    NN_ASSERT(s != NULL && idx < s->ctx_count, "nn_ctxstr_elem_hash: idx out of bounds");+    if (s == NULL || idx >= s->ctx_count) return 0;     return s->ctx[idx].sp_hash; }  uint32_t-nn_ctxstr_elem_name(const nn_ctxstr_t *s, uint16_t idx)+nn_ctxstr_elem_name(const nn_ctxstr_t *s, uint32_t idx) {-    NN_ASSERT(idx < s->ctx_count, "nn_ctxstr_elem_name: idx out of bounds");+    NN_ASSERT(s != NULL && idx < s->ctx_count, "nn_ctxstr_elem_name: idx out of bounds");+    if (s == NULL || idx >= s->ctx_count) return 0;     return s->ctx[idx].sp_name; }  uint32_t-nn_ctxstr_elem_output(const nn_ctxstr_t *s, uint16_t idx)+nn_ctxstr_elem_output(const nn_ctxstr_t *s, uint32_t idx) {-    NN_ASSERT(idx < s->ctx_count, "nn_ctxstr_elem_output: idx out of bounds");+    NN_ASSERT(s != NULL && idx < s->ctx_count, "nn_ctxstr_elem_output: idx out of bounds");+    if (s == NULL || idx >= s->ctx_count) return 0;     return s->ctx[idx].output; }

@@ -44,14 +44,16 @@ } nn_sce_t;  /* A string with context.  text is an interned nn_symbol_t for the- * string content.  ctx_count is the number of context elements.+ * string content.  ctx_count is the number of context elements; it is+ * a full uint32_t because context sets scale with the evaluated+ * expression (a narrower count would wrap and undersize the array).  * ctx[] is a C99 flexible array of context elements, sorted by  * (tag, sp_hash, sp_name, output) for deterministic comparison.  *  * Single contiguous allocation: header + elements. */ typedef struct nn_ctxstr {     uint32_t    text;-    uint16_t    ctx_count;+    uint32_t    ctx_count;     nn_sce_t    ctx[]; } nn_ctxstr_t; @@ -59,8 +61,10 @@  /* Allocate a new nn_ctxstr_t with space for ctx_count elements.  * Elements are uninitialized - caller must fill via nn_ctxstr_set_*.- * Tracked globally for bulk cleanup. */-nn_ctxstr_t *nn_ctxstr_new(uint32_t text, uint16_t ctx_count);+ * Tracked globally for bulk cleanup.  Returns NULL on allocation+ * failure or if the element array size would overflow - the caller+ * must check. */+nn_ctxstr_t *nn_ctxstr_new(uint32_t text, uint32_t ctx_count);  /* Free all tracked nn_ctxstr_t allocations.  Called during arena  * teardown, after thunk iteration but before env/symbol cleanup. */@@ -68,24 +72,30 @@  /* --- Element setters --- */ -void nn_ctxstr_set_plain(nn_ctxstr_t *s, uint16_t idx,+/* idx must be < ctx_count.  A NULL struct or out-of-range idx is+ * dropped (asserts in debug builds) rather than writing out of+ * bounds - the bound stays live under NDEBUG. */++void nn_ctxstr_set_plain(nn_ctxstr_t *s, uint32_t idx,                          uint32_t sp_hash, uint32_t sp_name); -void nn_ctxstr_set_drv_output(nn_ctxstr_t *s, uint16_t idx,+void nn_ctxstr_set_drv_output(nn_ctxstr_t *s, uint32_t idx,                               uint32_t sp_hash, uint32_t sp_name,                               uint32_t output); -void nn_ctxstr_set_all_outputs(nn_ctxstr_t *s, uint16_t idx,+void nn_ctxstr_set_all_outputs(nn_ctxstr_t *s, uint32_t idx,                                uint32_t sp_hash, uint32_t sp_name);  /* --- Accessors --- */  uint32_t nn_ctxstr_text(const nn_ctxstr_t *s);-uint16_t nn_ctxstr_ctx_count(const nn_ctxstr_t *s);+uint32_t nn_ctxstr_ctx_count(const nn_ctxstr_t *s); -uint8_t  nn_ctxstr_elem_tag(const nn_ctxstr_t *s, uint16_t idx);-uint32_t nn_ctxstr_elem_hash(const nn_ctxstr_t *s, uint16_t idx);-uint32_t nn_ctxstr_elem_name(const nn_ctxstr_t *s, uint16_t idx);-uint32_t nn_ctxstr_elem_output(const nn_ctxstr_t *s, uint16_t idx);+/* Element reads with idx >= ctx_count return 0 (asserts in debug+ * builds) rather than reading out of bounds. */+uint8_t  nn_ctxstr_elem_tag(const nn_ctxstr_t *s, uint32_t idx);+uint32_t nn_ctxstr_elem_hash(const nn_ctxstr_t *s, uint32_t idx);+uint32_t nn_ctxstr_elem_name(const nn_ctxstr_t *s, uint32_t idx);+uint32_t nn_ctxstr_elem_output(const nn_ctxstr_t *s, uint32_t idx);  #endif /* NN_CTXSTR_H */

@@ -60,13 +60,20 @@ }  /* Allocate raw bytes from the page-based bump allocator.- * Returns aligned, zero-initialized memory. */+ * Returns aligned, zero-initialized memory, or NULL on overflow/OOM. */ static void * nn_env_alloc_raw(uint32_t bytes) {+    /* align_up would wrap for sizes near UINT32_MAX; such a request can+     * only be corrupt input, so fail it instead of wrapping small. */+    if (bytes > UINT32_MAX - (NN_ENV_ALIGN - 1)) return NULL;     bytes = align_up(bytes, NN_ENV_ALIGN); -    if (!g_current_page || g_current_page->used + bytes > g_current_page->capacity) {+    /* used <= capacity always holds, so capacity - used cannot underflow;+     * the additive form (used + bytes > capacity) overflows uint32_t for+     * near-4GB requests and would pass the check, then memset past the+     * end of a 256 KB page. */+    if (!g_current_page || bytes > g_current_page->capacity - g_current_page->used) {         uint32_t page_cap = bytes > NN_ENV_PAGE_SIZE ? bytes : NN_ENV_PAGE_SIZE;         struct nn_env_page *page = alloc_page(page_cap);         if (!page) return NULL;@@ -140,7 +147,7 @@ nn_env_t * nn_env_new(void **slots, uint32_t slot_count,            void *lazy_scope, nn_env_t *parent,-           void **with_scopes, uint16_t with_count)+           void **with_scopes, uint32_t with_count) {     nn_env_t *env = (nn_env_t *)nn_env_alloc_raw((uint32_t)sizeof(nn_env_t));     if (!env) return NULL;@@ -171,10 +178,12 @@ nn_env_t * nn_env_push_with(nn_env_t *base, void *scope) {-    if (base->with_count >= UINT16_MAX) return NULL;-    uint16_t new_count = base->with_count + 1;-    void **new_withs = (void **)nn_env_alloc_raw(-        (uint32_t)new_count * (uint32_t)sizeof(void *));+    /* The increment must not wrap.  Counts anywhere near this bound+     * cannot allocate anyway (the array alloc caps at UINT32_MAX+     * bytes), so this is the formal guard, not a reachable limit. */+    if (base->with_count == UINT32_MAX) return NULL;+    uint32_t new_count = base->with_count + 1;+    void **new_withs = nn_env_alloc_with_scopes(new_count);     if (!new_withs) return NULL;      /* New scope at index 0 (innermost) */@@ -239,7 +248,7 @@     return env->with_scopes; } -uint16_t+uint32_t nn_env_with_count(const nn_env_t *env) {     return env->with_count;@@ -284,7 +293,7 @@ /* --- With-scopes array allocation --- */  void **-nn_env_alloc_with_scopes(uint16_t count)+nn_env_alloc_with_scopes(uint32_t count) {     if (count == 0) return NULL;     uint64_t bytes64 = (uint64_t)count * sizeof(void *);

@@ -29,7 +29,7 @@     void          *lazy_scope;   /* nn_attrset_t* or NULL */     struct nn_env *parent;       /* nn_env_t* or NULL */     void         **with_scopes;  /* array of nn_attrset_t* (or NULL) */-    uint16_t       with_count;   /* 2 bytes + 6 pad to struct alignment */+    uint32_t       with_count;   /* 4 bytes + 4 pad to struct alignment */ } nn_env_t;  /* --- Lifecycle --- */@@ -57,7 +57,7 @@ /* Full constructor: set all fields explicitly. */ nn_env_t *nn_env_new(void **slots, uint32_t slot_count,                      void *lazy_scope, nn_env_t *parent,-                     void **with_scopes, uint16_t with_count);+                     void **with_scopes, uint32_t with_count);  /* Child env with positional slots, inheriting parent's with-scopes.  * lazy_scope = NULL. */@@ -78,7 +78,7 @@ void        *nn_env_lazy_scope(const nn_env_t *env); nn_env_t    *nn_env_parent(const nn_env_t *env); void       **nn_env_with_scopes(const nn_env_t *env);-uint16_t     nn_env_with_count(const nn_env_t *env);+uint32_t     nn_env_with_count(const nn_env_t *env);  /* --- Lookup --- */ @@ -95,8 +95,10 @@ /* --- With-scopes array allocation --- */  /* Allocate an arena array of `count` void* pointers for with-scopes.- * All entries initialized to NULL.  Returns NULL if count is 0. */-void **nn_env_alloc_with_scopes(uint16_t count);+ * All entries initialized to NULL.  Returns NULL if count is 0, if the+ * array size would exceed the allocator's uint32 byte limit, or on+ * OOM - the caller must check. */+void **nn_env_alloc_with_scopes(uint32_t count);  /* --- Diagnostics --- */ 

@@ -40,8 +40,15 @@ nn_lambda_t * nn_lambda_new(struct nn_env *env, uint32_t body_bc_idx,               uint8_t formals_type, uint32_t name_sym,-              uint8_t allow_extra, uint16_t formal_count)+              uint8_t allow_extra, uint32_t formal_count) {+    /* The count is input-reachable (it scales with the source formal+     * list); computing the entries size in uint64_t and capping it at+     * the UINT32_MAX byte limit used across the C layer keeps the+     * malloc argument from wrapping size_t on any platform. */+    uint64_t entry_bytes64 = (uint64_t)formal_count * sizeof(nn_formal_entry_t);+    if (entry_bytes64 > UINT32_MAX) return NULL;+     nn_lambda_t *lam = (nn_lambda_t *)malloc(sizeof(nn_lambda_t));     if (!lam) return NULL; @@ -53,14 +60,12 @@     lam->formal_count = formal_count;      if (formal_count > 0) {-        lam->entries = (nn_formal_entry_t *)malloc(-            (size_t)formal_count * sizeof(nn_formal_entry_t));+        lam->entries = (nn_formal_entry_t *)malloc((size_t)entry_bytes64);         if (!lam->entries) {             free(lam);             return NULL;         }-        memset(lam->entries, 0,-               (size_t)formal_count * sizeof(nn_formal_entry_t));+        memset(lam->entries, 0, (size_t)entry_bytes64);     } else {         lam->entries = NULL;     }@@ -70,11 +75,16 @@ }  void-nn_lambda_set_entry(nn_lambda_t *lam, uint16_t idx,+nn_lambda_set_entry(nn_lambda_t *lam, uint32_t idx,                     uint32_t name_sym, uint32_t has_default,                     uint32_t default_bc_idx) {-    NN_ASSERT(idx < lam->formal_count, "nn_lambda_set_entry: idx out of bounds");+    /* Bound stays live under NDEBUG: the fill index derives from+     * input-sized data crossing the FFI, so a violated bound must drop+     * the write, not run past the sized array. */+    NN_ASSERT(lam != NULL && lam->entries != NULL && idx < lam->formal_count,+              "nn_lambda_set_entry: idx out of bounds");+    if (lam == NULL || lam->entries == NULL || idx >= lam->formal_count) return;     lam->entries[idx].name_sym       = name_sym;     lam->entries[idx].has_default    = has_default;     lam->entries[idx].default_bc_idx = default_bc_idx;@@ -126,32 +136,38 @@     return lam->allow_extra; } -uint16_t+uint32_t nn_lambda_formal_count(const nn_lambda_t *lam) {     return lam->formal_count; } +/* Entry reads keep their bound live under NDEBUG (see set_entry);+ * a violated bound returns 0 rather than reading out of bounds. */+ uint32_t-nn_lambda_entry_name(const nn_lambda_t *lam, uint16_t idx)+nn_lambda_entry_name(const nn_lambda_t *lam, uint32_t idx) {-    NN_ASSERT(lam->entries != NULL && idx < lam->formal_count,+    NN_ASSERT(lam != NULL && lam->entries != NULL && idx < lam->formal_count,               "nn_lambda_entry_name: idx out of bounds or no formals");+    if (lam == NULL || lam->entries == NULL || idx >= lam->formal_count) return 0;     return lam->entries[idx].name_sym; }  uint32_t-nn_lambda_entry_has_default(const nn_lambda_t *lam, uint16_t idx)+nn_lambda_entry_has_default(const nn_lambda_t *lam, uint32_t idx) {-    NN_ASSERT(lam->entries != NULL && idx < lam->formal_count,+    NN_ASSERT(lam != NULL && lam->entries != NULL && idx < lam->formal_count,               "nn_lambda_entry_has_default: idx out of bounds or no formals");+    if (lam == NULL || lam->entries == NULL || idx >= lam->formal_count) return 0;     return lam->entries[idx].has_default; }  uint32_t-nn_lambda_entry_default(const nn_lambda_t *lam, uint16_t idx)+nn_lambda_entry_default(const nn_lambda_t *lam, uint32_t idx) {-    NN_ASSERT(lam->entries != NULL && idx < lam->formal_count,+    NN_ASSERT(lam != NULL && lam->entries != NULL && idx < lam->formal_count,               "nn_lambda_entry_default: idx out of bounds or no formals");+    if (lam == NULL || lam->entries == NULL || idx >= lam->formal_count) return 0;     return lam->entries[idx].default_bc_idx; }

@@ -43,14 +43,16 @@ } nn_formal_entry_t;  /* Lambda closure: env + body + formals specification.- * Packed for minimal size (pointers first, then uint32s, then small fields).- * 28 bytes on 64-bit (no padding). */+ * Packed for minimal size: pointers first, then uint32s, then small+ * fields - no internal padding.  formal_count is a full uint32_t+ * because the formal list scales with the source expression (a+ * narrower count would wrap and undersize the entries array). */ typedef struct nn_lambda {     struct nn_env         *env;          /* captured closure environment */     nn_formal_entry_t     *entries;      /* formal entries (malloc'd, or NULL) */     uint32_t               body_bc_idx;  /* bytecode index of lambda body */     uint32_t               name_sym;     /* symbol for Name/NamedSet binding */-    uint16_t               formal_count; /* number of formal entries */+    uint32_t               formal_count; /* number of formal entries */     uint8_t                formals_type; /* NN_FORMALS_NAME/SET/NAMED_SET */     uint8_t                allow_extra;  /* 1 if ellipsis (...) present */ } nn_lambda_t;@@ -60,14 +62,17 @@ /* Allocate a new lambda closure.  The entries array is allocated  * internally (formal_count entries).  Fill entries via  * nn_lambda_set_entry() after construction.- * Returns NULL on allocation failure. */+ * Returns NULL on allocation failure or if the entries array size+ * would overflow - the caller must check. */ nn_lambda_t *nn_lambda_new(struct nn_env *env, uint32_t body_bc_idx,                            uint8_t formals_type, uint32_t name_sym,-                           uint8_t allow_extra, uint16_t formal_count);+                           uint8_t allow_extra, uint32_t formal_count);  /* Set a formal entry at the given index (for construction).- * Index must be < formal_count. */-void nn_lambda_set_entry(nn_lambda_t *lam, uint16_t idx,+ * idx must be < formal_count.  A NULL struct or out-of-range idx is+ * dropped (asserts in debug builds) rather than writing out of+ * bounds - the bound stays live under NDEBUG. */+void nn_lambda_set_entry(nn_lambda_t *lam, uint32_t idx,                          uint32_t name_sym, uint32_t has_default,                          uint32_t default_bc_idx); @@ -83,11 +88,13 @@ uint8_t        nn_lambda_formals_type(const nn_lambda_t *lam); uint32_t       nn_lambda_name_sym(const nn_lambda_t *lam); uint8_t        nn_lambda_allow_extra(const nn_lambda_t *lam);-uint16_t       nn_lambda_formal_count(const nn_lambda_t *lam);+uint32_t       nn_lambda_formal_count(const nn_lambda_t *lam); -/* Read formal entry fields by index (must be < formal_count). */-uint32_t nn_lambda_entry_name(const nn_lambda_t *lam, uint16_t idx);-uint32_t nn_lambda_entry_has_default(const nn_lambda_t *lam, uint16_t idx);-uint32_t nn_lambda_entry_default(const nn_lambda_t *lam, uint16_t idx);+/* Read formal entry fields by index (must be < formal_count).+ * Out-of-range reads return 0 (asserts in debug builds) rather than+ * reading out of bounds. */+uint32_t nn_lambda_entry_name(const nn_lambda_t *lam, uint32_t idx);+uint32_t nn_lambda_entry_has_default(const nn_lambda_t *lam, uint32_t idx);+uint32_t nn_lambda_entry_default(const nn_lambda_t *lam, uint32_t idx);  #endif /* NN_LAMBDA_H */

@@ -196,6 +196,14 @@  nn_symbol_t nn_symbol_intern(const char *str, size_t len) {+    /* An empty string arrives from Haskell's zero-copy marshalling as+     * (NULL, 0).  memcpy/memcmp require valid pointers even for a zero+     * length, so normalize at the boundary.  Empty symbols are reachable+     * from evaluated input ({ "" = 1; }), so the branch survives release+     * builds. */+    if (len == 0) {+        str = "";+    }     uint32_t hash = fnv1a(str, len);     uint32_t idx = hash & g_sym.slots_mask; 

@@ -45,7 +45,8 @@ /* Intern a string, returning its symbol.  If the string was already  * interned, returns the existing symbol (O(1) amortized).  * The input string is copied - the caller may free it after this call.- * str must not be NULL.  len is the byte length (not null-terminated). */+ * len is the byte length (not null-terminated).  (NULL, 0) denotes the+ * empty string; str must not be NULL when len > 0. */ nn_symbol_t nn_symbol_intern(const char *str, size_t len);  /* Return the string data for a symbol.  The pointer is valid until

@@ -15,6 +15,7 @@  #include "nn_thunk.h" +#include <stdio.h> #include <stdlib.h> #include <string.h> @@ -85,14 +86,19 @@     uint32_t cap = initial_capacity > 0 ? initial_capacity                                         : NN_THUNK_DEFAULT_BLOCK_CAPACITY; +    /* An allocation failure here would leave g_arena NULL and the first+     * thunk allocation would dereference it - fail loudly at startup+     * instead (same policy as nn_env_init). */     g_arena = (struct nn_thunk_arena *)malloc(sizeof(struct nn_thunk_arena));-    if (!g_arena) return;+    if (!g_arena) {+        fprintf(stderr, "nn_thunk_init: arena alloc failed\n");+        abort();+    }      struct nn_thunk_block *first = alloc_block(cap);     if (!first) {-        free(g_arena);-        g_arena = NULL;-        return;+        fprintf(stderr, "nn_thunk_init: block alloc failed\n");+        abort();     }      g_arena->head = first;@@ -120,19 +126,6 @@ /* --- Allocation --- */  nn_thunk_t *-nn_thunk_new(void *pending_data)-{-    nn_thunk_t *t = arena_alloc(g_arena);-    if (!t) return NULL;-    t->state = NN_THUNK_PENDING;-    t->val_tag = 0;-    t->_pad = 0;-    t->bc_idx = 0;  /* legacy StablePtr thunk marker */-    t->payload = pending_data;-    return t;-}--nn_thunk_t * nn_thunk_new_bc(uint32_t bc_idx, void *env_ptr) {     nn_thunk_t *t = arena_alloc(g_arena);@@ -383,6 +376,18 @@ {     if (thunk->state != NN_THUNK_PENDING) return 0;     thunk->state = NN_THUNK_BLACKHOLE;+    return 1;+}++/* Restore BLACKHOLE -> PENDING after a force threw and was caught upstream.+ * mark_blackhole only flips the state byte, so payload + bc_idx are intact and+ * the thunk is fully re-forceable; a later force re-evaluates rather than+ * misreporting infinite recursion.  Returns 1 on success, 0 if not BLACKHOLE. */+int+nn_thunk_mark_pending(nn_thunk_t *thunk)+{+    if (thunk->state != NN_THUNK_BLACKHOLE) return 0;+    thunk->state = NN_THUNK_PENDING;     return 1; } 

@@ -81,7 +81,8 @@  /* Initialize the global thunk arena.  initial_capacity is the number  * of thunks to pre-allocate per block (0 uses default: 65536 = 1 MB).- * Must be called once before any nn_thunk_new() calls. */+ * Must be called once before any thunk allocation (nn_thunk_new_bc or+ * the computed-value constructors). */ void nn_thunk_init(uint32_t initial_capacity);  /* Destroy the global thunk arena, freeing all block memory.@@ -92,13 +93,8 @@  /* --- Allocation --- */ -/* Allocate a new PENDING thunk from the arena (legacy StablePtr path).- * pending_data is an opaque pointer (StablePtr to Haskell value).- * Sets bc_idx = 0 to distinguish from bytecode thunks.- * Returns a pointer into arena memory, valid until nn_thunk_destroy(). */-nn_thunk_t *nn_thunk_new(void *pending_data);- /* Allocate a new PENDING thunk with a bytecode index + env payload.+ * Returns a pointer into arena memory, valid until nn_thunk_destroy().  * bc_idx is the root instruction index in the bytecode store.  * env_ptr is a StablePtr Env from Haskell (required for knot-tying;  * raw Ptr would force the env at allocation time, breaking laziness). */@@ -162,6 +158,12 @@  * Payload remains unchanged (caller reads it before this call).  * Returns 1 on success, 0 if thunk is not PENDING. */ int nn_thunk_mark_blackhole(nn_thunk_t *thunk);++/* Transition BLACKHOLE -> PENDING (a force threw and was caught upstream).+ * Payload + bc_idx are preserved, so the thunk is re-forceable; matches C+++ * Nix restoring a thunk after a caught exception during force.+ * Returns 1 on success, 0 if thunk is not BLACKHOLE. */+int nn_thunk_mark_pending(nn_thunk_t *thunk);  /* Set a non-COMPUTED thunk to COMPUTED with a StablePtr value (NN_VALUE_PTR).  * Accepts PENDING or BLACKHOLE state (skips blackhole for direct memoization).

@@ -0,0 +1,67 @@+#include "nn_winfs.h"++#ifdef _WIN32++#include <windows.h>+#include <winternl.h>++/* FileCaseSensitiveInformation and its flag are absent from older SDK and+ * MinGW headers; both values are fixed ABI, defined locally. */+enum { NN_FILE_CASE_SENSITIVE_INFORMATION = 71 };++#ifndef FILE_CS_FLAG_CASE_SENSITIVE_DIR+#define FILE_CS_FLAG_CASE_SENSITIVE_DIR 0x00000001+#endif++typedef struct nn_file_case_sensitive_info {+  ULONG flags;+} nn_file_case_sensitive_info;++typedef NTSTATUS(NTAPI *nn_nt_set_information_file)(HANDLE, PIO_STATUS_BLOCK,+                                                    PVOID, ULONG, ULONG);++int nn_dir_set_case_sensitive(const wchar_t *path) {+  HMODULE ntdll;+  nn_nt_set_information_file set_information_file;+  HANDLE dir;+  nn_file_case_sensitive_info info;+  IO_STATUS_BLOCK iosb;+  NTSTATUS status;++  /* NtSetInformationFile is the documented route to the per-directory+   * flag (fsutil and WSL use it); resolved dynamically because it lives+   * in ntdll, which is always loaded but not in the link line. */+  ntdll = GetModuleHandleW(L"ntdll.dll");+  if (ntdll == NULL) {+    return 0;+  }+  set_information_file =+      (nn_nt_set_information_file)GetProcAddress(ntdll, "NtSetInformationFile");+  if (set_information_file == NULL) {+    return 0;+  }++  dir = CreateFileW(path, FILE_WRITE_ATTRIBUTES,+                    FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,+                    NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);+  if (dir == INVALID_HANDLE_VALUE) {+    return 0;+  }++  info.flags = FILE_CS_FLAG_CASE_SENSITIVE_DIR;+  status = set_information_file(dir, &iosb, &info, sizeof info,+                                NN_FILE_CASE_SENSITIVE_INFORMATION);+  CloseHandle(dir);+  return status >= 0 ? 1 : 0;+}++#else /* !_WIN32 */++/* Per-directory case sensitivity is an NTFS feature; APFS decides at+ * volume creation and Linux filesystems are case-sensitive by nature. */+int nn_dir_set_case_sensitive(const wchar_t *path) {+  (void)path;+  return 0;+}++#endif

@@ -0,0 +1,18 @@+/* Platform filesystem capabilities the store layer probes at runtime.+ * Windows-only functionality; other platforms compile the constant-failure+ * stubs so callers fall back without conditional compilation. */+#ifndef NN_WINFS_H+#define NN_WINFS_H++#include <wchar.h>++/* Make an EMPTY directory's namespace case-sensitive (the NTFS+ * per-directory flag, the same mechanism WSL uses to host Linux trees).+ * Returns 1 on success, 0 when refused or unsupported - a non-NTFS+ * volume, policy, a non-empty directory, or a non-Windows build - and+ * the caller falls back to the case-hack.  The check guards external+ * input (NAR trees choose which directories need it), so the failure+ * path is a live branch, never an assert. */+int nn_dir_set_case_sensitive(const wchar_t *path);++#endif

@@ -1,19 +1,23 @@ cabal-version:      3.0 name:               nova-nix-version:            0.6.0.0+version:            0.8.0.0 synopsis:           Windows-native Nix implementation in Haskell and C99 description:-  A from-scratch implementation of the Nix package manager that runs-  natively on Windows, macOS, and Linux - no WSL or Cygwin.  A-  Haskell evaluator handles parsing and lazy evaluation, backed by a C99-  data layer that keeps evaluation data off the GHC heap.  It evaluates-  real Nix expressions (including nixpkgs), computes derivations and-  content-addressed store paths that byte-match upstream Nix, and builds-  real packages from source natively on Windows through a stage-1 stdenv-  over a store-pinned MinGW-w64 toolchain.-  Built outputs are content-addressed, substituted from a binary cache-  before building, and pushed to one with @nova-nix push@.+  An implementation of Nix for Windows, written in Haskell with a C99+  data layer that keeps evaluation data off the GHC heap.  It also runs+  on macOS and Linux.  It has its own parser, lazy evaluator,+  content-addressed store, derivation builder and binary-cache+  substituter, and does not need an existing Nix installation. +  On the pinned nixpkgs revision its CI checks, the derivation paths it+  computes match upstream Nix 2.24.9.  On Windows it builds packages from+  source through a stage-1 stdenv over a store-pinned MinGW-w64+  toolchain.  The project is experimental; see the README for what is+  not implemented yet.++  Evaluation needs the C data layer, so library code must run it between+  @Nix.Eval.Arena.arenaInit@ and @Nix.Eval.Arena.arenaDestroy@.+   Built on @nova-cache@ for NAR serialization, narinfo handling, and   Ed25519-signed binary substitution. @@ -27,9 +31,10 @@ category:           Nix, Distribution, System stability:          experimental build-type:         Simple-tested-with:        GHC == 9.8.4+tested-with:        GHC == 9.14.1 extra-doc-files:     CHANGELOG.md+    NOTICE     README.md -- C data-layer headers.  These are #included by the cbits/*.c sources -- (via include-dirs: cbits) but are not auto-added to the sdist by the@@ -56,6 +61,7 @@     Nix.Parser.Lexer     Nix.Parser.ParseError     Nix.Eval+    Nix.Eval.CanonPath     Nix.Eval.Context     Nix.Eval.Types     Nix.Eval.IO@@ -72,20 +78,27 @@     Nix.Eval.Compile     Nix.Eval.EvalFormals     Nix.Eval.Arena+    Nix.Eval.AttrPath     Nix.Store     Nix.Store.Path+    Nix.Store.Path.Internal     Nix.Store.DB+    Nix.Store.Lock+    Nix.Store.CaseSensitive+    Nix.Store.ExecBit     Nix.DependencyGraph     Nix.Derivation     Nix.Builder     Nix.Builder.Unpack+    Nix.Compression+    Nix.Config     Nix.Push     Nix.Substituter     Nix.Builtins     Nix.Hash    build-depends:-      base                >= 4.16 && < 5+      base                >= 4.22 && < 5     , array               >= 0.5 && < 0.6     , bytestring          >= 0.11 && < 0.13     , containers          >= 0.6 && < 0.9@@ -96,8 +109,9 @@     , http-client-tls     >= 0.3 && < 0.5     , http-types          >= 0.12 && < 0.13     , ram                 >= 0.20 && < 1+    , filelock            >= 0.1.1 && < 0.2     , mtl                 >= 2.2 && < 2.4-    , nova-cache          >= 0.4.2 && < 0.5+    , nova-cache:{nova-cache, xz, zstandard, bzip2} >= 0.11.1.1 && < 0.12     , process             >= 1.6 && < 1.7     , regex-tdfa          >= 1.3 && < 1.4     , sqlite-simple       >= 0.4 && < 0.5@@ -116,8 +130,12 @@     cbits/nn_arena.c     cbits/nn_bytecode.c     cbits/nn_lambda.c+    cbits/nn_winfs.c   include-dirs:     cbits-  cc-options:       -std=c99 -Wall -Wextra -pedantic -Werror+  -- -Werror deliberately NOT baked in: a future gcc/clang adding a new+  -- -Wall diagnostic must not retroactively break installing published+  -- releases.  CI enforces warnings-as-errors via its C99-strict job.+  cc-options:       -std=c99 -Wall -Wextra -pedantic   hs-source-dirs:   src   default-language:  Haskell2010   default-extensions:@@ -128,6 +146,11 @@     -Wcompat     -Wincomplete-record-updates     -Wincomplete-uni-patterns+    -- GHC 9.14 deprecates the pattern namespace specifier in import and+    -- export lists in favour of data, but hlint (through 3.10) cannot+    -- parse the replacement.  The old spelling stays, warning muted,+    -- until hlint learns it (then: pattern -> data, drop these flags).+    -Wno-pattern-namespace-specifier  -- --------------------------------------------------------------------------- -- CLI executable@@ -143,7 +166,8 @@   ghc-options:      -Wall -Wcompat -threaded -rtsopts    build-depends:-      base                >= 4.16 && < 5+      base                >= 4.22 && < 5+    , bytestring          >= 0.11 && < 0.13     , containers          >= 0.6 && < 0.9     , directory           >= 1.3 && < 1.4     , filepath            >= 1.4 && < 1.6@@ -157,20 +181,28 @@   type:             exitcode-stdio-1.0   main-is:          Main.hs   hs-source-dirs:   test+  other-modules:    FetchurlFixture   default-language: Haskell2010   default-extensions:     OverloadedStrings-  ghc-options:      -Wall -Wcompat+  -- -threaded: the path-lock race tests hold a blocking OS file lock in+  -- one thread while another waits on it, which needs real concurrency+  -- under blocking foreign calls.+  ghc-options:      -Wall -Wcompat -Wno-pattern-namespace-specifier -threaded    build-depends:-      base                >= 4.16 && < 5+      base                >= 4.22 && < 5+    , async               >= 2.2 && < 2.3     , bytestring          >= 0.11 && < 0.13     , containers          >= 0.6 && < 0.9     , directory           >= 1.3 && < 1.4     , filepath            >= 1.4 && < 1.6-    , nova-cache          >= 0.4.2 && < 0.5+    , http-client         >= 0.7 && < 0.8+    , network             >= 3.2 && < 3.3+    , nova-cache:{nova-cache, zstandard} >= 0.11.1.1 && < 0.12     , nova-nix     , process             >= 1.6 && < 1.7+    , sqlite-simple       >= 0.4 && < 0.5     , tar                 >= 0.7.1 && < 0.8     , text                >= 2.0 && < 2.2     , zstd                >= 0.1 && < 0.2

@@ -20,13 +20,16 @@ -- -- == On Windows ----- The key difference is process creation.  Linux uses @fork\/exec@ with--- namespace isolation.  We use 'System.Process.createProcess' which maps--- to @CreateProcess@ on Windows - native, no POSIX layer.+-- The key difference is process creation.  Upstream on Linux uses+-- @fork\/exec@ with namespace isolation.  nova-nix spawns builders through+-- "System.Process", which reaches @CreateProcess@ on Windows with no POSIX+-- layer, and does not sandbox them yet (#25). ----- For now, builds run without sandboxing (same as Nix on macOS did for--- years).  Future work: Windows Job Objects for resource limits,--- App Containers for filesystem isolation.+-- The builder's process tree runs inside a Win32 job object with+-- kill-on-job-close ('Proc.use_process_jobs'), so an interrupt or a+-- builder exit reaps grandchildren instead of orphaning them.  Filesystem+-- and privilege isolation are still future work: a restricted token with a+-- store-granting ACL (the security boundary), then AppContainer for more. -- -- We ship @bash.exe@ (from MSYS2) as the default builder on Windows. -- Same approach as Git for Windows.@@ -39,33 +42,55 @@     -- * Build configuration     BuildConfig (..),     defaultBuildConfig,++    -- * Pure pieces (exported for tests)+    BuilderSpawn (..),+    buildPath,+    execWrapperConfig,+    execWrapperFor,+    rewriteEnv,+    rewritePlaceholders,+    scrubAmbient,+    unionEnvs,+    verifyFetchHash,+    fetchUrlsFromEnv,+    tryFetchUrlsWith,   ) where -import Control.Exception (SomeException, try)-import Control.Monad (filterM, when)+import Control.Exception (IOException, SomeException, displayException, finally, onException, try)+import Control.Monad (filterM, unless, when)+import Data.Bifunctor (first) import qualified Data.ByteString as BS-import qualified Data.ByteString.Lazy as LBS-import Data.Char (toLower)+import Data.Char (isAscii, isSpace, toLower, toUpper) import Data.Either (fromRight)+import Data.Foldable (for_)+import Data.IORef (IORef, atomicModifyIORef', newIORef, readIORef, writeIORef)+import Data.List (sort)+import Data.List.NonEmpty (NonEmpty (..))+import qualified Data.List.NonEmpty as NE import Data.Map.Strict (Map) import qualified Data.Map.Strict as Map-import Data.Maybe (catMaybes)+import Data.Maybe (catMaybes, isJust) import Data.Text (Text) import qualified Data.Text as T+import qualified Data.Text.Encoding as TE+import Data.Text.Encoding.Error (lenientDecode) import qualified Data.Text.IO as TIO import qualified Network.HTTP.Client as HTTP import qualified Network.HTTP.Client.TLS as HTTPS import qualified Network.HTTP.Types.Status as HTTP-import Nix.Builder.Unpack (builtinUnpackBuilder, runBuiltinUnpack)+import Nix.Builder.Unpack (UnpackLimits, builtinUnpackBuilder, defaultUnpackLimits, runBuiltinUnpack) import Nix.DependencyGraph (DepGraph, TopoResult (..), buildDepGraph, topoSort) import qualified Nix.DependencyGraph-import Nix.Derivation (Derivation (..), DerivationOutput (..), fromATerm)-import Nix.Hash (bytesToHexText, hexToBytes, rawHashWithAlgo)-import Nix.Store (PathRegistration, Store (..), isValid, placeInStore, registerPaths, registrationFor, scanReferences, scanTempReferences)-import Nix.Store.Path (StoreDir (..), StorePath (..), storePathToFilePath)-import Nix.Substituter (CacheConfig, SubstResult (..), trySubstitute)-import System.Directory (createDirectoryIfMissing, doesDirectoryExist, doesPathExist, removeDirectoryRecursive)+import Nix.Derivation (Derivation (..), DerivationOutput (..), currentPlatform, fromATerm, platformToText)+import Nix.Hash (IncrementalHash, bytesToHexText, hashFinalizeBytes, hashInitWithAlgo, hashPlaceholder, hashUpdateChunk, hexToBytes, makeStorePath, rawHashWithAlgo)+import Nix.Store (PathLock, PathRegistration, Store (..), acquirePathLock, isValid, placeInStore, registerPaths, releasePathLock, scanReferences, scanTempReferences)+import qualified Nix.Store.ExecBit as ExecBit+import Nix.Store.Path (StoreDir (..), StorePath (spHash, spName), StorePathNameError, defaultStoreDir, defaultStoreDirText, storePathToFilePath, unStoreDir)+import Nix.Substituter (CacheConfig, SubstResult (..), catchSync, trySubstitute)+import qualified NovaCache.NAR as NAR+import System.Directory (createDirectoryIfMissing, doesDirectoryExist, doesPathExist, removeDirectoryRecursive, removePathForcibly) import qualified System.Environment import System.Exit (ExitCode (..)) import System.FilePath (takeDirectory, takeFileName, (</>))@@ -82,14 +107,49 @@ envNixBuildTop :: Text envNixBuildTop = "NIX_BUILD_TOP" --- | Environment variable for the temp directory.-envTmpDir :: Text+-- | The four temp-directory names, every one pointed at the build+-- directory, matching upstream's single assignment of all four.  Tools+-- disagree about which one they read (POSIX tools take @TMPDIR@, msys+-- reads @TMPDIR@ and @TMP@, native Windows tools take @TMP@ then+-- @TEMP@), and a scrubbed environment that repoints only one leaves+-- the others to fall back to a directory the build cannot own - on+-- Windows, GetTempPath bottoms out at the Windows directory itself.+envTmpDir, envTempDir, envTmp, envTemp :: Text envTmpDir = "TMPDIR"+envTempDir = "TEMPDIR"+envTmp = "TMP"+envTemp = "TEMP"  -- | Environment variable for the Nix store path. envNixStore :: Text envNixStore = "NIX_STORE" +-- | Ambient variables a Windows builder may inherit, by uppercase-folded+-- name.  SystemRoot is a hard execution requirement - the CLR's crypto+-- provider fails to load without it (verified live on a clean Windows 11+-- box), while plain Win32 binaries merely tolerate its absence - and+-- SystemDrive and windir are the aliases some tools consult instead of it.+windowsAmbientAllowlist :: [Text]+windowsAmbientAllowlist = [systemRootKey, "SYSTEMDRIVE", "WINDIR"]++-- | The folded name 'scrubAmbient' derives COMSPEC from.+systemRootKey :: Text+systemRootKey = "SYSTEMROOT"++-- | The command interpreter variable, synthesized from SystemRoot rather+-- than inherited: programs shelling out through the C runtime's+-- @system()@ read it from the block.+envComspec :: Text+envComspec = "COMSPEC"++-- | Executable-extension resolution, pinned instead of inherited so name+-- resolution does not drift with host configuration.  cmd.exe's own+-- built-in default when the variable is absent adds @.VBS;.JS;.WS;.MSC@;+-- a build has no business resolving those implicitly.+envPathext, pathextValue :: Text+envPathext = "PATHEXT"+pathextValue = ".COM;.EXE;.BAT;.CMD"+ -- | Environment variable for PATH. envPath :: Text envPath = "PATH"@@ -97,12 +157,14 @@ -- | The magic builder string for the built-in URL fetcher.  A derivation with -- this builder is not executed as a process - the Builder downloads its @url@ -- and verifies it against @outputHash@ (see 'runBuiltinFetchurl').-builtinFetchurlBuilder :: Text+-- Bytes, matching the 'drvBuilder' field it is compared against.+builtinFetchurlBuilder :: BS.ByteString builtinFetchurlBuilder = "builtin:fetchurl"  -- | Derivation environment keys read by @builtin:fetchurl@.-envUrl, envOut :: Text+envUrl, envUrls, envOut :: Text envUrl = "url"+envUrls = "urls" envOut = "out"  -- | HTTP success status code.@@ -119,6 +181,11 @@ envSourceDateEpoch :: Text envSourceDateEpoch = "SOURCE_DATE_EPOCH" +-- | The derivation attribute naming ambient variables a fixed-output+-- build may read, upstream's carve-out for fetchers that need proxies.+envImpureEnvVars :: Text+envImpureEnvVars = "impureEnvVars"+ -- | The fixed build timestamp handed to every builder: 1980-01-01 UTC. -- Determinism-aware tools (binutils @ld@ writes it into the PE header -- instead of the wall clock; gcc uses it for @__DATE__@\/@__TIME__@)@@ -138,12 +205,18 @@     bcStoreDir :: !StoreDir,     -- | Temp directory for builds (cleaned after each build).     bcTmpDir :: !FilePath,-    -- | Path to bash executable (shipped with nova-nix on Windows).-    bcBashPath :: !FilePath,-    -- | Enable sandboxing (not yet implemented on Windows).-    bcSandbox :: !Bool,     -- | Binary caches to try before building (checked in priority order).-    bcCaches :: ![CacheConfig]+    bcCaches :: ![CacheConfig],+    -- | Extraction budget for @builtin:unpack@ builds.+    bcUnpackLimits :: !UnpackLimits,+    -- | Launchers for derivations whose @system@ this machine cannot execute+    -- directly, keyed by that system string exactly as+    -- 'Nix.Derivation.platformToText' spells it (@x86_64-windows@ -> a wine+    -- binary). Prepended to the builder at the spawn boundary only, so the+    -- derivation itself - and its store paths - stay identical to a native+    -- build's. A foreign system with no entry here is refused rather than+    -- spawned natively; see 'execWrapperFor'.+    bcExecWrappers :: !(Map Text FilePath)   }   deriving (Eq, Show) @@ -156,12 +229,9 @@         if isWindows           then "C:\\Temp\\nova-nix-build"           else "/tmp/nova-nix-build",-      bcBashPath =-        if isWindows-          then "bash" -- rely on PATH (MSYS2/Git Bash)-          else "/bin/bash",-      bcSandbox = False,-      bcCaches = []+      bcCaches = [],+      bcExecWrappers = Map.empty,+      bcUnpackLimits = defaultUnpackLimits     }  -- | Result of a build attempt.@@ -184,68 +254,328 @@ -- 4. Run the builder process -- 5. On success: scan references, move outputs to store, register -- 6. On failure: clean up and report error--- 7. Exception safety: wrap in try, convert to BuildFailure+-- 7. Exception safety: synchronous exceptions convert to BuildFailure;+--    asynchronous exceptions propagate ('catchSync') - an interrupt+--    must abort the build, never be reported as a build failure. buildDerivation :: BuildConfig -> Store -> Derivation -> IO BuildResult-buildDerivation config store drv = do-  result <- try (buildDerivationInner config store drv)-  case result of-    Right buildResult -> pure buildResult-    Left (err :: SomeException) ->-      pure (BuildFailure ("build exception: " <> T.pack (show err)) 1)+buildDerivation config store drv =+  buildDerivationInner config store drv+    `catchSync` \err -> pure (BuildFailure ("build exception: " <> T.pack (show err)) 1) +-- | Build under the outputs' path locks.  A derivation another process+-- finished while we waited for them is adopted rather than redone:+-- rebuilding would delete a registered path out from under whoever is+-- already using it, which is why substitution adopts a finished path too. buildDerivationInner :: BuildConfig -> Store -> Derivation -> IO BuildResult-buildDerivationInner config store drv = do+buildDerivationInner config store drv =+  withOutputLocks config store drv (maybe (buildUnderLock config store drv) (pure . BuildSuccess))++-- | Hold every output's path lock for the whole build, and report+-- whether the derivation was already finished by the time they were+-- granted.+--+-- #119 and #121 made delete, materialize and register one critical+-- section under @\<store-path\>.lock@.  The build path never joined it,+-- so two concurrent builds of one derivation shared a build directory+-- ('computeBuildDir' is deterministic), interleaved their writes into a+-- single tree, and each registered it as valid.  Nothing failed; the+-- registered output was simply not what either build produced.+--+-- Outputs are locked in 'StorePath' order so two processes racing the+-- same multi-output derivation request them in the same sequence.  A+-- build holds locks for its own outputs only - dependencies are+-- resolved before 'buildDerivation' is called, never underneath it - so+-- no process holds one lock while waiting on another, and there is no+-- cycle to deadlock on.+--+-- The validity re-check happens under the locks, not before them:+-- checked earlier it would answer about a moment that has already+-- passed by the time the build starts.+withOutputLocks :: BuildConfig -> Store -> Derivation -> (Maybe StorePath -> IO a) -> IO a+withOutputLocks config store drv act = do+  heldLocks <- newIORef []+  let takeLock sp = do+        lock <- acquirePathLock (bcStoreDir config) sp+        atomicModifyIORef' heldLocks (\locks -> (lock : locks, ()))+  ( do+      mapM_ takeLock (sort (map doPath (drvOutputs drv)))+      finishedElsewhere <- allOutputsValid store drv+      act finishedElsewhere+    )+    `finally` (readIORef heldLocks >>= mapM_ releasePathLock)++-- | The derivation's first output path when EVERY output is already+-- registered, otherwise 'Nothing'.+--+-- Every output, never just the first: a partially valid multi-output+-- derivation still has to build, and treating it as finished would leave+-- the missing outputs missing.  Both the lock-held re-check and the gate+-- in 'resolveDep' ask this one question, so the two cannot disagree.+allOutputsValid :: Store -> Derivation -> IO (Maybe StorePath)+allOutputsValid store drv = case map doPath (drvOutputs drv) of+  [] -> pure Nothing+  outputPaths@(firstOutput : _) -> do+    validity <- mapM (isValid store) outputPaths+    pure (if and validity then Just firstOutput else Nothing)++-- | The build itself, with every output's lock already held.+buildUnderLock :: BuildConfig -> Store -> Derivation -> IO BuildResult+buildUnderLock config store drv = do   -- 1. Validate inputs (sources + input-derivation outputs) exist   inputsOk <- validateInputs config store drv   case inputsOk of     Left errMsg -> pure (BuildFailure errMsg 1)     Right () -> do-      -- 2. Create temp build directory+      -- 2. Create temp build directory.  The location is deterministic+      --    (computeBuildDir), so a crashed earlier run may have left stale+      --    contents that builtin:unpack would misread as an archive+      --    collision - always start from an empty directory, and always+      --    remove it on the way out (finally), builder exceptions included.       let buildDir = computeBuildDir config drv+      removePathForcibly buildDir       createDirectoryIfMissing True buildDir+      (`finally` cleanupBuildDir buildDir) $ do+        -- 3. Compute output paths (but do NOT pre-create them - the builder+        --    is responsible for creating $out, $dev, etc.).+        --+        --    $out is the FINAL store path now, as upstream's is: a temp+        --    path recorded by the build (a compiler driver, a libtool+        --    archive) would otherwise outlive the temp dir it named.+        outputValidity <- mapM (isValid store . doPath) (drvOutputs drv)+        case traverse outputPlan (zip (drvOutputs drv) outputValidity) of+          Left nameErr -> pure (BuildFailure ("output name is not a store path name: " <> T.pack (show nameErr)) 1)+          Right plans -> runPlannedBuild config store drv buildDir plans -      -- 3. Compute output paths (but do NOT pre-create them - the builder-      --    is responsible for creating $out, $dev, etc.)-      let outputDirs = [(doName out, buildDir </> T.unpack (doName out)) | out <- drvOutputs drv]+-- | Where the builder writes each output, and where that has to end up.+--+-- The two coincide for an output being built: writing into the final store+-- path is what this whole arrangement is for.  They differ for an output+-- that is already valid, which the builder is still handed (a package with+-- a @dev@ output has one builder writing both) but which must not be+-- touched: it is registered, its @NarHash@ describes its current bytes,+-- and 'placeInStore' has already sealed it read-only.+data OutputPlan = OutputPlan+  { -- | The derivation output's name, as it reaches the environment.+    opName :: !Text,+    -- | Where the output has to be when the build is done.+    opFinal :: !StorePath,+    -- | Where the builder is told to write.+    opScratch :: !StorePath,+    -- | Whether 'opFinal' is already registered, and so must survive.+    opValid :: !Bool+  } -      -- 4. Set up environment-      let builderPath = T.unpack (drvBuilder drv)-          environ = buildEnvironment config drv builderPath buildDir outputDirs+-- | Plan one output, given whether its final path is already valid.+outputPlan :: (DerivationOutput, Bool) -> Either StorePathNameError OutputPlan+outputPlan (out, valid)+  | not valid = Right (OutputPlan (doName out) (doPath out) (doPath out) False)+  | otherwise = do+      fallback <- fallbackOutputPath (doPath out)+      pure (OutputPlan (doName out) (doPath out) fallback True) -          -- 5. Run the builder-          builderArgs = map T.unpack (drvArgs drv)-      -- A "builtin:" builder (e.g. builtin:fetchurl) is handled in-process;-      -- everything else is a normal subprocess.  The output validation and-      -- registration below are shared by both paths.+-- | A scratch store path for an output that must not be written to, built+-- so it cannot collide with any real store path.+--+-- Upstream's @makeFallbackPath@ (the @StorePath@ overload, in+-- @src/libstore/unix/build/local-derivation-goal.cc@ at 2.24.9) with the+-- same shape: a bogus @rewrite:@ path type and an all-zeroes inner hash,+-- keyed on the output path it stands in for.+-- Upstream also keys on the @.drv@ path; that is not reachable here, and+-- the output path already names one output of one derivation, so the+-- result is just as unique.+fallbackOutputPath :: StorePath -> Either StorePathNameError StorePath+fallbackOutputPath sp =+  makeStorePath+    defaultStoreDir+    ("rewrite:" <> spHash sp <> "-" <> spName sp)+    (BS.replicate 32 0)+    (spName sp)++-- | Parse @--exec-wrapper SYSTEM=PATH@ specs into the map 'bcExecWrappers'+-- wants.+--+-- @SYSTEM@ is a derivation's own @system@ string, spelled as+-- 'Nix.Derivation.platformToText' spells it, because 'execWrapperFor'+-- matches it by equality and nothing else.+--+-- A system named twice is an error rather than last-one-wins: two specs for+-- one system is a mistake in the invocation either way, and silently+-- picking one of them means a build runs through a launcher the operator+-- did not think they had asked for.+execWrapperConfig :: [String] -> Either Text (Map Text FilePath)+execWrapperConfig = foldl' step (Right Map.empty)+  where+    step acc spec = do+      wrappers <- acc+      (system, path) <- one spec+      if Map.member system wrappers+        then Left ("--exec-wrapper names " <> system <> " twice")+        else Right (Map.insert system path wrappers)+    one spec = case break (== '=') spec of+      (system, '=' : path)+        | not (null system), not (null path) -> Right (T.pack system, path)+      _ -> Left ("--exec-wrapper expects SYSTEM=PATH, got: " <> T.pack spec)++-- | How this machine can spawn a derivation's builder.+data BuilderSpawn+  = -- | The derivation targets this machine's platform; spawn it directly.+    SpawnNative+  | -- | Spawn through this launcher, named for the derivation's system.+    SpawnThrough !FilePath+  | -- | Nothing here can execute this derivation's builder; the payload is+    -- the system string that has no launcher.+    SpawnUnsupported !Text+  deriving (Eq, Show)++-- | How to spawn this derivation's builder on this machine.+--+-- \"This is my platform\" and \"I have no launcher for this platform\" are+-- different answers: collapsing them to \"spawn directly\" runs a foreign+-- builder natively and reports whatever the loader says, after the whole+-- closure has already been realized. A system this machine cannot execute+-- and has not been told how to is refused instead.+execWrapperFor :: BuildConfig -> Derivation -> BuilderSpawn+execWrapperFor config drv+  | drvPlatform drv == currentPlatform = SpawnNative+  | otherwise = case Map.lookup system (bcExecWrappers config) of+      Just launcher -> SpawnThrough launcher+      Nothing -> SpawnUnsupported system+  where+    system = platformToText (drvPlatform drv)++-- | The build, once every output knows where it is written and where it+-- belongs.+runPlannedBuild :: BuildConfig -> Store -> Derivation -> FilePath -> [OutputPlan] -> IO BuildResult+runPlannedBuild config store drv buildDir plans = do+  let scratchDir p = storePathToFilePath (bcStoreDir config) (opScratch p)+      outputDirs = [(opName p, scratchDir p) | p <- plans]+      -- Every scratch path is the build's to use: the ones that are final+      -- paths may hold a tree an interrupted run left behind, and the+      -- fallbacks may hold one an interrupted run failed to discard.+      clearScratch = for_ plans (removePathForcibly . scratchDir)+  clearScratch+  createDirectoryIfMissing True (unStoreDir (bcStoreDir config))+  -- The cleanup contract: the build directory is not where outputs live+  -- any more, so an interrupt or a throw between the builder starting and+  -- registration committing would otherwise strand an unregistered tree at+  -- a real store path.  Once the registrations are committed there is+  -- nothing left to take back, and the flag says so.+  committed <- newIORef False+  let cleanupUnlessCommitted = do+        done <- readIORef committed+        unless done clearScratch+  ( do+      -- 4. Decode builder/args/env for the spawn boundary.  Derivation+      --    strings are BYTES (identity); spawning a process needs real+      --    text, so invalid UTF-8 in any of them is a clean build+      --    failure, never a mojibake spawn.  The builtin builders skip+      --    this - they read the byte fields directly.       exitResult <- case drvBuilder drv of         b           | b == builtinFetchurlBuilder -> runBuiltinFetchurl drv outputDirs-          | b == builtinUnpackBuilder -> runBuiltinUnpack drv outputDirs-        _ -> runBuilder builderPath builderArgs environ buildDir+          | b == builtinUnpackBuilder -> runBuiltinUnpack (bcStoreDir config) (bcUnpackLimits config) drv outputDirs+        _ -> case (execWrapperFor config drv, decodeBuilderStrings drv) of+          (SpawnUnsupported system, _) ->+            pure+              ( Left+                  ( 1,+                    "no way to run a "+                      <> system+                      <> " builder on this machine; pass --exec-wrapper "+                      <> system+                      <> "=PATH to name a launcher for it"+                  )+              )+          (_, Left errMsg) -> pure (Left (1, errMsg))+          (spawn, Right (builderText, argTexts, decodedEnv)) ->+            let -- onStore first, so nothing a placeholder expands to gets+                -- rewritten a second time.+                rewrite = rewritePlaceholders outputDirs . onStore config+                builderPath = T.unpack (onStore config builderText)+                environ = buildEnvironment config (rewriteEnv rewrite decodedEnv) builderPath buildDir outputDirs+                builderArgs = map (T.unpack . rewrite) argTexts+                -- Env still names the real builder - a launcher only+                -- changes what's spawned, not what the derivation says.+                (spawnPath, spawnArgs) = case spawn of+                  SpawnThrough launcher -> (launcher, builderPath : builderArgs)+                  _ -> (builderPath, builderArgs)+                -- Only a fixed-output derivation's impureEnvVars reach+                -- the spawn: upstream gates the carve-out on the+                -- derivation type being non-sandboxed, which for us is+                -- exactly the fixed-output case.+                carriesHash out = not (T.null (doHashAlgo out))+                impureVars+                  | any carriesHash (drvOutputs drv) =+                      T.words (Map.findWithDefault "" envImpureEnvVars decodedEnv)+                  | otherwise = []+             in -- 5. Run the builder+                runBuilder spawnPath spawnArgs environ impureVars buildDir       case exitResult of         Left (exitCode, stderrText) -> do-          -- 6. Failure: clean up-          cleanupBuildDir buildDir+          -- Whatever the builder wrote is in the store now, so failure has+          -- to take it back out: an unregistered tree there is invisible to+          -- the database and would only confuse the next run.+          clearScratch           pure (BuildFailure ("builder failed: " <> stderrText) exitCode)         Right () -> do-          -- 7. Success: validate that the builder created all expected outputs.-          --    Outputs may be files or directories - both are valid (real Nix-          --    allows $out to be a single file, a directory tree, or a symlink).+          -- 6. Success: validate that the builder created all expected+          --    outputs.  Outputs may be files or directories - both are+          --    valid (real Nix allows $out to be a single file, a+          --    directory tree, or a symlink).           missing <- filterM (fmap not . doesPathExist . snd) outputDirs           case missing of-            [] -> do-              registerResult <- registerOutputs config store drv buildDir outputDirs-              cleanupBuildDir buildDir-              pure registerResult-            _ -> do-              cleanupBuildDir buildDir+            _ : _ -> do               let names = T.intercalate ", " (map fst missing)+              -- The builder may have produced some outputs before omitting+              -- another.  None were registered, so take those orphaned+              -- trees back out of the store.+              clearScratch               pure (BuildFailure ("builder succeeded but outputs missing: " <> names) 1)+            [] -> do+              result <- registerOutputs config store drv buildDir plans+              case result of+                BuildSuccess _ -> do+                  writeIORef committed True+                  -- Upstream discards a valid output's redirected copy+                  -- rather than reading it; only the fallbacks go, the+                  -- registered trees stay.+                  for_ [p | p <- plans, opValid p] (removePathForcibly . scratchDir)+                _ -> clearScratch+              pure result+    )+    `onException` cleanupUnlessCommitted +-- | Decode a derivation's builder path, arguments, and env values from+-- their identity bytes to the 'Text' the process-spawn boundary needs.+-- @Left@ names the offending field.+decodeBuilderStrings :: Derivation -> Either Text (Text, [Text], Map Text Text)+decodeBuilderStrings drv = do+  builderText <- decodeField "the builder path" (drvBuilder drv)+  argTexts <- traverse (decodeField "a builder argument") (drvArgs drv)+  envTexts <-+    Map.traverseWithKey+      (\key val -> decodeField ("environment variable '" <> key <> "'") val)+      (drvEnv drv)+  pure (builderText, argTexts, envTexts)+  where+    decodeField what bytes = case TE.decodeUtf8' bytes of+      Right t -> Right t+      Left _ -> Left ("cannot spawn builder: " <> what <> " contains invalid UTF-8")+ -- --------------------------------------------------------------------------- -- Input validation -- --------------------------------------------------------------------------- +-- | Rewrite a derivation string's store paths from their identity (the+-- canonical @\/nix\/store@ spelling) to where this machine actually keeps+-- them, at the spawn boundary. A no-op when the two coincide.+onStore :: BuildConfig -> Text -> Text+onStore config+  | storeDirText == defaultStoreDirText = id+  | otherwise = T.replace (defaultStoreDirText <> "/") (storeDirText <> "/")+  where+    storeDirText = T.pack (unStoreDir (bcStoreDir config))+ -- | Check that all inputs needed to build a derivation are present in the store. -- -- Input sources must be valid.  For input derivations, the artifacts a build@@ -317,6 +647,27 @@ -- Environment -- --------------------------------------------------------------------------- +-- | Replace each output's @builtins.placeholder@ sentinel with its+-- build-time path (the same value @$out@ carries).  Only the args and the+-- environment are rewritten; the builder path is left alone, matching+-- upstream, which assigns @builder = drv->builder@ unrewritten and rewrites+-- only @drv->args@ (local-derivation-goal.cc:2170,2176).+rewritePlaceholders :: [(Text, FilePath)] -> Text -> Text+rewritePlaceholders outputDirs value =+  foldr substitute value outputDirs+  where+    substitute (name, path) = T.replace (hashPlaceholder name) (T.pack path)++-- | Apply a build-time rewrite to an environment's names as well as its+-- values.  Upstream rewrites the whole @name=value@ string+-- (local-derivation-goal.cc:2004), so a placeholder in a dynamic attribute+-- name is substituted too; rewriting only the values would hand the builder+-- a variable whose name still held the sentinel.+rewriteEnv :: (Text -> Text) -> Map Text Text -> Map Text Text+rewriteEnv rewrite = Map.fromList . map rewritePair . Map.toList+  where+    rewritePair (name, value) = (rewrite name, rewrite value)+ -- | Build the process environment from the derivation env + standard vars. -- The builder path is used to derive PATH entries - the builder's own -- directory and its sibling @usr\/bin@ are included so that coreutils@@ -325,14 +676,15 @@ -- store paths from declared build dependencies. buildEnvironment ::   BuildConfig ->-  Derivation ->+  Map Text Text ->   FilePath ->   FilePath ->   [(Text, FilePath)] ->   Map Text Text-buildEnvironment config drv builderPath buildDir outputDirs =-  let -- Start with derivation environment-      baseEnv = drvEnv drv+buildEnvironment config decodedEnv builderPath buildDir outputDirs =+  let -- Start with the derivation environment (values decoded at the+      -- spawn boundary by 'decodeBuilderStrings')+      baseEnv = decodedEnv       -- Add output paths: $out, $dev, etc.       outputEnv = Map.fromList [(name, T.pack path) | (name, path) <- outputDirs]       -- Standard build variables@@ -340,25 +692,82 @@         Map.fromList           [ (envNixBuildTop, T.pack buildDir),             (envTmpDir, T.pack buildDir),+            (envTempDir, T.pack buildDir),+            (envTmp, T.pack buildDir),+            (envTemp, T.pack buildDir),             (homeEnvVar, T.pack buildDir),             (envNixStore, T.pack (unStoreDir (bcStoreDir config))),             (envPath, buildPath builderPath),             (envSourceDateEpoch, sourceDateEpochValue)           ]    in -- Priority: output paths > derivation env > standard env-      Map.unions [outputEnv, baseEnv, standardEnv]+      unionEnvs [outputEnv, baseEnv, standardEnv] +-- | Union environment maps left to right (an earlier map's variable wins).+-- On Windows environment names are one case-insensitive namespace, so+-- displacement folds names by per-character uppercase - matching the+-- kernel's env-name comparison - and the winner keeps its own spelling:+-- a build's @PATH@ must displace an inherited @Path@, or both would land+-- in the child's environment block and which one the child sees would be+-- runtime-dependent.  On Unix names are distinct by case and this is+-- 'Map.unions'.+unionEnvs :: [Map Text Text] -> Map Text Text+unionEnvs envs+  | isWindows =+      let foldName = T.map toUpper+          folded =+            [ Map.fromList [(foldName name, (name, val)) | (name, val) <- Map.toList env]+            | env <- envs+            ]+       in Map.fromList (Map.elems (Map.unions folded))+  | otherwise = Map.unions envs++-- | The ambient environment a builder is allowed to see.  Everything+-- else is scrubbed: upstream builds in a cleared environment (its+-- initEnv begins with @env.clear()@ and the child is exec'd with+-- exactly that block), so an undeclared ambient variable reaching a+-- build embeds machine-specific data in its output - undermining the+-- reproducibility SOURCE_DATE_EPOCH exists to pin.+--+-- On Unix the allowance is empty.  A Windows process block cannot be:+-- 'windowsAmbientAllowlist' names what passes through, COMSPEC is+-- synthesized from the allowed SystemRoot, and PATHEXT is pinned to+-- 'pathextValue'.  Names compare case-insensitively on Windows, so the+-- allowlist matches by folded name and a passed variable keeps its+-- ambient spelling.+scrubAmbient :: Map Text Text -> Map Text Text+scrubAmbient ambient+  | not isWindows = Map.empty+  | otherwise =+      let foldName = T.map toUpper+          folded = Map.fromList [(foldName name, (name, val)) | (name, val) <- Map.toList ambient]+          allowed = Map.fromList [pair | key <- windowsAmbientAllowlist, Just pair <- [Map.lookup key folded]]+          synthesized =+            Map.fromList $+              (envPathext, pathextValue)+                : [ (envComspec, root <> "\\System32\\cmd.exe")+                  | Just (_, root) <- [Map.lookup systemRootKey folded]+                  ]+       in unionEnvs [allowed, synthesized]+ -- | Construct the build PATH from the builder's location. -- Includes the builder's directory, its sibling @usr\/bin@ (for MSYS2 -- coreutils bundled with Git for Windows), and system directories. -- On a bootstrapped store, the builder's dir IS a store path, so this -- naturally becomes a store-only PATH.+--+-- A bare-name or dot-relative builder has no directory to derive: @.@+-- here would put the BUILD WORKING DIRECTORY first on PATH, so a file+-- dropped into the build dir would resolve ahead of every tool.  Such+-- builders get the system directories only. buildPath :: FilePath -> Text buildPath builderPath =   let builderDir = takeDirectory builderPath       parentDir = takeDirectory builderDir       -- Builder's own dir + coreutils sibling (MSYS2 layout)-      builderDirs = [builderDir, parentDir </> "usr" </> "bin"]+      builderDirs+        | builderDir == "." = []+        | otherwise = [builderDir, parentDir </> "usr" </> "bin"]       systemDirs =         if System.Info.os == "mingw32"           then ["C:\\Windows\\System32", "C:\\Windows"]@@ -380,28 +789,51 @@ -- | Run the builder process, returning either (exitCode, stderr) on failure -- or () on success. ----- The build environment is overlaid on top of the inherited system--- environment.  Build variables take priority, but system-critical--- variables (e.g. SYSTEMROOT on Windows) pass through.  This matches--- unsandboxed build behavior - proper isolation comes with Phase 5.+-- The child's environment is exactly the build environment plus+-- 'scrubAmbient''s allowance - the ambient environment does not flow+-- through.  Filesystem and process isolation remain future work; the+-- environment no longer waits on them.+--+-- @impureVars@ is the impureEnvVars carve-out: the caller passes the+-- names a fixed-output derivation listed (empty otherwise), and each+-- is copied from the ambient environment - the EMPTY STRING when+-- absent, not omitted, matching upstream's @getEnv(i).value_or("")@.+-- Upstream writes these last in initEnv, so they win even over the+-- derivation's own values.  Names match exactly, as upstream's do. runBuilder ::   FilePath ->   [String] ->   Map Text Text ->+  [Text] ->   FilePath ->   IO (Either (Int, Text) ())-runBuilder builderPath builderArgs buildEnv workDir = do+runBuilder builderPath builderArgs buildEnv impureVars workDir = do   systemEnv <- System.Environment.getEnvironment   let systemMap = Map.fromList [(T.pack k, T.pack v) | (k, v) <- systemEnv]-      -- Build env wins over system env-      mergedEnv = Map.union buildEnv systemMap+      impureAllowance =+        Map.fromList [(var, Map.findWithDefault "" var systemMap) | var <- impureVars]+      -- Impure carve-out wins, then build env, displacing case variants+      -- on Windows; the scrubbed ambient allowance fills underneath.+      mergedEnv = unionEnvs [impureAllowance, buildEnv, scrubAmbient systemMap]       envList = [(T.unpack k, T.unpack v) | (k, v) <- Map.toList mergedEnv]       cp =         (mkBuilderProcess builderPath builderArgs)           { Proc.cwd = Just workDir,             Proc.env = Just envList,             Proc.std_out = Proc.CreatePipe,-            Proc.std_err = Proc.CreatePipe+            Proc.std_err = Proc.CreatePipe,+            -- Wrap the builder's whole process tree in a Win32 job with+            -- kill-on-job-close.  Without it, a builder's grandchildren+            -- (bash -> make -> cc, or anything cmd.exe spawns) outlive an+            -- interrupt: terminateProcess reaches only the direct child,+            -- so the tree is orphaned and keeps running.  With the job,+            -- terminateProcess becomes TerminateJobObject and reaps the+            -- tree, and waitForProcess waits for all of it.  Ignored on+            -- POSIX, where a process group already scopes the children.+            -- A deliberately daemonizing grandchild changes from leaking+            -- to blocking the build until it exits; that is the correct+            -- trade for a build, which owns everything it spawned.+            Proc.use_process_jobs = True           }   (exitCode, _stdout, stderrText) <- Proc.readCreateProcessWithExitCode cp ""   case exitCode of@@ -452,54 +884,107 @@ -- Built-in fetcher (builtin:fetchurl) -- --------------------------------------------------------------------------- --- | Run a @builtin:fetchurl@ derivation: download its @url@ into @$out@ and--- verify the bytes against the derivation's @outputHash@.  Nix's bootstrap+-- | Run a @builtin:fetchurl@ derivation: try URLs in order and verify the+-- written bytes against the derivation's @outputHash@. Nix's bootstrap -- fetcher is baked into the binary because nothing can be fetched before a -- fetcher exists.  Returns the same @Either (exit, msg) ()@ shape as -- 'runBuilder', so the shared output-registration path is reused unchanged. runBuiltinFetchurl :: Derivation -> [(Text, FilePath)] -> IO (Either (Int, Text) ()) runBuiltinFetchurl drv outputDirs =-  case (Map.lookup envUrl (drvEnv drv), lookup envOut outputDirs, fixedOutput) of-    (Nothing, _, _) -> pure (Left (1, "builtin:fetchurl: derivation has no 'url'"))+  case (fetchUrlsFromEnv (drvEnv drv), lookup envOut outputDirs, fixedOutput) of+    (Left err, _, _) -> pure (Left (1, "builtin:fetchurl: " <> err))     (_, Nothing, _) -> pure (Left (1, "builtin:fetchurl: derivation defines no 'out' output"))     (_, _, Nothing) -> pure (Left (1, "builtin:fetchurl: 'out' output has no fixed-output hash"))-    (Just url, Just outPath, Just out) -> do-      downloaded <- downloadUrl url-      case downloaded of-        Left err -> pure (Left (1, "builtin:fetchurl: " <> err))-        Right body -> do-          BS.writeFile outPath body-          pure (verifyFetchHash url out body)+    (Right urls@(firstUrl :| _), Just outPath, Just out)+      -- Invalid specifications reject before any network traffic.+      | recursive -> pure (Left (1, recursiveUnsupportedMessage))+      | Nothing <- hexToBytes (doHash out) ->+          pure (Left (1, malformedExpectedHash firstUrl))+      | otherwise -> case hashInitWithAlgo algo of+          Nothing ->+            pure (Left (1, "builtin:fetchurl: unsupported hash algorithm '" <> algo <> "'"))+          Just ctx -> do+            result <- tryFetchUrlsWith (fetchAndVerify outPath out ctx) urls+            pure $ case result of+              Left err -> Left (1, err)+              Right value -> Right value+      where+        (recursive, algo) = splitHashMode (doHashAlgo out)   where     -- builtin:fetchurl derivations are always fixed-output; the expected hash     -- lives in the canonical output spec (doHashAlgo + doHash), not the env.     fixedOutput = case drvOutputs drv of       (out : _) | not (T.null (doHashAlgo out)) -> Just out       _ -> Nothing+    fetchAndVerify outPath out ctx url = do+      downloaded <- downloadUrlTo url outPath ctx+      pure $ case downloaded of+        Left err -> Left ("builtin:fetchurl: " <> err)+        Right digest -> first snd (verifyFetchedDigest url out digest) --- | Download a URL to a strict 'BS.ByteString' using nova-nix's own linked--- HTTP client (the same 'Network.HTTP.Client' the substituter uses) - no--- external @curl@, which is what makes this a genuine builtin.  Any network--- exception is turned into a 'Left' so it becomes a clean build failure.-downloadUrl :: Text -> IO (Either Text BS.ByteString)-downloadUrl url = do-  attempt <- try fetch-  pure $ case attempt of-    Left (e :: SomeException) -> Left ("download error: " <> T.pack (show e))-    Right result -> result+-- | Nova's mirror extension uses the ASCII-whitespace-separated @urls@ field.+-- An absent field preserves the legacy single @url@ interface. An explicit+-- empty or malformed list is an error, rather than a silent fallback.+fetchUrlsFromEnv :: Map Text BS.ByteString -> Either Text (NonEmpty Text)+fetchUrlsFromEnv env = case Map.lookup envUrls env of+  Just bytes -> do+    text <- decode envUrls bytes+    maybe (Left "'urls' is empty") Right (NE.nonEmpty (filter (not . T.null) (T.split separator text)))+  Nothing -> case Map.lookup envUrl env of+    Nothing -> Left "derivation has no 'url' or 'urls'"+    Just bytes -> do+      url <- decode envUrl bytes+      if T.null url then Left "'url' is empty" else Right (url :| [])   where+    -- Match the fetcher expression's POSIX space class, preserving non-ASCII+    -- URL characters that 'T.words' would otherwise split into new candidates.+    separator char = isAscii char && isSpace char+    decode field = first (const ("'" <> field <> "' contains invalid UTF-8")) . TE.decodeUtf8'++-- | Ordered fallback policy, independent of HTTP and files. Only the first+-- successful /verified/ attempt wins; report every failure if none wins.+-- Exceptions propagate, so cancellation cannot start another download.+tryFetchUrlsWith :: (Monad m) => (Text -> m (Either Text a)) -> NonEmpty Text -> m (Either Text a)+tryFetchUrlsWith attempt = go []+  where+    go !failures (url :| rest) = do+      result <- attempt url+      case result of+        Right value -> pure (Right value)+        Left err -> case NE.nonEmpty rest of+          Nothing -> pure (Left (T.intercalate "\n" (reverse (err : failures))))+          Just urls -> go (err : failures) urls++-- | Download a URL to a file using nova-nix's own linked HTTP client+-- (the same 'Network.HTTP.Client' the substituter uses) - no external+-- @curl@, which is what makes this a genuine builtin.  The body streams+-- to disk through the incremental hash chunk by chunk, so memory stays+-- at chunk size no matter the download's size, and the returned digest+-- is of exactly the written bytes. Synchronous exceptions become a 'Left';+-- cancellation propagates through the shared build cleanup. Every attempt+-- opens the output in WriteMode and starts from the original hash context.+downloadUrlTo :: Text -> FilePath -> IncrementalHash -> IO (Either Text BS.ByteString)+downloadUrlTo url outPath ctx0 =+  fetch `catchSync` \err -> pure (Left ("download error: " <> T.pack (show err)))+  where     fetch :: IO (Either Text BS.ByteString)     fetch = do-      manager <- HTTP.newManager HTTPS.tlsManagerSettings+      manager <- HTTPS.getGlobalManager       request0 <- HTTP.parseRequest (T.unpack url)       let request = request0 {HTTP.requestHeaders = ("User-Agent", fetchUserAgent) : HTTP.requestHeaders request0}-      response <- HTTP.httpLbs request manager-      pure (bodyOrError response)-    bodyOrError response-      | code == httpStatusOk = Right (LBS.toStrict (HTTP.responseBody response))-      | otherwise = Left ("HTTP " <> T.pack (show code) <> " fetching " <> url)-      where-        code = HTTP.statusCode (HTTP.responseStatus response)+      HTTP.withResponse request manager $ \response -> do+        let code = HTTP.statusCode (HTTP.responseStatus response)+        if code /= httpStatusOk+          then pure (Left ("HTTP " <> T.pack (show code) <> " fetching " <> url))+          else System.IO.withBinaryFile outPath System.IO.WriteMode $ \handle ->+            let consume !ctx = do+                  chunk <- HTTP.brRead (HTTP.responseBody response)+                  if BS.null chunk+                    then pure (Right (hashFinalizeBytes ctx))+                    else do+                      BS.hPut handle chunk+                      consume (hashUpdateChunk ctx chunk)+             in consume ctx0  -- | Verify the fetched bytes against the derivation's fixed-output hash, read -- from the canonical output spec.  @doHashAlgo@ is @sha256@/@sha512@/... (or@@ -509,33 +994,53 @@ -- the download - and fail with a clear message rather than a wrong result. verifyFetchHash :: Text -> DerivationOutput -> BS.ByteString -> Either (Int, Text) () verifyFetchHash url out body-  | recursive =-      Left (1, "builtin:fetchurl: recursive outputHashMode (unpack/executable) not yet supported; fetch flat and unpack in a build phase")+  | recursive = Left (1, recursiveUnsupportedMessage)   | otherwise = case (hexToBytes (doHash out), rawHashWithAlgo algo body) of-      (Nothing, _) -> Left (1, "builtin:fetchurl: malformed expected hash for " <> url)+      (Nothing, _) -> Left (1, malformedExpectedHash url)       (_, Nothing) -> Left (1, "builtin:fetchurl: unsupported hash algorithm '" <> algo <> "'")-      (Just expected, Just got)-        | expected == got -> Right ()-        | otherwise ->-            Left-              ( 1,-                "builtin:fetchurl: hash mismatch for "-                  <> url-                  <> "\n  expected: "-                  <> algoField-                  <> ":"-                  <> doHash out-                  <> "\n  got:      "-                  <> algoField-                  <> ":"-                  <> bytesToHexText got-              )+      (Just _, Just got) -> verifyFetchedDigest url out got   where+    (recursive, algo) = splitHashMode (doHashAlgo out)++-- | Compare an already-computed digest of the fetched bytes against the+-- derivation's fixed-output hash - the streaming twin of+-- 'verifyFetchHash', which hashes a buffered body.+verifyFetchedDigest :: Text -> DerivationOutput -> BS.ByteString -> Either (Int, Text) ()+verifyFetchedDigest url out got = case hexToBytes (doHash out) of+  Nothing -> Left (1, malformedExpectedHash url)+  Just expected+    | expected == got -> Right ()+    | otherwise ->+        Left+          ( 1,+            "builtin:fetchurl: hash mismatch for "+              <> url+              <> "\n  expected: "+              <> algoField+              <> ":"+              <> doHash out+              <> "\n  got:      "+              <> algoField+              <> ":"+              <> bytesToHexText got+          )+  where     algoField = doHashAlgo out-    (recursive, algo) = case T.stripPrefix "r:" algoField of-      Just rest -> (True, rest)-      Nothing -> (False, algoField) +-- | Split @outputHashAlgo@ into the recursive-mode marker and the bare+-- algorithm name (@r:sha256@ is recursive @sha256@).+splitHashMode :: Text -> (Bool, Text)+splitHashMode algoField = case T.stripPrefix "r:" algoField of+  Just rest -> (True, rest)+  Nothing -> (False, algoField)++recursiveUnsupportedMessage :: Text+recursiveUnsupportedMessage =+  "builtin:fetchurl: recursive outputHashMode (unpack/executable) not yet supported; fetch flat and unpack in a build phase"++malformedExpectedHash :: Text -> Text+malformedExpectedHash url = "builtin:fetchurl: malformed expected hash for " <> url+ -- --------------------------------------------------------------------------- -- Output registration -- ---------------------------------------------------------------------------@@ -549,9 +1054,9 @@   Store ->   Derivation ->   FilePath ->-  [(Text, FilePath)] ->+  [OutputPlan] ->   IO BuildResult-registerOutputs config store drv _buildDir outputDirs = do+registerOutputs config store drv _buildDir plans = do   let -- Candidates for reference scanning: input sources, the input       -- derivations' realized OUTPUT paths, and this derivation's own outputs.       inputOutputs = fromRight [] (resolveInputOutputs config drv)@@ -560,12 +1065,19 @@       -- the caller (buildWithDeps) would need to pass it through.       -- Register with no deriver for now - queryDeriver will return Nothing.       drvPathText = Nothing-      -- (temp output dir, final store path) for every output, used to detect-      -- self- and cross-output references that appear as build-temp paths.-      tempPairs = [(outDir, doPath out) | (out, (_, outDir)) <- zip (drvOutputs drv) outputDirs]+      -- (fallback dir, the output it stood in for) for every already-valid+      -- output.  Nothing may reference one: the tree is discarded after the+      -- build, so a reference to it is a dangling edge, and upstream avoids+      -- the same thing by rewriting the hashes back out of the contents.+      -- Scanning for it and failing is louder and needs no rewriting.+      fallbackPairs =+        [ (storePathToFilePath (bcStoreDir config) (opScratch p), opFinal p)+        | p <- plans,+          opValid p+        ]   -- Phase 1: scan references and move each output into the store, collecting a   -- PathRegistration (no DB writes yet).  Already-valid outputs are skipped.-  prepared <- mapM (prepareOutput config store allCandidates tempPairs drvPathText) (zip (drvOutputs drv) outputDirs)+  prepared <- mapM (prepareOutput config store allCandidates fallbackPairs drvPathText) (zip (drvOutputs drv) plans)   case sequence prepared of     Left errMsg -> pure (BuildFailure errMsg 1)     Right regs -> do@@ -585,35 +1097,126 @@   [StorePath] ->   [(FilePath, StorePath)] ->   Maybe Text ->-  (DerivationOutput, (Text, FilePath)) ->+  (DerivationOutput, OutputPlan) ->   IO (Either Text (Maybe PathRegistration))-prepareOutput config store candidates tempPairs drvPathText (output, (_outName, outDir)) = do+prepareOutput config store candidates fallbackPairs drvPathText (output, plan) = do   let targetSP = doPath output       targetPath = storePathToFilePath (bcStoreDir config) targetSP+      outDir = storePathToFilePath (bcStoreDir config) (opScratch plan)   -- Check the build actually produced the output (file or directory).   exists <- doesPathExist outDir   if not exists     then pure (Left ("output missing: " <> T.pack outDir))     else do-      -- Validity is a DB fact, not mere disk presence: an output left on disk by-      -- an interrupted build is NOT valid and must be (re-)registered.+      -- Validity is a DB fact, not mere disk presence: an output left on disk+      -- by an interrupted run is NOT valid, and build outputs are not+      -- content-addressed, so a leftover cannot be verified against its path.+      -- Replace it with the freshly built output (upstream's delete-then-move+      -- at output registration) rather than adopt unverifiable bytes;+      -- 'removePathForcibly' clears read-only marks, so a tree an earlier run+      -- already marked read-only cannot wedge the replacement.       valid <- isValid store targetSP       if valid         then pure (Right Nothing)         else do-          onDisk <- doesPathExist targetPath-          -- Scan whichever artifact we will register: a leftover store path if-          -- present, otherwise the fresh build output.-          let scanPath = if onDisk then targetPath else outDir-          inputRefs <- scanReferences (bcStoreDir config) candidates scanPath-          selfRefs <- scanTempReferences tempPairs scanPath-          let refs = dedupStorePaths (inputRefs ++ selfRefs)-          reg <--            if onDisk-              then registrationFor store targetSP drvPathText refs-              else placeInStore store outDir targetSP drvPathText refs-          pure (Right (Just reg))+          -- The builder wrote straight into the store path, so there is+          -- nothing to clear: outDir IS targetPath.  A stale tree from an+          -- interrupted run was removed before the build, not here.+          --+          -- One scan, not two: 'candidates' already carries this+          -- derivation's own outputs, and outDir is the final path, so a+          -- self- or cross-output reference is an ordinary hit.+          leaked <- scanTempReferences fallbackPairs outDir+          case leaked of+            _ : _ -> do+              -- A fallback path is about to stop existing, so a produced+              -- output naming one would be registered with a dangling+              -- reference.  Fail loudly instead, and take the tree back+              -- out so no later run meets it.+              removePathForcibly outDir+              pure+                ( Left+                    ( "output "+                        <> doName output+                        <> " refers to the scratch path of an already-valid output ("+                        <> T.intercalate ", " [spName sp <> "@" <> spHash sp | sp <- leaked]+                        <> "); rebuild every output of this derivation instead"+                    )+                )+            [] -> do+              refs <- dedupStorePaths <$> scanReferences candidates outDir+              reg <- placeInStore store outDir targetSP drvPathText refs+              fixedCheck <- verifyFixedOutput output targetPath+              case fixedCheck of+                Left err -> do+                  -- Wrong bytes for a declared content address: remove the+                  -- placed tree so a later run cannot meet it on disk.+                  removePathForcibly targetPath+                  pure (Left err)+                Right () -> pure (Right (Just reg)) +-- | Re-check a placed fixed-output output against its declared hash.+-- A fixed-output derivation declares both its store path and, via the+-- output spec (@doHashAlgo@ + @doHash@), the exact content the path+-- must carry - but the builder process writes the actual bytes, so the+-- placed result must reproduce the declared digest before it may+-- register as valid (upstream: the fixed-output check in its+-- registerOutputs).  Flat mode hashes the output file's bytes;+-- recursive (@r:@) mode hashes the canonical NAR of the placed tree.+-- Non-fixed outputs (empty @doHashAlgo@) pass unchecked.+verifyFixedOutput :: DerivationOutput -> FilePath -> IO (Either Text ())+verifyFixedOutput out placedPath+  | T.null (doHashAlgo out) = pure (Right ())+  | recursive = do+      -- Re-serialises the placed tree: the registration's NAR hash is+      -- always sha256, while the declared algorithm may be any.+      entry <- ExecBit.serialiseFromPath placedPath+      pure (finish (rawHashWithAlgo algo (NAR.serialise entry)))+  | otherwise = do+      isDir <- doesDirectoryExist placedPath+      if isDir+        then pure (Left (subject <> ": flat outputHashMode, but the output is a directory"))+        else finish <$> hashFileWithAlgo algo placedPath+  where+    (recursive, algo) = splitHashMode (doHashAlgo out)+    subject = "fixed-output '" <> spName (doPath out) <> "'"+    finish Nothing =+      Left (subject <> ": unsupported hash algorithm '" <> algo <> "'")+    finish (Just got) = case hexToBytes (doHash out) of+      Nothing -> Left (subject <> ": malformed expected hash")+      Just expected+        | expected == got -> Right ()+        | otherwise ->+            Left+              ( subject+                  <> ": hash mismatch\n  expected: "+                  <> doHashAlgo out+                  <> ":"+                  <> doHash out+                  <> "\n  got:      "+                  <> doHashAlgo out+                  <> ":"+                  <> bytesToHexText got+              )++-- | Stream a file through the incremental hash without materializing it+-- (a fixed-output file is input-sized).  'Nothing' for an unsupported+-- algorithm.+hashFileWithAlgo :: Text -> FilePath -> IO (Maybe BS.ByteString)+hashFileWithAlgo algo path = case hashInitWithAlgo algo of+  Nothing -> pure Nothing+  Just initialCtx -> System.IO.withBinaryFile path System.IO.ReadMode $ \handle ->+    let consume !ctx = do+          chunk <- BS.hGet handle fixedOutputHashChunk+          if BS.null chunk+            then pure (Just (hashFinalizeBytes ctx))+            else consume (hashUpdateChunk ctx chunk)+     in consume initialCtx++-- | Read-chunk size for hashing a placed output file.+fixedOutputHashChunk :: Int+fixedOutputHashChunk = 65536+ -- | Deduplicate store paths by their (unique) hash. dedupStorePaths :: [StorePath] -> [StorePath] dedupStorePaths = Map.elems . Map.fromList . map (\sp -> (spHash sp, sp))@@ -679,11 +1282,12 @@         Nothing -> Left ("cannot read .drv file: " <> T.pack drvFilePath)         Just content -> fromATerm content --- | Read a file as Text, returning Nothing on any error.--- Used only for reading immutable .drv files from the store.-unsafeReadFile :: FilePath -> Maybe Text+-- | Read a file's raw bytes, returning Nothing on any error.  Used only+-- for reading immutable .drv files from the store - byte IO, never+-- text-mode (no locale decode, no newline translation).+unsafeReadFile :: FilePath -> Maybe BS.ByteString unsafeReadFile path =-  case System.IO.Unsafe.unsafePerformIO (try (TIO.readFile path)) of+  case System.IO.Unsafe.unsafePerformIO (try (BS.readFile path)) of     Left (_ :: SomeException) -> Nothing     Right content -> Just content @@ -721,7 +1325,11 @@ -- | Resolve a single dependency: check cache, try substitution, or build. resolveDep :: BuildConfig -> Store -> Derivation -> IO (Either Text DepStatus) resolveDep config store drv = do-  cached <- isOutputCached store drv+  -- Every output, not just the first: a derivation whose first output is+  -- valid and whose second was deleted would otherwise be logged cached+  -- and skipped, and the missing output would stay missing.  Upstream+  -- skips a build only when all of them are valid.+  cached <- isJust <$> allOutputsValid store drv   if cached     then pure (Right Cached)     else do@@ -735,34 +1343,77 @@             BuildFailure msg code ->               pure (Left ("exit " <> T.pack (show code) <> ": " <> msg)) --- | Check whether the first output of a derivation is already in the store.-isOutputCached :: Store -> Derivation -> IO Bool-isOutputCached store drv = case drvOutputs drv of-  (out : _) -> isValid store (doPath out)-  [] -> pure False- -- | Log dependency resolution status to stderr. logDepStatus :: DepStatus -> Derivation -> IO () logDepStatus status drv =   TIO.hPutStrLn System.IO.stderr ("  " <> statusTag status <> " " <> formatDrvName drv)  -- | Try to substitute all outputs of a derivation from binary caches.--- Returns True if all outputs were successfully substituted.+-- Returns True if every output was substituted or already valid.+--+-- Registration is all-or-nothing and batched: every output is verified+-- and unpacked first, then recorded in one 'registerPaths' transaction,+-- so cross-output reference edges land after both endpoints' rows exist+-- and a partial substitution registers nothing (the subsequent build+-- starts from unregistered outputs and 'prepareOutput' replaces the+-- leftover unpacked trees).+--+-- Each substituted output arrives with its path lock STILL HELD (see+-- 'Nix.Substituter.SubstSuccess'), and the exclusion must survive until+-- the registration transaction commits - released earlier, another+-- process could meet the unpacked-but-unregistered window and delete+-- the tree the row is about to describe.  Every held lock is released+-- here on every exit path (finally), including failures that never+-- reach registration.+--+-- A registration the database REFUSES - its unregistered-referent guard,+-- reachable only through cache-declared references this store has never+-- seen - is a substitution failure like any other: the transaction+-- recorded nothing, so report it and fall back to building locally. trySubstituteOutputs :: BuildConfig -> Store -> Derivation -> IO Bool trySubstituteOutputs config store drv   | null (bcCaches config) = pure False   | otherwise = do-      results <- mapM (trySubstitute store (bcCaches config) . doPath) (drvOutputs drv)-      pure (all isSubstSuccess results)+      heldLocks <- newIORef []+      registerSubstituted heldLocks+        `finally` (readIORef heldLocks >>= mapM_ releasePathLock)   where-    isSubstSuccess (SubstSuccess _) = True-    isSubstSuccess _ = False+    registerSubstituted :: IORef [PathLock] -> IO Bool+    registerSubstituted heldLocks = do+      results <- mapM (substituteOne heldLocks . doPath) (drvOutputs drv)+      case traverse substOutcome results of+        Nothing -> pure False+        Just outcomes -> do+          registered <- try (registerPaths (stDB store) (catMaybes outcomes))+          case registered of+            Right () -> pure True+            Left (e :: IOException) -> do+              TIO.hPutStrLn+                System.IO.stderr+                ("  [subst] registration refused, building instead: " <> T.pack (displayException e))+              pure False+    -- Record a returned lock the moment it exists, so the enclosing+    -- finally owns it even when a later output's attempt fails or+    -- throws.+    substituteOne heldLocks sp = do+      result <- trySubstitute store (bcCaches config) sp+      case result of+        SubstSuccess _ lock -> atomicModifyIORef' heldLocks (\locks -> (lock : locks, ()))+        _ -> pure ()+      pure result+    -- An already-valid output counts as substituted but contributes no+    -- registration row (and holds no lock).+    substOutcome (SubstSuccess reg _) = Just (Just reg)+    substOutcome SubstAlreadyValid = Just Nothing+    substOutcome SubstNotFound = Nothing+    substOutcome (SubstError _) = Nothing --- | Format a derivation name for status output.+-- | Format a derivation name for status output (display-only, so the+-- byte-string env value decodes lossily). formatDrvName :: Derivation -> Text formatDrvName drv =   case Map.lookup "name" (drvEnv drv) of-    Just n -> n+    Just n -> TE.decodeUtf8With lenientDecode n     Nothing -> case drvOutputs drv of       (out : _) -> spName (doPath out)       [] -> "<unknown>"

@@ -39,8 +39,16 @@     -- * Derivation environment keys     envSrcs, +    -- * Extraction budget+    UnpackLimits (..),+    defaultUnpackLimits,+     -- * Running     runBuiltinUnpack,++    -- * Path validation (exposed for testing)+    entryComponents,+    resolveLinkTarget,   ) where @@ -50,26 +58,28 @@ import Control.Exception (SomeException, try) import Control.Monad (when) import Data.Bits ((.&.))+import qualified Data.ByteString as BS import qualified Data.ByteString.Lazy as BL import Data.Char (toLower)+import Data.Int (Int64) import Data.List (isPrefixOf, isSuffixOf) import qualified Data.Map.Strict as Map import Data.Text (Text) import qualified Data.Text as T+import qualified Data.Text.Encoding as TE import Nix.Derivation (Derivation (..))+import qualified Nix.Store.ExecBit as ExecBit+import Nix.Store.Path (StoreDir, defaultStoreDir, parseStorePath, storePathToFilePath) import System.Directory   ( copyFile,     createDirectoryIfMissing,     doesDirectoryExist,     doesFileExist,     doesPathExist,-    getPermissions,+    getFileSize,     listDirectory,-    setOwnerExecutable,-    setPermissions,   )-import System.FilePath (isAbsolute, joinPath, splitDirectories, takeDirectory, (</>))-import qualified System.Info+import System.FilePath (isAbsolute, isPathSeparator, joinPath, splitDirectories, takeDirectory, (</>))  -- --------------------------------------------------------------------------- -- Named constants@@ -78,7 +88,8 @@ -- | The magic builder string for the built-in archive extractor.  A -- derivation with this builder is not executed as a process - the Builder -- extracts its @srcs@ archives into @$out@ (see 'runBuiltinUnpack').-builtinUnpackBuilder :: Text+-- Bytes, matching the 'drvBuilder' field it is compared against.+builtinUnpackBuilder :: BS.ByteString builtinUnpackBuilder = "builtin:unpack"  -- | Derivation environment key holding the whitespace-separated archive@@ -91,6 +102,37 @@ unpackOutputName :: Text unpackOutputName = "out" +-- | Extraction budget for one @builtin:unpack@ build, across every+-- archive in @srcs@: total bytes materialized and total filesystem+-- entries created.  Archive bytes decompress and expand with no+-- relation to their compressed size, so extraction without a budget+-- lets a small input produce an output with no upper bound.+data UnpackLimits = UnpackLimits+  { ulMaxBytes :: !Int64,+    ulMaxEntries :: !Int+  }+  deriving (Eq, Show)++-- | Default extraction budget: 4 GiB and one million entries.  The+-- MSYS2 toolchain seed decompresses to well under half of either, and+-- 4 GiB matches the largest NAR nova-cache's server accepts.+defaultUnpackLimits :: UnpackLimits+defaultUnpackLimits =+  UnpackLimits+    { ulMaxBytes = 4 * 1024 * 1024 * 1024,+      ulMaxEntries = 1000000+    }++-- | Charge one created entry plus its bytes against the remaining+-- budget; a breached budget is a loud extraction failure.+chargeBudget :: Text -> Int64 -> UnpackLimits -> Either Text UnpackLimits+chargeBudget label bytes (UnpackLimits remainingBytes remainingEntries)+  | remainingEntries < 1 =+      Left ("extraction exceeds the entry budget at: " <> label)+  | bytes > remainingBytes =+      Left ("extraction exceeds the size budget at: " <> label)+  | otherwise = Right (UnpackLimits (remainingBytes - bytes) (remainingEntries - 1))+ -- | Owner-execute bit of a tar header's mode field (octal @0o100@). ownerExecuteMode :: TarEntry.Permissions ownerExecuteMode = 0o100@@ -103,11 +145,6 @@ paxPerFileCode = 'x' paxGlobalCode = 'g' --- | True on a Windows host.  NTFS has no executable bit (PATHEXT decides),--- so tar mode bits are only materialized on Unix.-isWindowsHost :: Bool-isWindowsHost = System.Info.os == "mingw32"- -- --------------------------------------------------------------------------- -- Entry types after long-name decoding -- ---------------------------------------------------------------------------@@ -132,38 +169,55 @@ -- @Either (exit, msg) ()@ shape as the process runner, so the shared -- output-validation and registration path in "Nix.Builder" is reused -- unchanged.-runBuiltinUnpack :: Derivation -> [(Text, FilePath)] -> IO (Either (Int, Text) ())-runBuiltinUnpack drv outputDirs =+--+-- @srcs@ carries eval's canonical @\/nix\/store@ spelling, and the physical+-- root may live elsewhere - @C:\\nix\\store@ on Windows, where a bare+-- \/-rooted path resolves against the current DRIVE - so each entry is+-- parsed as a store path and rendered through the store dir rather than+-- opened verbatim (#101).  On Unix the rendering is the identity.+runBuiltinUnpack :: StoreDir -> UnpackLimits -> Derivation -> [(Text, FilePath)] -> IO (Either (Int, Text) ())+runBuiltinUnpack storeDir limits drv outputDirs =   case (Map.lookup envSrcs (drvEnv drv), lookup unpackOutputName outputDirs) of     (Nothing, _) -> failure "derivation has no 'srcs'"-    (Just srcs, _)-      | null (sourcePaths srcs) -> failure "'srcs' is empty"-    (_, Nothing) -> failure "derivation defines no 'out' output"-    (Just srcs, Just outDir) -> do-      createDirectoryIfMissing True outDir-      result <- unpackAll outDir (sourcePaths srcs)-      pure $ case result of-        Left msg -> Left (1, "builtin:unpack: " <> msg)-        Right () -> Right ()+    (Just srcsBytes, mOutDir) -> case TE.decodeUtf8' srcsBytes of+      -- Store paths are ASCII; a non-UTF-8 srcs value cannot name any.+      Left _ -> failure "'srcs' contains invalid UTF-8"+      Right srcs+        | null (T.words srcs) -> failure "'srcs' is empty"+        | otherwise -> case traverse resolveSrc (T.words srcs) of+            Left bad -> failure ("'srcs' entry is not a store path: " <> bad)+            Right archives -> case mOutDir of+              Nothing -> failure "derivation defines no 'out' output"+              Just outDir -> do+                createDirectoryIfMissing True outDir+                result <- unpackAll outDir limits archives+                pure $ case result of+                  Left msg -> Left (1, "builtin:unpack: " <> msg)+                  Right () -> Right ()   where     failure msg = pure (Left (1, "builtin:unpack: " <> msg))-    sourcePaths = map T.unpack . T.words+    resolveSrc word = case parseStorePath defaultStoreDir word of+      Just sp -> Right (storePathToFilePath storeDir sp)+      Nothing -> Left word --- | Extract archives in order, stopping at the first failure.-unpackAll :: FilePath -> [FilePath] -> IO (Either Text ())-unpackAll _ [] = pure (Right ())-unpackAll outDir (archive : rest) = do-  result <- unpackArchive outDir archive+-- | Extract archives in order, stopping at the first failure.  One+-- budget spans all of them: the caps bound the BUILD's output, not any+-- single archive.+unpackAll :: FilePath -> UnpackLimits -> [FilePath] -> IO (Either Text ())+unpackAll _ _ [] = pure (Right ())+unpackAll outDir budget (archive : rest) = do+  result <- unpackArchive outDir budget archive   case result of     Left err -> pure (Left err)-    Right () -> unpackAll outDir rest+    Right remaining -> unpackAll outDir remaining rest --- | Unpack one archive into @outDir@.  The decompressor is chosen by file--- extension; the tar stream is decoded (GNU + pax long names) and extracted--- entry by entry.  Decompression errors surface lazily mid-stream, so the--- whole extraction is exception-wrapped into a clean failure.-unpackArchive :: FilePath -> FilePath -> IO (Either Text ())-unpackArchive outDir archivePath = do+-- | Unpack one archive into @outDir@, returning the budget left for the+-- archives after it.  The decompressor is chosen by file extension; the+-- tar stream is decoded (GNU + pax long names) and extracted entry by+-- entry.  Decompression errors surface lazily mid-stream, so the whole+-- extraction is exception-wrapped into a clean failure.+unpackArchive :: FilePath -> UnpackLimits -> FilePath -> IO (Either Text UnpackLimits)+unpackArchive outDir budget archivePath = do   attempt <- try run   pure $ case attempt of     Left (e :: SomeException) ->@@ -174,7 +228,7 @@       Nothing -> pure (Left ("unsupported archive format: " <> T.pack archivePath))       Just decoder -> do         raw <- BL.readFile archivePath-        extractEntries outDir (Tar.decodeLongNames (Tar.read (decoder raw)))+        extractEntries outDir budget (Tar.decodeLongNames (Tar.read (decoder raw)))  -- | Choose a decompressor from the archive file name.  @.tar.zst@ (MSYS2 -- packages) and plain @.tar@ are supported.  MSYS2's zstd frames do not@@ -192,48 +246,58 @@ -- Entry extraction -- --------------------------------------------------------------------------- --- | Walk the entry stream, extracting each entry under @outDir@.-extractEntries :: FilePath -> DecodedEntries -> IO (Either Text ())+-- | Walk the entry stream, extracting each entry under @outDir@ and+-- threading the remaining extraction budget.+extractEntries :: FilePath -> UnpackLimits -> DecodedEntries -> IO (Either Text UnpackLimits) extractEntries outDir = go   where-    go stream = case stream of-      Tar.Done -> pure (Right ())+    go budget stream = case stream of+      Tar.Done -> pure (Right budget)       Tar.Fail err -> pure (Left ("malformed archive: " <> T.pack (show err)))       Tar.Next entry rest -> do-        result <- extractEntry outDir entry+        result <- extractEntry outDir budget entry         case result of           Left err -> pure (Left err)-          Right () -> go rest+          Right remaining -> go remaining rest  -- | Extract a single entry, after validating its path stays inside the -- archive root and skipping pacman package metadata.-extractEntry :: FilePath -> DecodedEntry -> IO (Either Text ())-extractEntry outDir entry =+extractEntry :: FilePath -> UnpackLimits -> DecodedEntry -> IO (Either Text UnpackLimits)+extractEntry outDir budget entry =   case entryComponents (TarEntry.entryTarPath entry) of     Left err -> pure (Left err)     -- The archive root itself (an entry for "." or "./").-    Right [] -> pure (Right ())+    Right [] -> pure (Right budget)     Right comps-      | isPackageMetadata comps -> pure (Right ())-      | otherwise -> extractContent outDir comps entry+      | isPackageMetadata comps -> pure (Right budget)+      | otherwise -> extractContent outDir budget comps entry --- | Extract a path-validated entry's content.  @comps@ is non-empty (the+-- | Extract a path-validated entry's content, charging every created+-- entry and its bytes against the budget.  @comps@ is non-empty (the -- empty case is consumed by 'extractEntry').-extractContent :: FilePath -> [FilePath] -> DecodedEntry -> IO (Either Text ())-extractContent outDir comps entry =+extractContent :: FilePath -> UnpackLimits -> [FilePath] -> DecodedEntry -> IO (Either Text UnpackLimits)+extractContent outDir budget comps entry =   case TarEntry.entryContent entry of-    Tar.Directory -> do-      createDirectoryIfMissing True dest-      pure (Right ())-    Tar.NormalFile bytes _size -> do-      fresh <- freshDestination dest-      case fresh of+    Tar.Directory ->+      case chargeBudget pathText 0 budget of         Left err -> pure (Left err)-        Right () -> do-          createDirectoryIfMissing True (takeDirectory dest)-          BL.writeFile dest bytes-          when (executableEntry entry && not isWindowsHost) (markExecutable dest)-          pure (Right ())+        Right remaining -> do+          createDirectoryIfMissing True dest+          pure (Right remaining)+    Tar.NormalFile bytes size ->+      -- The header size is charged before the lazy content is realized,+      -- so a breach rejects the entry rather than materializing it.+      case chargeBudget pathText size budget of+        Left err -> pure (Left err)+        Right remaining -> do+          fresh <- freshDestination dest+          case fresh of+            Left err -> pure (Left err)+            Right () -> do+              createDirectoryIfMissing True (takeDirectory dest)+              BL.writeFile dest bytes+              when (executableEntry entry) (ExecBit.markExecutable dest)+              pure (Right remaining)     -- A symlink target is relative to the link's own directory.     Tar.SymbolicLink target ->       copyLinkTarget "symlink" (resolveLinkTarget parentComps target)@@ -241,7 +305,7 @@     Tar.HardLink target ->       copyLinkTarget "hardlink" (entryComponents target)     Tar.OtherEntryType code _ _-      | code == paxPerFileCode || code == paxGlobalCode -> pure (Right ())+      | code == paxPerFileCode || code == paxGlobalCode -> pure (Right budget)       | otherwise ->           pure (Left ("unsupported tar entry type '" <> T.singleton code <> "': " <> pathText))     Tar.CharacterDevice _ _ -> unsupportedSpecial "character device"@@ -266,12 +330,27 @@           case fresh of             Left err -> pure (Left err)             Right () -> do-              createDirectoryIfMissing True (takeDirectory dest)-              copyFile targetPath dest-              pure (Right ())+              size <- getFileSize targetPath+              case chargeBudget pathText (fromIntegral size) budget of+                Left err -> pure (Left err)+                Right remaining -> do+                  createDirectoryIfMissing True (takeDirectory dest)+                  copyFile targetPath dest+                  -- copyFile carries the unnamed stream only, so on+                  -- Windows a hardlink entry materialized as a copy would+                  -- arrive without its target's exec mark.+                  ExecBit.copyExecMark targetPath dest+                  pure (Right remaining)       | isDir = do-          copyTree targetPath dest-          pure (Right ())+          -- The same collision guard as regular entries: without it a+          -- directory link copy silently merges into content another+          -- archive extracted, making the result entry-order-dependent.+          fresh <- freshDestination dest+          case fresh of+            Left err -> pure (Left err)+            Right () -> case chargeBudget pathText 0 budget of+              Left err -> pure (Left err)+              Right remaining -> copyTree remaining targetPath dest       | otherwise =           pure             ( Left@@ -294,6 +373,7 @@ entryComponents :: FilePath -> Either Text [FilePath] entryComponents raw   | isAbsolute raw = Left ("absolute entry path: " <> T.pack raw)+  | startsAtRoot comps = Left ("rooted entry path: " <> T.pack raw)   | ".." `elem` comps = Left ("entry path escapes archive root: " <> T.pack raw)   | any (elem ':') comps = Left ("entry path contains ':': " <> T.pack raw)   | otherwise = Right comps@@ -306,6 +386,7 @@ resolveLinkTarget :: [FilePath] -> FilePath -> Either Text [FilePath] resolveLinkTarget parentComps target   | isAbsolute target = Left ("absolute symlink target: " <> T.pack target)+  | startsAtRoot targetComps = Left ("rooted symlink target: " <> T.pack target)   | otherwise = walk (reverse parentComps) targetComps   where     targetComps = filter (/= ".") (splitDirectories target)@@ -318,6 +399,19 @@         | ':' `elem` comp -> Left ("symlink target contains ':': " <> T.pack target)         | otherwise -> walk (comp : stack) rest +-- | True when the first path component is a bare separator, i.e. a path rooted+-- at the current drive rather than a named location (a leading @/@ or @\\@ with+-- no drive letter).  On Windows 'isAbsolute' returns 'False' for such paths -+-- it wants a drive letter or a UNC prefix - yet 'System.FilePath.combine' still+-- discards the output directory when the right operand begins with a separator,+-- so joining one onto @outDir@ drops @outDir@ and the write lands at the drive+-- root.  'isPathSeparator' follows the host convention, so on POSIX a leading+-- @\\@ is an ordinary filename character and correctly is not treated as rooted.+startsAtRoot :: [FilePath] -> Bool+startsAtRoot comps = case comps of+  (comp : _) -> not (null comp) && all isPathSeparator comp+  [] -> False+ -- | pacman package metadata at the archive root (@.PKGINFO@, @.BUILDINFO@, -- @.MTREE@, @.INSTALL@): describes the package to pacman, is not part of the -- installed tree, and collides across packages when several archives merge@@ -346,24 +440,35 @@ executableEntry :: DecodedEntry -> Bool executableEntry entry = TarEntry.entryPermissions entry .&. ownerExecuteMode /= 0 --- | Materialize the executable bit on Unix hosts.-markExecutable :: FilePath -> IO ()-markExecutable path = do-  perms <- getPermissions path-  setPermissions path (setOwnerExecutable True perms)- -- | Recursively copy a directory tree (used to materialize directory--- symlinks, which cannot be store-portable links on Windows).-copyTree :: FilePath -> FilePath -> IO ()-copyTree src dest = do+-- symlinks, which cannot be store-portable links on Windows), charging+-- every created entry and byte against the budget: each tree copy+-- duplicates content already extracted and charged once, so uncharged+-- copies would let K link entries multiply the output roughly 2^K-fold.+copyTree :: UnpackLimits -> FilePath -> FilePath -> IO (Either Text UnpackLimits)+copyTree budget0 src dest = do   createDirectoryIfMissing True dest   names <- listDirectory src-  mapM_ copyOne names+  go budget0 names   where-    copyOne name = do+    go budget [] = pure (Right budget)+    go budget (name : rest) = do       let from = src </> name           to = dest </> name       isDir <- doesDirectoryExist from-      if isDir-        then copyTree from to-        else copyFile from to+      copied <-+        if isDir+          then case chargeBudget (T.pack to) 0 budget of+            Left err -> pure (Left err)+            Right remaining -> copyTree remaining from to+          else do+            size <- getFileSize from+            case chargeBudget (T.pack to) (fromIntegral size) budget of+              Left err -> pure (Left err)+              Right remaining -> do+                copyFile from to+                ExecBit.copyExecMark from to+                pure (Right remaining)+      case copied of+        Left err -> pure (Left err)+        Right remaining -> go remaining rest

@@ -12,9 +12,11 @@      -- * NIX_PATH parsing     parseNixPath,+    splitNixPath,   ) where +import Data.Char (isAsciiLower, isAsciiUpper) import Data.Int (Int64) import qualified Data.Map.Strict as Map import Data.Text (Text)@@ -22,7 +24,7 @@ import Foreign.Ptr (nullPtr) import Nix.Eval (Env (..), NixValue (..), Thunk (..), attrSetFromMap, builtinNames, currentSystemStr, evaluated) import Nix.Eval.Types (clistFromThunks, mkStr, newCEnv, thunkToCPtr)-import Nix.Store.Path (platformStoreDirText)+import Nix.Store.Path (defaultStoreDirText)  -- | The initial environment containing all builtins. --@@ -38,33 +40,39 @@ builtinEnv :: Int64 -> [Thunk] -> Env builtinEnv timestamp searchPaths =   let scope =-        attrSetFromMap $-          Map.fromList $-            -- Values-            [ ("true", evaluated (VBool True)),-              ("false", evaluated (VBool False)),-              ("null", evaluated VNull),-              ("builtins", evaluated (builtinsAttrSet timestamp searchPaths)),-              -- Search path support: <name> desugars to __findFile __nixPath "name"-              -- (matching C++ Nix's parser desugaring).-              ("__findFile", evaluated (VBuiltin "findFile" [])),-              ("__nixPath", evaluated (VList (clistFromThunks (map thunkToCPtr searchPaths))))-            ]-              -- Top-level builtin functions (available without builtins. prefix)-              ++ map topLevelBuiltin topLevelBuiltinNames+        attrSetFromMap+          $ Map.fromList+          $+          -- Values+          [ ("true", evaluated (VBool True)),+            ("false", evaluated (VBool False)),+            ("null", evaluated VNull),+            ("builtins", evaluated (builtinsAttrSet timestamp searchPaths)),+            -- Search path support: <name> desugars to __findFile __nixPath "name"+            -- (matching C++ Nix's parser desugaring).+            ("__findFile", evaluated (VBuiltin "findFile" [])),+            ("__nixPath", evaluated (VList (clistFromThunks (map thunkToCPtr searchPaths))))+          ]+            -- Top-level builtin functions (available without builtins. prefix)+            ++ map topLevelBuiltin topLevelBuiltinNames    in newCEnv nullPtr 0 (Just scope) Nothing nullPtr 0  -- | Builtins exposed at the top level (without @builtins.@ prefix). -- This matches real Nix - nixpkgs uses these unqualified everywhere.+-- Exactly upstream's unprefixed surface: fetchurl and toFile are+-- deliberately NOT here (upstream exposes them only under @builtins.@,+-- and nixpkgs relies on @with pkgs; fetchurl@ binding pkgs.fetchurl). topLevelBuiltinNames :: [Text] topLevelBuiltinNames =   [ "abort",     "baseNameOf",+    "break",     "derivation",+    "derivationStrict",     "dirOf",     "fetchGit",     "fetchTarball",-    "fetchurl",+    "fromTOML",     "import",     "isNull",     "map",@@ -72,7 +80,6 @@     "removeAttrs",     "scopedImport",     "throw",-    "toFile",     "toString"   ] @@ -102,7 +109,10 @@     [ ("true", evaluated (VBool True)),       ("false", evaluated (VBool False)),       ("null", evaluated VNull),-      ("storeDir", evaluated (mkStr platformStoreDirText)),+      -- Canonical, not platform: eval-visible store paths carry the+      -- /nix/store spelling on every platform, and storeDir must agree+      -- with them (upstream returns the store dir its paths are under).+      ("storeDir", evaluated (mkStr defaultStoreDirText)),       ("nixVersion", evaluated (mkStr "2.24.0")),       ("langVersion", evaluated (VInt 6)),       ("nixPath", evaluated (VList (clistFromThunks (map thunkToCPtr searchPaths)))),@@ -142,20 +152,48 @@                 )             ) --- | Split a NIX_PATH string on colon separators, respecting Windows--- drive letters.  A colon followed by @\\@ or @/@ (e.g. @C:\\@) is--- part of a path, not a separator.+-- | Split a NIX_PATH string on colon separators.  A colon stays part of+-- its entry, rather than separating, in exactly two shapes:+--+-- * a URL colon - followed by @//@ - so an entry like+--   @nixpkgs=https://example.com/nixpkgs.tar.gz@ stays whole (upstream's+--   NIX_PATH parser keeps pseudo-URL entries whole);+-- * a Windows drive colon - preceded by a single ASCII letter that opens+--   the entry or follows @=@, and followed by @\\@ or @/@ - so @C:\\x@,+--   @C:/x@, and @nixpkgs=C:\\x@ stay whole.+--+-- Every other colon separates, so a Unix-style list of absolute paths+-- (@/foo:/bar@) splits at each colon: @/foo@ does not end in a drive+-- letter, and a lone @/@ after the colon is not a URL. splitNixPath :: Text -> [Text]-splitNixPath = go T.empty+splitNixPath = go []   where-    go acc remaining = case T.uncons remaining of-      Nothing -> [acc | not (T.null acc)]-      Just (':', rest)-        | isDriveSep rest -> go (acc <> ":" <> T.take 1 rest) (T.drop 1 rest)-        | otherwise -> acc : go T.empty rest-      Just (c, rest) -> go (T.snoc acc c) rest-    -- After a colon, if the next char is \ or /, it's a drive letter-    isDriveSep t = case T.uncons t of-      Just ('\\', _) -> True-      Just ('/', _) -> True-      _ -> False+    -- Accumulates reversed chunks and concatenates once per entry, so a+    -- long entry costs O(n) instead of the O(n^2) of per-character snoc.+    go !chunks remaining =+      let (chunk, rest) = T.break (== ':') remaining+       in case T.uncons rest of+            Nothing ->+              let entry = T.concat (reverse (chunk : chunks))+               in [entry | not (T.null entry)]+            Just (_, afterColon)+              | keepsColon (null chunks) chunk afterColon ->+                  go (T.take 1 afterColon : ":" : chunk : chunks) (T.drop 1 afterColon)+              | otherwise ->+                  T.concat (reverse (chunk : chunks)) : go [] afterColon+    -- Whether the colon between chunk and afterColon is a URL or drive+    -- colon (the two shapes above).  atEntryStart says chunk opens its+    -- entry (nothing absorbed before it), so a lone letter can only be a+    -- drive letter there.+    keepsColon atEntryStart chunk afterColon+      | T.isPrefixOf "//" afterColon = True+      | startsWithPathSep afterColon = endsInDriveLetter atEntryStart chunk+      | otherwise = False+    startsWithPathSep t = case T.uncons t of+      Just (c, _) -> c == '/' || c == '\\'+      Nothing -> False+    endsInDriveLetter atEntryStart chunk = case T.unsnoc chunk of+      Just (beforeLetter, letter) ->+        (isAsciiUpper letter || isAsciiLower letter)+          && (T.isSuffixOf "=" beforeLetter || (atEntryStart && T.null beforeLetter))+      Nothing -> False

@@ -0,0 +1,66 @@+-- | The narinfo compression register - one vocabulary for every+-- consumer (the substituter's dispatch, and push once it writes+-- compressed objects), so the accepted set exists exactly once and+-- cannot drift between encodings.+--+-- Upstream note: C++ Nix decodes an absent or empty @Compression@+-- field as @bzip2@ (the field's historical default).  nova-cache's+-- parser defaults only the ABSENT key; a present-but-empty+-- @Compression:@ line parses to the empty string and arrives here+-- verbatim, so this register handles that spelling itself - the+-- 'T.null' branch is reached by ordinary narinfos off the wire and is+-- not dead code.  Both spellings decode to 'CompressionBzip2', so+-- such a narinfo substitutes exactly as upstream would rather than+-- failing over a field that looks like nothing at all.+module Nix.Compression+  ( NarCompression (..),+    parseNarCompression,+    compressionNameNone,+    compressionNameXz,+    compressionNameZstd,+    compressionNameBzip2,+  )+where++import Data.Text (Text)+import qualified Data.Text as T++-- | A compression codec the substituter can decode.  Parsing into this+-- sum happens once at the narinfo boundary; every dispatch downstream+-- is an exhaustive match, so a new codec is added by extending the type+-- and following the compiler.+data NarCompression+  = CompressionNone+  | CompressionXz+  | CompressionZstd+  | CompressionBzip2+  deriving (Eq, Show)++-- | The wire spelling of the identity codec.+compressionNameNone :: Text+compressionNameNone = "none"++-- | The wire spelling of the xz codec (cache.nixos.org's format).+compressionNameXz :: Text+compressionNameXz = "xz"++-- | The wire spelling of the zstd codec (the modern caches' format,+-- and the compression @nova-nix push@ can produce).+compressionNameZstd :: Text+compressionNameZstd = "zstd"++-- | The wire spelling of the bzip2 codec (the historical caches'+-- format, and what upstream decodes an absent field as).+compressionNameBzip2 :: Text+compressionNameBzip2 = "bzip2"++-- | Parse a narinfo @Compression@ value.  Unsupported codecs reject by+-- name; the empty string decodes as the codec upstream defaults it to+-- (see the module header).+parseNarCompression :: Text -> Either Text NarCompression+parseNarCompression name+  | name == compressionNameNone = Right CompressionNone+  | name == compressionNameXz = Right CompressionXz+  | name == compressionNameZstd = Right CompressionZstd+  | name == compressionNameBzip2 || T.null name = Right CompressionBzip2+  | otherwise = Left ("unsupported compression: " <> name)

@@ -0,0 +1,190 @@+-- | Nix configuration: the @nix.conf@ / @NIX_CONFIG@ settings that decide+-- which binary caches a machine substitutes from and which public keys it+-- trusts.+--+-- == The format+--+-- One @name = value@ assignment per line.  A @#@ truncates the rest of the+-- line (a comment).  A list value is whitespace separated.  These are the+-- rules upstream's @parseConfigFiles@ applies (comment truncation, no line+-- continuation, whitespace tokenizing), matched here.+--+-- == Precedence+--+-- Sources are folded weakest first, so a later source overrides an earlier+-- one.  A plain assignment REPLACES the accumulated value; an @extra-@+-- prefixed assignment APPENDS to it.  The caller supplies the sources in+-- order (built-in default, then files, then @NIX_CONFIG@, then the command+-- line), so the command line wins, exactly as upstream orders them.+--+-- == Security+--+-- @trusted-public-keys@ decides which signatures a substituted path is+-- accepted under.  The precedence is therefore load bearing: a source that+-- REPLACES the trusted set where it should APPEND, or an @extra-@ that is+-- mishandled, silently widens what the machine trusts.  The fold here is+-- pure and total so the whole rule set can be tested directly.+--+-- Not yet modelled (tracked separately): @include@ \/ @!include@+-- directives, the @\/etc\/nix@ system file and the @XDG_CONFIG_DIRS@+-- cascade.  A line opening with @include@ is refused loudly rather than+-- silently skipped, so a config that depends on one fails visibly.+module Nix.Config+  ( -- * Resolved settings+    NixConfig (..),+    defaultNixConfig,++    -- * Parsing and folding+    ConfigAssignment (..),+    parseConfigText,+    applyAssignment,+    applyConfigText,+    resolveConfig,+  )+where++import Data.Text (Text)+import qualified Data.Text as T++-- ---------------------------------------------------------------------------+-- Settings+-- ---------------------------------------------------------------------------++-- | The subset of Nix settings that this layer resolves: the binary caches+-- to try and the public keys their signatures are trusted under.  Both are+-- ordered lists (upstream's @substituters@ is a @Strings@, and+-- @trusted-public-keys@ is too); order is preserved on write, though it+-- does not affect key acceptance (any trusted key is enough).+data NixConfig = NixConfig+  { ncSubstituters :: ![Text],+    ncTrustedPublicKeys :: ![Text]+  }+  deriving (Eq, Show)++-- | The baseline the fold starts from: no substituters and no trusted+-- keys.  This is nova-nix's existing default (nothing is substituted+-- unless configured), a deliberate divergence from upstream's+-- cache.nixos.org default: turning a cache on for every machine is the+-- operator's decision to make in a config file, not a built-in.+defaultNixConfig :: NixConfig+defaultNixConfig = NixConfig {ncSubstituters = [], ncTrustedPublicKeys = []}++-- ---------------------------------------------------------------------------+-- Parsing+-- ---------------------------------------------------------------------------++-- | One parsed @name = value@ assignment, before its name is resolved+-- against the known settings and aliases.+data ConfigAssignment = ConfigAssignment+  { caName :: !Text,+    caValue :: !Text+  }+  deriving (Eq, Show)++-- | Parse config text into ordered assignments.  Comments and blank lines+-- drop out; a malformed line (fewer than @name = value@, or a missing+-- @=@) is a loud error rather than a silent skip, matching upstream's+-- @UsageError@ - a typo in a security-relevant file must not pass for an+-- empty setting.  An @include@ \/ @!include@ line is refused as not yet+-- supported.+parseConfigText :: Text -> Either Text [ConfigAssignment]+parseConfigText = traverse parseLine . filter (not . isBlank) . map stripComment . T.lines+  where+    isBlank line = null (T.words line)+    stripComment = T.takeWhile (/= '#')+    parseLine line = case T.words line of+      (directive : _)+        | directive == includeDirective || directive == bangIncludeDirective ->+            Left ("nix.conf: '" <> directive <> "' is not supported yet")+      (name : eq : valueTokens)+        | eq == assignEq -> Right (ConfigAssignment name (T.unwords valueTokens))+      _ -> Left ("nix.conf: syntax error in line '" <> T.strip line <> "'")++-- ---------------------------------------------------------------------------+-- Applying+-- ---------------------------------------------------------------------------++-- | Apply one assignment to the accumulated config.  The name is resolved+-- through the aliases (@binary-caches@ -> @substituters@,+-- @binary-cache-public-keys@ -> @trusted-public-keys@) and the @extra-@+-- prefix (append rather than replace).  A name outside the known set is+-- ignored, not an error: upstream warns and continues, and refusing every+-- unknown key would reject a config that also carries settings this layer+-- does not model yet.+applyAssignment :: NixConfig -> ConfigAssignment -> NixConfig+applyAssignment config (ConfigAssignment name value) =+  case resolveName name of+    Nothing -> config+    Just (field, mode) ->+      let parsed = T.words value+       in setField field (combine mode (getField field config) parsed) config+  where+    combine ReplaceMode _ new = new+    combine AppendMode old new = old ++ new++-- | Which list a setting name targets, once the @extra-@ prefix and the+-- aliases are resolved, and whether it replaces or appends.+resolveName :: Text -> Maybe (ConfigField, ApplyMode)+resolveName name =+  case T.stripPrefix extraPrefix name of+    Just base -> tag AppendMode (baseField base)+    Nothing -> tag ReplaceMode (baseField name)+  where+    tag mode mField = case mField of+      Just field -> Just (field, mode)+      Nothing -> Nothing+    baseField n+      | n == substitutersKey || n == substitutersAlias = Just SubstitutersField+      | n == trustedKeysKey || n == trustedKeysAlias = Just TrustedKeysField+      | otherwise = Nothing++-- | The two list settings this layer resolves.+data ConfigField = SubstitutersField | TrustedKeysField+  deriving (Eq, Show)++-- | Whether an assignment replaces the accumulated value or appends to it.+data ApplyMode = ReplaceMode | AppendMode+  deriving (Eq, Show)++getField :: ConfigField -> NixConfig -> [Text]+getField SubstitutersField = ncSubstituters+getField TrustedKeysField = ncTrustedPublicKeys++setField :: ConfigField -> [Text] -> NixConfig -> NixConfig+setField SubstitutersField v config = config {ncSubstituters = v}+setField TrustedKeysField v config = config {ncTrustedPublicKeys = v}++-- | Parse and apply one source's text onto the accumulated config.+applyConfigText :: NixConfig -> Text -> Either Text NixConfig+applyConfigText config text = foldl applyAssignment config <$> parseConfigText text++-- | Fold a list of sources onto the default config, weakest first.  The+-- caller orders the list so the command line is last (and so wins); a+-- parse error in any source aborts, since a security-relevant file that+-- does not parse must not be treated as absent.+resolveConfig :: [Text] -> Either Text NixConfig+resolveConfig = foldl step (Right defaultNixConfig)+  where+    step acc source = acc >>= \config -> applyConfigText config source++-- ---------------------------------------------------------------------------+-- Setting names+-- ---------------------------------------------------------------------------++substitutersKey, substitutersAlias :: Text+substitutersKey = "substituters"+substitutersAlias = "binary-caches"++trustedKeysKey, trustedKeysAlias :: Text+trustedKeysKey = "trusted-public-keys"+trustedKeysAlias = "binary-cache-public-keys"++extraPrefix :: Text+extraPrefix = "extra-"++assignEq :: Text+assignEq = "="++includeDirective, bangIncludeDirective :: Text+includeDirective = "include"+bangIncludeDirective = "!include"

@@ -22,7 +22,6 @@   ) where -import Data.List (foldl') import Data.Map.Strict (Map) import qualified Data.Map.Strict as Map import Data.Maybe (fromMaybe)@@ -180,16 +179,21 @@  -- | All transitive dependencies of a store path (not including itself). transitiveDeps :: DepGraph -> StorePath -> Set StorePath-transitiveDeps (DepGraph graph) root = go Set.empty (Seq.singleton root)+transitiveDeps (DepGraph graph) root =+  Set.delete root (go (Set.singleton root) (Seq.singleton root))   where-    go visited queue = case Seq.viewl queue of+    -- visited marks ENQUEUED nodes - the root is seeded, so a+    -- self-dependent root is expanded once instead of recursing forever.+    go !visited queue = case Seq.viewl queue of       Seq.EmptyL -> visited-      sp Seq.:< rest-        | Set.member sp visited -> go visited rest-        | otherwise ->-            let deps = maybe [] dnDeps (Map.lookup sp graph)-                visitedWithDep = if sp == root then visited else Set.insert sp visited-             in go visitedWithDep (foldl' (|>) rest deps)+      sp Seq.:< rest ->+        enqueueFresh visited rest (maybe [] dnDeps (Map.lookup sp graph))+    -- Mark and enqueue each dep not yet seen, then continue the walk.+    enqueueFresh !visited !queue deps = case deps of+      [] -> go visited queue+      (dep : more)+        | Set.member dep visited -> enqueueFresh visited queue more+        | otherwise -> enqueueFresh (Set.insert dep visited) (queue |> dep) more  -- | Direct dependencies of a store path. directDeps :: DepGraph -> StorePath -> [StorePath]

@@ -66,6 +66,11 @@   ) where +import Data.ByteString (ByteString)+import qualified Data.ByteString as BS+import qualified Data.ByteString.Builder as B+import qualified Data.ByteString.Char8 as BC+import qualified Data.ByteString.Lazy as LBS import Data.Function (on) import Data.List (sortBy) import Data.Map.Strict (Map)@@ -73,7 +78,9 @@ import qualified Data.Set as Set import Data.Text (Text) import qualified Data.Text as T-import Nix.Store.Path (StorePath (..))+import qualified Data.Text.Encoding as TE+import Data.Text.Encoding.Error (lenientDecode)+import Nix.Store.Path (StorePath) import qualified Nix.Store.Path as SP import qualified System.Info as SI @@ -146,6 +153,13 @@   deriving (Eq, Show)  -- | A complete derivation - everything needed to build a package.+--+-- The builder, args, and env VALUES are byte strings: they are coerced+-- Nix strings, which carry arbitrary bytes, and they flow byte-exact+-- into the ATerm (and therefore the @.drv@ hash and every output path).+-- Env KEYS are attr names, which nova-nix constrains to valid UTF-8+-- 'Text'; for valid UTF-8, Text ordering equals byte ordering, so the+-- sorted env section matches upstream's bytewise @std::map@ order. data Derivation = Derivation   { -- | What this derivation produces.     drvOutputs :: ![DerivationOutput],@@ -156,19 +170,21 @@     -- | Target platform: "x86_64-linux", "x86_64-windows", etc.     drvPlatform :: !Platform,     -- | The builder executable (store path to bash, or other).-    drvBuilder :: !Text,+    drvBuilder :: !ByteString,     -- | Arguments to the builder.-    drvArgs :: ![Text],+    drvArgs :: ![ByteString],     -- | Environment variables for the build.-    drvEnv :: !(Map Text Text)+    drvEnv :: !(Map Text ByteString)   }   deriving (Eq, Show)  -- | Serialize a derivation to ATerm format (the .drv file format).--- This serialization is what gets hashed to compute the store path.+-- This serialization is what gets hashed to compute the store path,+-- so the result is BYTES: env values, args, and the builder land in it+-- exactly as coerced, with no encoding step in between. -- -- Format: @Derive([outputs],[inputDrvs],[inputSrcs],platform,builder,[args],[env])@-toATerm :: Derivation -> Text+toATerm :: Derivation -> ByteString toATerm = toATermForHash False Nothing  -- | Serialize a derivation for HASHING, with the two knobs the Nix@@ -184,23 +200,25 @@ --     input's path spelling (not its content) hash identically. -- -- @toATermForHash False Nothing@ is exactly 'toATerm'.-toATermForHash :: Bool -> Maybe [(Text, [Text])] -> Derivation -> Text+toATermForHash :: Bool -> Maybe [(Text, [Text])] -> Derivation -> ByteString toATermForHash maskOutputs inputSubst drv =-  "Derive("-    <> atermOutputsWith maskOutputs (drvOutputs drv)-    <> ","-    <> inputDrvsSection-    <> ","-    <> atermInputSrcs (drvInputSrcs drv)-    <> ","-    <> atermString (platformToText (drvPlatform drv))-    <> ","-    <> atermString (drvBuilder drv)-    <> ","-    <> atermStringList (drvArgs drv)-    <> ","-    <> atermEnv (drvEnv drv)-    <> ")"+  LBS.toStrict+    $ B.toLazyByteString+    $ "Derive("+      <> atermOutputsWith maskOutputs (drvOutputs drv)+      <> ","+      <> inputDrvsSection+      <> ","+      <> atermInputSrcs (drvInputSrcs drv)+      <> ","+      <> atermStringT (platformToText (drvPlatform drv))+      <> ","+      <> atermString (drvBuilder drv)+      <> ","+      <> atermList (map atermString (drvArgs drv))+      <> ","+      <> atermEnv (drvEnv drv)+      <> ")"   where     inputDrvsSection = case inputSubst of       Nothing -> atermInputDrvs (drvInputDrvs drv)@@ -209,30 +227,37 @@ -- | Serialize outputs: @[(name,path,hashAlgo,hash)]@, sorted by output name. -- When @maskOutputs@ is set, every path is rendered as @\"\"@ (used by the -- masked modulo hash, where output paths aren't known yet).-atermOutputsWith :: Bool -> [DerivationOutput] -> Text+atermOutputsWith :: Bool -> [DerivationOutput] -> B.Builder atermOutputsWith maskOutputs outs =   let sorted = sortBy (compare `on` doName) outs-   in "[" <> T.intercalate "," (map render sorted) <> "]"+   in atermList (map render sorted)   where     render out =       "("-        <> atermString (doName out)+        <> atermStringT (doName out)         <> ","-        <> atermString (if maskOutputs then "" else SP.storePathToText SP.defaultStoreDir (doPath out))+        <> atermStringT (if maskOutputs then "" else SP.storePathToText SP.defaultStoreDir (doPath out))         <> ","-        <> atermString (doHashAlgo out)+        <> atermStringT (doHashAlgo out)         <> ","-        <> atermString (doHash out)+        <> atermStringT (doHash out)         <> ")"  -- | Input-derivations serializer for the modulo substitution: keys are the--- modulo-hash hex strings (sorted), output-name lists sorted and deduplicated.-atermInputDrvsSubst :: [(Text, [Text])] -> Text+-- modulo-hash hex strings.  Entries that share a key are merged, unioning+-- their output-name sets, so the section carries one entry per distinct modulo+-- hash - mirroring upstream @hashDerivationModulo@'s @std::map<Hash, StringSet>@,+-- where two inputs that collapse to the same modulo hash (e.g. two fetches+-- differing only in URL) become a single entry.  'Set.union' makes the merge+-- order-independent; 'Map.toAscList' and 'Set.toAscList' fix the ascending+-- hex-key and output-name order (hex is lowercase, so this matches the bytewise+-- order of upstream's @std::map<std::string>@).+atermInputDrvsSubst :: [(Text, [Text])] -> B.Builder atermInputDrvsSubst subs =-  let sorted = sortBy (compare `on` fst) subs-   in "[" <> T.intercalate "," (map render sorted) <> "]"+  let merged = Map.fromListWith Set.union [(key, Set.fromList outs) | (key, outs) <- subs]+   in atermList (map render (Map.toAscList merged))   where-    render (key, outs) = "(" <> atermString key <> "," <> atermStringList (sortNubText outs) <> ")"+    render (key, outs) = "(" <> atermStringT key <> "," <> atermList (map atermStringT (Set.toAscList outs)) <> ")"  -- | Sort and deduplicate output names (matches C++ @std::set<string>@). sortNubText :: [Text] -> [Text]@@ -240,60 +265,84 @@  -- | Serialize input derivations: @[(drvPath,[outName1,outName2])]@ -- Sorted by store path for determinism.-atermInputDrvs :: Map StorePath [Text] -> Text+atermInputDrvs :: Map StorePath [Text] -> B.Builder atermInputDrvs drvs =   let sorted = Map.toAscList drvs-   in "[" <> T.intercalate "," (map atermInputDrv sorted) <> "]"+   in atermList (map atermInputDrv sorted) -atermInputDrv :: (StorePath, [Text]) -> Text+atermInputDrv :: (StorePath, [Text]) -> B.Builder atermInputDrv (sp, outs) =   "("-    <> atermString (SP.storePathToText SP.defaultStoreDir sp)+    <> atermStringT (SP.storePathToText SP.defaultStoreDir sp)     <> ","-    <> atermStringList (sortNubText outs)+    <> atermList (map atermStringT (sortNubText outs))     <> ")"  -- | Serialize input sources: @[path1,path2,...]@ -- Sorted for deterministic ATerm hashing.-atermInputSrcs :: [StorePath] -> Text+atermInputSrcs :: [StorePath] -> B.Builder atermInputSrcs srcs =   let sorted = sortBy (compare `on` SP.storePathToText SP.defaultStoreDir) srcs-   in "[" <> T.intercalate "," (map (atermString . SP.storePathToText SP.defaultStoreDir) sorted) <> "]"+   in atermList (map (atermStringT . SP.storePathToText SP.defaultStoreDir) sorted) --- | Serialize a list of strings: @[s1,s2,...]@-atermStringList :: [Text] -> Text-atermStringList strs =-  "[" <> T.intercalate "," (map atermString strs) <> "]"+-- | Bracketed, comma-separated section.+atermList :: [B.Builder] -> B.Builder+atermList items = "[" <> mconcat (intersperseComma items) <> "]"+  where+    intersperseComma [] = []+    intersperseComma [only] = [only]+    intersperseComma (item : rest) = item : "," : intersperseComma rest --- | Serialize environment: @[(key,value)]@ sorted by key.-atermEnv :: Map Text Text -> Text+-- | Serialize environment: @[(key,value)]@ sorted by key.  Keys are+-- valid-UTF-8 Text, so 'Map.toAscList' order equals upstream's bytewise+-- order; values are raw bytes.+atermEnv :: Map Text ByteString -> B.Builder atermEnv env =   let sorted = Map.toAscList env-   in "[" <> T.intercalate "," (map atermEnvPair sorted) <> "]"+   in atermList (map atermEnvPair sorted) -atermEnvPair :: (Text, Text) -> Text+atermEnvPair :: (Text, ByteString) -> B.Builder atermEnvPair (key, val) =-  "(" <> atermString key <> "," <> atermString val <> ")"+  "(" <> atermStringT key <> "," <> atermString val <> ")" --- | ATerm string: double-quoted with standard escaping.-atermString :: Text -> Text-atermString s = "\"" <> T.concatMap escapeATerm s <> "\""+-- | ATerm string: double-quoted with standard escaping, byte-level.+-- Every escapable is a single ASCII byte, so escaping the byte stream is+-- exactly upstream's per-char escaping over its byte strings.+atermString :: ByteString -> B.Builder+atermString s = "\"" <> escapeATermBytes s <> "\"" --- | Escape a character for ATerm format.-escapeATerm :: Char -> Text-escapeATerm '\\' = "\\\\"-escapeATerm '"' = "\\\""-escapeATerm '\n' = "\\n"-escapeATerm '\r' = "\\r"-escapeATerm '\t' = "\\t"-escapeATerm c = T.singleton c+-- | ATerm string from Text (names, store paths, hex keys): UTF-8 bytes,+-- then the shared byte-level escaping.+atermStringT :: Text -> B.Builder+atermStringT = atermString . TE.encodeUtf8 +-- | Escape the five ATerm specials; all other bytes pass through verbatim.+-- Scans for the next special with 'BC.break' so clean spans copy in bulk.+escapeATermBytes :: ByteString -> B.Builder+escapeATermBytes s =+  let (plain, rest) = BC.break atermSpecial s+   in case BC.uncons rest of+        Nothing -> B.byteString plain+        Just (c, remaining) ->+          B.byteString plain <> escapeOne c <> escapeATermBytes remaining+  where+    atermSpecial c = c == '\\' || c == '"' || c == '\n' || c == '\r' || c == '\t'+    escapeOne '\\' = "\\\\"+    escapeOne '"' = "\\\""+    escapeOne '\n' = "\\n"+    escapeOne '\r' = "\\r"+    escapeOne '\t' = "\\t"+    -- Unreachable: 'BC.break atermSpecial' only stops at the five specials.+    escapeOne c = B.charUtf8 c+ -- --------------------------------------------------------------------------- -- ATerm parser (hand-rolled recursive descent) -- --------------------------------------------------------------------------- --- | Parser state: remaining input text.-newtype Parser a = Parser {runParser :: Text -> Either Text (a, Text)}+-- | Parser state: remaining input bytes.  The @.drv@ on disk is a byte+-- string; only Text-shaped fields (names, paths, keys) decode, and only+-- after unescaping.+newtype Parser a = Parser {runParser :: ByteString -> Either Text (a, ByteString)}  instance Functor Parser where   fmap f (Parser p) = Parser $ \input -> case p input of@@ -316,46 +365,67 @@ parserFail :: Text -> Parser a parserFail msg = Parser $ \_ -> Left msg +-- | Lossy decode for parse-error snippets only.+snippet :: ByteString -> Text+snippet = TE.decodeUtf8With lenientDecode+ -- | Consume a specific character. pChar :: Char -> Parser () pChar expected = Parser $ \input ->-  case T.uncons input of+  case BC.uncons input of     Just (c, rest) | c == expected -> Right ((), rest)     Just (c, _) -> Left ("expected '" <> T.singleton expected <> "' but got '" <> T.singleton c <> "'")     Nothing -> Left ("expected '" <> T.singleton expected <> "' but got end of input")  -- | Consume a specific string prefix.-pString :: Text -> Parser ()+pString :: ByteString -> Parser () pString prefix = Parser $ \input ->-  case T.stripPrefix prefix input of+  case BS.stripPrefix prefix input of     Just rest -> Right ((), rest)-    Nothing -> Left ("expected \"" <> prefix <> "\" at: " <> T.take 20 input)+    Nothing -> Left ("expected \"" <> snippet prefix <> "\" at: " <> snippet (BS.take 20 input)) --- | Parse a quoted ATerm string with escape handling.-pQuotedString :: Parser Text+-- | Parse a quoted ATerm string with escape handling; the content is the+-- raw unescaped bytes.+pQuotedString :: Parser ByteString pQuotedString = do   pChar '"'   content <- pStringContent   pChar '"'   pure content +-- | Like 'pQuotedString' for Text-shaped fields (names, store paths, env+-- keys, platform): strict UTF-8 decode after unescaping, so invalid bytes+-- in a field nova-nix represents as Text are a parse error, never mojibake.+pQuotedText :: Parser Text+pQuotedText = do+  content <- pQuotedString+  case TE.decodeUtf8' content of+    Right t -> pure t+    Left _ -> parserFail ("invalid UTF-8 in ATerm string: " <> snippet (BS.take 40 content))+ -- | Parse the contents of a quoted string (up to unescaped quote).-pStringContent :: Parser Text-pStringContent = Parser $ \input -> go input T.empty+-- Scans to the next special byte with 'BC.break' so clean spans are+-- copied in bulk, accumulating reversed chunks (O(n) total).+pStringContent :: Parser ByteString+pStringContent = Parser $ \input -> go input []   where     go remaining acc =-      case T.uncons remaining of-        Nothing -> Left "unterminated string"-        Just ('"', _) -> Right (acc, remaining)-        Just ('\\', rest) -> case T.uncons rest of-          Nothing -> Left "unterminated escape"-          Just ('\\', rest2) -> go rest2 (acc <> "\\")-          Just ('"', rest2) -> go rest2 (acc <> "\"")-          Just ('n', rest2) -> go rest2 (acc <> "\n")-          Just ('r', rest2) -> go rest2 (acc <> "\r")-          Just ('t', rest2) -> go rest2 (acc <> "\t")-          Just (c, rest2) -> go rest2 (acc <> "\\" <> T.singleton c)-        Just (c, rest) -> go rest (acc <> T.singleton c)+      let (plain, rest) = BC.break (\c -> c == '"' || c == '\\') remaining+       in case BC.uncons rest of+            Nothing -> Left "unterminated string"+            Just ('"', _) -> Right (BS.concat (reverse (plain : acc)), rest)+            Just ('\\', afterSlash) -> case BC.uncons afterSlash of+              Nothing -> Left "unterminated escape"+              Just ('\\', rest2) -> go rest2 ("\\" : plain : acc)+              Just ('"', rest2) -> go rest2 ("\"" : plain : acc)+              Just ('n', rest2) -> go rest2 ("\n" : plain : acc)+              Just ('r', rest2) -> go rest2 ("\r" : plain : acc)+              Just ('t', rest2) -> go rest2 ("\t" : plain : acc)+              -- A non-standard escape keeps the byte and drops the+              -- backslash, as upstream's .drv string parser does.+              Just (c, rest2) -> go rest2 (BC.singleton c : plain : acc)+            -- Unreachable: BC.break stops only at '"' or '\\'.+            Just (c, _) -> Left ("pStringContent: impossible break byte '" <> T.singleton c <> "'")  -- | Parse a comma-separated list enclosed in brackets: @[item,item,...]@ pList :: Parser a -> Parser [a]@@ -381,20 +451,26 @@             Right (item, rest2) -> goMore rest2 (item : acc)  -- | Parse a single output tuple: @(name, path, hashAlgo, hash)@.+-- The output name is validated with the store-name rules at this parse+-- boundary: it later becomes a filesystem component under the build+-- dir and an environment variable name, and a @.drv@ read from disk+-- is input, not trusted state. pOutput :: Parser DerivationOutput pOutput = do   pChar '('-  name <- pQuotedString+  name <- pQuotedText   pChar ','-  pathStr <- pQuotedString+  pathStr <- pQuotedText   pChar ','-  hashAlgo <- pQuotedString+  hashAlgo <- pQuotedText   pChar ','-  hashVal <- pQuotedString+  hashVal <- pQuotedText   pChar ')'-  case parseStorePathFromATerm pathStr of-    Just sp -> pure (DerivationOutput name sp hashAlgo hashVal)-    Nothing -> parserFail ("invalid output store path: " <> pathStr)+  case SP.checkStorePathName name of+    Left err -> parserFail ("invalid output name: " <> SP.storePathNameErrorText err)+    Right () -> case parseStorePathFromATerm pathStr of+      Just sp -> pure (DerivationOutput name sp hashAlgo hashVal)+      Nothing -> parserFail ("invalid output store path: " <> pathStr)  -- | Parse a store path from an ATerm string. -- Tries defaultStoreDir first, then Windows store dir.@@ -408,9 +484,9 @@ pInputDrv :: Parser (StorePath, [Text]) pInputDrv = do   pChar '('-  pathStr <- pQuotedString+  pathStr <- pQuotedText   pChar ','-  outs <- pList pQuotedString+  outs <- pList pQuotedText   pChar ')'   case parseStorePathFromATerm pathStr of     Just sp -> pure (sp, outs)@@ -419,31 +495,32 @@ -- | Parse an input source (quoted store path string). pInputSrc :: Parser StorePath pInputSrc = do-  pathStr <- pQuotedString+  pathStr <- pQuotedText   case parseStorePathFromATerm pathStr of     Just sp -> pure sp     Nothing -> parserFail ("invalid input src store path: " <> pathStr) --- | Parse an environment pair: @(key, value)@.-pEnvPair :: Parser (Text, Text)+-- | Parse an environment pair: @(key, value)@.  The key is an attr name+-- (Text); the value keeps its raw bytes.+pEnvPair :: Parser (Text, ByteString) pEnvPair = do   pChar '('-  key <- pQuotedString+  key <- pQuotedText   pChar ','   val <- pQuotedString   pChar ')'   pure (key, val) --- | Parse a full derivation from ATerm format.+-- | Parse a full derivation from its ATerm bytes. -- Format: @Derive([outputs],[inputDrvs],[inputSrcs],platform,builder,[args],[env])@ -- -- Total function: returns @Left@ on any malformed input.-fromATerm :: Text -> Either Text Derivation+fromATerm :: ByteString -> Either Text Derivation fromATerm input = case runParser pDerivation input of   Left err -> Left ("ATerm parse error: " <> err)   Right (drv, remaining)-    | T.null remaining -> Right drv-    | otherwise -> Left ("ATerm parse error: unexpected trailing: " <> T.take 40 remaining)+    | BS.null remaining -> Right drv+    | otherwise -> Left ("ATerm parse error: unexpected trailing: " <> snippet (BS.take 40 remaining))  pDerivation :: Parser Derivation pDerivation = do@@ -454,7 +531,7 @@   pChar ','   inputSrcs <- pList pInputSrc   pChar ','-  platformStr <- pQuotedString+  platformStr <- pQuotedText   pChar ','   builder <- pQuotedString   pChar ','

@@ -1,4167 +1,5430 @@ {-# LANGUAGE LambdaCase #-} {-# LANGUAGE PatternSynonyms #-}---- | Nix expression evaluator.------ Nix evaluation is LAZY.  Attribute set members and list elements--- are stored as thunks and only forced when their value is demanded.--- Function arguments are likewise thunked - @(x: 1) (throw "boom")@--- returns @1@ because @x@ is never referenced.------ The evaluator maintains an environment ('Env') that maps variable--- names to thunks.  @let@, @with@, function application, and--- recursive attribute sets all extend the environment.-module Nix.Eval-  ( -- * Values (re-exported from Types)-    NixValue (..),-    CompiledRegex (..),-    Thunk (..),--    -- * Attribute sets (re-exported from Types)-    AttrSet (..),-    CAttrSet,-    attrSetFromMap,-    attrSetLookup,-    attrSetKeys,-    attrSetToMap,-    attrSetToAscList,-    attrSetMember,-    attrSetElems,-    attrSetNull,-    attrSetRemoveKeys,-    attrSetSize,--    -- * String context (re-exported from Types)-    StringContextElement (..),-    StringContext (..),-    emptyContext,-    mkStr,--    -- * Environment (re-exported from Types)-    Env (..),-    emptyEnv,--    -- * Evaluation monad (re-exported from Types)-    MonadEval (..),-    PureEval,-    runPureEval,--    -- * Evaluation-    eval,-    evalBytecode,-    force,--    -- * Helpers (for Builtins)-    typeName,-    evaluated,-    readThunkValue,--    -- * Builtin registry-    BuiltinDef (..),-    builtinRegistry,-    builtinNames,--    -- * Platform-    currentSystemStr,-  )-where--import Control.Monad (foldM, when, (>=>))-import qualified Crypto.Hash as CH-import qualified Data.Array as Array-import Data.Bits (complement, xor, (.&.), (.|.))-import qualified Data.ByteArray as BA-import qualified Data.ByteString as BS-import Data.Char (chr, digitToInt, isAlpha, isDigit, isHexDigit, isOctDigit, ord)-import Data.IORef (IORef, atomicModifyIORef', newIORef)-import Data.Int (Int64)-import Data.List (find, foldl', sort)-import Data.Map.Strict (Map)-import qualified Data.Map.Strict as Map-import Data.Maybe (catMaybes, fromMaybe, isJust, isNothing, maybeToList)-import Data.Sequence (Seq (..))-import qualified Data.Sequence as Seq-import qualified Data.Set as Set-import Data.Text (Text)-import qualified Data.Text as T-import qualified Data.Text.Encoding as TE-import Data.Word (Word32, Word8)-import Foreign.Ptr (Ptr, castPtr, nullPtr, ptrToWordPtr, wordPtrToPtr)-import Foreign.Storable (peekElemOff, pokeElemOff)-import Nix.Derivation (Derivation (..), DerivationOutput (..), textToPlatform, toATerm, toATermForHash)-import Nix.Eval.CBytecode (cbcArg1, cbcArg2, cbcArg3, cbcData, cbcFlags, cbcOpcode, cbcShortArg, pattern OpApp, pattern OpAssert, pattern OpAttrs, pattern OpBinary, pattern OpHasAttr, pattern OpIf, pattern OpIndStr, pattern OpLambda, pattern OpLet, pattern OpList, pattern OpLitBool, pattern OpLitFloat, pattern OpLitInt, pattern OpLitNull, pattern OpLitPath, pattern OpLitUri, pattern OpResolvedVar, pattern OpSearchPath, pattern OpSelect, pattern OpStr, pattern OpUnary, pattern OpVar, pattern OpWith, pattern OpWithVar)-import Nix.Eval.CEnv (cenvPushWith)-import Nix.Eval.CList (CList (..), clistGet)-import Nix.Eval.CThunk (CThunkPtr)-import Nix.Eval.Compile (BcAttrKey (..), BcBinding (..), compileExpr, decodeBcBindings, decodeBcCaptureInfo, decodeBcFormals, reassembleDouble, reassembleInt64)-import Nix.Eval.Context (extractInputDrvs, extractInputSrcs, plainContext)-import Nix.Eval.Operator (evalBinary, evalUnary, nixCompare, nixEqual)-import Nix.Eval.StringInterp (coerceToString, formatNixFloat, stripIndentedChunks)-import Nix.Eval.Symbol (Symbol (..), symbolText)-import Nix.Eval.Types-  ( AttrSet (..),-    CAttrSet,-    CompiledRegex (..),-    Env (..),-    EvalFormal (..),-    EvalFormals (..),-    MonadEval (..),-    NixValue (..),-    PureEval,-    StringContext (..),-    StringContextElement (..),-    Thunk (..),-    allocCSlots,-    attrSetElems,-    attrSetFromMap,-    attrSetKeys,-    attrSetLookup,-    attrSetMapWithKey,-    attrSetMember,-    attrSetNull,-    attrSetRemoveKeys,-    attrSetSize,-    attrSetToAscList,-    attrSetToMap,-    attrSetUnionWith,-    buildCAttrSetKeys,-    buildCSlots,-    cheapThunkBc,-    clistFromThunks,-    clistLen,-    clistThunks,-    emptyContext,-    emptyEnv,-    envFromSlots,-    envLookup,-    envLookupResolved,-    envWithScopesRaw,-    evaluated,-    fillCAttrSetValues,-    fillCSlots,-    mkStr,-    mkSyntheticThunk,-    mkThunk,-    mkThunkBc,-    newCEnv,-    newMinimalEnv,-    readThunkValue,-    runPureEval,-    thunkToCPtr,-    typeName,-    withScopesForCapture,-  )-import Nix.Expr.Types-  ( AttrKey (..),-    BinaryOp (..),-    CaptureInfo (..),-    Expr (..),-    NixAtom (..),-    UnaryOp (..),-  )-import Nix.Hash (bytesToHexText, hashPlaceholder, hexToBytes, makeFixedOutputPath, makeOutputPath, makeTextPath, sha256Digest, sha256Hex)-import Nix.Store.Path (StorePath (..), defaultStoreDir, defaultStoreDirText, parseStorePath, storePathToFilePath, storePathToText)-import qualified NovaCache.Base32 as Nix32-import qualified NovaCache.Base64 as B64-import System.IO.Unsafe (unsafePerformIO)-import qualified System.Info-import Text.Regex.TDFA (matchAllText)-import qualified Text.Regex.TDFA as RE---- | Evaluate a Nix expression in an environment.--- Compiles the expression to bytecode and dispatches to 'evalBytecode'.-eval :: (MonadEval m) => Env -> Expr -> m NixValue-eval env expr =-  let bcIdx = unsafePerformIO (compileExpr expr)-   in evalBytecode env bcIdx---- | Force a thunk to a value.------ Delegates to 'forceThunk' which is a 'MonadEval' method - this--- allows IO evaluators to implement memoization (caching the result--- after the first force) while pure evaluators simply re-evaluate.-force :: (MonadEval m) => Thunk -> m NixValue-force = forceThunk evalBytecode---- | Evaluate a bytecode instruction by index.--- This is the primary evaluator - reads opcodes from the C bytecode--- store and dispatches.  All recursive evaluation goes through this--- function, never through 'eval' directly.-evalBytecode :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBytecode env bcIdx =-  let opcode = unsafePerformIO (cbcOpcode bcIdx)-   in case opcode of-        OpLitInt ->-          let lo = unsafePerformIO (cbcArg1 bcIdx)-              hi = unsafePerformIO (cbcArg2 bcIdx)-           in pure (VInt (reassembleInt64 lo hi))-        OpLitFloat ->-          let lo = unsafePerformIO (cbcArg1 bcIdx)-              hi = unsafePerformIO (cbcArg2 bcIdx)-           in pure (VFloat (reassembleDouble lo hi))-        OpLitBool ->-          let flag = unsafePerformIO (cbcShortArg bcIdx)-           in pure (VBool (flag /= 0))-        OpLitNull -> pure VNull-        OpLitUri ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-           in pure (mkStr (symbolText (Symbol sym)))-        OpLitPath ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-           in VPath <$> resolvePathLiteral (symbolText (Symbol sym))-        OpStr -> evalBcStr env bcIdx-        OpIndStr -> evalBcIndStr env bcIdx-        OpVar ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-           in evalVar env (symbolText (Symbol sym))-        OpWithVar ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-              name = symbolText (Symbol sym)-           in evalWithVar env name-        OpResolvedVar ->-          let level = fromIntegral (unsafePerformIO (cbcArg1 bcIdx))-              idx = fromIntegral (unsafePerformIO (cbcArg2 bcIdx))-           in force (envLookupResolved level idx env)-        OpAttrs -> evalBcAttrs env bcIdx-        OpList -> evalBcList env bcIdx-        OpSelect -> evalBcSelect env bcIdx-        OpHasAttr -> evalBcHasAttr env bcIdx-        OpApp -> evalBcApp env bcIdx-        OpLambda -> evalBcLambda env bcIdx-        OpLet -> evalBcLet env bcIdx-        OpIf ->-          let condIdx = unsafePerformIO (cbcArg1 bcIdx)-              thenIdx = unsafePerformIO (cbcArg2 bcIdx)-              elseIdx = unsafePerformIO (cbcArg3 bcIdx)-           in do-                condVal <- evalBytecode env condIdx-                case condVal of-                  VBool True -> evalBytecode env thenIdx-                  VBool False -> evalBytecode env elseIdx-                  _ -> throwEvalError ("'if' condition must be a Boolean, got " <> typeName condVal)-        OpWith ->-          let scopeIdx = unsafePerformIO (cbcArg1 bcIdx)-              bodyIdx = unsafePerformIO (cbcArg2 bcIdx)-              -- Lazy with: defer forcing the scope until a WITH_VAR lookup-              -- actually needs it.  This is critical for nixpkgs where-              -- all-packages.nix uses `with pkgs;` inside a fixpoint --              -- eagerly forcing the scope would blackhole.-              scopeThunk = cheapThunkBc env scopeIdx-           in evalBytecode (pushLazyWithScope scopeThunk env) bodyIdx-        OpAssert ->-          let condIdx = unsafePerformIO (cbcArg1 bcIdx)-              bodyIdx = unsafePerformIO (cbcArg2 bcIdx)-           in do-                condVal <- evalBytecode env condIdx-                case condVal of-                  VBool True -> evalBytecode env bodyIdx-                  VBool False -> throwEvalError "assertion failed"-                  _ -> throwEvalError ("assertion condition must be a Boolean, got " <> typeName condVal)-        OpUnary ->-          let flags_ = unsafePerformIO (cbcFlags bcIdx)-              operandIdx = unsafePerformIO (cbcArg1 bcIdx)-           in do-                val <- evalBytecode env operandIdx-                evalUnary (decodeUnaryOp flags_) val-        OpBinary -> evalBcBinary env bcIdx-        OpSearchPath ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-           in evalSearchPath env (symbolText (Symbol sym))-        _ -> throwEvalError "evalBytecode: unknown opcode"---- ------------------------------------------------------------------------------ Bytecode helpers--- ------------------------------------------------------------------------------- | Decode a UnaryOp from bytecode flags.-decodeUnaryOp :: Word8 -> UnaryOp-decodeUnaryOp 0 = OpNot-decodeUnaryOp 1 = OpNegate--- Unreachable: the tag is written by Nix.Eval.Compile's encodeUnaryOp, which--- only emits 0 or 1.-decodeUnaryOp n = error ("decodeUnaryOp: unknown tag " <> show n)---- | Decode a BinaryOp from bytecode flags.-decodeBinaryOp :: Word8 -> BinaryOp-decodeBinaryOp 0 = OpAdd-decodeBinaryOp 1 = OpSub-decodeBinaryOp 2 = OpMul-decodeBinaryOp 3 = OpDiv-decodeBinaryOp 4 = OpAnd-decodeBinaryOp 5 = OpOr-decodeBinaryOp 6 = OpImpl-decodeBinaryOp 7 = OpEq-decodeBinaryOp 8 = OpNeq-decodeBinaryOp 9 = OpLt-decodeBinaryOp 10 = OpLte-decodeBinaryOp 11 = OpGt-decodeBinaryOp 12 = OpGte-decodeBinaryOp 13 = OpConcat-decodeBinaryOp 14 = OpUpdate--- Unreachable: the tag is written by Nix.Eval.Compile's encodeBinaryOp, which--- only emits 0..14.-decodeBinaryOp n = error ("decodeBinaryOp: unknown tag " <> show n)---- | Evaluate a binary operation from bytecode, with short-circuit--- support for &&, ||, ->.-evalBcBinary :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcBinary env bcIdx0 =-  let flags_ = unsafePerformIO (cbcFlags bcIdx0)-      leftIdx = unsafePerformIO (cbcArg1 bcIdx0)-      rightIdx = unsafePerformIO (cbcArg2 bcIdx0)-      op = decodeBinaryOp flags_-   in case op of-        OpAnd -> evalShortCircuitAnd env leftIdx rightIdx-        OpOr -> evalShortCircuitOr env leftIdx rightIdx-        OpImpl -> evalShortCircuitImpl env leftIdx rightIdx-        OpAdd -> do-          leftVal <- evalBytecode env leftIdx-          rightVal <- evalBytecode env rightIdx-          evalAddWithCoercion leftVal rightVal-        _ -> do-          leftVal <- evalBytecode env leftIdx-          rightVal <- evalBytecode env rightIdx-          evalBinary force op leftVal rightVal---- | Addition with string coercion fallback, matching C++ Nix behavior.--- C++ Nix's ExprOpAdd falls through to concatStrings when operands--- are not both numeric and neither is a path.  concatStrings calls--- coerceToString on each part, which handles attrsets via outPath.-evalAddWithCoercion :: (MonadEval m) => NixValue -> NixValue -> m NixValue-evalAddWithCoercion left right = case (left, right) of-  -- Numeric: direct arithmetic (matches C++ Nix priority)-  (VFloat _, _) -> evalBinary force OpAdd left right-  (_, VFloat _) -> evalBinary force OpAdd left right-  (VInt _, VInt _) -> evalBinary force OpAdd left right-  -- Path: direct concat-  (VPath _, _) -> evalBinary force OpAdd left right-  -- String-like: direct concat when both are string/path-  (VStr {}, VStr {}) -> evalBinary force OpAdd left right-  (VStr {}, VPath _) -> evalBinary force OpAdd left right-  -- Otherwise: string concatenation with STRICT coercion (Nix coerceMore=false)-  -- - only strings and sets with __toString/outPath coerce; numbers, bools,-  -- null, lists, and functions are type errors, matching C++ Nix's `+`.-  _ -> do-    (leftStr, leftCtx) <- coerceAddOperand left-    (rightStr, rightCtx) <- coerceAddOperand right-    pure (VStr (leftStr <> rightStr) (leftCtx <> rightCtx))---- | Strict string coercion for the @+@ operator (Nix @coerceMore = false@):--- strings, and sets with @__toString@/@outPath@, coerce; numbers, booleans,--- null, lists, and functions are type errors.-coerceAddOperand :: (MonadEval m) => NixValue -> m (Text, StringContext)-coerceAddOperand v@(VStr {}) = coerceToString False force applyValue v-coerceAddOperand v@(VAttrs {}) = coerceToString False force applyValue v-coerceAddOperand v =-  throwEvalError ("cannot coerce " <> typeName v <> " to a string with the + operator")---- | Bytecode short-circuit &&-evalShortCircuitAnd :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue-evalShortCircuitAnd env leftIdx rightIdx = do-  leftVal <- evalBytecode env leftIdx-  case leftVal of-    VBool False -> pure (VBool False)-    VBool True -> do-      rightVal <- evalBytecode env rightIdx-      case rightVal of-        VBool _ -> pure rightVal-        _ -> throwEvalError ("second operand of && must be a Boolean, got " <> typeName rightVal)-    _ -> throwEvalError ("first operand of && must be a Boolean, got " <> typeName leftVal)---- | Bytecode short-circuit ||-evalShortCircuitOr :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue-evalShortCircuitOr env leftIdx rightIdx = do-  leftVal <- evalBytecode env leftIdx-  case leftVal of-    VBool True -> pure (VBool True)-    VBool False -> do-      rightVal <- evalBytecode env rightIdx-      case rightVal of-        VBool _ -> pure rightVal-        _ -> throwEvalError ("second operand of || must be a Boolean, got " <> typeName rightVal)-    _ -> throwEvalError ("first operand of || must be a Boolean, got " <> typeName leftVal)---- | Bytecode short-circuit ->-evalShortCircuitImpl :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue-evalShortCircuitImpl env leftIdx rightIdx = do-  leftVal <- evalBytecode env leftIdx-  case leftVal of-    VBool False -> pure (VBool True)-    VBool True -> do-      rightVal <- evalBytecode env rightIdx-      case rightVal of-        VBool _ -> pure rightVal-        _ -> throwEvalError ("second operand of -> must be a Boolean, got " <> typeName rightVal)-    _ -> throwEvalError ("first operand of -> must be a Boolean, got " <> typeName leftVal)---- | Evaluate a string literal from bytecode data buffer.-evalBcStr :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcStr env bcIdx0 = do-  let count = fromIntegral (unsafePerformIO (cbcShortArg bcIdx0))-      dataOff = unsafePerformIO (cbcArg1 bcIdx0)-  chunks <- evalBcStringParts env count dataOff-  pure (VStr (T.concat [t | (_, t, _) <- chunks]) (mconcat [c | (_, _, c) <- chunks]))---- | Evaluate an indented string literal from bytecode data buffer.  The common--- indentation is stripped from the LITERAL chunks before concatenation, so an--- interpolated multi-line value cannot drag the computed indent down - matching--- C++ Nix.-evalBcIndStr :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcIndStr env bcIdx0 = do-  let count = fromIntegral (unsafePerformIO (cbcShortArg bcIdx0))-      dataOff = unsafePerformIO (cbcArg1 bcIdx0)-  chunks <- evalBcStringParts env count dataOff-  let (text, ctx) = stripIndentedChunks chunks-  pure (VStr text ctx)---- | Evaluate string parts from the bytecode data buffer.  Each part is two--- words: (tag, value).  tag=0 means literal (value = symbol), tag=1 means--- interpolation (value = bc_idx).  The 'Bool' marks literal (@True@) vs--- interpolated (@False@) so indented strings strip only the literals.-evalBcStringParts :: (MonadEval m) => Env -> Int -> Word32 -> m [(Bool, Text, StringContext)]-evalBcStringParts _ 0 _ = pure []-evalBcStringParts env n off = do-  let tag = unsafePerformIO (cbcData off)-      val = unsafePerformIO (cbcData (off + 1))-  chunk <- case tag of-    0 -> pure (True, symbolText (Symbol val), emptyContext)-    _ -> do-      v <- evalBytecode env val-      (txt, ctx) <- coerceToStringInterp v-      pure (False, txt, ctx)-  rest <- evalBcStringParts env (n - 1) (off + 2)-  pure (chunk : rest)---- | Evaluate a list from bytecode data buffer.-evalBcList :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcList env bcIdx0 =-  let count = fromIntegral (unsafePerformIO (cbcShortArg bcIdx0)) :: Int-      dataOff = unsafePerformIO (cbcArg1 bcIdx0)-      readChildren 0 _ = []-      readChildren n off =-        let childIdx = unsafePerformIO (cbcData off)-         in cheapThunkBc env childIdx : readChildren (n - 1) (off + 1)-   in pure (VList (clistFromThunks (map thunkToCPtr (readChildren count dataOff))))---- | Evaluate a function application from bytecode.-evalBcApp :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcApp env bcIdx0 = do-  let funcIdx = unsafePerformIO (cbcArg1 bcIdx0)-      argIdx = unsafePerformIO (cbcArg2 bcIdx0)-  funcVal <- evalBytecode env funcIdx-  case funcVal of-    VLambda closureEnv formals bodyBcIdx -> do-      let argThunk = cheapThunkBc env argIdx-      extEnv <- matchFormals closureEnv formals argThunk-      evalBytecode extEnv bodyBcIdx-    VBuiltin "tryEval" [] -> do-      result <- catchEvalError (evalBytecode env argIdx)-      case result of-        Right val ->-          pure-            ( VAttrs-                ( attrSetFromMap $-                    Map.fromList-                      [ ("success", evaluated (VBool True)),-                        ("value", evaluated val)-                      ]-                )-            )-        Left _ ->-          pure-            ( VAttrs-                ( attrSetFromMap $-                    Map.fromList-                      [ ("success", evaluated (VBool False)),-                        ("value", evaluated (VBool False))-                      ]-                )-            )-    VBuiltin name accArgs -> do-      argVal <- evalBytecode env argIdx-      applyBuiltin name accArgs argVal-    VAttrs attrs-      | Just functorThunk <- attrSetLookup "__functor" attrs -> do-          functor <- force functorThunk-          partiallyApplied <- applyValue functor funcVal-          -- Maintain laziness: thunk the argument for lambdas, like-          -- the normal VLambda path above.  Builtins force anyway.-          case partiallyApplied of-            VLambda closureEnv formals bodyBcIdx -> do-              let argThunk = cheapThunkBc env argIdx-              extEnv <- matchFormals closureEnv formals argThunk-              evalBytecode extEnv bodyBcIdx-            _ -> do-              argVal <- evalBytecode env argIdx-              applyValue partiallyApplied argVal-    _ -> throwEvalError ("attempt to call " <> typeName funcVal <> ", which is not a function")---- | Evaluate a lambda literal from bytecode - returns VLambda.-evalBcLambda :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcLambda env bcIdx0 =-  let flags_ = unsafePerformIO (cbcFlags bcIdx0)-      formalsOff = unsafePerformIO (cbcArg1 bcIdx0)-      bodyBcIdx = unsafePerformIO (cbcArg2 bcIdx0)-      captureOff = unsafePerformIO (cbcArg3 bcIdx0)-      formals = unsafePerformIO (decodeBcFormals flags_ formalsOff)-      captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)-   in pure (VLambda (buildCaptureEnv env captureInfo) formals bodyBcIdx)---- | Evaluate a select expression from bytecode.-evalBcSelect :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcSelect env bcIdx0 = do-  let hasDef = unsafePerformIO (cbcFlags bcIdx0) /= 0-      pathLen = fromIntegral (unsafePerformIO (cbcShortArg bcIdx0))-      targetIdx = unsafePerformIO (cbcArg1 bcIdx0)-      pathOff = unsafePerformIO (cbcArg2 bcIdx0)-      defIdx = unsafePerformIO (cbcArg3 bcIdx0)-  targetVal <- evalBytecode env targetIdx-  result <- walkBcAttrPath env pathLen pathOff targetVal-  case result of-    Just val -> pure val-    Nothing-      | hasDef -> evalBytecode env defIdx-      | otherwise -> do-          let pathName = collectBcAttrPathNames pathLen pathOff-              targetKeys = case targetVal of-                VAttrs attrs -> T.intercalate ", " (take 20 (attrSetKeys attrs))-                _ -> ""-          throwEvalError ("attribute '" <> pathName <> "' not found in " <> typeName targetVal <> " {" <> targetKeys <> "}")---- | Evaluate a hasAttr expression from bytecode.-evalBcHasAttr :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcHasAttr env bcIdx0 = do-  let pathLen = fromIntegral (unsafePerformIO (cbcShortArg bcIdx0))-      targetIdx = unsafePerformIO (cbcArg1 bcIdx0)-      pathOff = unsafePerformIO (cbcArg2 bcIdx0)-  targetVal <- evalBytecode env targetIdx-  result <- walkBcAttrPath env pathLen pathOff targetVal-  pure (VBool (isJust result))---- | Collect static attribute path names for error reporting.-collectBcAttrPathNames :: Int -> Word32 -> Text-collectBcAttrPathNames pathLen pathOff = T.intercalate "." (go pathLen pathOff)-  where-    go 0 _ = []-    go n off =-      let isExpr = unsafePerformIO (cbcData off)-          keyVal = unsafePerformIO (cbcData (off + 1))-          name = if isExpr /= 0 then "<expr>" else symbolText (Symbol keyVal)-       in name : go (n - 1) (off + 2)---- | Walk an attribute path stored in the bytecode data buffer.--- Each element is two words: (is_expr, key_or_bc_idx).-walkBcAttrPath :: (MonadEval m) => Env -> Int -> Word32 -> NixValue -> m (Maybe NixValue)-walkBcAttrPath _ 0 _ val = pure (Just val)-walkBcAttrPath env n off val = case val of-  VAttrs attrs -> do-    let isExpr = unsafePerformIO (cbcData off)-        keyVal = unsafePerformIO (cbcData (off + 1))-    resolved <--      if isExpr /= 0-        then do-          keyResult <- evalBytecode env keyVal-          case keyResult of-            VStr s _ -> pure (Just s)-            VNull -> pure Nothing-            _ -> throwEvalError ("dynamic attribute key must be a string, got " <> typeName keyResult)-        else pure (Just (symbolText (Symbol keyVal)))-    case resolved >>= (`attrSetLookup` attrs) of-      Just thunk -> do-        inner <- force thunk-        walkBcAttrPath env (n - 1) (off + 2) inner-      Nothing -> pure Nothing-  -- Non-attrset: attribute path cannot continue.  Return Nothing so-  -- that callers with a default (``a.b or def'') or hasAttr (``a ? b'')-  -- can handle it gracefully, matching C++ Nix behaviour.-  _ -> pure Nothing---- | Evaluate attribute set from bytecode.-evalBcAttrs :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcAttrs env bcIdx0 = do-  let isRec = unsafePerformIO (cbcFlags bcIdx0) /= 0-      bindCount = unsafePerformIO (cbcShortArg bcIdx0)-      dataOff = unsafePerformIO (cbcArg1 bcIdx0)-      captureOff = unsafePerformIO (cbcArg2 bcIdx0)-      bindings = unsafePerformIO (decodeBcBindings bindCount dataOff)-  if isRec-    then do-      let captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)-      evalBcRecAttrs env bindings captureInfo-    else evalBcNonRecAttrs env bindings---- | Evaluate a non-recursive attr set from bytecode bindings.-evalBcNonRecAttrs :: (MonadEval m) => Env -> [BcBinding] -> m NixValue-evalBcNonRecAttrs env bindings = do-  thunkMap <- buildBcThunkMap env bindings-  pure (VAttrs (attrSetFromMap thunkMap))---- | Evaluate a recursive attr set from bytecode bindings.-evalBcRecAttrs :: (MonadEval m) => Env -> [BcBinding] -> CaptureInfo -> m NixValue-evalBcRecAttrs env bindings captureInfo-  | allBcPositional bindings =-      -- Positional path: slots for variable lookup, CAttrSet for return.-      let slotCount = bcBindingSlotCount bindings-          slotsPtr = allocCSlots slotCount-          parentEnv = buildCaptureEnv env captureInfo-          (withArr, withCount) = case captureInfo of-            NoCaptureInfo -> envWithScopesRaw env-            Captures _ -> (nullPtr, 0)-            CapturesWithScopes _ -> withScopesForCapture env-          recEnv = newCEnv slotsPtr slotCount Nothing (Just parentEnv) withArr withCount-          thunkList = buildBcSlotThunks recEnv env bindings-          filled = fillCSlots slotsPtr thunkList-          attrMap = buildBcAttrMapFromSlots bindings thunkList-       in filled `seq` pure (VAttrs (attrSetFromMap attrMap))-  | otherwise = do-      -- Fallback: dynamic/nested keys - two-phase CAttrSet.-      allKeys <- bcBindingAllKeys env bindings-      let cset = buildCAttrSetKeys allKeys-          attrSet = AttrSet cset-          parentEnv = buildCaptureEnv env captureInfo-          (withArr, withCount) = case captureInfo of-            NoCaptureInfo -> envWithScopesRaw env-            Captures _ -> (nullPtr, 0)-            CapturesWithScopes _ -> withScopesForCapture env-          recEnv = newCEnv nullPtr 0 (Just attrSet) (Just parentEnv) withArr withCount-      thunkMap <- buildBcThunkMap recEnv bindings-      let filled = fillCAttrSetValues cset thunkMap-       in filled `seq` pure (VAttrs attrSet)---- | Evaluate a let expression from bytecode.-evalBcLet :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcLet env bcIdx0 = do-  let bindCount = unsafePerformIO (cbcShortArg bcIdx0)-      dataOff = unsafePerformIO (cbcArg1 bcIdx0)-      bodyIdx = unsafePerformIO (cbcArg2 bcIdx0)-      captureOff = unsafePerformIO (cbcArg3 bcIdx0)-      bindings = unsafePerformIO (decodeBcBindings bindCount dataOff)-      captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)-  if allBcPositional bindings-    then do-      -- Positional path: slots for O(1) lookup.-      let slotCount = bcBindingSlotCount bindings-          slotsPtr = allocCSlots slotCount-          parentEnv = buildCaptureEnv env captureInfo-          (withArr, withCount) = case captureInfo of-            NoCaptureInfo -> envWithScopesRaw env-            Captures _ -> (nullPtr, 0)-            CapturesWithScopes _ -> withScopesForCapture env-          letEnv = newCEnv slotsPtr slotCount Nothing (Just parentEnv) withArr withCount-          filled = fillCSlots slotsPtr (buildBcSlotThunks letEnv env bindings)-       in filled `seq` evalBytecode letEnv bodyIdx-    else do-      -- Fallback: dynamic/nested keys - two-phase CAttrSet.-      allKeys <- bcBindingAllKeys env bindings-      let cset = buildCAttrSetKeys allKeys-          parentEnv = buildCaptureEnv env captureInfo-          (withArr, withCount) = case captureInfo of-            NoCaptureInfo -> envWithScopesRaw env-            Captures _ -> (nullPtr, 0)-            CapturesWithScopes _ -> withScopesForCapture env-          letEnv = newCEnv nullPtr 0 (Just (AttrSet cset)) (Just parentEnv) withArr withCount-      thunkMap <- buildBcThunkMap letEnv bindings-      let filled = fillCAttrSetValues cset thunkMap-       in filled `seq` evalBytecode letEnv bodyIdx---- | Check if all bytecode bindings are single static keys (eligible for positional).--- Must stay in sync with 'allStaticSingleKey' in 'Nix.Expr.Resolve'.-allBcPositional :: [BcBinding] -> Bool-allBcPositional = all isEligible-  where-    isEligible (BcNamed [BcStaticKey _] _) = True-    isEligible (BcInherit _) = True-    isEligible (BcInheritFrom _ _) = True-    isEligible _ = False---- | Count positional slots for bytecode bindings.--- Must stay in sync with 'lexicalScopeFromBindings' in 'Nix.Expr.Resolve'.-bcBindingSlotCount :: [BcBinding] -> Int-bcBindingSlotCount = foldl' countOne 0-  where-    countOne !acc (BcNamed [BcStaticKey _] _) = acc + 1-    countOne !acc (BcInherit syms) = acc + length syms-    countOne !acc (BcInheritFrom _ syms) = acc + length syms-    countOne !acc _ = acc---- | Build thunks for positional bytecode bindings in declaration order.-buildBcSlotThunks :: Env -> Env -> [BcBinding] -> [Thunk]-buildBcSlotThunks recEnv outerEnv = concatMap slotThunk-  where-    slotThunk (BcNamed [BcStaticKey _] valBcIdx) =-      [mkThunkBc recEnv valBcIdx]-    slotThunk (BcInherit syms) =-      map (inheritLookup outerEnv . symbolText . Symbol) syms-    slotThunk (BcInheritFrom fromBcIdx syms) =-      -- inherit (from) x y z; becomes one thunk per name that selects from the from-expr.-      -- Each thunk gets a minimal env with the from-value at slot 0.-      let fromThunk = mkThunkBc recEnv fromBcIdx-          mkInheritThunk sym =-            let name = symbolText (Symbol sym)-                selectExpr = ESelect (EResolvedVar 0 0) [StaticKey name] Nothing-                (sp, sc) = buildCSlots [fromThunk]-                fromEnv = newMinimalEnv sp sc-             in mkSyntheticThunk fromEnv selectExpr-       in map mkInheritThunk syms-    -- Unreachable: allBcPositional guards this path.-    slotThunk _ = []---- | Build attr map from slots for positional bytecode bindings.-buildBcAttrMapFromSlots :: [BcBinding] -> [Thunk] -> Map Text Thunk-buildBcAttrMapFromSlots bindings thunks = go bindings thunks Map.empty-  where-    go [] _ !acc = acc-    go (BcNamed [BcStaticKey sym] _ : bs) (t : ts) !acc =-      go bs ts (Map.insert (symbolText (Symbol sym)) t acc)-    go (BcInherit syms : bs) ts !acc =-      let (used, rest) = splitAt (length syms) ts-          accMerged = foldl' (\a (sym, t0) -> Map.insert (symbolText (Symbol sym)) t0 a) acc (zip syms used)-       in go bs rest accMerged-    go (BcInheritFrom _ syms : bs) ts !acc =-      let (used, rest) = splitAt (length syms) ts-          accMerged = foldl' (\a (sym, t0) -> Map.insert (symbolText (Symbol sym)) t0 a) acc (zip syms used)-       in go bs rest accMerged-    -- Unreachable: allBcPositional guards this path.-    go (_ : bs) ts !acc = go bs ts acc---- | Build thunk map for bytecode attrs (non-rec or fallback rec path).-buildBcThunkMap :: (MonadEval m) => Env -> [BcBinding] -> m (Map Text Thunk)-buildBcThunkMap thunkEnv = foldM addBinding Map.empty-  where-    addBinding acc (BcNamed keys valBcIdx) = do-      resolvedKeys <- mapM (resolveBcKey thunkEnv) keys-      case sequence resolvedKeys of-        Nothing -> pure acc -- null key -> skip-        Just [key] ->-          pure (insertWithMerge acc key (mkThunkBc thunkEnv valBcIdx))-        Just path ->-          let nested = buildBcNestedAttr thunkEnv path valBcIdx-           in pure (foldl' (\a (k, t0) -> insertWithMerge a k t0) acc (Map.toList nested))-    addBinding acc (BcInherit syms) =-      pure (foldl' (\a sym -> let name = symbolText (Symbol sym) in insertWithMerge a name (inheritLookup thunkEnv name)) acc syms)-    addBinding acc (BcInheritFrom fromBcIdx syms) =-      -- inherit (from) name selects name from the from-expr.-      -- Create a small env with the from value at slot 0, then a-      -- synthetic expression that selects name from slot 0.-      let addInheritFrom a sym =-            let name = symbolText (Symbol sym)-                selectExpr = ESelect (EResolvedVar 0 0) [StaticKey name] Nothing-                (sp, sc) = buildCSlots [mkThunkBc thunkEnv fromBcIdx]-                fromEnv = newMinimalEnv sp sc-             in insertWithMerge a name (mkSyntheticThunk fromEnv selectExpr)-       in pure (foldl' addInheritFrom acc syms)--    insertWithMerge acc key thunk =-      case Map.lookup key acc of-        Nothing -> Map.insert key thunk acc-        Just existing -> Map.insert key (mergeThunks existing thunk) acc---- | Resolve a bytecode attr key to text.-resolveBcKey :: (MonadEval m) => Env -> BcAttrKey -> m (Maybe Text)-resolveBcKey _env (BcStaticKey sym) = pure (Just (symbolText (Symbol sym)))-resolveBcKey env (BcDynamicKey bcIdx0) = do-  val <- evalBytecode env bcIdx0-  case val of-    VStr s _ -> pure (Just s)-    VNull -> pure Nothing-    _ -> throwEvalError ("dynamic attribute key must be a string, got " <> typeName val)---- | Build a nested attribute structure from a resolved dotted path (bytecode).-buildBcNestedAttr :: Env -> [Text] -> Word32 -> Map Text Thunk-buildBcNestedAttr _thunkEnv [] _valBcIdx = Map.empty-buildBcNestedAttr thunkEnv [key] valBcIdx =-  Map.singleton key (mkThunkBc thunkEnv valBcIdx)-buildBcNestedAttr thunkEnv (key : rest) valBcIdx =-  Map.singleton key (evaluated (VAttrs (attrSetFromMap (buildBcNestedAttr thunkEnv rest valBcIdx))))---- | Extract all top-level keys from bytecode bindings, resolving--- dynamic keys as needed.  Used by the fallback path (two-phase--- CAttrSet construction) where all keys must be known before thunks.-bcBindingAllKeys :: (MonadEval m) => Env -> [BcBinding] -> m [Text]-bcBindingAllKeys env bindings = fmap concat (mapM oneBinding bindings)-  where-    oneBinding (BcNamed (key : _) _) = do-      resolved <- resolveBcKey env key-      pure (maybeToList resolved)-    oneBinding (BcNamed [] _) = pure []-    oneBinding (BcInherit syms) =-      pure (map (symbolText . Symbol) syms)-    oneBinding (BcInheritFrom _ syms) =-      pure (map (symbolText . Symbol) syms)---- ------------------------------------------------------------------------------ Search paths (<nixpkgs>, <nixpkgs/lib>)--- ------------------------------------------------------------------------------- | Evaluate a search path expression.--- Desugars to @builtins.findFile builtins.nixPath "name"@ - exactly how--- real Nix handles @\<name\>@ expressions.-evalSearchPath :: (MonadEval m) => Env -> Text -> m NixValue-evalSearchPath env name = do-  builtinsVal <- evalVar env "builtins"-  case builtinsVal of-    VAttrs builtinsAttrs ->-      case attrSetLookup "nixPath" builtinsAttrs of-        Just nixPathThunk -> do-          nixPathVal <- force nixPathThunk-          builtinFindFile nixPathVal (mkStr name)-        Nothing ->-          throwEvalError ("file '" <> name <> "' was not found in the Nix search path")-    _ ->-      throwEvalError ("file '" <> name <> "' was not found in the Nix search path")---- ------------------------------------------------------------------------------ Variables--- -----------------------------------------------------------------------------evalVar :: (MonadEval m) => Env -> Text -> m NixValue-evalVar env name =-  case envLookup name env of-    Just thunk -> force thunk-    Nothing -> throwEvalError ("undefined variable '" <> name <> "'")---- | Evaluate a with-scoped variable: check with-scopes first (innermost--- to outermost), then fall back to the standard name-based lookup--- (parent chain to builtins).  For trimmed envs ('CapturesWithScopes'),--- the root scope is already appended to 'envWithScopes' so the--- with-scope lookup finds builtins without needing a parent chain.--- Supports both resolved (CAttrSet*) and lazy (CThunk*, tagged with bit 0)--- with-scope entries.  Lazy entries are forced on first lookup and the--- pointer is updated in place so subsequent lookups hit the resolved--- attrset directly.-evalWithVar :: (MonadEval m) => Env -> Text -> m NixValue-evalWithVar env name =-  let (withArr, withCount) = envWithScopesRaw env-   in evalWithVarScopes env name withArr (fromIntegral withCount) 0--evalWithVarScopes :: (MonadEval m) => Env -> Text -> Ptr (Ptr ()) -> Int -> Int -> m NixValue-evalWithVarScopes env name withArr count idx-  | idx >= count = evalVar env name-  | otherwise = do-      let scopePtr = unsafePerformIO (peekElemOff withArr idx)-      if isLazyWithScope scopePtr-        then do-          -- Lazy with-scope: force the thunk to get the attrset-          let thunkPtr = untagWithScope scopePtr-          scopeVal <- force (Thunk thunkPtr)-          case scopeVal of-            VAttrs (AttrSet cset) -> do-              -- Cache: replace the tagged thunk pointer with the resolved-              -- attrset pointer so future lookups are fast.-              let resolvedPtr = castPtr cset-              seq (unsafePerformIO (pokeElemOff withArr idx resolvedPtr)) (pure ())-              case attrSetLookup name (AttrSet cset) of-                Just thunk -> force thunk-                Nothing -> evalWithVarScopes env name withArr count (idx + 1)-            _ -> throwEvalError ("'with' requires a set, got " <> typeName scopeVal)-        else-          -- Resolved attrset scope (normal path)-          case attrSetLookup name (AttrSet (castPtr scopePtr)) of-            Just thunk -> force thunk-            Nothing -> evalWithVarScopes env name withArr count (idx + 1)---- | Check if a with-scope pointer is tagged as lazy (bit 0 set).-isLazyWithScope :: Ptr () -> Bool-isLazyWithScope ptr = ptrToWordPtr ptr .&. 1 /= 0---- | Remove the lazy tag from a with-scope pointer, returning a CThunkPtr.-untagWithScope :: Ptr () -> CThunkPtr-untagWithScope ptr =-  let tagged = ptrToWordPtr ptr-   in wordPtrToPtr (tagged .&. complement 1)---- | Tag a CThunkPtr as a lazy with-scope (set bit 0).-tagLazyWithScope :: CThunkPtr -> Ptr ()-tagLazyWithScope ptr =-  let raw = ptrToWordPtr (castPtr ptr)-   in wordPtrToPtr (raw .|. 1)---- | Push a lazy (thunk-based) with-scope onto the environment.--- The scope is NOT forced until a WITH_VAR lookup actually needs it.-{-# NOINLINE pushLazyWithScope #-}-pushLazyWithScope :: Thunk -> Env -> Env-pushLazyWithScope (Thunk thunkPtr) =-  pushWithScopeRaw (tagLazyWithScope thunkPtr)---- | Push a raw pointer as a with-scope.-{-# NOINLINE pushWithScopeRaw #-}-pushWithScopeRaw :: Ptr () -> Env -> Env-pushWithScopeRaw ptr (Env envPtr) =-  Env (unsafePerformIO (cenvPushWith envPtr ptr))---- ------------------------------------------------------------------------------ Formals matching + env helpers (used by evalBcApp, applyValue, etc.)--- ------------------------------------------------------------------------------- | Match a lambda's formals against an argument thunk.-matchFormals :: (MonadEval m) => Env -> EvalFormals -> Thunk -> m Env-matchFormals closureEnv (EFName _) argThunk =-  let (sp, sc) = buildCSlots [argThunk]-   in pure (envFromSlots sp sc closureEnv)-matchFormals closureEnv (EFSet formals allowExtra) argThunk = do-  argVal <- force argThunk-  matchFormalSet closureEnv formals allowExtra argVal Nothing-matchFormals closureEnv (EFNamedSet _ formals allowExtra) argThunk = do-  argVal <- force argThunk-  matchFormalSet closureEnv formals allowExtra argVal (Just argThunk)---- | Match destructuring set pattern formals against an attrset value.-matchFormalSet :: (MonadEval m) => Env -> [EvalFormal] -> Bool -> NixValue -> Maybe Thunk -> m Env-matchFormalSet closureEnv formals allowExtra argVal atThunk =-  case argVal of-    VAttrs attrs -> do-      checkExtraKeys formals allowExtra attrs-      checkMissingFormals attrs formals-      let formalEnv = envFromSlots formalSlotsPtr formalSlotCount closureEnv-          (formalSlotsPtr, formalSlotCount) = buildCSlots formalThunks-          formalThunks = case atThunk of-            Nothing -> map resolveOneFormal formals-            Just at -> at : map resolveOneFormal formals-          resolveOneFormal (EvalFormal name defBcIdx) =-            case attrSetLookup name attrs of-              Just thunk -> thunk-              Nothing -> case defBcIdx of-                Just bcIdx -> mkThunkBc formalEnv bcIdx-                Nothing -> error "matchFormalSet: missing required formal (unreachable)"-      pure formalEnv-    _ -> throwEvalError ("function expects a set argument, got " <> typeName argVal)--checkExtraKeys :: (MonadEval m) => [EvalFormal] -> Bool -> AttrSet -> m ()-checkExtraKeys _ True _ = pure ()-checkExtraKeys formals False attrs =-  let expected = map efName formals-      actual = attrSetKeys attrs-      extra = filter (`notElem` expected) actual-   in case extra of-        [] -> pure ()-        (k : _) -> throwEvalError ("unexpected attribute '" <> k <> "' in function argument")--checkMissingFormals :: (MonadEval m) => AttrSet -> [EvalFormal] -> m ()-checkMissingFormals attrs formals =-  let allMissing = [efName f | f <- formals, isNothing (efDefault f), not (attrSetMember (efName f) attrs)]-   in case allMissing of-        [] -> pure ()-        (name : _) ->-          let provided = attrSetKeys attrs-              provSnippet = T.intercalate ", " (take 20 provided)-              missSnippet = T.intercalate ", " allMissing-           in throwEvalError ("missing required attribute '" <> name <> "'; all missing: [" <> missSnippet <> "]; provided keys (" <> T.pack (show (length provided)) <> "): [" <> provSnippet <> "]")---- | Build capture environment from capture info.--- NoCaptureInfo: no trimming, use env as-is.--- Captures: build minimal env from captured slots.--- CapturesWithScopes: build minimal env + copy with-scopes.-buildCaptureEnv :: Env -> CaptureInfo -> Env-buildCaptureEnv env NoCaptureInfo = env-buildCaptureEnv env (Captures captureList) =-  let (slotsPtr, slotCount) = buildCSlots [envLookupResolved lvl idx env | (lvl, idx) <- captureList]-   in newMinimalEnv slotsPtr slotCount-buildCaptureEnv env (CapturesWithScopes captureList) =-  let (slotsPtr, slotCount) = buildCSlots [envLookupResolved lvl idx env | (lvl, idx) <- captureList]-      (withArr, withCount) = withScopesForCapture env-   in newCEnv slotsPtr slotCount Nothing Nothing withArr withCount---- | Look up a name in the environment and return its thunk.--- Used by @inherit@ bindings (both bytecode and Expr paths).-inheritLookup :: Env -> Text -> Thunk-inheritLookup env name =-  case envLookup name env of-    Just thunk -> thunk-    Nothing -> error ("inheritLookup: undefined variable '" <> T.unpack name <> "' (unreachable)")---- | Merge two thunks for nested attribute update.--- If both are computed attrsets, recursively merge with attrSetUnionWith.--- Otherwise the new value wins.-mergeThunks :: Thunk -> Thunk -> Thunk-mergeThunks a b =-  case (readThunkValue a, readThunkValue b) of-    (Just (VAttrs aa), Just (VAttrs bb)) ->-      evaluated (VAttrs (attrSetUnionWith mergeThunks aa bb))-    _ -> b---- ------------------------------------------------------------------------------ Builtin registry (single-definition-site for all builtins)--- ------------------------------------------------------------------------------- | A builtin function definition: its arity and implementation.-data BuiltinDef m = BuiltinDef-  { bdArity :: !Int,-    bdApply :: [NixValue] -> m NixValue-  }---- | Define an arity-1 builtin.-builtin1 :: (MonadEval m) => Text -> (NixValue -> m NixValue) -> (Text, BuiltinDef m)-builtin1 name f =-  ( name,-    BuiltinDef 1 $ \case-      [a] -> f a-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-  )---- | Define an arity-2 builtin.-builtin2 ::-  (MonadEval m) =>-  Text ->-  (NixValue -> NixValue -> m NixValue) ->-  (Text, BuiltinDef m)-builtin2 name f =-  ( name,-    BuiltinDef 2 $ \case-      [a, b] -> f a b-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-  )---- | Define an arity-3 builtin.-builtin3 ::-  (MonadEval m) =>-  Text ->-  (NixValue -> NixValue -> NixValue -> m NixValue) ->-  (Text, BuiltinDef m)-builtin3 name f =-  ( name,-    BuiltinDef 3 $ \case-      [a, b, c] -> f a b c-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-  )---- | Central registry of all builtins.  Adding a new builtin is a single--- entry here plus its implementation function - no other files need changes.-builtinRegistry :: (MonadEval m) => Map Text (BuiltinDef m)-builtinRegistry =-  Map.fromList-    [ -- Type checking (arity 1)-      builtin1 "typeOf" (pure . mkStr . typeOfValue),-      builtin1 "isNull" (pure . VBool . isNullVal),-      builtin1 "isInt" (pure . VBool . isIntVal),-      builtin1 "isFloat" (pure . VBool . isFloatVal),-      builtin1 "isBool" (pure . VBool . isBoolVal),-      builtin1 "isString" (pure . VBool . isStringVal),-      builtin1 "isList" (pure . VBool . isListVal),-      builtin1 "isAttrs" (pure . VBool . isAttrsVal),-      builtin1 "isFunction" (pure . VBool . isFunctionVal),-      -- List operations (arity 1)-      builtin1 "length" builtinLength,-      builtin1 "head" builtinHead,-      builtin1 "tail" builtinTail,-      -- String operations (arity 1)-      builtin1 "toString" (fmap (uncurry VStr) . coerceToStringPermissive),-      builtin1 "stringLength" builtinStringLength,-      -- Control (arity 1)-      builtin1 "throw" builtinThrow,-      builtin1 "abort" builtinAbort,-      -- Attr set operations (arity 1)-      builtin1 "attrNames" builtinAttrNames,-      builtin1 "attrValues" builtinAttrValues,-      builtin1 "listToAttrs" builtinListToAttrs,-      -- Attr set operations (arity 2)-      builtin2 "hasAttr" builtinHasAttr,-      builtin2 "getAttr" builtinGetAttr,-      builtin2 "removeAttrs" builtinRemoveAttrs,-      builtin2 "intersectAttrs" builtinIntersectAttrs,-      builtin2 "catAttrs" builtinCatAttrs,-      -- List higher-order (arity 2)-      builtin2 "map" builtinMap,-      builtin2 "filter" builtinFilter,-      builtin2 "genList" builtinGenList,-      builtin2 "sort" builtinSort,-      builtin2 "concatMap" builtinConcatMap,-      builtin2 "any" builtinAny,-      builtin2 "all" builtinAll,-      builtin2 "elem" builtinElem,-      builtin2 "elemAt" builtinElemAt,-      builtin2 "partition" builtinPartition,-      builtin2 "groupBy" builtinGroupBy,-      -- String operations (arity 2)-      builtin2 "concatStringsSep" builtinConcatStringsSep,-      -- Arity 3-      builtin3 "foldl'" builtinFoldl,-      builtin3 "substring" builtinSubstring,-      -- Numeric-      builtin1 "isPath" (pure . VBool . isPathVal),-      builtin1 "ceil" builtinCeil,-      builtin1 "floor" builtinFloor,-      builtin2 "seq" builtinSeq,-      builtin2 "trace" builtinTrace,-      builtin2 "warn" builtinWarn,-      builtin1 "unsafeDiscardStringContext" builtinDiscardContext,-      builtin1 "unsafeDiscardOutputDependency" builtinDiscardOutputDep,-      -- String context introspection-      builtin1 "hasContext" builtinHasContext,-      builtin1 "getContext" builtinGetContext,-      builtin2 "appendContext" builtinAppendContext,-      builtin1 "baseNameOf" builtinBaseNameOf,-      builtin1 "dirOf" builtinDirOf,-      builtin1 "concatLists" builtinConcatLists,-      builtin2 "lessThan" builtinLessThan,-      -- Arithmetic + bitwise-      builtin2 "add" builtinAdd,-      builtin2 "sub" builtinSub,-      builtin2 "mul" builtinMul,-      builtin2 "div" builtinDiv,-      builtin2 "mod" builtinMod,-      builtin2 "bitAnd" builtinBitAnd,-      builtin2 "bitOr" builtinBitOr,-      builtin2 "bitXor" builtinBitXor,-      builtin2 "min" builtinMin,-      builtin2 "max" builtinMax,-      -- Attr set higher-order-      builtin2 "mapAttrs" builtinMapAttrs,-      builtin1 "functionArgs" builtinFunctionArgs,-      builtin2 "setFunctionArgs" builtinSetFunctionArgs,-      builtin2 "zipAttrsWith" builtinZipAttrsWith,-      -- String manipulation-      builtin2 "match" builtinMatch,-      builtin2 "split" builtinSplit,-      builtin3 "replaceStrings" builtinReplaceStrings,-      builtin2 "compareVersions" builtinCompareVersions,-      builtin1 "splitVersion" builtinSplitVersion,-      builtin1 "parseDrvName" builtinParseDrvName,-      -- Serialization + hashing-      builtin1 "toJSON" builtinToJSON,-      builtin1 "fromJSON" builtinFromJSON,-      builtin2 "hashString" builtinHashString,-      -- Error handling + sequencing-      builtin1 "tryEval" (\_ -> throwEvalError "unreachable: tryEval handled in evalApp"),-      builtin2 "deepSeq" builtinDeepSeq,-      -- Graph traversal-      builtin1 "genericClosure" builtinGenericClosure,-      -- IO builtins (delegate to MonadEval methods)-      builtin1 "import" builtinImport,-      builtin1 "readFile" builtinReadFile,-      builtin1 "pathExists" builtinPathExists,-      builtin1 "readDir" builtinReadDir,-      builtin1 "getEnv" builtinGetEnv,-      builtin1 "toPath" builtinToPath,-      -- Store path operations-      builtin1 "placeholder" builtinPlaceholder,-      builtin1 "storePath" builtinStorePath,-      builtin2 "findFile" builtinFindFile,-      builtin2 "toFile" builtinToFile,-      builtin2 "scopedImport" builtinScopedImport,-      -- Network fetchers-      builtin1 "fetchurl" builtinFetchurl,-      builtin1 "fetchTarball" builtinFetchTarball,-      builtin1 "fetchGit" builtinFetchGit,-      -- Derivation construction: lazy 'derivation' wrapper over the eager-      -- 'derivationStrict' primop (matches C++ Nix corepkgs/derivation.nix).-      builtin1 "derivation" builtinDerivationLazy,-      builtin1 "derivationStrict" builtinDerivationStrict,-      -- Error context (pass-through - context only matters on error)-      builtin2 "addErrorContext" (\_ val -> pure val),-      -- Attr position (return null - nixpkgs handles this gracefully)-      builtin2 "unsafeGetAttrPos" (\_ _ -> pure VNull),-      -- Debugging (traceVerbose: same as trace for now, --trace-verbose not yet gated)-      builtin2 "traceVerbose" builtinTrace,-      builtin1 "break" pure,-      -- IO: file hashing + type detection-      builtin2 "hashFile" builtinHashFile,-      builtin1 "readFileType" builtinReadFileType,-      -- Serialization-      builtin1 "fromTOML" builtinFromTOML,-      -- Hash conversion-      builtin1 "convertHash" builtinConvertHash,-      -- XML serialization-      builtin1 "toXML" builtinToXML,-      -- Source filtering + path import-      builtin1 "path" builtinPath,-      builtin2 "filterSource" builtinFilterSource,-      -- Experimental feature stubs-      builtin2 "outputOf" builtinOutputOf,-      builtin1 "fetchTree" builtinFetchTree,-      builtin1 "fetchClosure" builtinFetchClosure-    ]---- | Names of all registered builtins.-builtinNames :: [Text]-builtinNames = Map.keys (builtinRegistry :: Map Text (BuiltinDef PureEval))---- ------------------------------------------------------------------------------ Builtin dispatch (partial application via accumulated args)--- ------------------------------------------------------------------------------- | Arity of a builtin (how many arguments before execution).-builtinArity :: Text -> Int-builtinArity name = maybe 1 bdArity (Map.lookup name (builtinRegistry :: Map Text (BuiltinDef PureEval)))---- | Apply a builtin with accumulated args.  If we have enough args,--- execute; otherwise return a partially applied builtin.-applyBuiltin :: (MonadEval m) => Text -> [NixValue] -> NixValue -> m NixValue-applyBuiltin name accArgs arg =-  let allArgs = accArgs ++ [arg]-      arity = builtinArity name-   in if length allArgs < arity-        then pure (VBuiltin name (precompileArgs name allArgs))-        else executeBuiltin name allArgs---- | Pre-compile regex patterns at partial application time.--- When builtins.match or builtins.split receives its first argument--- (the pattern string), compile it immediately and store the compiled--- RE.Regex in a VCompiledRegex, replacing the raw VStr.  The compiled--- form is carried in VBuiltin's accumulated args and reused on every--- subsequent application - zero recompilation.-precompileArgs :: Text -> [NixValue] -> [NixValue]-precompileArgs "match" [VStr pat _] =-  let anchored = "^" <> pat <> "$"-   in case cachedCompileRegex anchored of-        Just compiled -> [VCompiledRegex (CompiledRegex pat compiled)]-        Nothing -> [VStr pat emptyContext] -- fail later at execute time-precompileArgs "split" [VStr pat _] =-  case cachedCompileRegex pat of-    Just compiled -> [VCompiledRegex (CompiledRegex pat compiled)]-    Nothing -> [VStr pat emptyContext] -- fail later at execute time-precompileArgs _ args = args---- | Apply a function value (lambda or builtin) to one argument.--- Used by higher-order builtins to invoke user-supplied functions.-applyValue :: (MonadEval m) => NixValue -> NixValue -> m NixValue-applyValue (VLambda closureEnv formals bodyBcIdx) arg = do-  extEnv <- matchFormals closureEnv formals (evaluated arg)-  evalBytecode extEnv bodyBcIdx-applyValue (VBuiltin name accArgs) arg =-  applyBuiltin name accArgs arg-applyValue other _ =-  throwEvalError ("attempt to call " <> typeName other <> ", which is not a function")---- | Execute a builtin once all arguments are collected.------ Direct case dispatch avoids rebuilding the polymorphic 'builtinRegistry'--- Map on every call.  'builtinRegistry' is polymorphic in @m@ so GHC--- cannot cache it as a CAF - it gets reconstructed on every use.--- Pattern matching on the name is zero-allocation.-executeBuiltin :: (MonadEval m) => Text -> [NixValue] -> m NixValue-executeBuiltin name args = case name of-  -- Type checking (arity 1)-  "typeOf" -> apply1 (pure . mkStr . typeOfValue)-  "isNull" -> apply1 (pure . VBool . isNullVal)-  "isInt" -> apply1 (pure . VBool . isIntVal)-  "isFloat" -> apply1 (pure . VBool . isFloatVal)-  "isBool" -> apply1 (pure . VBool . isBoolVal)-  "isString" -> apply1 (pure . VBool . isStringVal)-  "isList" -> apply1 (pure . VBool . isListVal)-  "isAttrs" -> apply1 (pure . VBool . isAttrsVal)-  "isFunction" -> apply1 (pure . VBool . isFunctionVal)-  -- List operations (arity 1)-  "length" -> apply1 builtinLength-  "head" -> apply1 builtinHead-  "tail" -> apply1 builtinTail-  -- String operations (arity 1)-  "toString" -> apply1 (fmap (uncurry VStr) . coerceToStringPermissive)-  "stringLength" -> apply1 builtinStringLength-  -- Control (arity 1)-  "throw" -> apply1 builtinThrow-  "abort" -> apply1 builtinAbort-  -- Attr set operations (arity 1)-  "attrNames" -> apply1 builtinAttrNames-  "attrValues" -> apply1 builtinAttrValues-  "listToAttrs" -> apply1 builtinListToAttrs-  -- Attr set operations (arity 2)-  "hasAttr" -> apply2 builtinHasAttr-  "getAttr" -> apply2 builtinGetAttr-  "removeAttrs" -> apply2 builtinRemoveAttrs-  "intersectAttrs" -> apply2 builtinIntersectAttrs-  "catAttrs" -> apply2 builtinCatAttrs-  -- List higher-order (arity 2)-  "map" -> apply2 builtinMap-  "filter" -> apply2 builtinFilter-  "genList" -> apply2 builtinGenList-  "sort" -> apply2 builtinSort-  "concatMap" -> apply2 builtinConcatMap-  "any" -> apply2 builtinAny-  "all" -> apply2 builtinAll-  "elem" -> apply2 builtinElem-  "elemAt" -> apply2 builtinElemAt-  "partition" -> apply2 builtinPartition-  "groupBy" -> apply2 builtinGroupBy-  -- String operations (arity 2)-  "concatStringsSep" -> apply2 builtinConcatStringsSep-  -- Arity 3-  "foldl'" -> apply3 builtinFoldl-  "substring" -> apply3 builtinSubstring-  -- Numeric-  "isPath" -> apply1 (pure . VBool . isPathVal)-  "ceil" -> apply1 builtinCeil-  "floor" -> apply1 builtinFloor-  "seq" -> apply2 builtinSeq-  "trace" -> apply2 builtinTrace-  "warn" -> apply2 builtinWarn-  "unsafeDiscardStringContext" -> apply1 builtinDiscardContext-  "unsafeDiscardOutputDependency" -> apply1 builtinDiscardOutputDep-  -- String context introspection-  "hasContext" -> apply1 builtinHasContext-  "getContext" -> apply1 builtinGetContext-  "appendContext" -> apply2 builtinAppendContext-  "baseNameOf" -> apply1 builtinBaseNameOf-  "dirOf" -> apply1 builtinDirOf-  "concatLists" -> apply1 builtinConcatLists-  "lessThan" -> apply2 builtinLessThan-  -- Arithmetic + bitwise-  "add" -> apply2 builtinAdd-  "sub" -> apply2 builtinSub-  "mul" -> apply2 builtinMul-  "div" -> apply2 builtinDiv-  "mod" -> apply2 builtinMod-  "bitAnd" -> apply2 builtinBitAnd-  "bitOr" -> apply2 builtinBitOr-  "bitXor" -> apply2 builtinBitXor-  "min" -> apply2 builtinMin-  "max" -> apply2 builtinMax-  -- Attr set higher-order-  "mapAttrs" -> apply2 builtinMapAttrs-  "functionArgs" -> apply1 builtinFunctionArgs-  "setFunctionArgs" -> apply2 builtinSetFunctionArgs-  "zipAttrsWith" -> apply2 builtinZipAttrsWith-  -- String manipulation-  "match" -> apply2 builtinMatch-  "split" -> apply2 builtinSplit-  "replaceStrings" -> apply3 builtinReplaceStrings-  "compareVersions" -> apply2 builtinCompareVersions-  "splitVersion" -> apply1 builtinSplitVersion-  "parseDrvName" -> apply1 builtinParseDrvName-  -- Serialization + hashing-  "toJSON" -> apply1 builtinToJSON-  "fromJSON" -> apply1 builtinFromJSON-  "hashString" -> apply2 builtinHashString-  -- Error handling + sequencing-  "tryEval" -> apply1 (\_ -> throwEvalError "unreachable: tryEval handled in evalApp")-  "deepSeq" -> apply2 builtinDeepSeq-  -- Graph traversal-  "genericClosure" -> apply1 builtinGenericClosure-  -- IO builtins (delegate to MonadEval methods)-  "import" -> apply1 builtinImport-  "readFile" -> apply1 builtinReadFile-  "pathExists" -> apply1 builtinPathExists-  "readDir" -> apply1 builtinReadDir-  "getEnv" -> apply1 builtinGetEnv-  "toPath" -> apply1 builtinToPath-  -- Store path operations-  "placeholder" -> apply1 builtinPlaceholder-  "storePath" -> apply1 builtinStorePath-  "findFile" -> apply2 builtinFindFile-  "toFile" -> apply2 builtinToFile-  "scopedImport" -> apply2 builtinScopedImport-  -- Network fetchers-  "fetchurl" -> apply1 builtinFetchurl-  "fetchTarball" -> apply1 builtinFetchTarball-  "fetchGit" -> apply1 builtinFetchGit-  -- Derivation construction: lazy 'derivation' over eager 'derivationStrict'-  "derivation" -> apply1 builtinDerivationLazy-  "derivationStrict" -> apply1 builtinDerivationStrict-  -- Error context (pass-through - context only matters on error)-  "addErrorContext" -> apply2 (\_ val -> pure val)-  -- Attr position (return null - nixpkgs handles this gracefully)-  "unsafeGetAttrPos" -> apply2 (\_ _ -> pure VNull)-  -- Debugging (traceVerbose: same as trace for now)-  "traceVerbose" -> apply2 builtinTrace-  "break" -> apply1 pure-  -- IO: file hashing + type detection-  "hashFile" -> apply2 builtinHashFile-  "readFileType" -> apply1 builtinReadFileType-  -- Serialization-  "fromTOML" -> apply1 builtinFromTOML-  -- Hash conversion-  "convertHash" -> apply1 builtinConvertHash-  -- XML serialization-  "toXML" -> apply1 builtinToXML-  -- Source filtering + path import-  "path" -> apply1 builtinPath-  "filterSource" -> apply2 builtinFilterSource-  -- Experimental feature stubs-  "outputOf" -> apply2 builtinOutputOf-  "fetchTree" -> apply1 builtinFetchTree-  "fetchClosure" -> apply1 builtinFetchClosure-  _ -> throwEvalError ("unknown builtin '" <> name <> "'")-  where-    apply1 f = case args of-      [a] -> f a-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-    apply2 f = case args of-      [a, b] -> f a b-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-    apply3 f = case args of-      [a, b, c] -> f a b c-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")---- ------------------------------------------------------------------------------ Builtin implementations - type checking--- -----------------------------------------------------------------------------typeOfValue :: NixValue -> Text-typeOfValue val = case val of-  VInt _ -> "int"-  VFloat _ -> "float"-  VBool _ -> "bool"-  VNull -> "null"-  VStr _ _ -> "string"-  VPath _ -> "path"-  VList _ -> "list"-  VAttrs _ -> "set"-  VLambda {} -> "lambda"-  VBuiltin _ _ -> "lambda"-  VDerivation _ -> "set"-  VCompiledRegex _ -> "lambda"--isNullVal :: NixValue -> Bool-isNullVal VNull = True-isNullVal _ = False--isIntVal :: NixValue -> Bool-isIntVal (VInt _) = True-isIntVal _ = False--isFloatVal :: NixValue -> Bool-isFloatVal (VFloat _) = True-isFloatVal _ = False--isBoolVal :: NixValue -> Bool-isBoolVal (VBool _) = True-isBoolVal _ = False--isStringVal :: NixValue -> Bool-isStringVal (VStr _ _) = True-isStringVal _ = False--isListVal :: NixValue -> Bool-isListVal (VList _) = True-isListVal _ = False--isAttrsVal :: NixValue -> Bool-isAttrsVal (VAttrs _) = True-isAttrsVal _ = False--isFunctionVal :: NixValue -> Bool-isFunctionVal (VLambda {}) = True-isFunctionVal (VBuiltin _ _) = True-isFunctionVal _ = False---- ------------------------------------------------------------------------------ Builtin implementations - list (arity 1)--- -----------------------------------------------------------------------------builtinLength :: (MonadEval m) => NixValue -> m NixValue-builtinLength (VList cl) = pure (VInt (fromIntegral (clistLen cl)))-builtinLength other = throwEvalError ("builtins.length: expected a list, got " <> typeName other)--builtinHead :: (MonadEval m) => NixValue -> m NixValue-builtinHead (VList cl)-  | clistLen cl == 0 = throwEvalError "builtins.head: empty list"-  | otherwise = case clistThunks cl of-      (p : _) -> force (Thunk p)-      [] -> throwEvalError "builtins.head: empty list" -- unreachable: clistLen > 0-builtinHead other = throwEvalError ("builtins.head: expected a list, got " <> typeName other)--builtinTail :: (MonadEval m) => NixValue -> m NixValue-builtinTail (VList cl)-  | clistLen cl == 0 = throwEvalError "builtins.tail: empty list"-  | otherwise = pure (VList (clistFromThunks (drop 1 (clistThunks cl))))-builtinTail other = throwEvalError ("builtins.tail: expected a list, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - string (arity 1)--- -----------------------------------------------------------------------------builtinStringLength :: (MonadEval m) => NixValue -> m NixValue-builtinStringLength (VStr s _) = pure (VInt (fromIntegral (T.length s)))-builtinStringLength other =-  throwEvalError ("builtins.stringLength: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - control--- -----------------------------------------------------------------------------builtinThrow :: (MonadEval m) => NixValue -> m NixValue-builtinThrow (VStr msg _) = throwEvalError msg-builtinThrow other = throwEvalError ("builtins.throw: expected a string, got " <> typeName other)--builtinAbort :: (MonadEval m) => NixValue -> m NixValue-builtinAbort (VStr msg _) = abortEvaluation msg-builtinAbort other = abortEvaluation ("builtins.abort: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - attr set (arity 1)--- -----------------------------------------------------------------------------builtinAttrNames :: (MonadEval m) => NixValue -> m NixValue-builtinAttrNames (VAttrs attrs) =-  -- Nix returns attribute names lexicographically sorted; the C array is in-  -- interned-symbol order, so sort here (consistent with builtins.attrValues,-  -- which sorts via attrSetElems).-  let thunks = map (evaluated . mkStr) (sort (attrSetKeys attrs))-   in pure (VList (clistFromThunks (map thunkToCPtr thunks)))-builtinAttrNames other =-  throwEvalError ("builtins.attrNames: expected a set, got " <> typeName other)--builtinAttrValues :: (MonadEval m) => NixValue -> m NixValue-builtinAttrValues (VAttrs attrs) =-  pure (VList (clistFromThunks (map thunkToCPtr (attrSetElems attrs))))-builtinAttrValues other =-  throwEvalError ("builtins.attrValues: expected a set, got " <> typeName other)--builtinListToAttrs :: (MonadEval m) => NixValue -> m NixValue-builtinListToAttrs (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  pairs <- mapM listToAttrsPair thunks-  -- Nix listToAttrs uses first-wins: if duplicate name, first element wins.-  let firstWins = Map.fromListWith (\_ kept -> kept) pairs-  pure (VAttrs (attrSetFromMap firstWins))-builtinListToAttrs other =-  throwEvalError ("builtins.listToAttrs: expected a list, got " <> typeName other)---- | Extract { name, value } from a thunk for listToAttrs.-listToAttrsPair :: (MonadEval m) => Thunk -> m (Text, Thunk)-listToAttrsPair thunk = do-  val <- force thunk-  case val of-    VAttrs attrs -> do-      nameThunk <--        maybe (throwEvalError "builtins.listToAttrs: element missing 'name'") pure $-          attrSetLookup "name" attrs-      nameVal <- force nameThunk-      case nameVal of-        VStr keyName _ ->-          case attrSetLookup "value" attrs of-            Just valueThunk -> pure (keyName, valueThunk)-            Nothing -> throwEvalError "builtins.listToAttrs: element missing 'value'"-        _ -> throwEvalError "builtins.listToAttrs: 'name' must be a string"-    _ -> throwEvalError "builtins.listToAttrs: element must be a set"---- ------------------------------------------------------------------------------ Builtin implementations - attr set (arity 2)--- -----------------------------------------------------------------------------builtinHasAttr :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinHasAttr (VStr key _) (VAttrs attrs) =-  pure (VBool (attrSetMember key attrs))-builtinHasAttr (VStr _ _) other =-  throwEvalError ("builtins.hasAttr: expected a set, got " <> typeName other)-builtinHasAttr other _ =-  throwEvalError ("builtins.hasAttr: expected a string, got " <> typeName other)--builtinGetAttr :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinGetAttr (VStr key _) (VAttrs attrs) =-  case attrSetLookup key attrs of-    Just thunk -> force thunk-    Nothing -> throwEvalError ("builtins.getAttr: attribute '" <> key <> "' not found")-builtinGetAttr (VStr _ _) other =-  throwEvalError ("builtins.getAttr: expected a set, got " <> typeName other)-builtinGetAttr other _ =-  throwEvalError ("builtins.getAttr: expected a string, got " <> typeName other)--builtinRemoveAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinRemoveAttrs (VAttrs attrs) (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  keys <- mapM forceToString thunks-  pure (VAttrs (attrSetRemoveKeys keys attrs))-  where-    forceToString thunk = do-      val <- force thunk-      case val of-        VStr s _ -> pure s-        _ -> throwEvalError "builtins.removeAttrs: key list must contain strings"-builtinRemoveAttrs (VAttrs _) other =-  throwEvalError ("builtins.removeAttrs: expected a list, got " <> typeName other)-builtinRemoveAttrs other _ =-  throwEvalError ("builtins.removeAttrs: expected a set, got " <> typeName other)--builtinIntersectAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinIntersectAttrs (VAttrs a) (VAttrs b) =-  -- Iterate keys of 'a' (typically the smaller set, e.g. functionArgs)-  -- and point-lookup each in 'b' (typically the large set, e.g. nixpkgs).-  -- This avoids materializing all thunks in 'b'.-  let keysA = attrSetKeys a-      result = Map.fromList [(k, thunk) | k <- keysA, Just thunk <- [attrSetLookup k b]]-   in pure (VAttrs (attrSetFromMap result))-builtinIntersectAttrs (VAttrs _) other =-  throwEvalError ("builtins.intersectAttrs: expected a set, got " <> typeName other)-builtinIntersectAttrs other _ =-  throwEvalError ("builtins.intersectAttrs: expected a set, got " <> typeName other)--builtinCatAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinCatAttrs (VStr key _) (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  vals <- catAttrsCollect key thunks-  pure (VList (clistFromThunks (map thunkToCPtr vals)))-builtinCatAttrs (VStr _ _) other =-  throwEvalError ("builtins.catAttrs: expected a list, got " <> typeName other)-builtinCatAttrs other _ =-  throwEvalError ("builtins.catAttrs: expected a string, got " <> typeName other)---- | Collect values for a given key from a list of attrsets.--- Tail-recursive with accumulator to avoid stack overflow on large lists.-catAttrsCollect :: (MonadEval m) => Text -> [Thunk] -> m [Thunk]-catAttrsCollect key = go []-  where-    go !acc [] = pure (reverse acc)-    go !acc (thunk : rest) = do-      val <- force thunk-      case val of-        VAttrs attrs ->-          case attrSetLookup key attrs of-            Just found -> go (found : acc) rest-            Nothing -> go acc rest-        _ -> throwEvalError "builtins.catAttrs: list element must be a set"---- ------------------------------------------------------------------------------ Builtin implementations - list higher-order (arity 2)--- -----------------------------------------------------------------------------builtinMap :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinMap func (VList cl) =-  -- Lazy: each element is a deferred application, forced only on demand.-  let thunks = map Thunk (clistThunks cl)-   in pure (VList (clistFromThunks (map (thunkToCPtr . deferApply func) thunks)))-builtinMap _ other =-  throwEvalError ("builtins.map: expected a list, got " <> typeName other)--builtinFilter :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinFilter predFn (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  filtered <- filterThunks predFn thunks-  pure (VList (clistFromThunks (map thunkToCPtr filtered)))-builtinFilter _ other =-  throwEvalError ("builtins.filter: expected a list, got " <> typeName other)--filterThunks :: (MonadEval m) => NixValue -> [Thunk] -> m [Thunk]-filterThunks _ [] = pure []-filterThunks predFn (thunk : rest) = do-  val <- force thunk-  result <- applyValue predFn val-  case result of-    VBool True -> (thunk :) <$> filterThunks predFn rest-    VBool False -> filterThunks predFn rest-    _ -> throwEvalError "builtins.filter: predicate must return a bool"--builtinGenList :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinGenList func (VInt n)-  | n < 0 = throwEvalError "builtins.genList: length must be non-negative"-  | otherwise =-      -- Lazy: each element is a deferred @f i@, forced only on demand.-      -- Slot 0 = function.-      let fnThunk = evaluated func-          (sp, sc) = buildCSlots [fnThunk]-          env = newMinimalEnv sp sc-          mkIndexThunk i = mkThunk env (EApp (EResolvedVar 0 0) (ELit (NixInt i)))-       in pure (VList (clistFromThunks (map (thunkToCPtr . mkIndexThunk) [0 .. n - 1])))-builtinGenList _ other =-  throwEvalError ("builtins.genList: expected an integer, got " <> typeName other)--builtinSort :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinSort comparator (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  vals <- mapM force thunks-  sorted <- mergeSort comparator vals-  pure (VList (clistFromThunks (map (thunkToCPtr . evaluated) sorted)))-builtinSort _ other =-  throwEvalError ("builtins.sort: expected a list, got " <> typeName other)---- | Stable O(n log n) merge sort using a user-supplied comparator.--- The comparator takes two args (curried) and returns bool.-mergeSort :: (MonadEval m) => NixValue -> [NixValue] -> m [NixValue]-mergeSort _ [] = pure []-mergeSort _ [x] = pure [x]-mergeSort cmp xs = do-  let half = length xs `div` 2-      (left, right) = splitAt half xs-  sortedLeft <- mergeSort cmp left-  sortedRight <- mergeSort cmp right-  mergeSorted cmp sortedLeft sortedRight--mergeSorted :: (MonadEval m) => NixValue -> [NixValue] -> [NixValue] -> m [NixValue]-mergeSorted _ [] ys = pure ys-mergeSorted _ xs [] = pure xs-mergeSorted cmp (x : xs) (y : ys) = do-  partial <- applyValue cmp x-  result <- applyValue partial y-  case result of-    VBool True -> (x :) <$> mergeSorted cmp xs (y : ys)-    VBool False -> (y :) <$> mergeSorted cmp (x : xs) ys-    _ -> throwEvalError "builtins.sort: comparator must return a bool"--builtinConcatMap :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinConcatMap func (VList cl) = do-  -- Semi-eager: must force each application to discover list structure for-  -- concatenation, but element thunks within those sub-lists stay lazy.-  let thunks = map Thunk (clistThunks cl)-      deferredApps = map (deferApply func) thunks-  results <- mapM force deferredApps-  concatted <- mapM extractList results-  pure (VList (clistFromThunks (map thunkToCPtr (concat concatted))))-builtinConcatMap _ other =-  throwEvalError ("builtins.concatMap: expected a list, got " <> typeName other)--extractList :: (MonadEval m) => NixValue -> m [Thunk]-extractList (VList cl) = pure (map Thunk (clistThunks cl))-extractList other =-  throwEvalError ("builtins.concatMap: function must return a list, got " <> typeName other)--builtinAny :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinAny predFn (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  result <- anyThunk predFn thunks-  pure (VBool result)-builtinAny _ other =-  throwEvalError ("builtins.any: expected a list, got " <> typeName other)--anyThunk :: (MonadEval m) => NixValue -> [Thunk] -> m Bool-anyThunk _ [] = pure False-anyThunk predFn (thunk : rest) = do-  val <- force thunk-  result <- applyValue predFn val-  case result of-    VBool True -> pure True-    VBool False -> anyThunk predFn rest-    _ -> throwEvalError "builtins.any: predicate must return a bool"--builtinAll :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinAll predFn (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  result <- allThunk predFn thunks-  pure (VBool result)-builtinAll _ other =-  throwEvalError ("builtins.all: expected a list, got " <> typeName other)--allThunk :: (MonadEval m) => NixValue -> [Thunk] -> m Bool-allThunk _ [] = pure True-allThunk predFn (thunk : rest) = do-  val <- force thunk-  result <- applyValue predFn val-  case result of-    VBool True -> allThunk predFn rest-    VBool False -> pure False-    _ -> throwEvalError "builtins.all: predicate must return a bool"--builtinElem :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinElem needle (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  found <- elemCheck needle thunks-  pure (VBool found)-builtinElem _ other =-  throwEvalError ("builtins.elem: expected a list, got " <> typeName other)--elemCheck :: (MonadEval m) => NixValue -> [Thunk] -> m Bool-elemCheck _ [] = pure False-elemCheck needle (thunk : rest) = do-  val <- force thunk-  eq <- nixEqual force needle val-  if eq then pure True else elemCheck needle rest--builtinElemAt :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinElemAt (VList cl) (VInt idx)-  | idx < 0 || fromIntegral idx >= clistLen cl = elemAtOOB idx cl-  | otherwise =-      -- O(1) direct C array access instead of materializing the whole list-      let ptr = unsafePerformIO (clistGet (unCList cl) (fromIntegral idx))-       in force (Thunk ptr)-  where-    elemAtOOB i c =-      throwEvalError-        ( "builtins.elemAt: index "-            <> T.pack (show i)-            <> " out of bounds for list of length "-            <> T.pack (show (clistLen c))-        )-builtinElemAt (VList _) other =-  throwEvalError ("builtins.elemAt: expected an integer, got " <> typeName other)-builtinElemAt other _ =-  throwEvalError ("builtins.elemAt: expected a list, got " <> typeName other)--builtinPartition :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinPartition predFn (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  (rightThunks, wrongThunks) <- partitionThunks predFn thunks-  pure-    ( VAttrs-        ( attrSetFromMap $-            Map.fromList-              [ ("right", evaluated (VList (clistFromThunks (map thunkToCPtr rightThunks)))),-                ("wrong", evaluated (VList (clistFromThunks (map thunkToCPtr wrongThunks))))-              ]-        )-    )-builtinPartition _ other =-  throwEvalError ("builtins.partition: expected a list, got " <> typeName other)---- | Tail-recursive partition with accumulator to avoid stack overflow.-partitionThunks :: (MonadEval m) => NixValue -> [Thunk] -> m ([Thunk], [Thunk])-partitionThunks predFn = go [] []-  where-    go !rs !ws [] = pure (reverse rs, reverse ws)-    go !rs !ws (thunk : rest) = do-      val <- force thunk-      result <- applyValue predFn val-      case result of-        VBool True -> go (thunk : rs) ws rest-        VBool False -> go rs (thunk : ws) rest-        _ -> throwEvalError "builtins.partition: predicate must return a bool"--builtinGroupBy :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinGroupBy func (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  groups <- groupByCollect func thunks Map.empty-  pure (VAttrs (attrSetFromMap (Map.map (evaluated . VList . clistFromThunks . map thunkToCPtr . reverse) groups)))-builtinGroupBy _ other =-  throwEvalError ("builtins.groupBy: expected a list, got " <> typeName other)--groupByCollect ::-  (MonadEval m) =>-  NixValue ->-  [Thunk] ->-  Map Text [Thunk] ->-  m (Map Text [Thunk])-groupByCollect _ [] acc = pure acc-groupByCollect func (thunk : rest) acc = do-  val <- force thunk-  result <- applyValue func val-  case result of-    VStr key _ ->-      groupByCollect func rest (Map.insertWith (++) key [thunk] acc)-    _ -> throwEvalError "builtins.groupBy: function must return a string"---- ------------------------------------------------------------------------------ Builtin implementations - string (arity 2)--- -----------------------------------------------------------------------------builtinConcatStringsSep :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinConcatStringsSep (VStr sep sepCtx) (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  pairs <- mapM forceToStrCtx thunks-  let texts = map fst pairs-      mergedCtx = sepCtx <> mconcat (map snd pairs)-  pure (VStr (T.intercalate sep texts) mergedCtx)-  where-    forceToStrCtx thunk = do-      val <- force thunk-      -- Nix coerces list elements to strings (paths, derivations, etc.).-      -- concatStringsSep is strict (coerceMore=False): non-string scalars error.-      coerceToString False force applyValue val-builtinConcatStringsSep (VStr _ _) other =-  throwEvalError ("builtins.concatStringsSep: expected a list, got " <> typeName other)-builtinConcatStringsSep other _ =-  throwEvalError ("builtins.concatStringsSep: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - arity 3--- -----------------------------------------------------------------------------builtinFoldl :: (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue-builtinFoldl op initial (VList cl) =-  foldlStrict op initial (map Thunk (clistThunks cl))-builtinFoldl _ _ other =-  throwEvalError ("builtins.foldl': expected a list, got " <> typeName other)---- | Strict left fold: apply @op acc elem@ for each element.--- @op@ is curried so we call @applyValue op acc@ then @applyValue partial elem@.-foldlStrict :: (MonadEval m) => NixValue -> NixValue -> [Thunk] -> m NixValue-foldlStrict _ acc [] = pure acc-foldlStrict op acc (thunk : rest) = do-  val <- force thunk-  partial <- applyValue op acc-  stepped <- applyValue partial val-  foldlStrict op stepped rest--builtinSubstring :: (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue-builtinSubstring (VInt start) (VInt len) (VStr s ctx)-  | start < 0 = throwEvalError "builtins.substring: negative start position"-  | otherwise =-      let startPos = fromIntegral start-          -- Nix clamps len to available length (negative len means rest of string)-          available = T.length s - startPos-          clampedLen =-            if len < 0-              then available-              else min (fromIntegral len) available-       in -- Context is preserved through substring (matching real Nix).-          pure (VStr (T.take clampedLen (T.drop startPos s)) ctx)-builtinSubstring _ _ (VStr _ _) =-  throwEvalError "builtins.substring: start and length must be integers"-builtinSubstring _ _ other =-  throwEvalError ("builtins.substring: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin helpers--- ------------------------------------------------------------------------------- | Build a thunk that defers @f arg@ - the application only happens when--- the thunk is forced.  Reuses the existing eval machinery via a synthetic--- @EApp (EResolvedVar 0 0) (EResolvedVar 0 1)@ in a self-contained env.--- Slot 0 = function, slot 1 = argument.-deferApply :: NixValue -> Thunk -> Thunk-deferApply func argThunk =-  let (sp, sc) = buildCSlots [evaluated func, argThunk]-      env = newMinimalEnv sp sc-   in mkSyntheticThunk env deferApplyExpr---- | Shared expression for 'deferApply'.  Allocated once as a CAF.-deferApplyExpr :: Expr-deferApplyExpr = EApp (EResolvedVar 0 0) (EResolvedVar 0 1)-{-# NOINLINE deferApplyExpr #-}---- | Permissive coercion used by @builtins.toString@.------ Like 'coerceToString' but additionally handles lists: elements are--- recursively coerced and joined with spaces, matching real Nix semantics.--- @toString [1 2 3]@ gives @"1 2 3"@.-coerceToStringPermissive :: (MonadEval m) => NixValue -> m (Text, StringContext)-coerceToStringPermissive (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  parts <- mapM coerceThunk thunks-  let texts = map fst parts-      ctx = mconcat (map snd parts)-  pure (T.intercalate " " texts, ctx)-  where-    coerceThunk thunk = do-      val <- force thunk-      coerceToStringPermissive val-coerceToStringPermissive other = coerceToString True force applyValue other---- | Coerce a value to a string for a DERIVATION field (an env value or an--- arg).  Like 'coerceToStringPermissive', but a path literal is copied into--- the store: it becomes its source store path, with that path added to the--- string context so it lands in the derivation's @inputSrcs@ - matching C++--- Nix's copy-to-store coercion of paths in derivation arguments/environment.-coerceToStoreString :: (MonadEval m) => NixValue -> m (Text, StringContext)-coerceToStoreString (VPath p) = do-  spText <- storeSourcePath p-  case parseStorePath defaultStoreDir spText of-    Just sp -> pure (spText, StringContext (Set.singleton (SCPlain sp)))-    Nothing -> pure (spText, mempty)-coerceToStoreString (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  parts <- mapM (force >=> coerceToStoreString) thunks-  pure (T.intercalate " " (map fst parts), mconcat (map snd parts))-coerceToStoreString other = coerceToStringPermissive other---- | Coerce a value for string interpolation (@"${...}"@).  Like--- 'coerceToString', but a path literal is copied into the store and replaced by--- its source store path (with context) - matching C++ Nix, where interpolation--- uses @copyToStore = true@, unlike 'builtins.toString', which does not copy.-coerceToStringInterp :: (MonadEval m) => NixValue -> m (Text, StringContext)-coerceToStringInterp (VPath p) = do-  spText <- storeSourcePath p-  case parseStorePath defaultStoreDir spText of-    Just sp -> pure (spText, StringContext (Set.singleton (SCPlain sp)))-    Nothing -> pure (spText, mempty)-coerceToStringInterp other = coerceToString False force applyValue other---- | The current system platform string.-currentSystemStr :: Text-currentSystemStr = case (System.Info.arch, System.Info.os) of-  ("x86_64", "mingw32") -> "x86_64-windows"-  ("x86_64", "darwin") -> "x86_64-darwin"-  ("aarch64", "darwin") -> "aarch64-darwin"-  ("aarch64", "linux") -> "aarch64-linux"-  ("x86_64", "linux") -> "x86_64-linux"-  (arch, os) -> T.pack arch <> "-" <> T.pack os---- | Store dir with trailing slash, for building store paths.-storeDirPrefix :: Text-storeDirPrefix = defaultStoreDirText <> "/"---- ------------------------------------------------------------------------------ Builtin implementations - numeric + context--- -----------------------------------------------------------------------------isPathVal :: NixValue -> Bool-isPathVal (VPath _) = True-isPathVal _ = False--builtinCeil :: (MonadEval m) => NixValue -> m NixValue-builtinCeil (VFloat f) = pure (VInt (ceiling f))-builtinCeil (VInt n) = pure (VInt n)-builtinCeil other = throwEvalError ("builtins.ceil: expected a number, got " <> typeName other)--builtinFloor :: (MonadEval m) => NixValue -> m NixValue-builtinFloor (VFloat f) = pure (VInt (floor f))-builtinFloor (VInt n) = pure (VInt n)-builtinFloor other = throwEvalError ("builtins.floor: expected a number, got " <> typeName other)--builtinDiscardContext :: (MonadEval m) => NixValue -> m NixValue-builtinDiscardContext (VStr s _) = pure (mkStr s)-builtinDiscardContext other =-  throwEvalError ("builtins.unsafeDiscardStringContext: expected a string, got " <> typeName other)---- | Strip only derivation output dependencies (SCDrvOutput, SCAllOutputs),--- keeping plain store path references (SCPlain).-builtinDiscardOutputDep :: (MonadEval m) => NixValue -> m NixValue-builtinDiscardOutputDep (VStr s (StringContext ctx)) =-  let kept = Set.filter isPlain ctx-   in pure (VStr s (StringContext kept))-  where-    isPlain (SCPlain _) = True-    isPlain _ = False-builtinDiscardOutputDep other =-  throwEvalError ("builtins.unsafeDiscardOutputDependency: expected a string, got " <> typeName other)---- | Check whether a string has any context elements.-builtinHasContext :: (MonadEval m) => NixValue -> m NixValue-builtinHasContext (VStr _ ctx) = pure (VBool (ctx /= emptyContext))-builtinHasContext other =-  throwEvalError ("builtins.hasContext: expected a string, got " <> typeName other)---- | Return the context of a string as an attrset.------ Each key is a store path string.  Each value is an attrset with:---   - @path@: true if there's a SCPlain reference---   - @allOutputs@: true if there's a SCAllOutputs reference---   - @outputs@: list of output names from SCDrvOutput references-builtinGetContext :: (MonadEval m) => NixValue -> m NixValue-builtinGetContext (VStr _ (StringContext ctx)) = do-  let grouped = groupContextByPath (Set.toList ctx)-      attrMap = Map.map contextEntryToAttrs grouped-  pure (VAttrs (attrSetFromMap attrMap))-builtinGetContext other =-  throwEvalError ("builtins.getContext: expected a string, got " <> typeName other)---- | Intermediate representation for grouping context elements by store path.-data ContextEntry = ContextEntry-  { cePath :: !Bool,-    ceAllOutputs :: !Bool,-    ceOutputs :: ![Text]-  }---- | Group context elements by their store path.-groupContextByPath :: [StringContextElement] -> Map Text ContextEntry-groupContextByPath = foldl' addElement Map.empty-  where-    addElement acc (SCPlain sp) =-      Map.insertWith mergeEntry (spToText sp) (ContextEntry True False []) acc-    addElement acc (SCDrvOutput sp outName) =-      Map.insertWith mergeEntry (spToText sp) (ContextEntry False False [outName]) acc-    addElement acc (SCAllOutputs sp) =-      Map.insertWith mergeEntry (spToText sp) (ContextEntry False True []) acc-    mergeEntry new old =-      ContextEntry-        (cePath new || cePath old)-        (ceAllOutputs new || ceAllOutputs old)-        (ceOutputs new ++ ceOutputs old)-    spToText sp =-      T.pack (storePathToFilePath defaultStoreDir sp)---- | Convert a ContextEntry to an attrset thunk.-contextEntryToAttrs :: ContextEntry -> Thunk-contextEntryToAttrs entry =-  let fields =-        [("path", evaluated (VBool True)) | cePath entry]-          ++ [("allOutputs", evaluated (VBool True)) | ceAllOutputs entry]-          ++ [("outputs", evaluated (VList (clistFromThunks [thunkToCPtr (evaluated (mkStr o)) | o <- ceOutputs entry]))) | not (null (ceOutputs entry))]-   in evaluated (VAttrs (attrSetFromMap (Map.fromList fields)))---- | Append context entries to a string from an attrset.------ @builtins.appendContext string contextAttrset@ adds the specified--- context elements to the string.-builtinAppendContext :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinAppendContext (VStr s ctx) (VAttrs contextAttrs) = do-  newCtx <- parseContextAttrs (attrSetToMap contextAttrs)-  pure (VStr s (ctx <> newCtx))-builtinAppendContext (VStr _ _) other =-  throwEvalError ("builtins.appendContext: second argument must be a set, got " <> typeName other)-builtinAppendContext other _ =-  throwEvalError ("builtins.appendContext: first argument must be a string, got " <> typeName other)---- | Parse a context attrset into a StringContext.--- Each key is a store path; each value is an attrset with optional--- @path@, @allOutputs@, and @outputs@ fields.-parseContextAttrs :: (MonadEval m) => Map Text Thunk -> m StringContext-parseContextAttrs attrs = do-  elements <- mapM parseOneCtx (Map.toList attrs)-  pure (StringContext (Set.fromList (concat elements)))-  where-    parseOneCtx (pathText, thunk) = do-      val <- force thunk-      case val of-        VAttrs inner -> do-          let sp = case parseStorePath defaultStoreDir pathText of-                Just parsed -> parsed-                Nothing -> StorePath (T.take 32 (T.drop (T.length storeDirPrefix) pathText)) (T.drop 33 (T.drop (T.length storeDirPrefix) pathText))-          hasPath <- getBoolAttr "path" inner-          hasAllOuts <- getBoolAttr "allOutputs" inner-          outNames <- getOutputsList inner-          let pathElems = [SCPlain sp | hasPath]-              allOutElems = [SCAllOutputs sp | hasAllOuts]-              outElems = [SCDrvOutput sp o | o <- outNames]-          pure (pathElems ++ allOutElems ++ outElems)-        _ -> throwEvalError "builtins.appendContext: context entry must be a set"--    getBoolAttr key attrs' = case attrSetLookup key attrs' of-      Nothing -> pure False-      Just thunk -> do-        val <- force thunk-        case val of-          VBool b -> pure b-          _ -> pure False--    getOutputsList attrs' = case attrSetLookup "outputs" attrs' of-      Nothing -> pure []-      Just thunk -> do-        val <- force thunk-        case val of-          VList cl -> mapM (forceToOutputName . Thunk) (clistThunks cl)-          _ -> pure []--    forceToOutputName thunk = do-      val <- force thunk-      case val of-        VStr s _ -> pure s-        _ -> throwEvalError "builtins.appendContext: output name must be a string"--builtinBaseNameOf :: (MonadEval m) => NixValue -> m NixValue-builtinBaseNameOf (VStr s ctx) = pure (VStr (lastComponent s) ctx)-builtinBaseNameOf (VPath p) = pure (mkStr (lastComponent p))-builtinBaseNameOf other =-  throwEvalError ("builtins.baseNameOf: expected a string or path, got " <> typeName other)--lastComponent :: Text -> Text-lastComponent t = case T.splitOn "/" t of-  [] -> t-  parts -> case reverse (filter (not . T.null) parts) of-    [] -> ""-    (final : _) -> final--builtinDirOf :: (MonadEval m) => NixValue -> m NixValue-builtinDirOf (VStr s ctx) = pure (VStr (dirComponent s) ctx)-builtinDirOf (VPath p) = pure (VPath (dirComponent p))-builtinDirOf other =-  throwEvalError ("builtins.dirOf: expected a string or path, got " <> typeName other)--dirComponent :: Text -> Text-dirComponent t =-  let idx = T.findIndex (== '/') (T.reverse t)-   in case idx of-        Nothing -> "."-        Just n -> T.take (T.length t - n - 1) t--builtinConcatLists :: (MonadEval m) => NixValue -> m NixValue-builtinConcatLists (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  sublists <- mapM forceThenExtractList thunks-  pure (VList (clistFromThunks (concat sublists)))-  where-    forceThenExtractList thunk = do-      val <- force thunk-      case val of-        VList innerCl -> pure (clistThunks innerCl)-        _ -> throwEvalError "builtins.concatLists: element must be a list"-builtinConcatLists other =-  throwEvalError ("builtins.concatLists: expected a list, got " <> typeName other)--builtinLessThan :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinLessThan a b = VBool <$> nixCompare force a b---- ------------------------------------------------------------------------------ Builtin implementations - arithmetic + bitwise--- -----------------------------------------------------------------------------builtinAdd :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinAdd (VInt a) (VInt b) = pure (VInt (a + b))-builtinAdd (VInt a) (VFloat b) = pure (VFloat (fromIntegral a + b))-builtinAdd (VFloat a) (VInt b) = pure (VFloat (a + fromIntegral b))-builtinAdd (VFloat a) (VFloat b) = pure (VFloat (a + b))-builtinAdd l r = throwEvalError ("builtins.add: expected numbers, got " <> typeName l <> " and " <> typeName r)--builtinSub :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinSub (VInt a) (VInt b) = pure (VInt (a - b))-builtinSub (VInt a) (VFloat b) = pure (VFloat (fromIntegral a - b))-builtinSub (VFloat a) (VInt b) = pure (VFloat (a - fromIntegral b))-builtinSub (VFloat a) (VFloat b) = pure (VFloat (a - b))-builtinSub l r = throwEvalError ("builtins.sub: expected numbers, got " <> typeName l <> " and " <> typeName r)--builtinMul :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinMul (VInt a) (VInt b) = pure (VInt (a * b))-builtinMul (VInt a) (VFloat b) = pure (VFloat (fromIntegral a * b))-builtinMul (VFloat a) (VInt b) = pure (VFloat (a * fromIntegral b))-builtinMul (VFloat a) (VFloat b) = pure (VFloat (a * b))-builtinMul l r = throwEvalError ("builtins.mul: expected numbers, got " <> typeName l <> " and " <> typeName r)--builtinDiv :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinDiv _ (VInt 0) = throwEvalError "builtins.div: division by zero"-builtinDiv (VInt a) (VInt b)-  | a == minBound && b == -1 = pure (VInt minBound)-  | otherwise = pure (VInt (quot a b))-builtinDiv _ (VFloat 0) = throwEvalError "builtins.div: division by zero"-builtinDiv (VInt a) (VFloat b) = pure (VFloat (fromIntegral a / b))-builtinDiv (VFloat a) (VInt b) = pure (VFloat (a / fromIntegral b))-builtinDiv (VFloat a) (VFloat b) = pure (VFloat (a / b))-builtinDiv l r = throwEvalError ("builtins.div: expected numbers, got " <> typeName l <> " and " <> typeName r)--builtinMod :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinMod _ (VInt 0) = throwEvalError "builtins.mod: division by zero"-builtinMod (VInt a) (VInt b)-  | a == minBound && b == -1 = pure (VInt 0)-  | otherwise = pure (VInt (rem a b))-builtinMod l r = throwEvalError ("builtins.mod: expected two integers, got " <> typeName l <> " and " <> typeName r)--builtinMin :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinMin a b = do-  aIsLess <- nixCompare force a b-  pure (if aIsLess then a else b)--builtinMax :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinMax a b = do-  aIsLess <- nixCompare force a b-  pure (if aIsLess then b else a)--builtinBitAnd :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinBitAnd (VInt a) (VInt b) = pure (VInt (a .&. b))-builtinBitAnd _ _ = throwEvalError "builtins.bitAnd: expected two integers"--builtinBitOr :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinBitOr (VInt a) (VInt b) = pure (VInt (a .|. b))-builtinBitOr _ _ = throwEvalError "builtins.bitOr: expected two integers"--builtinBitXor :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinBitXor (VInt a) (VInt b) = pure (VInt (xor a b))-builtinBitXor _ _ = throwEvalError "builtins.bitXor: expected two integers"---- ------------------------------------------------------------------------------ Builtin implementations - attr set higher-order--- -----------------------------------------------------------------------------builtinMapAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinMapAttrs func (VAttrs attrs) =-  -- Each attr value is a deferred @f key val@, forced only on demand.-  -- Eagerly builds all thunks via attrSetMapWithKey - with C arena thunks-  -- (~16 bytes each), this is cheaper than the former MappedAttrs overhead-  -- and keeps all data off the GHC heap.-  -- Slot 0 = function, slot 1 = key, slot 2 = value.-  pure (VAttrs (attrSetMapWithKey deferAttr attrs))-  where-    deferAttr key valThunk =-      let (sp, sc) = buildCSlots [evaluated func, evaluated (mkStr key), valThunk]-          env = newMinimalEnv sp sc-       in mkSyntheticThunk env mapAttrsExpr-builtinMapAttrs _ other =-  throwEvalError ("builtins.mapAttrs: expected a set, got " <> typeName other)---- | Shared expression for 'builtinMapAttrs'.  Allocated once as a CAF.-mapAttrsExpr :: Expr-mapAttrsExpr = EApp (EApp (EResolvedVar 0 0) (EResolvedVar 0 1)) (EResolvedVar 0 2)-{-# NOINLINE mapAttrsExpr #-}--builtinFunctionArgs :: (MonadEval m) => NixValue -> m NixValue-builtinFunctionArgs (VLambda _ formals _) = pure (formalsToAttrs formals)-builtinFunctionArgs (VBuiltin _ _) = pure (VAttrs (attrSetFromMap Map.empty))--- Callable sets with __functionArgs metadata (from setFunctionArgs).-builtinFunctionArgs (VAttrs attrs)-  | Just faThunk <- attrSetLookup "__functionArgs" attrs = force faThunk-builtinFunctionArgs other =-  throwEvalError ("builtins.functionArgs: expected a function, got " <> typeName other)--formalsToAttrs :: EvalFormals -> NixValue-formalsToAttrs (EFName _) = VAttrs (attrSetFromMap Map.empty)-formalsToAttrs (EFSet formals _) = formalsListToAttrs formals-formalsToAttrs (EFNamedSet _ formals _) = formalsListToAttrs formals--formalsListToAttrs :: [EvalFormal] -> NixValue-formalsListToAttrs formals =-  VAttrs $-    attrSetFromMap $-      Map.fromList-        [(efName f, evaluated (VBool (isJust (efDefault f)))) | f <- formals]---- | @builtins.setFunctionArgs f args@ - wraps @f@ in a callable attrset--- with @__functor@ (so it remains callable) and @__functionArgs@ metadata.--- Used by nixpkgs @lib.mirrorFunctionArgs@ / @lib.makeOverridable@.------ @__functor@ is @self: f@ - a lambda that ignores @self@ and returns--- the original function.  The function is captured in the closure env.-builtinSetFunctionArgs :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinSetFunctionArgs func (VAttrs argSpec) =-  -- Closure env holds the function at slot 0.  The __functor lambda-  -- body is EResolvedVar 1 0: level 1 (past _self's slot), index 0.-  let (sp, sc) = buildCSlots [evaluated func]-      closureEnv = newMinimalEnv sp sc-      bodyBcIdx = unsafePerformIO (compileExpr (EResolvedVar 1 0))-      -- __functor = self: __fn  (ignores self, returns the original function)-      functorLambda = VLambda closureEnv (EFName "_self") bodyBcIdx-   in pure $-        VAttrs $-          attrSetFromMap $-            Map.fromList-              [ ("__functor", evaluated functorLambda),-                ("__functionArgs", evaluated (VAttrs argSpec))-              ]-builtinSetFunctionArgs func args =-  throwEvalError ("builtins.setFunctionArgs: expected a set as second argument, got " <> typeName args <> " (func: " <> typeName func <> ")")--builtinZipAttrsWith :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinZipAttrsWith func (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  attrSets <- mapM forceToAttrSet thunks-  let merged = mergeAllAttrs attrSets-      -- Lazy: each result is a deferred f(name)(values) thunk, not eagerly-      -- evaluated.  Critical for nixpkgs evalModules fixpoint - config is a-      -- self-referencing lazy attrset that must be COMPUTED (holding the lazy-      -- result) before any individual attribute thunks are forced.-      resultPairs = map (deferZip func) (Map.toList merged)-  pure (VAttrs (attrSetFromMap (Map.fromList resultPairs)))-  where-    forceToAttrSet thunk = do-      val <- force thunk-      case val of-        VAttrs attrs -> pure (attrSetToMap attrs)-        _ -> throwEvalError "builtins.zipAttrsWith: list element must be a set"-    mergeAllAttrs = foldl' (\acc m -> Map.unionWith (++) acc (Map.map (: []) m)) Map.empty-    -- Slot 0 = function, slot 1 = name, slot 2 = values list.-    deferZip fn (key, thunkList) =-      let valueList = VList (clistFromThunks (map thunkToCPtr thunkList))-          (slots, slotCount) = buildCSlots [evaluated fn, evaluated (mkStr key), evaluated valueList]-          env = newMinimalEnv slots slotCount-       in (key, mkSyntheticThunk env mapAttrsExpr)-builtinZipAttrsWith _ other =-  throwEvalError ("builtins.zipAttrsWith: expected a list, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - string manipulation--- -----------------------------------------------------------------------------builtinReplaceStrings ::-  (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue-builtinReplaceStrings (VList fromCl) (VList toCl) (VStr input inputCtx) = do-  let fromThunks = map Thunk (clistThunks fromCl)-      toThunks = map Thunk (clistThunks toCl)-  froms <- mapM forceStr fromThunks-  toStrs <- mapM forceStr toThunks-  when (length froms /= length toStrs) $-    throwEvalError "builtins.replaceStrings: 'from' and 'to' must have the same length"-  let fromTexts = map fst froms-      toTexts = map fst toStrs-      -- Nix semantics: input context + 'to' string contexts (not 'from').-      -- Ideally only 'to' contexts for patterns that matched, but including-      -- all 'to' contexts is the common implementation.-      mergedCtx = inputCtx <> mconcat (map snd toStrs)-      pairs = zip fromTexts toTexts-  pure (VStr (replaceAll pairs input) mergedCtx)-  where-    forceStr thunk = do-      val <- force thunk-      case val of-        VStr s ctx -> pure (s, ctx)-        _ -> throwEvalError "builtins.replaceStrings: elements must be strings"-builtinReplaceStrings _ _ (VStr _ _) =-  throwEvalError "builtins.replaceStrings: first two arguments must be lists"-builtinReplaceStrings _ _ other =-  throwEvalError ("builtins.replaceStrings: expected a string, got " <> typeName other)---- | Replace all occurrences, O(n) via chunk list + T.concat.-replaceAll :: [(Text, Text)] -> Text -> Text-replaceAll pairs input = T.concat (go input)-  where-    go remaining-      | T.null remaining =-          -- At end of string, still check for empty-from match-          case findMatch pairs remaining of-            Just (replacement, _, _) -> [replacement]-            Nothing -> []-      | otherwise = case findMatch pairs remaining of-          Just (replacement, rest, matched) ->-            if T.null matched-              then case T.uncons remaining of-                -- empty-from: insert replacement then advance 1 char-                Just (ch, after) -> replacement : T.singleton ch : go after-                Nothing -> [replacement]-              else replacement : go rest-          Nothing -> case T.uncons remaining of-            Just (ch, after) -> T.singleton ch : go after-            Nothing -> []-    findMatch [] _ = Nothing-    findMatch ((from, to) : rest) txt-      | T.null from = Just (to, txt, from)-      | Just suffix <- T.stripPrefix from txt = Just (to, suffix, from)-      | otherwise = findMatch rest txt---- ------------------------------------------------------------------------------ Builtin implementations - regex (POSIX ERE via regex-tdfa)--- ------------------------------------------------------------------------------- ------------------------------------------------------------------------------ Regex compilation cache--- ------------------------------------------------------------------------------- | Global regex compilation cache.  Keyed by the raw pattern string--- (including anchoring for match).  Idempotent memoization via--- unsafePerformIO - same rationale as thunk memoization.-{-# NOINLINE regexCacheRef #-}-regexCacheRef :: IORef (Map Text RE.Regex)-regexCacheRef = unsafePerformIO (newIORef Map.empty)---- | Compile a regex, using the global cache to avoid recompilation.--- Returns Nothing for invalid patterns.  NOINLINE prevents GHC from--- inlining and floating the unsafePerformIO reads.-{-# NOINLINE cachedCompileRegex #-}-cachedCompileRegex :: Text -> Maybe RE.Regex-cachedCompileRegex pat =-  unsafePerformIO $ do-    cache <- atomicModifyIORef' regexCacheRef (\c -> (c, c))-    case Map.lookup pat cache of-      Just compiled -> pure (Just compiled)-      Nothing -> case RE.makeRegexM (T.unpack pat) :: Maybe RE.Regex of-        Nothing -> pure Nothing-        Just compiled -> do-          atomicModifyIORef' regexCacheRef (\c -> (Map.insert pat compiled c, ()))-          pure (Just compiled)---- ------------------------------------------------------------------------------ Regex builtins--- ------------------------------------------------------------------------------- | @builtins.match regex str@: match a POSIX ERE against a string.--- The regex is implicitly anchored (must match the entire string).--- Returns @null@ if no match, or a list of capture group strings--- (empty string for unmatched optional groups).-builtinMatch :: (MonadEval m) => NixValue -> NixValue -> m NixValue--- Pre-compiled path: regex was compiled at partial-application time.-builtinMatch (VCompiledRegex (CompiledRegex _ compiled)) (VStr str _) =-  matchWithCompiled compiled str--- Direct 2-arg call: use global compilation cache.-builtinMatch (VStr regex _) (VStr str _) =-  let anchored = "^" <> regex <> "$"-   in case cachedCompileRegex anchored of-        Nothing -> throwEvalError ("builtins.match: invalid regex: " <> regex)-        Just compiled -> matchWithCompiled compiled str-builtinMatch (VStr _ _) other =-  throwEvalError ("builtins.match: expected a string, got " <> typeName other)-builtinMatch (VCompiledRegex _) other =-  throwEvalError ("builtins.match: expected a string, got " <> typeName other)-builtinMatch other _ =-  throwEvalError ("builtins.match: expected a string (regex), got " <> typeName other)---- | Shared match logic for pre-compiled and freshly-compiled regex paths.-matchWithCompiled :: (MonadEval m) => RE.Regex -> Text -> m NixValue-matchWithCompiled compiled str =-  let matches = matchAllText compiled (T.unpack str)-   in case matches of-        [] -> pure VNull-        (match : _) ->-          -- match is an Array of (String, (offset, len)) pairs.-          -- Index 0 is the full match; indices 1.. are capture groups.-          let groups = Array.elems match-              -- Skip index 0 (full match) - return only capture groups.-              captureGroups = drop 1 groups-              -- A non-participating capture group has offset (-1); C++ Nix-              -- yields null for it, not the empty string.-              toThunk (s, (off, _)) =-                if off < 0 then evaluated VNull else evaluated (mkStr (T.pack s))-           in pure (VList (clistFromThunks (map (thunkToCPtr . toThunk) captureGroups)))---- | @builtins.split regex str@: split a string by a POSIX ERE.--- Returns an alternating list of non-matched strings and match-group lists.--- Example: @split "(x)" "axbxc"@ yields @["a" ["x"] "b" ["x"] "c"]@-builtinSplit :: (MonadEval m) => NixValue -> NixValue -> m NixValue--- Pre-compiled path: regex was compiled at partial-application time.-builtinSplit (VCompiledRegex (CompiledRegex _ compiled)) (VStr str _) =-  splitWithCompiled compiled str--- Direct 2-arg call: use global compilation cache.-builtinSplit (VStr regex _) (VStr str _) =-  case cachedCompileRegex regex of-    Nothing -> throwEvalError ("builtins.split: invalid regex: " <> regex)-    Just compiled -> splitWithCompiled compiled str-builtinSplit (VStr _ _) other =-  throwEvalError ("builtins.split: expected a string, got " <> typeName other)-builtinSplit (VCompiledRegex _) other =-  throwEvalError ("builtins.split: expected a string, got " <> typeName other)-builtinSplit other _ =-  throwEvalError ("builtins.split: expected a string (regex), got " <> typeName other)---- | Shared split logic for pre-compiled and freshly-compiled regex paths.-splitWithCompiled :: (MonadEval m) => RE.Regex -> Text -> m NixValue-splitWithCompiled compiled str =-  let allMatches = matchAllText compiled (T.unpack str)-      strText = T.unpack str-      result = buildSplitResult strText 0 allMatches-   in pure (VList (clistFromThunks (map thunkToCPtr result)))---- | Build the alternating list for builtins.split.-buildSplitResult :: String -> Int -> [Array.Array Int (String, (Int, Int))] -> [Thunk]-buildSplitResult remaining pos [] =-  -- No more matches - emit the rest of the string.-  [evaluated (mkStr (T.pack (drop pos remaining)))]-buildSplitResult remaining pos (match : rest) =-  let elems = Array.elems match-      (_, (matchStart, matchLen)) = case elems of-        (full : _) -> full-        [] -> ("", (pos, 0)) -- defensive: should not happen from matchAllText-        -- Text before this match-      before = T.pack (take (matchStart - pos) (drop pos remaining))-      -- Capture groups (indices 1..)-      groups = drop 1 (Array.elems match)-      -- A non-participating capture group has offset (-1) becomes null (as 'match').-      groupThunks =-        map (\(s, (off, _)) -> if off < 0 then evaluated VNull else evaluated (mkStr (T.pack s))) groups-      -- Continue after this match-      afterPos = matchStart + matchLen-   in evaluated (mkStr before)-        : evaluated (VList (clistFromThunks (map thunkToCPtr groupThunks)))-        : buildSplitResult remaining afterPos rest--builtinCompareVersions :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinCompareVersions (VStr a _) (VStr b _) =-  pure (VInt (compareVersionParts (splitVersionStr a) (splitVersionStr b)))-builtinCompareVersions _ _ = throwEvalError "builtins.compareVersions: expected two strings"---- | Convert 'Ordering' to the Nix compareVersions convention: -1, 0, 1.-ordToNix :: Ordering -> Int64-ordToNix LT = -1-ordToNix EQ = 0-ordToNix GT = 1--compareVersionParts :: [Text] -> [Text] -> Int64-compareVersionParts [] [] = 0--- When one version runs out, Nix pads the shorter side with an empty--- component and keeps comparing - so "1.0" > "1.0pre" (empty sorts AFTER--- "pre"), not "<" as a naive length comparison would give.-compareVersionParts [] (b : bs) =-  case compareComponent "" b of-    EQ -> compareVersionParts [] bs-    cmp -> ordToNix cmp-compareVersionParts (a : as) [] =-  case compareComponent a "" of-    EQ -> compareVersionParts as []-    cmp -> ordToNix cmp-compareVersionParts (a : as) (b : bs) =-  case compareComponent a b of-    EQ -> compareVersionParts as bs-    cmp -> ordToNix cmp--compareComponent :: Text -> Text -> Ordering-compareComponent a b-  | a == b = EQ-  | allDigits a && allDigits b = compare (readInt a) (readInt b)-  -- "pre" sorts before everything else (Nix pre-release convention)-  | a == "pre" = LT-  | b == "pre" = GT-  | a == "" = LT-  | b == "" = GT-  -- Alphabetic components sort before numeric in Nix-  | isAlphaComp a && allDigits b = LT-  | allDigits a && isAlphaComp b = GT-  | otherwise = compare a b-  where-    allDigits t = not (T.null t) && T.all isDigit t-    isAlphaComp t = case T.uncons t of-      Just (c, _) -> isAlpha c-      Nothing -> False-    readInt :: Text -> Int64-    readInt = T.foldl' (\acc c -> acc * 10 + fromIntegral (digitToInt c)) (0 :: Int64)--splitVersionStr :: Text -> [Text]-splitVersionStr t-  | T.null t = []-  | otherwise =-      let (component, rest) = spanComponent t-       in component : splitVersionAfterComponent rest--splitVersionAfterComponent :: Text -> [Text]-splitVersionAfterComponent t = case T.uncons t of-  Nothing -> []-  Just ('.', rest) -> splitVersionStr rest-  Just _ -> splitVersionStr t--spanComponent :: Text -> (Text, Text)-spanComponent t = case T.uncons t of-  Nothing -> ("", "")-  Just (c, rest)-    | isDigit c -> T.span isDigit t-    | isAlpha c -> T.span isAlpha t-    | otherwise -> (T.singleton c, rest)--builtinSplitVersion :: (MonadEval m) => NixValue -> m NixValue-builtinSplitVersion (VStr s _) =-  pure (VList (clistFromThunks (map (thunkToCPtr . evaluated . mkStr) (splitVersionComponents s))))-builtinSplitVersion other =-  throwEvalError ("builtins.splitVersion: expected a string, got " <> typeName other)--splitVersionComponents :: Text -> [Text]-splitVersionComponents t = case T.uncons t of-  Nothing -> []-  Just ('.', rest) -> splitVersionComponents rest-  Just (c, _)-    | isDigit c ->-        let (digits, rest) = T.span isDigit t-         in digits : splitVersionComponents rest-    | isAlpha c ->-        let (alpha, rest) = T.span isAlpha t-         in alpha : splitVersionComponents rest-    | otherwise ->-        -- Non-alphanumeric separator (e.g. '-', '_'): consume as single char-        let (_, rest) = T.splitAt 1 t-         in splitVersionComponents rest--builtinParseDrvName :: (MonadEval m) => NixValue -> m NixValue-builtinParseDrvName (VStr s _) =-  let (name, version) = parseName s-   in pure-        ( VAttrs-            ( attrSetFromMap $-                Map.fromList-                  [ ("name", evaluated (mkStr name)),-                    ("version", evaluated (mkStr version))-                  ]-            )-        )-builtinParseDrvName other =-  throwEvalError ("builtins.parseDrvName: expected a string, got " <> typeName other)--parseName :: Text -> (Text, Text)-parseName t =-  case findVersionDash t 0 of-    Nothing -> (t, "")-    Just idx -> (T.take idx t, T.drop (idx + 1) t)--findVersionDash :: Text -> Int -> Maybe Int-findVersionDash t idx = case T.uncons (T.drop idx t) of-  Nothing -> Nothing-  Just ('-', after)-    | Just (d, _) <- T.uncons after,-      isDigit d ->-        Just idx-  Just _ -> findVersionDash t (idx + 1)---- ------------------------------------------------------------------------------ Builtin implementations - serialization + hashing--- -----------------------------------------------------------------------------builtinToJSON :: (MonadEval m) => NixValue -> m NixValue-builtinToJSON val = do-  (json, ctx) <- valueToJSON val-  pure (VStr json ctx)--valueToJSON :: (MonadEval m) => NixValue -> m (Text, StringContext)-valueToJSON VNull = pure ("null", emptyContext)-valueToJSON (VBool True) = pure ("true", emptyContext)-valueToJSON (VBool False) = pure ("false", emptyContext)-valueToJSON (VInt n) = pure (T.pack (show n), emptyContext)-valueToJSON (VFloat f) = pure (formatNixFloat f, emptyContext)-valueToJSON (VStr s ctx) = pure (jsonEscapeString s, ctx)-valueToJSON (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  vals <- mapM force thunks-  results <- mapM valueToJSON vals-  let jsonVals = map fst results-      ctx = mconcat (map snd results)-  pure ("[" <> T.intercalate "," jsonVals <> "]", ctx)-valueToJSON (VAttrs attrs) =-  -- C++ Nix serializes an attrset via __toString first, then outPath, and only-  -- falls back to an object when neither is present.-  case (attrSetLookup "__toString" attrs, attrSetLookup "outPath" attrs) of-    (Nothing, Nothing) -> do-      let m = attrSetToMap attrs-          sortedKeys = Map.keys m-      results <- mapM (jsonPair m) sortedKeys-      let pairs = map fst results-          ctx = mconcat (map snd results)-      pure ("{" <> T.intercalate "," pairs <> "}", ctx)-    _ -> do-      (s, ctx) <- coerceToString True force applyValue (VAttrs attrs)-      pure (jsonEscapeString s, ctx)-  where-    jsonPair attrMap key = case Map.lookup key attrMap of-      Nothing -> pure ("", emptyContext)-      Just thunk -> do-        val <- force thunk-        (jsonVal, ctx) <- valueToJSON val-        pure (jsonEscapeString key <> ":" <> jsonVal, ctx)-valueToJSON (VPath p) = pure (jsonEscapeString p, emptyContext)-valueToJSON (VLambda {}) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"-valueToJSON (VBuiltin _ _) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"-valueToJSON (VDerivation _) = throwEvalError "builtins.toJSON: cannot convert a derivation to JSON"-valueToJSON (VCompiledRegex _) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"--jsonEscapeString :: Text -> Text-jsonEscapeString s = "\"" <> T.concatMap escapeChar s <> "\""-  where-    escapeChar '"' = "\\\""-    escapeChar '\\' = "\\\\"-    escapeChar '\n' = "\\n"-    escapeChar '\r' = "\\r"-    escapeChar '\t' = "\\t"-    escapeChar c-      | ord c < 0x20 = "\\u" <> T.pack (padHex 4 (showHex' (ord c)))-      | otherwise = T.singleton c-    padHex n str = replicate (n - length str) '0' ++ str-    showHex' 0 = "0"-    showHex' num = go num ""-      where-        go 0 acc = acc-        go v acc =-          let (q, r) = quotRem v 16-           in go q (hexDigit r : acc)---- | Safe hex digit lookup (total for 0-15).-hexDigit :: Int -> Char-hexDigit n-  | n >= 0 && n <= 9 = chr (ord '0' + n)-  | n >= 10 && n <= 15 = chr (ord 'a' + n - 10)-  | otherwise = '?' -- unreachable for valid hex--builtinFromJSON :: (MonadEval m) => NixValue -> m NixValue-builtinFromJSON (VStr s _) = case parseJSON (T.strip s) of-  Just (val, rest)-    | T.null (T.strip rest) -> pure val-    | otherwise -> throwEvalError "builtins.fromJSON: trailing content after JSON value"-  Nothing -> throwEvalError "builtins.fromJSON: invalid JSON"-builtinFromJSON other =-  throwEvalError ("builtins.fromJSON: expected a string, got " <> typeName other)--parseJSON :: Text -> Maybe (NixValue, Text)-parseJSON t = case T.uncons (T.stripStart t) of-  Nothing -> Nothing-  Just ('n', rest)-    | Just suffix <- T.stripPrefix "ull" rest -> Just (VNull, suffix)-  Just ('t', rest)-    | Just suffix <- T.stripPrefix "rue" rest -> Just (VBool True, suffix)-  Just ('f', rest)-    | Just suffix <- T.stripPrefix "alse" rest -> Just (VBool False, suffix)-  Just ('"', _) -> parseJSONString (T.stripStart t)-  Just ('[', rest) -> parseJSONArray rest-  Just ('{', rest) -> parseJSONObject rest-  Just (c, _)-    | c == '-' || isDigit c -> parseJSONNumber (T.stripStart t)-  _ -> Nothing--parseJSONString :: Text -> Maybe (NixValue, Text)-parseJSONString t = case T.uncons t of-  Just ('"', rest) ->-    let (strVal, remaining) = parseJSONStringContent rest-     in Just (mkStr strVal, remaining)-  _ -> Nothing---- | Parse JSON string content, O(n) via chunk list + T.concat.-parseJSONStringContent :: Text -> (Text, Text)-parseJSONStringContent = go []-  where-    go !chunks t = case T.uncons t of-      Nothing -> (T.concat (reverse chunks), "")-      Just ('"', rest) -> (T.concat (reverse chunks), rest)-      Just ('\\', rest) -> case T.uncons rest of-        Just ('"', r) -> go ("\"" : chunks) r-        Just ('\\', r) -> go ("\\" : chunks) r-        Just ('/', r) -> go ("/" : chunks) r-        Just ('n', r) -> go ("\n" : chunks) r-        Just ('r', r) -> go ("\r" : chunks) r-        Just ('t', r) -> go ("\t" : chunks) r-        Just ('u', r) -> case parseHex4 r of-          Just (hi, r2)-            -- UTF-16 surrogate pair: high surrogate followed by \uXXXX low-            | hi >= 0xD800 && hi <= 0xDBFF ->-                case T.stripPrefix "\\u" r2 of-                  Just r3 -> case parseHex4 r3 of-                    Just (lo, r4)-                      | lo >= 0xDC00 && lo <= 0xDFFF ->-                          let combined = 0x10000 + (hi - 0xD800) * 0x400 + (lo - 0xDC00)-                           in go (T.singleton (chr combined) : chunks) r4-                    _ -> go (T.singleton (chr hi) : chunks) r2-                  Nothing -> go (T.singleton (chr hi) : chunks) r2-          Just (codepoint, r2) ->-            go (T.singleton (chr codepoint) : chunks) r2-          Nothing -> go ("u" : chunks) r-        _ -> (T.concat (reverse chunks), rest)-      Just (c, rest) -> go (T.singleton c : chunks) rest--parseHex4 :: Text -> Maybe (Int, Text)-parseHex4 t-  | T.length t >= 4 =-      let hex = T.take 4 t-       in if T.all isHexDigit hex-            then Just (readHex4 hex, T.drop 4 t)-            else Nothing-  | otherwise = Nothing--readHex4 :: Text -> Int-readHex4 = T.foldl' (\acc c -> acc * 16 + digitToInt c) 0--parseJSONNumber :: Text -> Maybe (NixValue, Text)-parseJSONNumber t =-  let (numStr, rest) = T.span (\c -> isDigit c || c == '.' || c == '-' || c == 'e' || c == 'E' || c == '+') t-   in if T.null numStr-        then Nothing-        else-          if T.any (\c -> c == '.' || c == 'e' || c == 'E') numStr-            then case reads (T.unpack numStr) :: [(Double, String)] of-              [(d, "")] -> Just (VFloat d, rest)-              _ -> Nothing-            else case reads (T.unpack numStr) :: [(Int64, String)] of-              [(n, "")] -> Just (VInt n, rest)-              _ -> Nothing--parseJSONArray :: Text -> Maybe (NixValue, Text)-parseJSONArray t = parseJSONArrayElements (T.stripStart t) []--parseJSONArrayElements :: Text -> [Thunk] -> Maybe (NixValue, Text)-parseJSONArrayElements t acc = case T.uncons (T.stripStart t) of-  Just (']', rest) -> Just (VList (clistFromThunks (map thunkToCPtr (reverse acc))), rest)-  _ -> case parseJSON t of-    Just (val, rest) ->-      let stripped = T.stripStart rest-       in case T.uncons stripped of-            Just (',', rest2) -> parseJSONArrayElements rest2 (evaluated val : acc)-            Just (']', rest2) -> Just (VList (clistFromThunks (map thunkToCPtr (reverse (evaluated val : acc)))), rest2)-            _ -> Nothing-    Nothing -> Nothing--parseJSONObject :: Text -> Maybe (NixValue, Text)-parseJSONObject t = parseJSONObjectEntries (T.stripStart t) Map.empty--parseJSONObjectEntries :: Text -> Map Text Thunk -> Maybe (NixValue, Text)-parseJSONObjectEntries t acc = case T.uncons (T.stripStart t) of-  Just ('}', rest) -> Just (VAttrs (attrSetFromMap acc), rest)-  _ -> case parseJSONString (T.stripStart t) of-    Just (VStr key _, rest) -> case T.uncons (T.stripStart rest) of-      Just (':', rest2) -> case parseJSON rest2 of-        Just (val, rest3) ->-          let stripped = T.stripStart rest3-              updated = Map.insert key (evaluated val) acc-           in case T.uncons stripped of-                Just (',', rest4) -> parseJSONObjectEntries rest4 updated-                Just ('}', rest4) -> Just (VAttrs (attrSetFromMap updated), rest4)-                _ -> Nothing-        Nothing -> Nothing-      _ -> Nothing-    _ -> Nothing--builtinHashString :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinHashString (VStr algo _) (VStr input _) =-  hashBytesWithAlgo "hashString" algo (TE.encodeUtf8 input)-builtinHashString (VStr _ _) other =-  throwEvalError ("builtins.hashString: expected a string, got " <> typeName other)-builtinHashString other _ =-  throwEvalError ("builtins.hashString: expected a string, got " <> typeName other)--digestToHex :: (BA.ByteArrayAccess a) => a -> Text-digestToHex = bytesToHexText . BA.convert---- ------------------------------------------------------------------------------ Builtin implementations - deep evaluation--- -----------------------------------------------------------------------------builtinDeepSeq :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinDeepSeq first second = do-  deepForce first-  pure second--deepForce :: (MonadEval m) => NixValue -> m ()-deepForce (VList cl) = mapM_ ((force >=> deepForce) . Thunk) (clistThunks cl)-deepForce (VAttrs attrs) = mapM_ (force >=> deepForce) (attrSetElems attrs)-deepForce _ = pure ()---- | @builtins.seq a b@ - evaluate @a@ to WHNF, then return @b@.-builtinSeq :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinSeq !_first = pure---- | @builtins.trace msg val@ - print @msg@ to stderr, return @val@.-builtinTrace :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinTrace msgVal result = do-  msg <- case msgVal of-    VStr s _ -> pure s-    other -> pure (showValueForTrace other)-  traceMessage ("trace: " <> msg)-  pure result---- | @builtins.warn msg val@ - print warning to stderr, return @val@.-builtinWarn :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinWarn msgVal result = do-  msg <- case msgVal of-    VStr s _ -> pure s-    other -> pure (showValueForTrace other)-  traceMessage ("warning: " <> msg)-  pure result---- | Pretty-print a value for trace/warn, matching C++ Nix's printValue.-showValueForTrace :: NixValue -> Text-showValueForTrace (VInt n) = T.pack (show n)-showValueForTrace (VFloat f) = formatNixFloat f-showValueForTrace (VBool True) = "true"-showValueForTrace (VBool False) = "false"-showValueForTrace VNull = "null"-showValueForTrace (VPath p) = p-showValueForTrace other = "<<" <> typeName other <> ">>"---- ------------------------------------------------------------------------------ Builtin implementations - graph traversal--- -----------------------------------------------------------------------------builtinGenericClosure :: (MonadEval m) => NixValue -> m NixValue-builtinGenericClosure (VAttrs attrs) = do-  startSetThunk <--    maybe (throwEvalError "builtins.genericClosure: missing 'startSet'") pure $-      attrSetLookup "startSet" attrs-  operatorThunk <--    maybe (throwEvalError "builtins.genericClosure: missing 'operator'") pure $-      attrSetLookup "operator" attrs-  startSetVal <- force startSetThunk-  operatorVal <- force operatorThunk-  case startSetVal of-    VList cl -> do-      let items = map Thunk (clistThunks cl)-      result <- closureLoop operatorVal (Seq.fromList items) [] []-      pure (VList (clistFromThunks (map (thunkToCPtr . evaluated) result)))-    _ -> throwEvalError "builtins.genericClosure: 'startSet' must be a list"-builtinGenericClosure other =-  throwEvalError ("builtins.genericClosure: expected a set, got " <> typeName other)---- | BFS loop for genericClosure.  Uses Data.Sequence for O(1) queue--- append (the old list-based version was O(n) per operator call).--- seenKeys is still a linear scan - Nix value equality is monadic so--- Set/HashMap is not directly applicable without specialising on key type.-closureLoop ::-  (MonadEval m) =>-  NixValue ->-  Seq Thunk ->-  [NixValue] ->-  [NixValue] ->-  m [NixValue]-closureLoop _ Empty _ acc = pure (reverse acc)-closureLoop operator (thunk :<| rest) seenKeys acc = do-  item <- force thunk-  key <- extractKey item-  alreadySeen <- keyInList key seenKeys-  if alreadySeen-    then closureLoop operator rest seenKeys acc-    else do-      newItems <- applyValue operator item-      case newItems of-        VList newCl ->-          closureLoop operator (rest <> Seq.fromList (map Thunk (clistThunks newCl))) (key : seenKeys) (item : acc)-        _ -> throwEvalError "builtins.genericClosure: operator must return a list"--extractKey :: (MonadEval m) => NixValue -> m NixValue-extractKey (VAttrs attrs) =-  case attrSetLookup "key" attrs of-    Just thunk -> force thunk-    Nothing -> throwEvalError "builtins.genericClosure: item missing 'key' attribute"-extractKey _ = throwEvalError "builtins.genericClosure: item must be a set with 'key'"--keyInList :: (MonadEval m) => NixValue -> [NixValue] -> m Bool-keyInList _ [] = pure False-keyInList key (seen : rest) = do-  eq <- nixEqual force key seen-  if eq then pure True else keyInList key rest---- ------------------------------------------------------------------------------ IO builtins (delegate to MonadEval methods)--- ------------------------------------------------------------------------------- | Coerce a value to a path 'Text'.  Accepts 'VPath' and 'VStr';--- throws a type error for anything else.-coerceToPath :: (MonadEval m) => Text -> NixValue -> m Text-coerceToPath _ (VPath p) = pure p-coerceToPath _ (VStr s _) = pure s-coerceToPath name other =-  throwEvalError ("builtins." <> name <> ": expected a path or string, got " <> typeName other)--builtinImport :: (MonadEval m) => NixValue -> m NixValue-builtinImport (VPath p) = importFile p-builtinImport (VStr s _) = importFile s-builtinImport other =-  throwEvalError ("import: expected a path or string, got " <> typeName other)--builtinReadFile :: (MonadEval m) => NixValue -> m NixValue-builtinReadFile val = do-  p <- coerceToPath "readFile" val-  mkStr <$> readFileText p--builtinPathExists :: (MonadEval m) => NixValue -> m NixValue-builtinPathExists val = do-  p <- coerceToPath "pathExists" val-  VBool <$> doesPathExist p--builtinReadDir :: (MonadEval m) => NixValue -> m NixValue-builtinReadDir val = do-  p <- coerceToPath "readDir" val-  entries <- listDirectory p-  pure (VAttrs (attrSetFromMap (Map.fromList [(name, evaluated (mkStr fileType)) | (name, fileType) <- entries])))---- ------------------------------------------------------------------------------ Builtin implementations - environment + paths--- -----------------------------------------------------------------------------builtinGetEnv :: (MonadEval m) => NixValue -> m NixValue-builtinGetEnv (VStr name _) = mkStr <$> getEnvVar name-builtinGetEnv other =-  throwEvalError ("builtins.getEnv: expected a string, got " <> typeName other)--builtinToPath :: (MonadEval m) => NixValue -> m NixValue-builtinToPath (VPath p) = pure (VPath p)-builtinToPath (VStr s _) = case T.uncons s of-  Nothing -> throwEvalError "builtins.toPath: empty path"-  Just ('/', _) -> pure (VPath s)-  Just _ -> throwEvalError ("builtins.toPath: path must be absolute, got " <> s)-builtinToPath other =-  throwEvalError ("builtins.toPath: expected a string or path, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - store path operations--- -----------------------------------------------------------------------------builtinPlaceholder :: (MonadEval m) => NixValue -> m NixValue-builtinPlaceholder (VStr outputName _) = pure (mkStr (hashPlaceholder outputName))-builtinPlaceholder other =-  throwEvalError ("builtins.placeholder: expected a string, got " <> typeName other)--builtinStorePath :: (MonadEval m) => NixValue -> m NixValue-builtinStorePath (VPath p) = validateStorePath p-builtinStorePath (VStr s _) = validateStorePath s-builtinStorePath other =-  throwEvalError ("builtins.storePath: expected a path or string, got " <> typeName other)--validateStorePath :: (MonadEval m) => Text -> m NixValue-validateStorePath p-  | storeDirPrefix `T.isPrefixOf` p,-    T.length p > T.length storeDirPrefix,-    let basename = T.drop (T.length storeDirPrefix) p,-    T.length basename >= 33,-    Just ('-', _) <- T.uncons (T.drop 32 basename) =-      pure (VPath p)-  | otherwise =-      throwEvalError ("builtins.storePath: not a valid store path: " <> p)---- ------------------------------------------------------------------------------ Builtin implementations - Nix search path--- -----------------------------------------------------------------------------builtinFindFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinFindFile (VList cl) (VStr name _) = do-  let searchPath = map Thunk (clistThunks cl)-  entries <- mapM forceSearchEntry searchPath-  findFirst entries name-builtinFindFile (VList _) other =-  throwEvalError ("builtins.findFile: expected a string, got " <> typeName other)-builtinFindFile other _ =-  throwEvalError ("builtins.findFile: expected a list, got " <> typeName other)---- | Extract {prefix, path} from a search path entry thunk.-forceSearchEntry :: (MonadEval m) => Thunk -> m (Text, Text)-forceSearchEntry thunk = do-  val <- force thunk-  case val of-    VAttrs attrs -> do-      prefixThunk <--        maybe (throwEvalError "builtins.findFile: entry missing 'prefix'") pure $-          attrSetLookup "prefix" attrs-      pathThunk <--        maybe (throwEvalError "builtins.findFile: entry missing 'path'") pure $-          attrSetLookup "path" attrs-      prefixVal <- force prefixThunk-      pathVal <- force pathThunk-      prefix <- case prefixVal of-        VStr s _ -> pure s-        _ -> throwEvalError "builtins.findFile: 'prefix' must be a string"-      path <- case pathVal of-        VStr s _ -> pure s-        VPath s -> pure s-        _ -> throwEvalError "builtins.findFile: 'path' must be a string or path"-      pure (prefix, path)-    _ -> throwEvalError "builtins.findFile: search path entry must be a set"---- | Iterate search path entries, checking for a match.-findFirst :: (MonadEval m) => [(Text, Text)] -> Text -> m NixValue-findFirst [] name =-  throwEvalError ("file '" <> name <> "' was not found in the Nix search path")-findFirst ((prefix, path) : rest) name-  | prefix == name || (not (T.null prefix) && (prefix <> "/") `T.isPrefixOf` name) =-      let suffix = if prefix == name then "" else T.drop (T.length prefix + 1) name-          candidate = if T.null suffix then path else path <> "/" <> suffix-       in do-            exists <- doesPathExist candidate-            if exists-              then pure (VPath candidate)-              else findFirst rest name-  | T.null prefix =-      let candidate = path <> "/" <> name-       in do-            exists <- doesPathExist candidate-            if exists-              then pure (VPath candidate)-              else findFirst rest name-  | otherwise = findFirst rest name---- ------------------------------------------------------------------------------ Builtin implementations - store file creation--- -----------------------------------------------------------------------------builtinToFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinToFile (VStr name _) (VStr contents _) = do-  storePath <- writeToStore name contents-  pure (VPath storePath)-builtinToFile (VStr _ _) other =-  throwEvalError ("builtins.toFile: expected a string, got " <> typeName other)-builtinToFile other _ =-  throwEvalError ("builtins.toFile: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - scoped import--- -----------------------------------------------------------------------------builtinScopedImport :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinScopedImport (VAttrs attrs) pathVal = do-  p <- coerceToPath "scopedImport" pathVal-  let scope = Map.toList (attrSetToMap attrs)-  scopedImportFile scope p-builtinScopedImport other _ =-  throwEvalError ("builtins.scopedImport: expected a set, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - network fetchers--- -----------------------------------------------------------------------------builtinFetchurl :: (MonadEval m) => NixValue -> m NixValue-builtinFetchurl (VStr url _) = fetchUrlSimple url Nothing-builtinFetchurl (VAttrs attrs) = do-  url <- forceAttrStr "builtins.fetchurl" "url" attrs-  sha256 <- forceOptionalAttrStr attrs "sha256"-  fetchUrlSimple url sha256-builtinFetchurl other =-  throwEvalError ("builtins.fetchurl: expected a string or set, got " <> typeName other)--builtinFetchTarball :: (MonadEval m) => NixValue -> m NixValue-builtinFetchTarball (VStr url _) = fetchAndExtractTarball url-builtinFetchTarball (VAttrs attrs) = do-  url <- forceAttrStr "builtins.fetchTarball" "url" attrs-  fetchAndExtractTarball url-builtinFetchTarball other =-  throwEvalError ("builtins.fetchTarball: expected a string or set, got " <> typeName other)---- | Download a tarball, extract it, and return the path to the extracted--- directory.  Uses a content-hashed temp directory.  Downloads and extracts--- in a single shell pipeline to avoid binary-as-text encoding issues.-fetchAndExtractTarball :: (MonadEval m) => Text -> m NixValue-fetchAndExtractTarball url = do-  sysTmp <- getTempDir-  let urlHash = sha256Hex (TE.encodeUtf8 url)-      extractDir = sysTmp <> "/nova-nix-tarball-" <> urlHash-  -- Single pipeline: mkdir, download, extract with --strip-components=1-  -- The -- separator prevents argument injection from the URL.-  (code, _, errOut) <--    runProcess-      "sh"-      [ "-c",-        "mkdir -p \"$1\" && curl -sSfL -- \"$2\" | tar -xz -C \"$1\" --strip-components=1",-        "--",-        extractDir,-        url-      ]-      ""-  case code of-    0 -> pure (VPath extractDir)-    _ -> throwEvalError ("builtins.fetchTarball: " <> errOut)--builtinFetchGit :: (MonadEval m) => NixValue -> m NixValue-builtinFetchGit (VStr url _) = do-  sysTmp <- getTempDir-  let urlHash = sha256Hex (TE.encodeUtf8 url)-      cloneDir = sysTmp <> "/nova-nix-fetchgit-" <> urlHash-  (code, _, errOut) <- runProcess "git" ["clone", "--depth", "1", "--", url, cloneDir] ""-  case code of-    0 -> pure (VPath cloneDir)-    _ -> throwEvalError ("builtins.fetchGit: git clone failed: " <> errOut)-builtinFetchGit (VAttrs attrs) = do-  url <- forceAttrStr "builtins.fetchGit" "url" attrs-  builtinFetchGit (mkStr url)-builtinFetchGit other =-  throwEvalError ("builtins.fetchGit: expected a string or set, got " <> typeName other)---- | Resolve the system temp directory.  Checks @TMPDIR@ (Unix), then--- @TEMP@ (Windows), falls back to @\/tmp@.-getTempDir :: (MonadEval m) => m Text-getTempDir = do-  candidates <- mapM getEnvVar ["TMPDIR", "TEMP"]-  pure (fromMaybe "/tmp" (find (not . T.null) candidates))---- | Fetch a URL and optionally verify its hash.-fetchUrlSimple :: (MonadEval m) => Text -> Maybe Text -> m NixValue-fetchUrlSimple url _sha256 = do-  (code, stdout, stderr) <- runProcess "curl" ["-sSfL", "--", url] ""-  if code /= 0-    then throwEvalError ("fetch failed: " <> stderr)-    else do-      storePath <- writeToStore "fetchurl-result" stdout-      pure (VPath storePath)---- | Force a required string attribute from an attrset, using full Nix string--- coercion (VStr, VPath, VInt, VBool, VAttrs via __toString/outPath).-forceAttrStr :: (MonadEval m) => Text -> Text -> AttrSet -> m Text-forceAttrStr builtin key attrs =-  case attrSetLookup key attrs of-    Nothing -> throwEvalError (builtin <> ": missing required attribute '" <> key <> "'")-    Just thunk -> do-      val <- force thunk-      result <- catchEvalError (coerceToString True force applyValue val)-      case result of-        Right (s, _ctx) -> pure s-        Left _ -> throwEvalError (builtin <> ": '" <> key <> "' must be a string")---- | Force an optional string attribute via full Nix coercion.-forceOptionalAttrStr :: (MonadEval m) => AttrSet -> Text -> m (Maybe Text)-forceOptionalAttrStr attrs key =-  case attrSetLookup key attrs of-    Nothing -> pure Nothing-    Just thunk -> do-      val <- force thunk-      result <- catchEvalError (coerceToString True force applyValue val)-      case result of-        Right (s, _ctx) -> pure (Just s)-        Left _ -> pure Nothing---- ------------------------------------------------------------------------------ Builtin implementations - derivation construction--- ------------------------------------------------------------------------------- | Eager derivation computation - @builtins.derivationStrict@.  Forces all--- input attrs into env vars, content-hashes, and returns the full derivation--- attrset (drvPath, outPath, per-output, _derivation).  Called LAZILY by the--- @derivation@ wrapper ('builtinDerivationLazy'), so forcing a derivation to--- WHNF never forces this - matching C++ Nix's derivationStrict/derivation split.-builtinDerivationStrict :: (MonadEval m) => NixValue -> m NixValue-builtinDerivationStrict (VAttrs attrs) = do-  -- Extract required attributes-  drvName <- forceAttrStr "derivation" "name" attrs-  system <- forceAttrStr ("derivation \"" <> drvName <> "\"") "system" attrs-  builder <- forceAttrStr ("derivation \"" <> drvName <> "\"") "builder" attrs--  -- Extract optional outputs (default ["out"])-  outputNames <- case attrSetLookup "outputs" attrs of-    Nothing -> pure ["out"]-    Just thunk -> do-      val <- force thunk-      case val of-        VList cl -> mapM (forceToText . Thunk) (clistThunks cl)-        _ -> throwEvalError "derivation: 'outputs' must be a list of strings"--  -- Extract optional args (default []).  Path literals in args (e.g. stdenv's-  -- ./default-builder.sh) are copied into the store; their source paths flow-  -- into inputSrcs via the returned context.-  (builderArgs, argsContext) <- case attrSetLookup "args" attrs of-    Nothing -> pure ([], mempty)-    Just thunk -> do-      val <- force thunk-      case val of-        VList cl -> do-          parts <- mapM (\t -> force (Thunk t) >>= coerceToStoreString) (clistThunks cl)-          pure (map fst parts, mconcat (map snd parts))-        _ -> throwEvalError "derivation: 'args' must be a list of strings"--  -- Materialize once, reuse for both env collection and result merge-  let materialized = attrSetToMap attrs--  -- Collect string-coercible attrs into the build env, EXCLUDING "args"-  -- (C++ Nix puts args in the Derive() args field, never the env).  The-  -- per-output env vars ($out, ...) are added below.  Carries merged context.-  (drvEnvPairs, envContext) <- collectDrvEnvWithContext (Map.delete "__ignoreNulls" (Map.delete "args" materialized))--  let fullContext = envContext <> argsContext-      inputDrvs = extractInputDrvs fullContext-      inputSrcs = extractInputSrcs fullContext-      platform = textToPlatform system-      baseEnv = Map.fromList drvEnvPairs-      drvRefs = inputSrcs ++ Map.keys inputDrvs-      drvFileName = drvName <> ".drv"-      -- Build a Derivation sharing this call's inputs/platform/builder/args.-      mkDrv outs env =-        Derivation-          { drvOutputs = outs,-            drvInputDrvs = inputDrvs,-            drvInputSrcs = inputSrcs,-            drvPlatform = platform,-            drvBuilder = builder,-            drvArgs = builderArgs,-            drvEnv = env-          }-      -- Output carrying only its name; the path is masked at render time.-      maskedOutput name = DerivationOutput name (StorePath "" "") "" ""-      -- Resolve an input derivation's modulo hash (hex) from the cache,-      -- populated bottom-up by earlier 'builtinDerivationStrict' calls.-      resolveInputModulo (sp, outs) = do-        let inputPathText = storePathToText defaultStoreDir sp-        cached <- lookupDrvHash inputPathText-        case cached of-          Just hex -> pure (hex, outs)-          Nothing -> do-            -- Eval is bottom-up, so inputs evaluated this session are always-            -- cached by the time a dependent hashes.  A miss means an input-            -- referenced but not evaluated here (a pure-eval synthetic context,-            -- or a pre-built store drv): fall back to its store hash so-            -- evaluation still produces a value, and warn for visibility.-            traceMessage-              ("derivation: input modulo hash not cached, using store hash for " <> inputPathText)-            pure (spHash sp, outs)--  -- Fixed-output derivations (fetchurl etc.) are content-addressed and hash-  -- via the @fixed:out:@ scheme; input-addressed derivations recurse through-  -- the modulo hashes of their inputs.-  mFixed <- detectFixedOutput attrs--  (drvPathText, drvSP, outPaths, completeDrv) <- case mFixed of-    Just (foAlgo, foMode, foDigest) -> do-      let foPath = makeFixedOutputPath drvName foAlgo foMode foDigest-          foPathText = storePathToText defaultStoreDir foPath-          algoField = (if foMode == "recursive" then "r:" else "") <> foAlgo-          foHashHex = bytesToHexText foDigest-          foModulo =-            sha256Digest-              (TE.encodeUtf8 ("fixed:out:" <> algoField <> ":" <> foHashHex <> ":" <> foPathText))-          contents =-            mkDrv-              [DerivationOutput "out" foPath algoField foHashHex]-              (Map.insert "out" foPathText baseEnv)-          drvSp = makeTextPath drvFileName (sha256Digest (TE.encodeUtf8 (toATerm contents))) drvRefs-          drvText = storePathToText defaultStoreDir drvSp-      cacheDrvHash drvText (bytesToHexText foModulo)-      pure (drvText, drvSp, [("out", foPathText)], contents)-    Nothing -> do-      inputSubst <- mapM resolveInputModulo (Map.toList inputDrvs)-      let maskedEnv = foldr (`Map.insert` "") baseEnv outputNames-          maskedDrv = mkDrv (map maskedOutput outputNames) maskedEnv-          -- Masked modulo hash yields this derivation's own output paths.-          moduloMasked = sha256Digest (TE.encodeUtf8 (toATermForHash True (Just inputSubst) maskedDrv))-          outStorePaths = [(n, makeOutputPath n moduloMasked drvName) | n <- outputNames]-          outPathTexts = [(n, storePathToText defaultStoreDir sp) | (n, sp) <- outStorePaths]-          realEnv = foldr (\(n, t) e -> Map.insert n t e) baseEnv outPathTexts-          contents = mkDrv [DerivationOutput n sp "" "" | (n, sp) <- outStorePaths] realEnv-          -- Unmasked modulo hash (real outputs, inputs substituted) cached for-          -- when this derivation is itself an input to another.-          moduloUnmasked = sha256Digest (TE.encodeUtf8 (toATermForHash False (Just inputSubst) contents))-          drvSp = makeTextPath drvFileName (sha256Digest (TE.encodeUtf8 (toATerm contents))) drvRefs-          drvText = storePathToText defaultStoreDir drvSp-      cacheDrvHash drvText (bytesToHexText moduloUnmasked)-      pure (drvText, drvSp, outPathTexts, contents)--  -- Record this derivation's full .drv ATerm (the exact bytes whose hash is its-  -- store path) so the build driver can materialize the entire input-.drv-  -- closure before building.  Bottom-up eval guarantees every transitive input-  -- is recorded by the time a dependent is.-  recordDrvAterm drvPathText (toATerm completeDrv)--  let mainOutPath = case outPaths of-        ((_, p) : _) -> p-        [] -> ""-      -- The default output is the FIRST in @outputs@ (matching C++ Nix, which-      -- returns @(head outputsList).value@) - not necessarily @out@.-      mainOutName = case outPaths of-        ((n, _) : _) -> n-        [] -> "out"--  -- Context for output paths: each output carries SCDrvOutput context-  -- Context for drvPath: carries SCAllOutputs context-  let drvPathCtx = StringContext (Set.singleton (SCAllOutputs drvSP))-      outPathCtx outName = StringContext (Set.singleton (SCDrvOutput drvSP outName))--  -- Build per-output attrsets matching Nix: drv.out = { outPath, drvPath, type }-  let mkOutputAttrs outName outP =-        let outCtx = outPathCtx outName-            outputAttrMap =-              Map.fromList-                [ ("outPath", evaluated (VStr outP outCtx)),-                  ("drvPath", evaluated (VStr drvPathText drvPathCtx)),-                  ("type", evaluated (mkStr "derivation"))-                ]-         in evaluated (VAttrs (attrSetFromMap outputAttrMap))--  -- Build result attrset: original attrs + drvPath, outPath, type, per-output attrs-  let baseAttrs =-        Map.fromList $-          [ ("type", evaluated (mkStr "derivation")),-            ("drvPath", evaluated (VStr drvPathText drvPathCtx)),-            ("outPath", evaluated (VStr mainOutPath (outPathCtx mainOutName))),-            ("name", evaluated (mkStr drvName)),-            ("system", evaluated (mkStr system)),-            ("builder", evaluated (mkStr builder)),-            ("_derivation", evaluated (VDerivation completeDrv))-          ]-            ++ [(outName, mkOutputAttrs outName outP) | (outName, outP) <- outPaths]-      -- Merge original attrs underneath so computed attrs take priority-      resultAttrs = Map.union baseAttrs materialized--  pure (VAttrs (attrSetFromMap resultAttrs))-builtinDerivationStrict other =-  throwEvalError ("derivation: expected a set, got " <> typeName other)---- | Detect a fixed-output derivation.  Returns @Just (algo, mode, rawDigest)@--- when @outputHash@ is present and non-empty (fetchurl, fetchgit, ...), else--- 'Nothing' for an ordinary input-addressed derivation.  @mode@ is--- @\"flat\"@ or @\"recursive\"@; @algo@ is e.g. @\"sha256\"@.-detectFixedOutput :: (MonadEval m) => AttrSet -> m (Maybe (Text, Text, BS.ByteString))-detectFixedOutput attrs =-  case attrSetLookup "outputHash" attrs of-    Nothing -> pure Nothing-    Just thunk -> do-      val <- force thunk-      case val of-        VStr ohash _-          | not (T.null ohash) -> do-              ohAlgo <- optDrvStrAttr "outputHashAlgo" attrs-              ohMode <- optDrvStrAttr "outputHashMode" attrs-              (algo, digest) <- normalizeFixedHash ohash ohAlgo-              let mode = if ohMode == "recursive" then "recursive" else "flat"-              pure (Just (algo, mode, digest))-        _ -> pure Nothing---- | Read an optional string attribute, defaulting to @\"\"@ when absent or--- not a string.-optDrvStrAttr :: (MonadEval m) => Text -> AttrSet -> m Text-optDrvStrAttr key attrs =-  case attrSetLookup key attrs of-    Nothing -> pure ""-    Just thunk -> do-      val <- force thunk-      case val of-        VStr s _ -> pure s-        _ -> pure ""---- | Decode a fixed-output hash (SRI @algo-base64@, @algo:hash@, or a bare--- hash plus a separate algorithm) to its algorithm name and raw bytes.-normalizeFixedHash :: (MonadEval m) => Text -> Text -> m (Text, BS.ByteString)-normalizeFixedHash ohash ohAlgo-  | Just (algo, b64) <- parseSRI ohash = do-      bytes <- decodeBase64E "derivation" b64-      pure (algo, bytes)-  | Just (algo, rest) <- parseAlgoPrefix ohash = decodeWithAlgo algo rest-  | not (T.null ohAlgo) = decodeWithAlgo ohAlgo ohash-  | otherwise =-      throwEvalError ("derivation: cannot determine outputHash algorithm for " <> ohash)---- | Lazy @derivation@ wrapper - mirrors C++ Nix's @corepkgs/derivation.nix@.--- Returns a WHNF attrset whose @drvPath@/@outPath@/output-path/@_derivation@--- attrs are LAZY thunks that defer to 'builtinDerivationStrict'.  Forcing a--- derivation to WHNF therefore does NOT force its input/env closure - which is--- essential for nixpkgs, where merely referencing a derivation (e.g.--- @drv != null@, @assert (libxcrypt != null)@) must not build its whole closure.------ The lazy thunks are built with the same synthetic-select pattern used by--- @inherit (from)@: a single shared @strict@ thunk (so the eager computation--- runs at most once) selected from via fresh minimal envs.-builtinDerivationLazy :: (MonadEval m) => NixValue -> m NixValue-builtinDerivationLazy (VAttrs attrs) = do-  -- Output names are cheap (matches @drvAttrs @ { outputs ? [ "out" ], ... }@).-  outputNames <- case attrSetLookup "outputs" attrs of-    Nothing -> pure ["out"]-    Just thunk -> do-      val <- force thunk-      case val of-        VList cl -> mapM (forceToText . Thunk) (clistThunks cl)-        _ -> throwEvalError "derivation: 'outputs' must be a list of strings"-  -- One shared thunk computing @derivationStrict attrs@, forced only when an-  -- output path / drvPath is actually read.-  let drvAttrsThunk = evaluated (VAttrs attrs)-      strictBuiltinThunk = evaluated (VBuiltin "derivationStrict" [])-      strictThunk =-        let (sp, sc) = buildCSlots [drvAttrsThunk, strictBuiltinThunk]-            envDS = newMinimalEnv sp sc-         in mkSyntheticThunk envDS (EApp (EResolvedVar 0 1) (EResolvedVar 0 0))-      selectStrict field =-        let (sp, sc) = buildCSlots [strictThunk]-            envF = newMinimalEnv sp sc-         in mkSyntheticThunk envF (ESelect (EResolvedVar 0 0) [StaticKey field] Nothing)-  -- WHNF spine: input attrs (unforced) overlaid with the lazy computed attrs.-  let computedAttrs =-        Map.fromList $-          [ ("type", evaluated (mkStr "derivation")),-            ("drvPath", selectStrict "drvPath"),-            ("outPath", selectStrict "outPath"),-            ("_derivation", selectStrict "_derivation")-          ]-            ++ [(outName, selectStrict outName) | outName <- outputNames]-      resultAttrs = Map.union computedAttrs (attrSetToMap attrs)-  pure (VAttrs (attrSetFromMap resultAttrs))-builtinDerivationLazy other =-  throwEvalError ("derivation: expected a set, got " <> typeName other)---- | Force a thunk to a Text string via full Nix coercion.-forceToText :: (MonadEval m) => Thunk -> m Text-forceToText thunk = do-  val <- force thunk-  (s, _ctx) <- coerceToString True force applyValue val-  pure s---- | Collect all string-coercible attributes for the derivation environment,--- along with the merged string context from all collected values.--- Uses 'coerceToStringPermissive' for full Nix coercion including--- __toString, outPath, and list-to-space-separated-string.-collectDrvEnvWithContext :: (MonadEval m) => Map Text Thunk -> m ([(Text, Text)], StringContext)-collectDrvEnvWithContext attrs = do-  let pairs = Map.toList attrs-  results <- mapM tryCoerce pairs-  let envPairs = catMaybes [fmap (\(k, v, _) -> (k, v)) r | r <- results]-      mergedCtx = mconcat [ctx | Just (_, _, ctx) <- results]-  pure (envPairs, mergedCtx)-  where-    tryCoerce (key, thunk) = do-      val <- force thunk-      case val of-        VNull -> pure Nothing-        _ -> do-          result <- catchEvalError (coerceToStoreString val)-          case result of-            Right (s, ctx) -> pure (Just (key, s, ctx))-            Left _ -> pure Nothing---- ------------------------------------------------------------------------------ Builtin implementations - hashFile, readFileType--- ------------------------------------------------------------------------------- | @builtins.hashFile algo path@ - hash raw bytes of a file on disk.--- Returns base-16 hex string, matching @builtins.hashString@ output format.-builtinHashFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinHashFile (VStr algo _) (VPath path) = do-  bytes <- readFileBytes path-  hashBytesWithAlgo "hashFile" algo bytes-builtinHashFile (VStr algo _) (VStr path _) = do-  bytes <- readFileBytes path-  hashBytesWithAlgo "hashFile" algo bytes-builtinHashFile (VStr _ _) other =-  throwEvalError ("builtins.hashFile: expected a path, got " <> typeName other)-builtinHashFile other _ =-  throwEvalError ("builtins.hashFile: expected a string, got " <> typeName other)---- | Shared hash dispatch for raw 'ByteString' input.-hashBytesWithAlgo :: (MonadEval m) => Text -> Text -> BS.ByteString -> m NixValue-hashBytesWithAlgo ctx algo bytes = case algo of-  "sha256" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA256)))-  "sha512" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA512)))-  "sha1" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA1)))-  "md5" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.MD5)))-  _ -> throwEvalError ("builtins." <> ctx <> ": unknown hash algorithm '" <> algo <> "'")---- | @builtins.readFileType path@ - classify a filesystem entry.--- Returns @"regular"@, @"directory"@, @"symlink"@, or @"unknown"@.-builtinReadFileType :: (MonadEval m) => NixValue -> m NixValue-builtinReadFileType (VPath path) = mkStr <$> getFileType path-builtinReadFileType (VStr path _) = mkStr <$> getFileType path-builtinReadFileType other =-  throwEvalError ("builtins.readFileType: expected a path, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - convertHash--- ------------------------------------------------------------------------------- | @builtins.convertHash { hash, hashAlgo?, toHashFormat }@ - convert--- between hash representations.  Supports base16, nix32, base64, and sri.-builtinConvertHash :: (MonadEval m) => NixValue -> m NixValue-builtinConvertHash (VAttrs attrs) = do-  hashVal <- requireStrAttr "convertHash" "hash" attrs-  toFmt <- requireStrAttr "convertHash" "toHashFormat" attrs-  -- Detect input format and decode to raw bytes + algo-  (algo, rawBytes) <- decodeHashInput attrs hashVal-  -- Encode to target format-  case toFmt of-    "base16" -> pure (mkStr (bytesToHexText rawBytes))-    "nix32" -> pure (mkStr (Nix32.encode rawBytes))-    "base32" -> pure (mkStr (Nix32.encode rawBytes)) -- deprecated alias-    "base64" -> pure (mkStr (bytesToBase64 rawBytes))-    "sri" -> pure (mkStr (algo <> "-" <> bytesToBase64 rawBytes))-    _ -> throwEvalError ("builtins.convertHash: unknown toHashFormat '" <> toFmt <> "'")-builtinConvertHash other =-  throwEvalError ("builtins.convertHash: expected a set, got " <> typeName other)---- | Extract algo + raw bytes from the hash input, handling SRI, prefixed, and plain formats.-decodeHashInput :: (MonadEval m) => AttrSet -> Text -> m (Text, BS.ByteString)-decodeHashInput attrs hashStr-  -- SRI format: algo-base64-  | Just (algo, b64) <- parseSRI hashStr = do-      bytes <- decodeBase64E "convertHash" b64-      pure (algo, bytes)-  -- Prefixed format: algo:hex or algo:nix32-  | Just (algo, rest) <- parseAlgoPrefix hashStr =-      decodeWithAlgo algo rest-  -- Plain hash - need hashAlgo attribute-  | otherwise = do-      algo <- requireStrAttr "convertHash" "hashAlgo" attrs-      decodeWithAlgo algo hashStr---- | Try to decode as hex, then nix32, then base64.-decodeWithAlgo :: (MonadEval m) => Text -> Text -> m (Text, BS.ByteString)-decodeWithAlgo algo s-  | Just bytes <- hexToBytes s = pure (algo, bytes)-  | Right bytes <- Nix32.decode s = pure (algo, bytes)-  | Right bytes <- decodeBase64Pure s = pure (algo, bytes)-  | otherwise = throwEvalError ("builtins.convertHash: cannot decode hash '" <> s <> "'")---- | Parse @sha256-base64...@ SRI format.-parseSRI :: Text -> Maybe (Text, Text)-parseSRI t = case T.breakOn "-" t of-  (algo, rest)-    | not (T.null rest) && algo `elem` ["sha256", "sha512", "sha1", "md5"] ->-        Just (algo, T.drop 1 rest)-  _ -> Nothing---- | Parse @sha256:value@ prefixed format.-parseAlgoPrefix :: Text -> Maybe (Text, Text)-parseAlgoPrefix t = case T.breakOn ":" t of-  (algo, rest)-    | not (T.null rest) && algo `elem` ["sha256", "sha512", "sha1", "md5"] ->-        Just (algo, T.drop 1 rest)-  _ -> Nothing---- | Require a string attribute from an attrset.-requireStrAttr :: (MonadEval m) => Text -> Text -> AttrSet -> m Text-requireStrAttr ctx key attrs = case attrSetLookup key attrs of-  Just thunk -> do-    val <- force thunk-    case val of-      VStr s _ -> pure s-      _ -> throwEvalError ("builtins." <> ctx <> ": " <> key <> " must be a string")-  Nothing -> throwEvalError ("builtins." <> ctx <> ": missing required attribute '" <> key <> "'")---- ------------------------------------------------------------------------------ Base64 encode/decode - delegates to nova-cache (base64-bytestring under the hood)--- ------------------------------------------------------------------------------- | Encode bytes to base64.-bytesToBase64 :: BS.ByteString -> Text-bytesToBase64 = B64.encode---- | Decode base64 text to bytes (pure).-decodeBase64Pure :: Text -> Either Text BS.ByteString-decodeBase64Pure t =-  -- Strip whitespace and any existing padding, then re-pad to a multiple of-  -- 4.  base64-bytestring's 'decode' requires correct padding, so SRI hashes-  -- (correctly-padded standard base64, e.g. @sha256-...NQ=@) would otherwise be-  -- rejected once their trailing @=@ was removed.-  let stripped = T.filter (\c -> c /= '\n' && c /= '\r' && c /= '=') t-      padLen = (4 - (T.length stripped `mod` 4)) `mod` 4-      padded = stripped <> T.replicate padLen "="-   in case B64.decode padded of-        Right bytes -> Right bytes-        Left _ -> Left "invalid base64"---- | Decode base64 with error context for builtins.-decodeBase64E :: (MonadEval m) => Text -> Text -> m BS.ByteString-decodeBase64E ctx t = case decodeBase64Pure t of-  Right bytes -> pure bytes-  Left _ -> throwEvalError ("builtins." <> ctx <> ": invalid base64 encoding")---- ------------------------------------------------------------------------------ Builtin implementations - fromTOML--- ------------------------------------------------------------------------------- | @builtins.fromTOML str@ - parse a TOML document to a Nix value.--- Hand-rolled parser covering the TOML v1.0 subset used by nixpkgs:--- bare/quoted keys, dotted keys, basic/literal strings (multiline),--- integers (dec/hex/oct/bin), floats (inc. inf/nan), booleans,--- inline tables, arrays, array-of-tables, and standard tables.--- Datetimes are represented as strings (matching real Nix).-builtinFromTOML :: (MonadEval m) => NixValue -> m NixValue-builtinFromTOML (VStr s _) = case parseTOML s of-  Right val -> pure val-  Left err -> throwEvalError ("builtins.fromTOML: " <> err)-builtinFromTOML other =-  throwEvalError ("builtins.fromTOML: expected a string, got " <> typeName other)---- | Intermediate TOML value before conversion to NixValue.-data TOMLValue-  = TOMLStr !Text-  | TOMLInt !Int64-  | TOMLFloat !Double-  | TOMLBool !Bool-  | TOMLArray ![TOMLValue]-  | TOMLTable !(Map Text TOMLValue)-  deriving (Show)---- | Parse a TOML document into a NixValue.-parseTOML :: Text -> Either Text NixValue-parseTOML input = do-  table <- parseTOMLDoc (T.lines input)-  pure (tomlToNix (TOMLTable table))---- | Convert a TOMLValue to NixValue.-tomlToNix :: TOMLValue -> NixValue-tomlToNix val = case val of-  TOMLStr s -> mkStr s-  TOMLInt n -> VInt n-  TOMLFloat d -> VFloat d-  TOMLBool b -> VBool b-  TOMLArray xs -> VList (clistFromThunks (map (thunkToCPtr . evaluated . tomlToNix) xs))-  TOMLTable m -> VAttrs (attrSetFromMap (Map.map (evaluated . tomlToNix) m))---- | Parse all lines of a TOML document into a table.-parseTOMLDoc :: [Text] -> Either Text (Map Text TOMLValue)-parseTOMLDoc lns = go lns [] Map.empty-  where-    go [] _ root = Right root-    go (line : rest) currentPath root-      | T.null stripped || T.isPrefixOf "#" stripped =-          -- Empty line or comment-          go rest currentPath root-      | T.isPrefixOf "[[" stripped && T.isSuffixOf "]]" stripped =-          -- Array of tables: [[key]]-          let keyStr = T.strip (T.drop 2 (T.dropEnd 2 stripped))-              keys = parseDottedKey keyStr-           in go rest keys (insertArrayTable keys root)-      | T.isPrefixOf "[" stripped && T.isSuffixOf "]" stripped =-          -- Standard table: [key]-          let keyStr = T.strip (T.drop 1 (T.dropEnd 1 stripped))-              keys = parseDottedKey keyStr-           in go rest keys (ensureTable keys root)-      | otherwise =-          -- Key = value pair-          case parseKVLine stripped of-            Right (keys, val) ->-              go rest currentPath (insertNested (currentPath ++ keys) val root)-            Left err -> Left err-      where-        stripped = T.strip line---- | Parse a key = value line.-parseKVLine :: Text -> Either Text ([Text], TOMLValue)-parseKVLine line =-  let (keyPart, afterEq) = splitAtEquals line-   in case T.uncons afterEq of-        Nothing -> Left ("expected '=' in: " <> line)-        Just _ -> do-          let val = T.strip afterEq-          parsed <- parseTOMLValue val-          Right (parseDottedKey (T.strip keyPart), parsed)---- | Split a line at the first unquoted '=' sign.-splitAtEquals :: Text -> (Text, Text)-splitAtEquals = go T.empty-  where-    go acc t = case T.uncons t of-      Nothing -> (acc, T.empty)-      Just ('=', rest) -> (acc, rest)-      Just ('"', rest) ->-        let (quoted, after) = T.break (== '"') rest-         in case T.uncons after of-              Just ('"', r) -> go (acc <> "\"" <> quoted <> "\"") r-              _ -> go (acc <> "\"" <> quoted) after-      Just ('\'', rest) ->-        let (quoted, after) = T.break (== '\'') rest-         in case T.uncons after of-              Just ('\'', r) -> go (acc <> "'" <> quoted <> "'") r-              _ -> go (acc <> "'" <> quoted) after-      Just (c, rest) -> go (T.snoc acc c) rest---- | Parse dotted key like @foo.bar."baz qux"@ into @["foo", "bar", "baz qux"]@.-parseDottedKey :: Text -> [Text]-parseDottedKey t-  | T.null t = []-  | otherwise = case T.uncons t of-      Just ('"', rest) ->-        let (key, after) = T.break (== '"') rest-         in key : parseDottedKey (T.drop 1 (T.stripStart (dropDot after)))-      Just ('\'', rest) ->-        let (key, after) = T.break (== '\'') rest-         in key : parseDottedKey (T.drop 1 (T.stripStart (dropDot after)))-      _ ->-        let (key, after) = T.break (\c -> c == '.' || c == '"') t-         in T.strip key : case T.uncons after of-              Nothing -> []-              Just _ -> parseDottedKey (T.drop 1 (T.stripStart after))-  where-    dropDot txt = case T.uncons txt of-      Just ('.', rest) -> rest-      _ -> txt---- | Parse a TOML value (right side of '=').-parseTOMLValue :: Text -> Either Text TOMLValue-parseTOMLValue t =-  let stripped = T.strip t-      -- Strip inline comments (not inside strings)-      cleaned = stripInlineComment stripped-   in case T.uncons cleaned of-        Nothing -> Left "empty value"-        Just ('"', _)-          | T.isPrefixOf "\"\"\"" cleaned -> parseMultilineBasicStr (T.drop 3 cleaned)-          | otherwise -> parseBasicStr (T.drop 1 cleaned)-        Just ('\'', _)-          | T.isPrefixOf "'''" cleaned -> parseMultilineLiteralStr (T.drop 3 cleaned)-          | otherwise -> parseLiteralStr (T.drop 1 cleaned)-        Just ('{', _) -> parseInlineTable cleaned-        Just ('[', _) -> parseInlineArray cleaned-        Just ('t', _)-          | T.isPrefixOf "true" cleaned -> Right (TOMLBool True)-        Just ('f', _)-          | T.isPrefixOf "false" cleaned -> Right (TOMLBool False)-        Just ('i', _)-          | T.isPrefixOf "inf" cleaned -> Right (TOMLFloat (1 / 0))-        Just ('+', rest)-          | T.isPrefixOf "inf" rest -> Right (TOMLFloat (1 / 0))-          | T.isPrefixOf "nan" rest -> Right (TOMLFloat (0 / 0))-        Just ('-', rest)-          | T.isPrefixOf "inf" rest -> Right (TOMLFloat (negate (1 / 0)))-          | T.isPrefixOf "nan" rest -> Right (TOMLFloat (0 / 0))-        Just ('n', _)-          | T.isPrefixOf "nan" cleaned -> Right (TOMLFloat (0 / 0))-        _ -> parseTOMLNumberOrDatetime cleaned---- | Strip inline comment from a value (not inside quotes).-stripInlineComment :: Text -> Text-stripInlineComment = go (0 :: Int)-  where-    go _ t | T.null t = T.empty-    go depth t = case T.uncons t of-      Nothing -> T.empty-      Just ('#', _) | depth == (0 :: Int) -> T.empty-      Just ('"', rest)-        | depth == 0 ->-            let (str, after) = T.break (== '"') rest-             in T.cons '"' (str <> T.take 1 after <> go depth (T.drop 1 after))-      Just ('[', rest) -> T.cons '[' (go (depth + 1) rest)-      Just ('{', rest) -> T.cons '{' (go (depth + 1) rest)-      Just (']', rest) -> T.cons ']' (go (max 0 (depth - 1)) rest)-      Just ('}', rest) -> T.cons '}' (go (max 0 (depth - 1)) rest)-      Just (c, rest) -> T.cons c (go depth rest)---- | Parse a basic (double-quoted) TOML string.--- O(n) via chunk list + T.concat instead of O(n^2) T.snoc.-parseBasicStr :: Text -> Either Text TOMLValue-parseBasicStr = go []-  where-    go !chunks t = case T.uncons t of-      Nothing -> Left "unterminated basic string"-      Just ('"', _) -> Right (TOMLStr (T.concat (reverse chunks)))-      Just ('\\', rest) -> case T.uncons rest of-        Just ('n', r) -> go ("\n" : chunks) r-        Just ('t', r) -> go ("\t" : chunks) r-        Just ('r', r) -> go ("\r" : chunks) r-        Just ('\\', r) -> go ("\\" : chunks) r-        Just ('"', r) -> go ("\"" : chunks) r-        Just ('b', r) -> go ("\b" : chunks) r-        Just ('f', r) -> go ("\f" : chunks) r-        Just ('u', r) -> case parseHex4 r of-          Just (cp, r2) -> go (T.singleton (chr cp) : chunks) r2-          Nothing -> Left "invalid \\u escape"-        _ -> Left "invalid escape sequence"-      Just (c, rest) -> go (T.singleton c : chunks) rest---- | Parse a literal (single-quoted) TOML string.-parseLiteralStr :: Text -> Either Text TOMLValue-parseLiteralStr t =-  let (content, rest) = T.break (== '\'') t-   in case T.uncons rest of-        Just ('\'', _) -> Right (TOMLStr content)-        _ -> Left "unterminated literal string"---- | Parse a multiline basic string.-parseMultilineBasicStr :: Text -> Either Text TOMLValue-parseMultilineBasicStr t =-  case T.breakOn "\"\"\"" t of-    (content, rest)-      | T.isPrefixOf "\"\"\"" rest ->-          Right (TOMLStr (T.replace "\\\n" "" (stripLeadingNewline content)))-      | otherwise -> Left ("unterminated multiline basic string, remaining: " <> T.take 20 rest)---- | Parse a multiline literal string.-parseMultilineLiteralStr :: Text -> Either Text TOMLValue-parseMultilineLiteralStr t =-  case T.breakOn "'''" t of-    (content, rest)-      | T.isPrefixOf "'''" rest -> Right (TOMLStr (stripLeadingNewline content))-      | otherwise -> Left "unterminated multiline literal string"---- | Strip a leading newline (TOML spec: first newline after opening quotes is trimmed).-stripLeadingNewline :: Text -> Text-stripLeadingNewline t = case T.uncons t of-  Just ('\n', rest) -> rest-  Just ('\r', rest) -> case T.uncons rest of-    Just ('\n', r) -> r-    _ -> rest-  _ -> t---- | Parse a TOML number or datetime.-parseTOMLNumberOrDatetime :: Text -> Either Text TOMLValue-parseTOMLNumberOrDatetime s-  -- Hex, octal, binary integers-  | T.isPrefixOf "0x" s || T.isPrefixOf "0X" s = parseHexInt (T.drop 2 s)-  | T.isPrefixOf "0o" s || T.isPrefixOf "0O" s = parseOctInt (T.drop 2 s)-  | T.isPrefixOf "0b" s || T.isPrefixOf "0B" s = parseBinInt (T.drop 2 s)-  -- Contains date separators, so treat as a datetime string-  | T.any (== 'T') s && T.any (== '-') s = Right (TOMLStr s)-  | T.count "-" s >= 2 && T.any isDigit s = Right (TOMLStr s)-  | T.any (== ':') s && T.any isDigit s = Right (TOMLStr s)-  -- Float (has dot or exponent)-  | T.any (== '.') s || T.any (\c -> c == 'e' || c == 'E') s = parseFloat s-  -- Plain integer-  | otherwise = parseInt s---- | Parse a plain decimal integer, ignoring underscores.-parseInt :: Text -> Either Text TOMLValue-parseInt t =-  let cleaned = T.filter (/= '_') t-      (sign, digits) = case T.uncons cleaned of-        Just ('+', rest) -> (1, rest)-        Just ('-', rest) -> (-1, rest)-        _ -> (1, cleaned)-   in case readDecimal digits of-        Just n -> Right (TOMLInt (sign * n))-        Nothing -> Left ("invalid integer: " <> t)--parseHexInt :: Text -> Either Text TOMLValue-parseHexInt t =-  let cleaned = T.filter (/= '_') t-   in case readHexT cleaned of-        Just n -> Right (TOMLInt n)-        Nothing -> Left ("invalid hex integer: " <> t)--parseOctInt :: Text -> Either Text TOMLValue-parseOctInt t =-  let cleaned = T.filter (/= '_') t-   in case readOctT cleaned of-        Just n -> Right (TOMLInt n)-        Nothing -> Left ("invalid octal integer: " <> t)--parseBinInt :: Text -> Either Text TOMLValue-parseBinInt t =-  let cleaned = T.filter (/= '_') t-   in case readBinT cleaned of-        Just n -> Right (TOMLInt n)-        Nothing -> Left ("invalid binary integer: " <> t)--parseFloat :: Text -> Either Text TOMLValue-parseFloat t =-  let cleaned = T.filter (/= '_') t-   in case readDouble cleaned of-        Just d -> Right (TOMLFloat d)-        Nothing -> Left ("invalid float: " <> t)---- | Read a decimal integer from Text.-readDecimal :: Text -> Maybe Int64-readDecimal t-  | T.null t = Nothing-  | T.all isDigit t = Just (T.foldl' (\acc c -> acc * 10 + fromIntegral (digitToInt c)) 0 t)-  | otherwise = Nothing--readHexT :: Text -> Maybe Int64-readHexT t-  | T.null t = Nothing-  | T.all isHexDigit t = Just (T.foldl' (\acc c -> acc * 16 + fromIntegral (digitToInt c)) 0 t)-  | otherwise = Nothing--readOctT :: Text -> Maybe Int64-readOctT t-  | T.null t = Nothing-  | T.all isOctDigit t =-      Just (T.foldl' (\acc c -> acc * 8 + fromIntegral (digitToInt c)) 0 t)-  | otherwise = Nothing--readBinT :: Text -> Maybe Int64-readBinT t-  | T.null t = Nothing-  | T.all (\c -> c == '0' || c == '1') t =-      Just (T.foldl' (\acc c -> acc * 2 + fromIntegral (digitToInt c)) 0 t)-  | otherwise = Nothing--readDouble :: Text -> Maybe Double-readDouble t = case reads (T.unpack t) of-  [(d, "")] -> Just d-  _ -> Nothing---- | Parse an inline table: @{ key = val, ... }@.-parseInlineTable :: Text -> Either Text TOMLValue-parseInlineTable t = case T.uncons t of-  Just ('{', rest) ->-    let inner = T.strip (T.dropWhileEnd (== '}') (T.strip rest))-     in if T.null inner-          then Right (TOMLTable Map.empty)-          else do-            pairs <- mapM parseInlineKV (splitCommas inner)-            Right (TOMLTable (Map.fromList (concatMap flattenPair pairs)))-  _ -> Left "expected '{'"-  where-    flattenPair (keys, val) = case keys of-      [] -> []-      [k] -> [(k, val)]-      (k : ks) -> [(k, nestKeys ks val)]-    nestKeys [] v = v-    nestKeys (k : ks) v = TOMLTable (Map.singleton k (nestKeys ks v))---- | Parse an inline array: @[ val, ... ]@.-parseInlineArray :: Text -> Either Text TOMLValue-parseInlineArray t = case T.uncons t of-  Just ('[', rest) ->-    let inner = T.strip (T.dropWhileEnd (== ']') (T.strip rest))-     in if T.null inner-          then Right (TOMLArray [])-          else do-            vals <- mapM (parseTOMLValue . T.strip) (splitCommas inner)-            Right (TOMLArray vals)-  _ -> Left "expected '['"---- | Parse a single key=value pair in an inline table.-parseInlineKV :: Text -> Either Text ([Text], TOMLValue)-parseInlineKV t =-  let (keyPart, afterEq) = splitAtEquals (T.strip t)-   in do-        val <- parseTOMLValue (T.strip afterEq)-        Right (parseDottedKey (T.strip keyPart), val)---- | Split on commas not inside brackets or braces.--- O(n) via chunk list + T.concat instead of O(n^2) T.snoc.-splitCommas :: Text -> [Text]-splitCommas = go (0 :: Int) []-  where-    finalize chunks =-      let t = T.concat (reverse chunks)-       in [t | not (T.null (T.strip t))]-    go _ !chunks t | T.null t = finalize chunks-    go depth !chunks t = case T.uncons t of-      Nothing -> finalize chunks-      Just (',', rest) | depth == 0 -> T.concat (reverse chunks) : go 0 [] rest-      Just ('[', rest) -> go (depth + 1) ("[" : chunks) rest-      Just ('{', rest) -> go (depth + 1) ("{" : chunks) rest-      Just (']', rest) -> go (max 0 (depth - 1)) ("]" : chunks) rest-      Just ('}', rest) -> go (max 0 (depth - 1)) ("}" : chunks) rest-      Just ('"', rest) ->-        let (str, after) = T.break (== '"') rest-            consumed = "\"" <> str <> T.take 1 after-         in go depth (consumed : chunks) (T.drop 1 after)-      Just (c, rest) -> go depth (T.singleton c : chunks) rest---- | Insert a value at a nested key path into a table.-insertNested :: [Text] -> TOMLValue -> Map Text TOMLValue -> Map Text TOMLValue-insertNested [] _ m = m-insertNested [k] v m = Map.insert k v m-insertNested (k : ks) v m =-  let sub = case Map.lookup k m of-        Just (TOMLTable inner) -> inner-        _ -> Map.empty-   in Map.insert k (TOMLTable (insertNested ks v sub)) m---- | Ensure a table path exists (for @[table]@ headers).-ensureTable :: [Text] -> Map Text TOMLValue -> Map Text TOMLValue-ensureTable [] m = m-ensureTable [k] m = case Map.lookup k m of-  Just (TOMLTable _) -> m-  Nothing -> Map.insert k (TOMLTable Map.empty) m-  _ -> m-ensureTable (k : ks) m =-  let sub = case Map.lookup k m of-        Just (TOMLTable inner) -> inner-        _ -> Map.empty-   in Map.insert k (TOMLTable (ensureTable ks sub)) m---- | Insert an entry into an array-of-tables (@[[table]]@).-insertArrayTable :: [Text] -> Map Text TOMLValue -> Map Text TOMLValue-insertArrayTable [] m = m-insertArrayTable [k] m = case Map.lookup k m of-  Just (TOMLArray xs) -> Map.insert k (TOMLArray (xs ++ [TOMLTable Map.empty])) m-  Nothing -> Map.insert k (TOMLArray [TOMLTable Map.empty]) m-  _ -> Map.insert k (TOMLArray [TOMLTable Map.empty]) m-insertArrayTable (k : ks) m =-  let sub = case Map.lookup k m of-        Just (TOMLTable inner) -> inner-        Just (TOMLArray xs) ->-          -- Descend into the last element of the array-          case reverse xs of-            (TOMLTable inner : _) -> inner-            _ -> Map.empty-        _ -> Map.empty-      updated = insertArrayTable ks sub-   in case Map.lookup k m of-        Just (TOMLArray xs) ->-          case reverse xs of-            (TOMLTable _ : prev) ->-              Map.insert k (TOMLArray (reverse prev ++ [TOMLTable updated])) m-            _ -> Map.insert k (TOMLTable updated) m-        _ -> Map.insert k (TOMLTable updated) m---- ------------------------------------------------------------------------------ Builtin implementations - toXML--- ------------------------------------------------------------------------------- | @builtins.toXML val@ - convert a Nix value to its XML representation.--- Matches the format defined by the Nix manual: strings, ints, floats,--- bools, nulls, lists, and attrsets map to their XML counterparts.-builtinToXML :: (MonadEval m) => NixValue -> m NixValue-builtinToXML val = do-  xml <- valueToXML 0 val-  pure (mkStr ("<?xml version='1.0' encoding='utf-8'?>\n<expr>\n" <> xml <> "</expr>\n"))--valueToXML :: (MonadEval m) => Int -> NixValue -> m Text-valueToXML depth val = case val of-  VStr s _ ->-    pure (indent depth <> "<string value=" <> xmlQuote s <> " />\n")-  VInt n ->-    pure (indent depth <> "<int value=\"" <> T.pack (show n) <> "\" />\n")-  VFloat d ->-    pure (indent depth <> "<float value=\"" <> T.pack (show d) <> "\" />\n")-  VBool True ->-    pure (indent depth <> "<bool value=\"true\" />\n")-  VBool False ->-    pure (indent depth <> "<bool value=\"false\" />\n")-  VNull ->-    pure (indent depth <> "<null />\n")-  VPath p ->-    pure (indent depth <> "<path value=" <> xmlQuote p <> " />\n")-  VList cl -> do-    let thunks = map Thunk (clistThunks cl)-    items <- mapM (force >=> valueToXML (depth + 1)) thunks-    pure (indent depth <> "<list>\n" <> T.concat items <> indent depth <> "</list>\n")-  VAttrs attrs -> do-    let pairs = attrSetToAscList attrs-    items <- mapM (attrToXML (depth + 1)) pairs-    pure (indent depth <> "<attrs>\n" <> T.concat items <> indent depth <> "</attrs>\n")-  VLambda {} ->-    pure (indent depth <> "<function />\n")-  VBuiltin _ _ ->-    pure (indent depth <> "<function />\n")-  VDerivation _ ->-    pure (indent depth <> "<derivation />\n")-  VCompiledRegex _ ->-    pure (indent depth <> "<function />\n")-  where-    attrToXML d (name, thunk) = do-      v <- force thunk-      inner <- valueToXML d v-      pure (indent d <> "<attr name=" <> xmlQuote name <> ">\n" <> inner <> indent d <> "</attr>\n")--indent :: Int -> Text-indent n = T.replicate (n * 2) " "--xmlQuote :: Text -> Text-xmlQuote s = "\"" <> T.concatMap escapeChar s <> "\""-  where-    escapeChar '<' = "&lt;"-    escapeChar '>' = "&gt;"-    escapeChar '&' = "&amp;"-    escapeChar '"' = "&quot;"-    escapeChar c = T.singleton c---- ------------------------------------------------------------------------------ Builtin implementations - builtins.path--- ------------------------------------------------------------------------------- | @builtins.path { path; name?; filter?; sha256?; recursive?; }@------ Copy a path to the store and return the store path as a string with--- context.  @name@ defaults to the basename of @path@.  @filter@ is--- accepted but not yet applied (copies everything).-builtinPath :: (MonadEval m) => NixValue -> m NixValue-builtinPath (VAttrs attrs) = do-  pathStr <- forceAttrStr "builtins.path" "path" attrs-  nameOverride <- forceOptionalAttrStr attrs "name"-  let name = fromMaybe (extractBaseName pathStr) nameOverride-  storePathText <- copyPathToStore pathStr name-  -- Parse the store path to construct proper SCPlain context-  case parseStorePath defaultStoreDir storePathText of-    Just sp -> pure (VStr storePathText (plainContext sp))-    Nothing -> pure (VStr storePathText emptyContext)-builtinPath other =-  throwEvalError ("builtins.path: expected an attribute set, got " <> typeName other)---- | Extract the last path component from a path string.-extractBaseName :: Text -> Text-extractBaseName path =-  let stripped = T.dropWhileEnd (\c -> c == '/' || c == '\\') path-   in case T.breakOnEnd "/" stripped of-        ("", _) -> case T.breakOnEnd "\\" stripped of-          ("", _) -> stripped-          (_, name) -> name-        (_, name) -> name---- ------------------------------------------------------------------------------ Builtin implementations - filterSource--- ------------------------------------------------------------------------------- | @builtins.filterSource filter path@ - copy a path to the store,--- filtering entries via a predicate.  The filter function receives--- @(path, type)@ where type is @"regular"@, @"directory"@, @"symlink"@,--- or @"unknown"@.-builtinFilterSource :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinFilterSource _filterFn (VPath _path) =-  throwEvalError "builtins.filterSource: not yet implemented (requires store integration)"-builtinFilterSource _filterFn (VStr _path _) =-  throwEvalError "builtins.filterSource: not yet implemented (requires store integration)"-builtinFilterSource _ other =-  throwEvalError ("builtins.filterSource: expected a path, got " <> typeName other)+{-# LANGUAGE TupleSections #-}++-- | Nix expression evaluator.+--+-- Nix evaluation is LAZY.  Attribute set members and list elements+-- are stored as thunks and only forced when their value is demanded.+-- Function arguments are likewise thunked - @(x: 1) (throw "boom")@+-- returns @1@ because @x@ is never referenced.+--+-- The evaluator maintains an environment ('Env') that maps variable+-- names to thunks.  @let@, @with@, function application, and+-- recursive attribute sets all extend the environment.+module Nix.Eval+  ( -- * Values (re-exported from Types)+    NixValue (..),+    CompiledRegex (..),+    Thunk (..),++    -- * Attribute sets (re-exported from Types)+    AttrSet (..),+    CAttrSet,+    attrSetFromMap,+    attrSetLookup,+    attrSetKeys,+    attrSetToMap,+    attrSetToAscList,+    attrSetMember,+    attrSetElems,+    attrSetNull,+    attrSetRemoveKeys,+    attrSetSize,++    -- * String context (re-exported from Types)+    StringContextElement (..),+    StringContext (..),+    emptyContext,+    mkStr,++    -- * Environment (re-exported from Types)+    Env (..),+    emptyEnv,++    -- * Evaluation monad (re-exported from Types)+    MonadEval (..),+    PureEval,+    runPureEval,++    -- * Evaluation+    eval,+    evalBytecode,+    force,++    -- * Helpers (for Builtins)+    typeName,+    evaluated,+    readThunkValue,++    -- * Fetcher transport validation (pure, exported for tests)+    checkGitUrl,+    checkGitRef,+    checkGitRev,++    -- * Remembered fetches (pure, exported for tests)+    FetchCache (..),+    fetchCacheKey,+    encodeFetchCache,+    decodeFetchCache,++    -- * Builtin registry+    BuiltinDef (..),+    builtinRegistry,+    builtinNames,++    -- * Platform+    currentSystemStr,+  )+where++import Control.Monad (foldM, forM_, unless, void, when, (>=>))+import qualified Crypto.Hash as CH+import qualified Data.Array as Array+import Data.Bits (complement, xor, (.&.), (.|.))+import qualified Data.ByteArray as BA+import qualified Data.ByteString as BS+import qualified Data.ByteString.Char8 as BC+import Data.Char (chr, digitToInt, isAsciiLower, isAsciiUpper, isDigit, isHexDigit, isOctDigit, ord)+import Data.IORef (IORef, atomicModifyIORef', newIORef)+import Data.Int (Int64)+import Data.List (find, partition, sort)+import Data.Map.Strict (Map)+import qualified Data.Map.Strict as Map+import Data.Maybe (catMaybes, fromMaybe, isJust, isNothing, listToMaybe)+import Data.Sequence (Seq (..))+import qualified Data.Sequence as Seq+import qualified Data.Set as Set+import Data.Text (Text)+import qualified Data.Text as T+import qualified Data.Text.Encoding as TE+import qualified Data.Text.Read as TR+import Data.Time.Clock.POSIX (posixSecondsToUTCTime)+import Data.Time.Format (defaultTimeLocale, formatTime)+import Data.Word (Word32, Word64, Word8)+import Foreign.Ptr (Ptr, castPtr, nullPtr, ptrToWordPtr, wordPtrToPtr)+import Foreign.Storable (peekElemOff, pokeElemOff)+import Nix.Derivation (Derivation (..), DerivationOutput (..), textToPlatform, toATerm, toATermForHash)+import Nix.Eval.CBytecode (cbcArg1, cbcArg2, cbcArg3, cbcCountedPayload, cbcData, cbcFlags, cbcOpcode, cbcShortArg, pattern OpApp, pattern OpAssert, pattern OpAttrs, pattern OpBinary, pattern OpHasAttr, pattern OpIf, pattern OpIndStr, pattern OpLambda, pattern OpLet, pattern OpList, pattern OpLitBool, pattern OpLitFloat, pattern OpLitInt, pattern OpLitNull, pattern OpLitPath, pattern OpLitUri, pattern OpPathStr, pattern OpResolvedVar, pattern OpSearchPath, pattern OpSelect, pattern OpStr, pattern OpUnary, pattern OpVar, pattern OpWith, pattern OpWithVar)+import Nix.Eval.CEnv (cenvPushWith)+import Nix.Eval.CList (CList (..), clistGet)+import Nix.Eval.CThunk (CThunkPtr)+import Nix.Eval.CanonPath (canonBaseName, canonDirName, canonPathValue)+import Nix.Eval.Compile (BcAttrKey (..), BcBinding (..), compileExpr, decodeBcBindings, decodeBcCaptureInfo, decodeBcFormals, reassembleDouble, reassembleInt64)+import Nix.Eval.Context (extractAllOutputRefs, extractInputDrvs, extractInputSrcs, plainContext)+import Nix.Eval.Operator (checkedAdd, checkedMul, checkedSub, evalBinary, evalUnary, nixCompare, nixEqual)+import Nix.Eval.StringInterp (coerceToString, formatJsonFloat, formatNixFloat, formatXmlFloat, stripIndentedChunks)+import Nix.Eval.Symbol (Symbol (..), symbolBytes, symbolText)+import Nix.Eval.Types+  ( AttrSet (..),+    CAttrSet,+    CompiledRegex (..),+    Env (..),+    EvalFormal (..),+    EvalFormals (..),+    MonadEval (..),+    NixValue (..),+    PureEval,+    StringContext (..),+    StringContextElement (..),+    Thunk (..),+    allocCSlots,+    attrSetElems,+    attrSetFromMap,+    attrSetKeys,+    attrSetLookup,+    attrSetMapWithKey,+    attrSetMember,+    attrSetNull,+    attrSetRemoveKeys,+    attrSetSize,+    attrSetToAscList,+    attrSetToMap,+    buildCAttrSetKeys,+    buildCSlots,+    bytesToTextLossy,+    cheapThunkBc,+    checkedCPtr,+    clistFromThunks,+    clistLen,+    clistThunks,+    emptyContext,+    emptyEnv,+    envFromSlots,+    envLookup,+    envLookupResolved,+    envWithScopesRaw,+    evaluated,+    fillCAttrSetValues,+    fillCSlots,+    mkStr,+    mkStrBytes,+    mkSyntheticThunk,+    mkThunk,+    mkThunkBc,+    newCEnv,+    newMinimalEnv,+    readThunkValue,+    runPureEval,+    storePathOrThrow,+    thunkToCPtr,+    typeName,+    withScopesForCapture,+  )+import Nix.Expr.Types+  ( AttrKey (..),+    BinaryOp (..),+    CaptureInfo (..),+    Expr (..),+    NixAtom (..),+    UnaryOp (..),+  )+import Nix.Hash (base64HashLen, bytesToHexText, hashAlgoBytes, hashPlaceholder, hexHashLen, hexToBytes, makeFixedOutputPath, makeOutputPath, makeTextPath, nix32HashLen, sha256Digest, sha256Hex)+import Nix.Store.Path (StorePath (spName), StorePathNameError (..), checkStorePathName, defaultStoreDir, defaultStoreDirText, parseStorePath, parseStorePathBaseName, storePathNameErrorText, storePathNameReasonText, storePathToText)+import Nix.Store.Path.Internal (maskedOutputPath)+import qualified NovaCache.Base32 as Nix32+import qualified NovaCache.Base64 as B64+import qualified NovaCache.NAR as NAR+import System.IO.Unsafe (unsafePerformIO)+import qualified System.Info+import Text.Regex.TDFA (matchAllText)+import qualified Text.Regex.TDFA as RE+import Text.Regex.TDFA.ByteString ()++-- | Evaluate a Nix expression in an environment.+-- Compiles the expression to bytecode and dispatches to 'evalBytecode'.+eval :: (MonadEval m) => Env -> Expr -> m NixValue+eval env expr =+  let bcIdx = unsafePerformIO (compileExpr expr)+   in evalBytecode env bcIdx++-- | Force a thunk to a value.+--+-- Delegates to 'forceThunk' which is a 'MonadEval' method - this+-- allows IO evaluators to implement memoization (caching the result+-- after the first force) while pure evaluators simply re-evaluate.+force :: (MonadEval m) => Thunk -> m NixValue+force = forceThunk evalBytecode++-- | Strict UTF-8 decode at a Text-typed boundary (attr names, filesystem+-- paths, algorithm names, ...).  A Nix string is a byte string; where the+-- implementation needs 'Text', invalid UTF-8 is a clean eval error - never+-- a lossy replacement, which would smuggle a DIFFERENT string through an+-- identity-bearing boundary.+decodedText :: (MonadEval m) => Text -> BS.ByteString -> m Text+decodedText what bytes = case TE.decodeUtf8' bytes of+  Right t -> pure t+  Left _ -> throwEvalError (what <> ": invalid UTF-8 in string")++-- | Evaluate a bytecode instruction by index.+-- This is the primary evaluator - reads opcodes from the C bytecode+-- store and dispatches.  All recursive evaluation goes through this+-- function, never through 'eval' directly.+evalBytecode :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBytecode env bcIdx =+  let opcode = unsafePerformIO (cbcOpcode bcIdx)+   in case opcode of+        OpLitInt ->+          let lo = unsafePerformIO (cbcArg1 bcIdx)+              hi = unsafePerformIO (cbcArg2 bcIdx)+           in pure (VInt (reassembleInt64 lo hi))+        OpLitFloat ->+          let lo = unsafePerformIO (cbcArg1 bcIdx)+              hi = unsafePerformIO (cbcArg2 bcIdx)+           in pure (VFloat (reassembleDouble lo hi))+        OpLitBool ->+          let flag = unsafePerformIO (cbcShortArg bcIdx)+           in pure (VBool (flag /= 0))+        OpLitNull -> pure VNull+        OpLitUri ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+           in pure (mkStrBytes (symbolBytes (Symbol sym)))+        OpLitPath ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+           in VPath <$> resolvePathLiteral (symbolText (Symbol sym))+        OpStr -> evalBcStr env bcIdx+        OpIndStr -> evalBcIndStr env bcIdx+        OpPathStr -> evalBcPathStr env bcIdx+        OpVar ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+           in evalVar env (symbolText (Symbol sym))+        OpWithVar ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+              name = symbolText (Symbol sym)+           in evalWithVar env name+        OpResolvedVar ->+          let level = fromIntegral (unsafePerformIO (cbcArg1 bcIdx))+              idx = fromIntegral (unsafePerformIO (cbcArg2 bcIdx))+           in force (envLookupResolved level idx env)+        OpAttrs -> evalBcAttrs env bcIdx+        OpList -> evalBcList env bcIdx+        OpSelect -> evalBcSelect env bcIdx+        OpHasAttr -> evalBcHasAttr env bcIdx+        OpApp -> evalBcApp env bcIdx+        OpLambda -> evalBcLambda env bcIdx+        OpLet -> evalBcLet env bcIdx+        OpIf ->+          let condIdx = unsafePerformIO (cbcArg1 bcIdx)+              thenIdx = unsafePerformIO (cbcArg2 bcIdx)+              elseIdx = unsafePerformIO (cbcArg3 bcIdx)+           in do+                condVal <- evalBytecode env condIdx+                case condVal of+                  VBool True -> evalBytecode env thenIdx+                  VBool False -> evalBytecode env elseIdx+                  _ -> throwEvalError ("'if' condition must be a Boolean, got " <> typeName condVal)+        OpWith ->+          let scopeIdx = unsafePerformIO (cbcArg1 bcIdx)+              bodyIdx = unsafePerformIO (cbcArg2 bcIdx)+              -- Lazy with: defer forcing the scope until a WITH_VAR lookup+              -- actually needs it.  This is critical for nixpkgs where+              -- all-packages.nix uses `with pkgs;` inside a fixpoint -+              -- eagerly forcing the scope would blackhole.+              scopeThunk = cheapThunkBc env scopeIdx+           in evalBytecode (pushLazyWithScope scopeThunk env) bodyIdx+        OpAssert ->+          let condIdx = unsafePerformIO (cbcArg1 bcIdx)+              bodyIdx = unsafePerformIO (cbcArg2 bcIdx)+           in do+                condVal <- evalBytecode env condIdx+                case condVal of+                  VBool True -> evalBytecode env bodyIdx+                  -- A failed assert is catchable by tryEval (upstream+                  -- AssertionError); a non-bool condition is a type error.+                  VBool False -> throwCatchableError "assertion failed"+                  _ -> throwEvalError ("assertion condition must be a Boolean, got " <> typeName condVal)+        OpUnary ->+          let flags_ = unsafePerformIO (cbcFlags bcIdx)+              operandIdx = unsafePerformIO (cbcArg1 bcIdx)+           in do+                val <- evalBytecode env operandIdx+                evalUnary (decodeUnaryOp flags_) val+        OpBinary -> evalBcBinary env bcIdx+        OpSearchPath ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+           in evalSearchPath env (symbolText (Symbol sym))+        _ -> throwEvalError "evalBytecode: unknown opcode"++-- ---------------------------------------------------------------------------+-- Bytecode helpers+-- ---------------------------------------------------------------------------++-- | Decode a UnaryOp from bytecode flags.+decodeUnaryOp :: Word8 -> UnaryOp+decodeUnaryOp 0 = OpNot+decodeUnaryOp 1 = OpNegate+-- Unreachable: the tag is written by Nix.Eval.Compile's encodeUnaryOp, which+-- only emits 0 or 1.+decodeUnaryOp n = error ("decodeUnaryOp: unknown tag " <> show n)++-- | Decode a BinaryOp from bytecode flags.+decodeBinaryOp :: Word8 -> BinaryOp+decodeBinaryOp 0 = OpAdd+decodeBinaryOp 1 = OpSub+decodeBinaryOp 2 = OpMul+decodeBinaryOp 3 = OpDiv+decodeBinaryOp 4 = OpAnd+decodeBinaryOp 5 = OpOr+decodeBinaryOp 6 = OpImpl+decodeBinaryOp 7 = OpEq+decodeBinaryOp 8 = OpNeq+decodeBinaryOp 9 = OpLt+decodeBinaryOp 10 = OpLte+decodeBinaryOp 11 = OpGt+decodeBinaryOp 12 = OpGte+decodeBinaryOp 13 = OpConcat+decodeBinaryOp 14 = OpUpdate+-- Unreachable: the tag is written by Nix.Eval.Compile's encodeBinaryOp, which+-- only emits 0..14.+decodeBinaryOp n = error ("decodeBinaryOp: unknown tag " <> show n)++-- | Evaluate a binary operation from bytecode, with short-circuit+-- support for &&, ||, ->.+evalBcBinary :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcBinary env bcIdx0 =+  let flags_ = unsafePerformIO (cbcFlags bcIdx0)+      leftIdx = unsafePerformIO (cbcArg1 bcIdx0)+      rightIdx = unsafePerformIO (cbcArg2 bcIdx0)+      op = decodeBinaryOp flags_+   in case op of+        OpAnd -> evalShortCircuitAnd env leftIdx rightIdx+        OpOr -> evalShortCircuitOr env leftIdx rightIdx+        OpImpl -> evalShortCircuitImpl env leftIdx rightIdx+        OpAdd -> do+          leftVal <- evalBytecode env leftIdx+          rightVal <- evalBytecode env rightIdx+          evalAddWithCoercion leftVal rightVal+        _ -> do+          leftVal <- evalBytecode env leftIdx+          rightVal <- evalBytecode env rightIdx+          evalBinary force op leftVal rightVal++-- | Addition with string coercion fallback, matching C++ Nix behavior.+-- C++ Nix's ExprOpAdd falls through to concatStrings when operands+-- are not both numeric and neither is a path.  concatStrings calls+-- coerceToString on each part, which handles attrsets via outPath.+evalAddWithCoercion :: (MonadEval m) => NixValue -> NixValue -> m NixValue+evalAddWithCoercion left right = case (left, right) of+  -- Numeric: direct arithmetic (matches C++ Nix priority)+  (VFloat _, _) -> evalBinary force OpAdd left right+  (_, VFloat _) -> evalBinary force OpAdd left right+  (VInt _, VInt _) -> evalBinary force OpAdd left right+  -- Path + path: text concatenation, canonicalized - the joined spelling+  -- (dot segments, doubled separators) never survives into the value, as+  -- upstream (CanonPath on the concatenated text).+  (VPath a, VPath b) -> pure (VPath (canonPathValue (a <> b)))+  -- Path + coercible: the result stays a path, the right side coerces+  -- WITHOUT a store copy, and a right side carrying string context is an+  -- error, as upstream (a store-path reference cannot survive inside a+  -- path value).  Paths are Text in nova, so the appended bytes must+  -- decode; invalid UTF-8 cannot form a filesystem path here.+  (VPath a, _) -> do+    (rightStr, rightCtx) <- coerceAddOperand right+    if rightCtx == emptyContext+      then do+        appended <- decodedText "path concatenation" rightStr+        pure (VPath (canonPathValue (a <> appended)))+      else throwEvalError "cannot append a string with context (a store-path reference) to a path"+  -- Strings: direct concat.+  (VStr {}, VStr {}) -> evalBinary force OpAdd left right+  -- Otherwise: string concatenation with STRICT coercion (Nix coerceMore=false)+  -- - only strings, sets with __toString/outPath, and paths coerce; numbers,+  -- bools, null, lists, and functions are type errors, matching C++ Nix's `+`.+  -- A path on the right of a string is COPIED to the store (upstream+  -- copyToStore=true), so "x" + ./src concatenates the source's store path+  -- and carries it in the result's context.+  _ -> do+    (leftStr, leftCtx) <- coerceAddOperand left+    (rightStr, rightCtx) <- coerceAddOperand right+    pure (VStr (leftStr <> rightStr) (leftCtx <> rightCtx))++-- | Strict string coercion for the @+@ operator (Nix @coerceMore = false@):+-- strings, sets with @__toString@\/@outPath@, and paths (copied to the+-- store, carrying context) coerce; numbers, booleans, null, lists, and+-- functions are type errors.+coerceAddOperand :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)+coerceAddOperand v@(VStr {}) = coerceToString False force applyValue coercePathToStore v+coerceAddOperand v@(VAttrs {}) = coerceToString False force applyValue coercePathToStore v+coerceAddOperand v@(VPath _) = coerceToStoreString v+coerceAddOperand v =+  throwEvalError ("cannot coerce " <> typeName v <> " to a string with the + operator")++-- | Bytecode short-circuit &&+evalShortCircuitAnd :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue+evalShortCircuitAnd env leftIdx rightIdx = do+  leftVal <- evalBytecode env leftIdx+  case leftVal of+    VBool False -> pure (VBool False)+    VBool True -> do+      rightVal <- evalBytecode env rightIdx+      case rightVal of+        VBool _ -> pure rightVal+        _ -> throwEvalError ("second operand of && must be a Boolean, got " <> typeName rightVal)+    _ -> throwEvalError ("first operand of && must be a Boolean, got " <> typeName leftVal)++-- | Bytecode short-circuit ||+evalShortCircuitOr :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue+evalShortCircuitOr env leftIdx rightIdx = do+  leftVal <- evalBytecode env leftIdx+  case leftVal of+    VBool True -> pure (VBool True)+    VBool False -> do+      rightVal <- evalBytecode env rightIdx+      case rightVal of+        VBool _ -> pure rightVal+        _ -> throwEvalError ("second operand of || must be a Boolean, got " <> typeName rightVal)+    _ -> throwEvalError ("first operand of || must be a Boolean, got " <> typeName leftVal)++-- | Bytecode short-circuit ->+evalShortCircuitImpl :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue+evalShortCircuitImpl env leftIdx rightIdx = do+  leftVal <- evalBytecode env leftIdx+  case leftVal of+    VBool False -> pure (VBool True)+    VBool True -> do+      rightVal <- evalBytecode env rightIdx+      case rightVal of+        VBool _ -> pure rightVal+        _ -> throwEvalError ("second operand of -> must be a Boolean, got " <> typeName rightVal)+    _ -> throwEvalError ("first operand of -> must be a Boolean, got " <> typeName leftVal)++-- | Evaluate a string literal from bytecode data buffer.+evalBcStr :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcStr env bcIdx0 = do+  let (count, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+  chunks <- evalBcStringParts env count dataOff+  pure (VStr (BS.concat [t | (_, t, _) <- chunks]) (mconcat [c | (_, _, c) <- chunks]))++-- | Evaluate an indented string literal from bytecode data buffer.  The common+-- indentation is stripped from the LITERAL chunks before concatenation, so an+-- interpolated multi-line value cannot drag the computed indent down - matching+-- C++ Nix.+evalBcIndStr :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcIndStr env bcIdx0 = do+  let (count, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+  chunks <- evalBcStringParts env count dataOff+  let (text, ctx) = stripIndentedChunks chunks+  pure (VStr text ctx)++-- | Evaluate an interpolated path literal from the bytecode data+-- buffer.  The pieces concatenate with no separator, each interpolated+-- value coerced as a path segment, and the whole resolves like a plain+-- path literal - absolutized if still relative, @~\/@ expanded, and+-- canonicalized, so a @..@ or a slash arriving at runtime collapses+-- textually, matching upstream (verified against nix-instantiate+-- 2.33.2: @let v = "a\/.."; in .\/${v}@ is the base directory itself).+evalBcPathStr :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcPathStr env bcIdx0 = do+  let (count, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+  chunks <- evalBcPathParts env count dataOff+  text <- decodedText "path literal" (BS.concat chunks)+  VPath <$> resolvePathLiteral text++-- | The path-segment walk under 'evalBcPathStr': literal pieces pass+-- through; an interpolated value coerces with upstream's path-segment+-- rules - a context-free string passes, a path contributes its text+-- WITHOUT a store copy (unlike string interpolation, which copies),+-- and a string carrying store-path context is refused, since a path+-- value has nowhere to keep the context that holds a store reference+-- alive.  All three observed from nix-instantiate 2.33.2.+evalBcPathParts :: (MonadEval m) => Env -> Int -> Word32 -> m [BS.ByteString]+evalBcPathParts _ 0 _ = pure []+evalBcPathParts env n off = do+  let tag = unsafePerformIO (cbcData off)+      val = unsafePerformIO (cbcData (off + 1))+  chunk <- case tag of+    0 -> pure (symbolBytes (Symbol val))+    _ -> do+      v <- evalBytecode env val+      (txt, ctx) <- coerceToString False force applyValue coercePathVerbatim v+      unless (ctx == emptyContext) $+        throwEvalError "a string that refers to a store path cannot be appended to a path"+      pure txt+  rest <- evalBcPathParts env (n - 1) (off + 2)+  pure (chunk : rest)++-- | Evaluate string parts from the bytecode data buffer.  Each part is two+-- words: (tag, value).  tag=0 means literal (value = symbol), tag=1 means+-- interpolation (value = bc_idx).  The 'Bool' marks literal (@True@) vs+-- interpolated (@False@) so indented strings strip only the literals.+evalBcStringParts :: (MonadEval m) => Env -> Int -> Word32 -> m [(Bool, BS.ByteString, StringContext)]+evalBcStringParts _ 0 _ = pure []+evalBcStringParts env n off = do+  let tag = unsafePerformIO (cbcData off)+      val = unsafePerformIO (cbcData (off + 1))+  chunk <- case tag of+    0 -> pure (True, symbolBytes (Symbol val), emptyContext)+    _ -> do+      v <- evalBytecode env val+      (txt, ctx) <- coerceToStringInterp v+      pure (False, txt, ctx)+  rest <- evalBcStringParts env (n - 1) (off + 2)+  pure (chunk : rest)++-- | Evaluate a list from bytecode data buffer.+evalBcList :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcList env bcIdx0 =+  let (count, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+      readChildren 0 _ = []+      readChildren n off =+        let childIdx = unsafePerformIO (cbcData off)+         in cheapThunkBc env childIdx : readChildren (n - 1) (off + 1)+   in pure (VList (clistFromThunks (map thunkToCPtr (readChildren count dataOff))))++-- | Evaluate a function application from bytecode.+evalBcApp :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcApp env bcIdx0 = do+  let funcIdx = unsafePerformIO (cbcArg1 bcIdx0)+      argIdx = unsafePerformIO (cbcArg2 bcIdx0)+  funcVal <- evalBytecode env funcIdx+  case funcVal of+    VLambda closureEnv formals bodyBcIdx -> do+      let argThunk = cheapThunkBc env argIdx+      extEnv <- matchFormals closureEnv formals argThunk+      evalBytecode extEnv bodyBcIdx+    VBuiltin "tryEval" [] -> tryEvalAction (evalBytecode env argIdx)+    VBuiltin name accArgs -> do+      argVal <- evalBytecode env argIdx+      applyBuiltin name accArgs argVal+    VAttrs attrs+      | Just functorThunk <- attrSetLookup "__functor" attrs -> do+          functor <- force functorThunk+          partiallyApplied <- applyValue functor funcVal+          -- Maintain laziness: thunk the argument for lambdas, like+          -- the normal VLambda path above.  Builtins force anyway.+          case partiallyApplied of+            VLambda closureEnv formals bodyBcIdx -> do+              let argThunk = cheapThunkBc env argIdx+              extEnv <- matchFormals closureEnv formals argThunk+              evalBytecode extEnv bodyBcIdx+            -- A functor returning tryEval keeps the catch around the+            -- argument's evaluation, like the direct arm above.+            VBuiltin "tryEval" [] -> tryEvalAction (evalBytecode env argIdx)+            _ -> do+              argVal <- evalBytecode env argIdx+              applyValue partiallyApplied argVal+    _ -> throwEvalError ("attempt to call " <> typeName funcVal <> ", which is not a function")++-- | @builtins.tryEval@ over an argument's evaluation: @{ success, value }@+-- with catchable errors (throw, failed assert - the only kinds+-- 'catchEvalError' recovers) mapped to @success = false@.  The catch must+-- wrap the ARGUMENT'S EVALUATION: an application path that forces the+-- argument before dispatching here has already let the throw escape.+-- Callers holding an already-forced value pass @pure val@ - nothing left+-- to catch, so it success-wraps, exactly as upstream treats a value in+-- WHNF.+tryEvalAction :: (MonadEval m) => m NixValue -> m NixValue+tryEvalAction act = do+  result <- catchEvalError act+  pure $ case result of+    Right val ->+      VAttrs+        ( attrSetFromMap $+            Map.fromList+              [ ("success", evaluated (VBool True)),+                ("value", evaluated val)+              ]+        )+    Left _ ->+      VAttrs+        ( attrSetFromMap $+            Map.fromList+              [ ("success", evaluated (VBool False)),+                ("value", evaluated (VBool False))+              ]+        )++-- | Evaluate a lambda literal from bytecode - returns VLambda.+evalBcLambda :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcLambda env bcIdx0 =+  let flags_ = unsafePerformIO (cbcFlags bcIdx0)+      formalsOff = unsafePerformIO (cbcArg1 bcIdx0)+      bodyBcIdx = unsafePerformIO (cbcArg2 bcIdx0)+      captureOff = unsafePerformIO (cbcArg3 bcIdx0)+      formals = unsafePerformIO (decodeBcFormals flags_ formalsOff)+      captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)+   in pure (VLambda (buildCaptureEnv env captureInfo) formals bodyBcIdx)++-- | Evaluate a select expression from bytecode.+evalBcSelect :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcSelect env bcIdx0 = do+  let hasDef = unsafePerformIO (cbcFlags bcIdx0) /= 0+      targetIdx = unsafePerformIO (cbcArg1 bcIdx0)+      (pathLen, pathOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg2 bcIdx0)+      defIdx = unsafePerformIO (cbcArg3 bcIdx0)+  targetVal <- evalBytecode env targetIdx+  result <- walkBcAttrPath env pathLen pathOff targetVal+  case result of+    Just val -> pure val+    Nothing+      | hasDef -> evalBytecode env defIdx+      | otherwise -> do+          let pathName = collectBcAttrPathNames pathLen pathOff+              targetKeys = case targetVal of+                VAttrs attrs -> T.intercalate ", " (take 20 (attrSetKeys attrs))+                _ -> ""+          throwEvalError ("attribute '" <> pathName <> "' not found in " <> typeName targetVal <> " {" <> targetKeys <> "}")++-- | Evaluate a hasAttr expression from bytecode.+evalBcHasAttr :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcHasAttr env bcIdx0 = do+  let targetIdx = unsafePerformIO (cbcArg1 bcIdx0)+      (pathLen, pathOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg2 bcIdx0)+  targetVal <- evalBytecode env targetIdx+  VBool <$> hasBcAttrPath env pathLen pathOff targetVal++-- | Collect static attribute path names for error reporting.+collectBcAttrPathNames :: Int -> Word32 -> Text+collectBcAttrPathNames pathLen pathOff = T.intercalate "." (go pathLen pathOff)+  where+    go 0 _ = []+    go n off =+      let isExpr = unsafePerformIO (cbcData off)+          keyVal = unsafePerformIO (cbcData (off + 1))+          name = if isExpr /= 0 then "<expr>" else symbolText (Symbol keyVal)+       in name : go (n - 1) (off + 2)++-- | Resolve one attr-path element (two words at @off@) to its key text.+-- A dynamic key must produce a string - null included, as upstream's+-- select and has-attr key coercion rejects null with a type error.+resolveBcAttrKey :: (MonadEval m) => Env -> Word32 -> m Text+resolveBcAttrKey env off = do+  let isExpr = unsafePerformIO (cbcData off)+      keyVal = unsafePerformIO (cbcData (off + 1))+  if isExpr /= 0+    then do+      keyResult <- evalBytecode env keyVal+      case keyResult of+        VStr s _ -> decodedText "dynamic attribute key" s+        _ -> throwEvalError ("dynamic attribute key must be a string, got " <> typeName keyResult)+    else pure (symbolText (Symbol keyVal))++-- | Walk an attribute path stored in the bytecode data buffer.+-- Each element is two words: (is_expr, key_or_bc_idx).  Every matched+-- element is forced - select needs the terminal value, and the walk+-- needs each intermediate to be a set.+walkBcAttrPath :: (MonadEval m) => Env -> Int -> Word32 -> NixValue -> m (Maybe NixValue)+walkBcAttrPath _ 0 _ val = pure (Just val)+walkBcAttrPath env n off val = case val of+  VAttrs attrs -> do+    key <- resolveBcAttrKey env off+    case attrSetLookup key attrs of+      Just thunk -> do+        inner <- force thunk+        walkBcAttrPath env (n - 1) (off + 2) inner+      Nothing -> pure Nothing+  -- Non-attrset: attribute path cannot continue.  Return Nothing so+  -- that callers with a default (``a.b or def'') can handle it+  -- gracefully, matching C++ Nix behaviour.+  _ -> pure Nothing++-- | Presence walk for has-attr: intermediates force (the walk must reach+-- a set), but the terminal element is a membership check only - upstream+-- ``a ? b.c`` never evaluates the final attribute's value.+hasBcAttrPath :: (MonadEval m) => Env -> Int -> Word32 -> NixValue -> m Bool+hasBcAttrPath _ 0 _ _ = pure True+hasBcAttrPath env n off val = case val of+  VAttrs attrs -> do+    key <- resolveBcAttrKey env off+    case attrSetLookup key attrs of+      Just thunk+        | n == 1 -> pure True+        | otherwise -> do+            inner <- force thunk+            hasBcAttrPath env (n - 1) (off + 2) inner+      Nothing -> pure False+  _ -> pure False++-- | Evaluate attribute set from bytecode.+evalBcAttrs :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcAttrs env bcIdx0 = do+  let isRec = unsafePerformIO (cbcFlags bcIdx0) /= 0+      (bindCount, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+      captureOff = unsafePerformIO (cbcArg2 bcIdx0)+      bindings = unsafePerformIO (decodeBcBindings bindCount dataOff)+  if isRec+    then do+      let captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)+      evalBcRecAttrs env bindings captureInfo+    else evalBcNonRecAttrs env bindings++-- | Evaluate a non-recursive attr set from bytecode bindings.+--+-- Values go through 'cheapThunkBc', so a constant or a variable already in+-- scope becomes the value rather than a thunk over it, which is what+-- upstream's non-recursive @ExprAttrs::eval@ does through @maybeThunk@.  The+-- env here is the enclosing one and is fully built, so reading a variable+-- out of it now is safe; the recursive and @let@ paths knot-tie their own+-- frame and cannot make the same shortcut.+evalBcNonRecAttrs :: (MonadEval m) => Env -> [BcBinding] -> m NixValue+evalBcNonRecAttrs env bindings = do+  thunkMap <- buildBcThunkMap cheapThunkBc env bindings+  pure (VAttrs (attrSetFromMap thunkMap))++-- | Build a let\/rec frame env, sharing the parent-chain and with-scope+-- plumbing otherwise repeated across the positional and dynamic paths.  The+-- frame's own bindings are positional slots (@slots@\/@slotCount@) or a lazy+-- name-table @scope@; the parent and with-scopes come from the enclosing @env@+-- and @captureInfo@.+newFrameEnv :: Env -> CaptureInfo -> Ptr CThunkPtr -> Int -> Maybe AttrSet -> Env+newFrameEnv env captureInfo slots slotCount scope =+  newCEnv slots slotCount scope (Just (buildCaptureEnv env captureInfo)) withArr withCount+  where+    (withArr, withCount) = case captureInfo of+      NoCaptureInfo -> envWithScopesRaw env+      Captures _ -> (nullPtr, 0)+      CapturesWithScopes _ -> withScopesForCapture env++-- | Evaluate a recursive attr set from bytecode bindings.+evalBcRecAttrs :: (MonadEval m) => Env -> [BcBinding] -> CaptureInfo -> m NixValue+evalBcRecAttrs env bindings captureInfo+  | allBcPositional bindings =+      -- Positional path: slots for variable lookup, CAttrSet for return.+      let slotCount = bcBindingSlotCount bindings+          slotsPtr = allocCSlots slotCount+          recEnv = newFrameEnv env captureInfo slotsPtr slotCount Nothing+          thunkList = buildBcSlotThunks recEnv env bindings+          filled = fillCSlots slotsPtr thunkList+          attrMap = buildBcAttrMapFromSlots bindings thunkList+       in filled `seq` pure (VAttrs (attrSetFromMap attrMap))+  | otherwise = do+      -- Dynamic-key path: the set has a ${dynamic} key or a nested a.b path, so+      -- names are not all known at compile time.  Not a corner-cutting fallback:+      -- it follows C++ Nix's env2 semantics.  The rec env holds the+      -- statically-named bindings as thunks, and the dynamic keys AND values are+      -- evaluated against it - so they can see static siblings and enclosing+      -- vars, but not another dynamic key.  The result is the static bindings+      -- plus the dynamic (name -> value) pairs.+      let scopeCset = buildCAttrSetKeys (bcBindingStaticKeys bindings)+          recEnv = newFrameEnv env captureInfo nullPtr 0 (Just (AttrSet scopeCset))+          (staticBs, dynBs) = partition bcBindingIsStatic bindings+      staticThunks <- buildBcThunkMap mkThunkBc recEnv staticBs+      let scopeFilled = fillCAttrSetValues scopeCset staticThunks+      dynThunks <- scopeFilled `seq` buildBcThunkMap mkThunkBc recEnv dynBs+      -- A dynamic key colliding with a static sibling is an eval error+      -- upstream ("dynamic attribute already defined"), never a merge.+      case Map.keys (Map.intersection dynThunks staticThunks) of+        (dupKey : _) -> throwEvalError ("dynamic attribute '" <> dupKey <> "' already defined")+        [] ->+          let allThunks = Map.union dynThunks staticThunks+              resultCset = buildCAttrSetKeys (Map.keys allThunks)+              filled = fillCAttrSetValues resultCset allThunks+           in filled `seq` pure (VAttrs (AttrSet resultCset))++-- | Evaluate a let expression from bytecode.+evalBcLet :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcLet env bcIdx0 = do+  let (bindCount, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+      bodyIdx = unsafePerformIO (cbcArg2 bcIdx0)+      captureOff = unsafePerformIO (cbcArg3 bcIdx0)+      bindings = unsafePerformIO (decodeBcBindings bindCount dataOff)+      captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)+  if allBcPositional bindings+    then do+      -- Positional path: slots for O(1) lookup.+      let slotCount = bcBindingSlotCount bindings+          slotsPtr = allocCSlots slotCount+          letEnv = newFrameEnv env captureInfo slotsPtr slotCount Nothing+          filled = fillCSlots slotsPtr (buildBcSlotThunks letEnv env bindings)+       in filled `seq` evalBytecode letEnv bodyIdx+    else do+      -- Dynamic path: a nested a.b binding (a dynamic top-level key is not valid+      -- in a let).  Every top-level key is therefore static; sub-keys and values+      -- resolve in the let env, which the body also sees.+      let cset = buildCAttrSetKeys (bcBindingStaticKeys bindings)+          letEnv = newFrameEnv env captureInfo nullPtr 0 (Just (AttrSet cset))+      thunkMap <- buildBcThunkMap mkThunkBc letEnv bindings+      let filled = fillCAttrSetValues cset thunkMap+       in filled `seq` evalBytecode letEnv bodyIdx++-- | Check if all bytecode bindings are single static keys (eligible for positional).+-- Must stay in sync with 'allStaticSingleKey' in 'Nix.Expr.Resolve'.+allBcPositional :: [BcBinding] -> Bool+allBcPositional = all isEligible+  where+    isEligible (BcNamed [BcStaticKey _] _) = True+    isEligible (BcInherit _) = True+    isEligible (BcInheritFrom _ _) = True+    isEligible _ = False++-- | Count positional slots for bytecode bindings.+-- Must stay in sync with 'lexicalScopeFromBindings' in 'Nix.Expr.Resolve'.+bcBindingSlotCount :: [BcBinding] -> Int+bcBindingSlotCount = foldl' countOne 0+  where+    countOne !acc (BcNamed [BcStaticKey _] _) = acc + 1+    countOne !acc (BcInherit syms) = acc + length syms+    countOne !acc (BcInheritFrom _ syms) = acc + length syms+    countOne !acc _ = acc++-- | Build thunks for positional bytecode bindings in declaration order.+buildBcSlotThunks :: Env -> Env -> [BcBinding] -> [Thunk]+buildBcSlotThunks recEnv outerEnv = concatMap slotThunk+  where+    slotThunk (BcNamed [BcStaticKey _] valBcIdx) =+      [mkThunkBc recEnv valBcIdx]+    slotThunk (BcInherit syms) =+      map (inheritLookup outerEnv . symbolText . Symbol) syms+    slotThunk (BcInheritFrom fromBcIdx syms) =+      -- inherit (from) x y z; becomes one thunk per name that selects from the from-expr.+      -- Each thunk gets a minimal env with the from-value at slot 0.+      let fromThunk = mkThunkBc recEnv fromBcIdx+          mkInheritThunk sym =+            let name = symbolText (Symbol sym)+                selectExpr = ESelect (EResolvedVar 0 0) [StaticKey name] Nothing+                (sp, sc) = buildCSlots [fromThunk]+                fromEnv = newMinimalEnv sp sc+             in mkSyntheticThunk fromEnv selectExpr+       in map mkInheritThunk syms+    -- Unreachable: allBcPositional guards this path.+    slotThunk _ = []++-- | Build attr map from slots for positional bytecode bindings.+buildBcAttrMapFromSlots :: [BcBinding] -> [Thunk] -> Map Text Thunk+buildBcAttrMapFromSlots bindings thunks = go bindings thunks Map.empty+  where+    go [] _ !acc = acc+    go (BcNamed [BcStaticKey sym] _ : bs) (t : ts) !acc =+      go bs ts (Map.insert (symbolText (Symbol sym)) t acc)+    go (BcInherit syms : bs) ts !acc =+      let (used, rest) = splitAt (length syms) ts+          accMerged = foldl' (\a (sym, t0) -> Map.insert (symbolText (Symbol sym)) t0 a) acc (zip syms used)+       in go bs rest accMerged+    go (BcInheritFrom _ syms : bs) ts !acc =+      let (used, rest) = splitAt (length syms) ts+          accMerged = foldl' (\a (sym, t0) -> Map.insert (symbolText (Symbol sym)) t0 a) acc (zip syms used)+       in go bs rest accMerged+    -- Unreachable: allBcPositional guards this path.+    go (_ : bs) ts !acc = go bs ts acc++-- | Build thunk map for bytecode attrs (non-rec or fallback rec path).+-- | Build the name-to-thunk map for a set of bindings.+--+-- How a value becomes a thunk is the caller's decision: a non-recursive+-- attr set can resolve constants and in-scope variables immediately, while a+-- frame that is still being tied has to defer everything, since the slots+-- the variables point at are not filled yet.+buildBcThunkMap :: (MonadEval m) => (Env -> Word32 -> Thunk) -> Env -> [BcBinding] -> m (Map Text Thunk)+buildBcThunkMap mkValueThunk thunkEnv = foldM addBinding Map.empty+  where+    addBinding acc (BcNamed keys valBcIdx) = do+      resolvedKeys <- mapM (resolveBcKey thunkEnv) keys+      case sequence resolvedKeys of+        Nothing -> pure acc -- null key -> skip+        Just [key] ->+          insertChecked acc key (mkValueThunk thunkEnv valBcIdx)+        Just path ->+          let nested = buildBcNestedAttr thunkEnv path valBcIdx+           in foldM (\a (k, t0) -> insertChecked a k t0) acc (Map.toList nested)+    addBinding acc (BcInherit syms) =+      foldM (\a sym -> let name = symbolText (Symbol sym) in insertChecked a name (inheritLookup thunkEnv name)) acc syms+    addBinding acc (BcInheritFrom fromBcIdx syms) =+      -- inherit (from) name selects name from the from-expr.+      -- Create a small env with the from value at slot 0, then a+      -- synthetic expression that selects name from slot 0.+      let addInheritFrom a sym =+            let name = symbolText (Symbol sym)+                selectExpr = ESelect (EResolvedVar 0 0) [StaticKey name] Nothing+                (sp, sc) = buildCSlots [mkThunkBc thunkEnv fromBcIdx]+                fromEnv = newMinimalEnv sp sc+             in insertChecked a name (mkSyntheticThunk fromEnv selectExpr)+       in foldM addInheritFrom acc syms++    -- The parser normalizes static keys to appear exactly once, so a+    -- collision here means an evaluated DYNAMIC key hit an existing+    -- attr - an eval error upstream, never a silent merge.+    insertChecked acc key thunk =+      case Map.lookup key acc of+        Nothing -> pure (Map.insert key thunk acc)+        Just _ -> throwEvalError ("dynamic attribute '" <> key <> "' already defined")++-- | Resolve a bytecode attr key to text.+resolveBcKey :: (MonadEval m) => Env -> BcAttrKey -> m (Maybe Text)+resolveBcKey _env (BcStaticKey sym) = pure (Just (symbolText (Symbol sym)))+resolveBcKey env (BcDynamicKey bcIdx0) = do+  val <- evalBytecode env bcIdx0+  case val of+    VStr s _ -> Just <$> decodedText "dynamic attribute key" s+    VNull -> pure Nothing+    _ -> throwEvalError ("dynamic attribute key must be a string, got " <> typeName val)++-- | Build a nested attribute structure from a resolved dotted path (bytecode).+buildBcNestedAttr :: Env -> [Text] -> Word32 -> Map Text Thunk+buildBcNestedAttr _thunkEnv [] _valBcIdx = Map.empty+buildBcNestedAttr thunkEnv [key] valBcIdx =+  Map.singleton key (mkThunkBc thunkEnv valBcIdx)+buildBcNestedAttr thunkEnv (key : rest) valBcIdx =+  Map.singleton key (evaluated (VAttrs (attrSetFromMap (buildBcNestedAttr thunkEnv rest valBcIdx))))++-- | Top-level keys knowable without evaluating any dynamic key: static keys+-- and inherited names.  These populate the rec env's name table while the+-- dynamic keys are evaluated, so a dynamic key can reference a static sibling+-- or an enclosing variable (matching C++ Nix's env2), but not another dynamic+-- key.+bcBindingStaticKeys :: [BcBinding] -> [Text]+bcBindingStaticKeys = concatMap oneBinding+  where+    oneBinding (BcNamed (BcStaticKey sym : _) _) = [symbolText (Symbol sym)]+    oneBinding (BcNamed _ _) = []+    oneBinding (BcInherit syms) = map (symbolText . Symbol) syms+    oneBinding (BcInheritFrom _ syms) = map (symbolText . Symbol) syms++-- | True when a binding's top-level key is known statically (a static key or an+-- inherit).  These bindings populate the rec env's name table (C++ Nix's env2);+-- a binding with a dynamic top-level key does not - it is added to the value.+bcBindingIsStatic :: BcBinding -> Bool+bcBindingIsStatic (BcNamed (BcStaticKey _ : _) _) = True+bcBindingIsStatic (BcNamed _ _) = False+bcBindingIsStatic (BcInherit _) = True+bcBindingIsStatic (BcInheritFrom _ _) = True++-- ---------------------------------------------------------------------------+-- Search paths (<nixpkgs>, <nixpkgs/lib>)+-- ---------------------------------------------------------------------------++-- | Evaluate a search path expression.+-- Desugars to @builtins.findFile builtins.nixPath "name"@ - exactly how+-- real Nix handles @\<name\>@ expressions.+evalSearchPath :: (MonadEval m) => Env -> Text -> m NixValue+evalSearchPath env name = do+  builtinsVal <- evalVar env "builtins"+  case builtinsVal of+    VAttrs builtinsAttrs ->+      case attrSetLookup "nixPath" builtinsAttrs of+        Just nixPathThunk -> do+          nixPathVal <- force nixPathThunk+          builtinFindFile nixPathVal (mkStr name)+        Nothing ->+          throwCatchableError ("file '" <> name <> "' was not found in the Nix search path")+    _ ->+      throwCatchableError ("file '" <> name <> "' was not found in the Nix search path")++-- ---------------------------------------------------------------------------+-- Variables+-- ---------------------------------------------------------------------------++evalVar :: (MonadEval m) => Env -> Text -> m NixValue+evalVar env name =+  case envLookup name env of+    Just thunk -> force thunk+    Nothing -> throwEvalError ("undefined variable '" <> name <> "'")++-- | Evaluate a with-scoped variable: check with-scopes first (innermost+-- to outermost), then fall back to the standard name-based lookup+-- (parent chain to builtins).  For trimmed envs ('CapturesWithScopes'),+-- the root scope is already appended to 'envWithScopes' so the+-- with-scope lookup finds builtins without needing a parent chain.+-- Supports both resolved (CAttrSet*) and lazy (CThunk*, tagged with bit 0)+-- with-scope entries.  Lazy entries are forced on first lookup and the+-- pointer is updated in place so subsequent lookups hit the resolved+-- attrset directly.+evalWithVar :: (MonadEval m) => Env -> Text -> m NixValue+evalWithVar env name =+  let (withArr, withCount) = envWithScopesRaw env+   in evalWithVarScopes env name withArr (fromIntegral withCount) 0++evalWithVarScopes :: (MonadEval m) => Env -> Text -> Ptr (Ptr ()) -> Int -> Int -> m NixValue+evalWithVarScopes env name withArr count idx+  | idx >= count = evalVar env name+  | otherwise = do+      let scopePtr = unsafePerformIO (peekElemOff withArr idx)+      if isLazyWithScope scopePtr+        then do+          -- Lazy with-scope: force the thunk to get the attrset+          let thunkPtr = untagWithScope scopePtr+          scopeVal <- force (Thunk thunkPtr)+          case scopeVal of+            VAttrs (AttrSet cset) -> do+              -- Cache: replace the tagged thunk pointer with the resolved+              -- attrset pointer so future lookups are fast.+              let resolvedPtr = castPtr cset+              seq (unsafePerformIO (pokeElemOff withArr idx resolvedPtr)) (pure ())+              case attrSetLookup name (AttrSet cset) of+                Just thunk -> force thunk+                Nothing -> evalWithVarScopes env name withArr count (idx + 1)+            _ -> throwEvalError ("'with' requires a set, got " <> typeName scopeVal)+        else+          -- Resolved attrset scope (normal path)+          case attrSetLookup name (AttrSet (castPtr scopePtr)) of+            Just thunk -> force thunk+            Nothing -> evalWithVarScopes env name withArr count (idx + 1)++-- | Check if a with-scope pointer is tagged as lazy (bit 0 set).+isLazyWithScope :: Ptr () -> Bool+isLazyWithScope ptr = ptrToWordPtr ptr .&. 1 /= 0++-- | Remove the lazy tag from a with-scope pointer, returning a CThunkPtr.+untagWithScope :: Ptr () -> CThunkPtr+untagWithScope ptr =+  let tagged = ptrToWordPtr ptr+   in wordPtrToPtr (tagged .&. complement 1)++-- | Tag a CThunkPtr as a lazy with-scope (set bit 0).+tagLazyWithScope :: CThunkPtr -> Ptr ()+tagLazyWithScope ptr =+  let raw = ptrToWordPtr (castPtr ptr)+   in wordPtrToPtr (raw .|. 1)++-- | Push a lazy (thunk-based) with-scope onto the environment.+-- The scope is NOT forced until a WITH_VAR lookup actually needs it.+{-# NOINLINE pushLazyWithScope #-}+pushLazyWithScope :: Thunk -> Env -> Env+pushLazyWithScope (Thunk thunkPtr) =+  pushWithScopeRaw (tagLazyWithScope thunkPtr)++-- | Push a raw pointer as a with-scope.+{-# NOINLINE pushWithScopeRaw #-}+pushWithScopeRaw :: Ptr () -> Env -> Env+pushWithScopeRaw ptr (Env envPtr) =+  Env (checkedCPtr "pushWithScopeRaw" (unsafePerformIO (cenvPushWith envPtr ptr)))++-- ---------------------------------------------------------------------------+-- Formals matching + env helpers (used by evalBcApp, applyValue, etc.)+-- ---------------------------------------------------------------------------++-- | Match a lambda's formals against an argument thunk.+matchFormals :: (MonadEval m) => Env -> EvalFormals -> Thunk -> m Env+matchFormals closureEnv (EFName _) argThunk =+  let (sp, sc) = buildCSlots [argThunk]+   in pure (envFromSlots sp sc closureEnv)+matchFormals closureEnv (EFSet formals allowExtra) argThunk = do+  argVal <- force argThunk+  matchFormalSet closureEnv formals allowExtra argVal Nothing+matchFormals closureEnv (EFNamedSet _ formals allowExtra) argThunk = do+  argVal <- force argThunk+  matchFormalSet closureEnv formals allowExtra argVal (Just argThunk)++-- | Match destructuring set pattern formals against an attrset value.+matchFormalSet :: (MonadEval m) => Env -> [EvalFormal] -> Bool -> NixValue -> Maybe Thunk -> m Env+matchFormalSet closureEnv formals allowExtra argVal atThunk =+  case argVal of+    VAttrs attrs -> do+      checkExtraKeys formals allowExtra attrs+      checkMissingFormals attrs formals+      let formalEnv = envFromSlots formalSlotsPtr formalSlotCount closureEnv+          (formalSlotsPtr, formalSlotCount) = buildCSlots formalThunks+          formalThunks = case atThunk of+            Nothing -> map resolveOneFormal formals+            Just at -> at : map resolveOneFormal formals+          resolveOneFormal (EvalFormal name defBcIdx) =+            case attrSetLookup name attrs of+              Just thunk -> thunk+              Nothing -> case defBcIdx of+                Just bcIdx -> mkThunkBc formalEnv bcIdx+                Nothing -> error "matchFormalSet: missing required formal (unreachable)"+      pure formalEnv+    _ -> throwEvalError ("function expects a set argument, got " <> typeName argVal)++checkExtraKeys :: (MonadEval m) => [EvalFormal] -> Bool -> AttrSet -> m ()+checkExtraKeys _ True _ = pure ()+checkExtraKeys formals False attrs =+  let expected = map efName formals+      actual = attrSetKeys attrs+      extra = filter (`notElem` expected) actual+   in case extra of+        [] -> pure ()+        (k : _) -> throwEvalError ("unexpected attribute '" <> k <> "' in function argument")++checkMissingFormals :: (MonadEval m) => AttrSet -> [EvalFormal] -> m ()+checkMissingFormals attrs formals =+  let allMissing = [efName f | f <- formals, isNothing (efDefault f), not (attrSetMember (efName f) attrs)]+   in case allMissing of+        [] -> pure ()+        (name : _) ->+          let provided = attrSetKeys attrs+              provSnippet = T.intercalate ", " (take 20 provided)+              missSnippet = T.intercalate ", " allMissing+           in throwEvalError ("missing required attribute '" <> name <> "'; all missing: [" <> missSnippet <> "]; provided keys (" <> T.pack (show (length provided)) <> "): [" <> provSnippet <> "]")++-- | Build capture environment from capture info.+-- NoCaptureInfo: no trimming, use env as-is.+-- Captures: build minimal env from captured slots.+-- CapturesWithScopes: build minimal env + copy with-scopes.+buildCaptureEnv :: Env -> CaptureInfo -> Env+buildCaptureEnv env NoCaptureInfo = env+buildCaptureEnv env (Captures captureList) =+  let (slotsPtr, slotCount) = buildCSlots [envLookupResolved lvl idx env | (lvl, idx) <- captureList]+   in newMinimalEnv slotsPtr slotCount+buildCaptureEnv env (CapturesWithScopes captureList) =+  let (slotsPtr, slotCount) = buildCSlots [envLookupResolved lvl idx env | (lvl, idx) <- captureList]+      (withArr, withCount) = withScopesForCapture env+   in newCEnv slotsPtr slotCount Nothing Nothing withArr withCount++-- | Look up a name in the environment and return its thunk.+-- Used by @inherit@ bindings (both bytecode and Expr paths).+inheritLookup :: Env -> Text -> Thunk+inheritLookup env name =+  case envLookup name env of+    Just thunk -> thunk+    Nothing -> error ("inheritLookup: undefined variable '" <> T.unpack name <> "' (unreachable)")++-- ---------------------------------------------------------------------------+-- Builtin registry (single-definition-site for all builtins)+-- ---------------------------------------------------------------------------++-- | A builtin function definition: its arity and implementation.+data BuiltinDef m = BuiltinDef+  { bdArity :: !Int,+    bdApply :: [NixValue] -> m NixValue+  }++-- | Define an arity-1 builtin.+builtin1 :: (MonadEval m) => Text -> (NixValue -> m NixValue) -> (Text, BuiltinDef m)+builtin1 name f =+  ( name,+    BuiltinDef 1 $ \case+      [a] -> f a+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+  )++-- | Define an arity-2 builtin.+builtin2 ::+  (MonadEval m) =>+  Text ->+  (NixValue -> NixValue -> m NixValue) ->+  (Text, BuiltinDef m)+builtin2 name f =+  ( name,+    BuiltinDef 2 $ \case+      [a, b] -> f a b+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+  )++-- | Define an arity-3 builtin.+builtin3 ::+  (MonadEval m) =>+  Text ->+  (NixValue -> NixValue -> NixValue -> m NixValue) ->+  (Text, BuiltinDef m)+builtin3 name f =+  ( name,+    BuiltinDef 3 $ \case+      [a, b, c] -> f a b c+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+  )++-- | Central registry of all builtins.  Adding a new builtin is a single+-- entry here plus its implementation function - no other files need changes.+builtinRegistry :: (MonadEval m) => Map Text (BuiltinDef m)+builtinRegistry =+  Map.fromList+    [ -- Type checking (arity 1)+      builtin1 "typeOf" (pure . mkStr . typeOfValue),+      builtin1 "isNull" (pure . VBool . isNullVal),+      builtin1 "isInt" (pure . VBool . isIntVal),+      builtin1 "isFloat" (pure . VBool . isFloatVal),+      builtin1 "isBool" (pure . VBool . isBoolVal),+      builtin1 "isString" (pure . VBool . isStringVal),+      builtin1 "isList" (pure . VBool . isListVal),+      builtin1 "isAttrs" (pure . VBool . isAttrsVal),+      builtin1 "isFunction" (pure . VBool . isFunctionVal),+      -- List operations (arity 1)+      builtin1 "length" builtinLength,+      builtin1 "head" builtinHead,+      builtin1 "tail" builtinTail,+      -- String operations (arity 1)+      builtin1 "toString" (fmap (uncurry VStr) . coerceToStringPermissive),+      builtin1 "stringLength" builtinStringLength,+      -- Control (arity 1)+      builtin1 "throw" builtinThrow,+      builtin1 "abort" builtinAbort,+      -- Attr set operations (arity 1)+      builtin1 "attrNames" builtinAttrNames,+      builtin1 "attrValues" builtinAttrValues,+      builtin1 "listToAttrs" builtinListToAttrs,+      -- Attr set operations (arity 2)+      builtin2 "hasAttr" builtinHasAttr,+      builtin2 "getAttr" builtinGetAttr,+      builtin2 "removeAttrs" builtinRemoveAttrs,+      builtin2 "intersectAttrs" builtinIntersectAttrs,+      builtin2 "catAttrs" builtinCatAttrs,+      -- List higher-order (arity 2)+      builtin2 "map" builtinMap,+      builtin2 "filter" builtinFilter,+      builtin2 "genList" builtinGenList,+      builtin2 "sort" builtinSort,+      builtin2 "concatMap" builtinConcatMap,+      builtin2 "any" builtinAny,+      builtin2 "all" builtinAll,+      builtin2 "elem" builtinElem,+      builtin2 "elemAt" builtinElemAt,+      builtin2 "partition" builtinPartition,+      builtin2 "groupBy" builtinGroupBy,+      -- String operations (arity 2)+      builtin2 "concatStringsSep" builtinConcatStringsSep,+      -- Arity 3+      builtin3 "foldl'" builtinFoldl,+      builtin3 "substring" builtinSubstring,+      -- Numeric+      builtin1 "isPath" (pure . VBool . isPathVal),+      builtin1 "ceil" builtinCeil,+      builtin1 "floor" builtinFloor,+      builtin2 "seq" builtinSeq,+      builtin2 "trace" builtinTrace,+      builtin2 "warn" builtinWarn,+      builtin1 "unsafeDiscardStringContext" builtinDiscardContext,+      builtin1 "unsafeDiscardOutputDependency" builtinDiscardOutputDep,+      builtin1 "addDrvOutputDependencies" builtinAddDrvOutputDeps,+      -- String context introspection+      builtin1 "hasContext" builtinHasContext,+      builtin1 "getContext" builtinGetContext,+      builtin2 "appendContext" builtinAppendContext,+      builtin1 "baseNameOf" builtinBaseNameOf,+      builtin1 "dirOf" builtinDirOf,+      builtin1 "concatLists" builtinConcatLists,+      builtin2 "lessThan" builtinLessThan,+      -- Arithmetic + bitwise+      builtin2 "add" builtinAdd,+      builtin2 "sub" builtinSub,+      builtin2 "mul" builtinMul,+      builtin2 "div" builtinDiv,+      builtin2 "bitAnd" builtinBitAnd,+      builtin2 "bitOr" builtinBitOr,+      builtin2 "bitXor" builtinBitXor,+      -- Attr set higher-order+      builtin2 "mapAttrs" builtinMapAttrs,+      builtin1 "functionArgs" builtinFunctionArgs,+      builtin2 "zipAttrsWith" builtinZipAttrsWith,+      -- String manipulation+      builtin2 "match" builtinMatch,+      builtin2 "split" builtinSplit,+      builtin3 "replaceStrings" builtinReplaceStrings,+      builtin2 "compareVersions" builtinCompareVersions,+      builtin1 "splitVersion" builtinSplitVersion,+      builtin1 "parseDrvName" builtinParseDrvName,+      -- Serialization + hashing+      builtin1 "toJSON" builtinToJSON,+      builtin1 "fromJSON" builtinFromJSON,+      builtin2 "hashString" builtinHashString,+      -- Error handling + sequencing+      -- An argument reaching here is already forced (any throw happened+      -- before tryEval saw it), so it success-wraps; the catching paths+      -- are evalBcApp and applyValueLazy.+      builtin1 "tryEval" (tryEvalAction . pure),+      builtin2 "deepSeq" builtinDeepSeq,+      -- Graph traversal+      builtin1 "genericClosure" builtinGenericClosure,+      -- IO builtins (delegate to MonadEval methods)+      builtin1 "import" builtinImport,+      builtin1 "readFile" builtinReadFile,+      builtin1 "pathExists" builtinPathExists,+      builtin1 "readDir" builtinReadDir,+      builtin1 "getEnv" builtinGetEnv,+      builtin1 "toPath" builtinToPath,+      -- Store path operations+      builtin1 "placeholder" builtinPlaceholder,+      builtin1 "storePath" builtinStorePath,+      builtin2 "findFile" builtinFindFile,+      builtin2 "toFile" builtinToFile,+      builtin2 "scopedImport" builtinScopedImport,+      -- Network fetchers+      builtin1 "fetchurl" builtinFetchurl,+      builtin1 "fetchTarball" builtinFetchTarball,+      builtin1 "fetchGit" builtinFetchGit,+      -- Derivation construction: lazy 'derivation' wrapper over the eager+      -- 'derivationStrict' primop, as upstream's+      -- src/libexpr/primops/derivation.nix does.+      builtin1 "derivation" builtinDerivationLazy,+      builtin1 "derivationStrict" builtinDerivationStrict,+      -- Error context (pass-through - context only matters on error)+      builtin2 "addErrorContext" (\_ val -> pure val),+      -- Attr position (return null - nixpkgs handles this gracefully)+      builtin2 "unsafeGetAttrPos" (\_ _ -> pure VNull),+      -- Debugging (traceVerbose: same as trace for now, --trace-verbose not yet gated)+      builtin2 "traceVerbose" builtinTrace,+      builtin1 "break" pure,+      -- IO: file hashing + type detection+      builtin2 "hashFile" builtinHashFile,+      builtin1 "readFileType" builtinReadFileType,+      -- Serialization+      builtin1 "fromTOML" builtinFromTOML,+      -- Hash conversion+      builtin1 "convertHash" builtinConvertHash,+      -- XML serialization+      builtin1 "toXML" builtinToXML,+      -- Source filtering + path import+      builtin1 "path" builtinPath,+      builtin2 "filterSource" builtinFilterSource,+      -- Experimental feature stubs+      builtin2 "outputOf" builtinOutputOf,+      builtin1 "fetchTree" builtinFetchTree,+      builtin1 "fetchClosure" builtinFetchClosure+    ]++-- | Names of all registered builtins.+builtinNames :: [Text]+builtinNames = Map.keys (builtinRegistry :: Map Text (BuiltinDef PureEval))++-- ---------------------------------------------------------------------------+-- Builtin dispatch (partial application via accumulated args)+-- ---------------------------------------------------------------------------++-- | Arity of a builtin (how many arguments before execution).+builtinArity :: Text -> Int+builtinArity name = maybe 1 bdArity (Map.lookup name (builtinRegistry :: Map Text (BuiltinDef PureEval)))++-- | Apply a builtin with accumulated args.  If we have enough args,+-- execute; otherwise return a partially applied builtin.+applyBuiltin :: (MonadEval m) => Text -> [NixValue] -> NixValue -> m NixValue+applyBuiltin name accArgs arg =+  let allArgs = accArgs ++ [arg]+      arity = builtinArity name+   in if length allArgs < arity+        then pure (VBuiltin name (precompileArgs name allArgs))+        else executeBuiltin name allArgs++-- | Pre-compile regex patterns at partial application time.+-- When builtins.match or builtins.split receives its first argument+-- (the pattern string), compile it immediately and store the compiled+-- RE.Regex in a VCompiledRegex, replacing the raw VStr.  The compiled+-- form is carried in VBuiltin's accumulated args and reused on every+-- subsequent application - zero recompilation.  Both builtins compile+-- the RAW pattern: match's whole-string requirement is a span check at+-- match time, not textual @^...$@ anchoring, which would misparse a+-- top-level alternation (@^a|b$@ is @(^a)|(b$)@).+precompileArgs :: Text -> [NixValue] -> [NixValue]+precompileArgs "match" [VStr pat _] = compiledRegexArg pat+precompileArgs "split" [VStr pat _] = compiledRegexArg pat+precompileArgs _ args = args++-- | The single-element arg list for a regex builtin: the compiled pattern+-- if valid, the raw string otherwise (the error surfaces at execute time).+compiledRegexArg :: BS.ByteString -> [NixValue]+compiledRegexArg pat = case cachedCompileRegex pat of+  Just compiled -> [VCompiledRegex (CompiledRegex pat compiled)]+  Nothing -> [VStr pat emptyContext]++-- | Apply a function value (lambda or builtin) to one argument.+-- Used by higher-order builtins to invoke user-supplied functions.+applyValue :: (MonadEval m) => NixValue -> NixValue -> m NixValue+applyValue (VLambda closureEnv formals bodyBcIdx) arg = do+  extEnv <- matchFormals closureEnv formals (evaluated arg)+  evalBytecode extEnv bodyBcIdx+applyValue (VBuiltin name accArgs) arg =+  applyBuiltin name accArgs arg+applyValue other _ =+  throwEvalError ("attempt to call " <> typeName other <> ", which is not a function")++-- | Apply a function value to an UNFORCED thunk argument.  Upstream's+-- higher-order list builtins (filter, any, all, partition, groupBy,+-- foldl') pass elements as unforced values, so an element the function+-- never inspects may contain a throw without failing the call.  A+-- builtin callee still receives a forced value (builtins force their+-- arguments regardless), and set-pattern formals force on destructuring+-- exactly as upstream does.+applyValueLazy :: (MonadEval m) => NixValue -> Thunk -> m NixValue+applyValueLazy (VLambda closureEnv formals bodyBcIdx) argThunk = do+  extEnv <- matchFormals closureEnv formals argThunk+  evalBytecode extEnv bodyBcIdx+-- tryEval's catch must wrap the argument's forcing (see 'tryEvalAction'):+-- map/filter passing a throwing element to tryEval yields success = false,+-- not an escaped error.+applyValueLazy (VBuiltin "tryEval" []) argThunk = tryEvalAction (force argThunk)+applyValueLazy other argThunk = do+  val <- force argThunk+  applyValue other val++-- | Execute a builtin once all arguments are collected.+--+-- Direct case dispatch avoids rebuilding the polymorphic 'builtinRegistry'+-- Map on every call.  'builtinRegistry' is polymorphic in @m@ so GHC+-- cannot cache it as a CAF - it gets reconstructed on every use.+-- Pattern matching on the name is zero-allocation.+executeBuiltin :: (MonadEval m) => Text -> [NixValue] -> m NixValue+executeBuiltin name args = case name of+  -- Type checking (arity 1)+  "typeOf" -> apply1 (pure . mkStr . typeOfValue)+  "isNull" -> apply1 (pure . VBool . isNullVal)+  "isInt" -> apply1 (pure . VBool . isIntVal)+  "isFloat" -> apply1 (pure . VBool . isFloatVal)+  "isBool" -> apply1 (pure . VBool . isBoolVal)+  "isString" -> apply1 (pure . VBool . isStringVal)+  "isList" -> apply1 (pure . VBool . isListVal)+  "isAttrs" -> apply1 (pure . VBool . isAttrsVal)+  "isFunction" -> apply1 (pure . VBool . isFunctionVal)+  -- List operations (arity 1)+  "length" -> apply1 builtinLength+  "head" -> apply1 builtinHead+  "tail" -> apply1 builtinTail+  -- String operations (arity 1)+  "toString" -> apply1 (fmap (uncurry VStr) . coerceToStringPermissive)+  "stringLength" -> apply1 builtinStringLength+  -- Control (arity 1)+  "throw" -> apply1 builtinThrow+  "abort" -> apply1 builtinAbort+  -- Attr set operations (arity 1)+  "attrNames" -> apply1 builtinAttrNames+  "attrValues" -> apply1 builtinAttrValues+  "listToAttrs" -> apply1 builtinListToAttrs+  -- Attr set operations (arity 2)+  "hasAttr" -> apply2 builtinHasAttr+  "getAttr" -> apply2 builtinGetAttr+  "removeAttrs" -> apply2 builtinRemoveAttrs+  "intersectAttrs" -> apply2 builtinIntersectAttrs+  "catAttrs" -> apply2 builtinCatAttrs+  -- List higher-order (arity 2)+  "map" -> apply2 builtinMap+  "filter" -> apply2 builtinFilter+  "genList" -> apply2 builtinGenList+  "sort" -> apply2 builtinSort+  "concatMap" -> apply2 builtinConcatMap+  "any" -> apply2 builtinAny+  "all" -> apply2 builtinAll+  "elem" -> apply2 builtinElem+  "elemAt" -> apply2 builtinElemAt+  "partition" -> apply2 builtinPartition+  "groupBy" -> apply2 builtinGroupBy+  -- String operations (arity 2)+  "concatStringsSep" -> apply2 builtinConcatStringsSep+  -- Arity 3+  "foldl'" -> apply3 builtinFoldl+  "substring" -> apply3 builtinSubstring+  -- Numeric+  "isPath" -> apply1 (pure . VBool . isPathVal)+  "ceil" -> apply1 builtinCeil+  "floor" -> apply1 builtinFloor+  "seq" -> apply2 builtinSeq+  "trace" -> apply2 builtinTrace+  "warn" -> apply2 builtinWarn+  "unsafeDiscardStringContext" -> apply1 builtinDiscardContext+  "unsafeDiscardOutputDependency" -> apply1 builtinDiscardOutputDep+  "addDrvOutputDependencies" -> apply1 builtinAddDrvOutputDeps+  -- String context introspection+  "hasContext" -> apply1 builtinHasContext+  "getContext" -> apply1 builtinGetContext+  "appendContext" -> apply2 builtinAppendContext+  "baseNameOf" -> apply1 builtinBaseNameOf+  "dirOf" -> apply1 builtinDirOf+  "concatLists" -> apply1 builtinConcatLists+  "lessThan" -> apply2 builtinLessThan+  -- Arithmetic + bitwise+  "add" -> apply2 builtinAdd+  "sub" -> apply2 builtinSub+  "mul" -> apply2 builtinMul+  "div" -> apply2 builtinDiv+  "bitAnd" -> apply2 builtinBitAnd+  "bitOr" -> apply2 builtinBitOr+  "bitXor" -> apply2 builtinBitXor+  -- Attr set higher-order+  "mapAttrs" -> apply2 builtinMapAttrs+  "functionArgs" -> apply1 builtinFunctionArgs+  "zipAttrsWith" -> apply2 builtinZipAttrsWith+  -- String manipulation+  "match" -> apply2 builtinMatch+  "split" -> apply2 builtinSplit+  "replaceStrings" -> apply3 builtinReplaceStrings+  "compareVersions" -> apply2 builtinCompareVersions+  "splitVersion" -> apply1 builtinSplitVersion+  "parseDrvName" -> apply1 builtinParseDrvName+  -- Serialization + hashing+  "toJSON" -> apply1 builtinToJSON+  "fromJSON" -> apply1 builtinFromJSON+  "hashString" -> apply2 builtinHashString+  -- Error handling + sequencing+  -- Already-forced argument: success-wrap (see the registry entry).+  "tryEval" -> apply1 (tryEvalAction . pure)+  "deepSeq" -> apply2 builtinDeepSeq+  -- Graph traversal+  "genericClosure" -> apply1 builtinGenericClosure+  -- IO builtins (delegate to MonadEval methods)+  "import" -> apply1 builtinImport+  "readFile" -> apply1 builtinReadFile+  "pathExists" -> apply1 builtinPathExists+  "readDir" -> apply1 builtinReadDir+  "getEnv" -> apply1 builtinGetEnv+  "toPath" -> apply1 builtinToPath+  -- Store path operations+  "placeholder" -> apply1 builtinPlaceholder+  "storePath" -> apply1 builtinStorePath+  "findFile" -> apply2 builtinFindFile+  "toFile" -> apply2 builtinToFile+  "scopedImport" -> apply2 builtinScopedImport+  -- Network fetchers+  "fetchurl" -> apply1 builtinFetchurl+  "fetchTarball" -> apply1 builtinFetchTarball+  "fetchGit" -> apply1 builtinFetchGit+  -- Derivation construction: lazy 'derivation' over eager 'derivationStrict'+  "derivation" -> apply1 builtinDerivationLazy+  "derivationStrict" -> apply1 builtinDerivationStrict+  -- Error context (pass-through - context only matters on error)+  "addErrorContext" -> apply2 (\_ val -> pure val)+  -- Attr position (return null - nixpkgs handles this gracefully)+  "unsafeGetAttrPos" -> apply2 (\_ _ -> pure VNull)+  -- Debugging (traceVerbose: same as trace for now)+  "traceVerbose" -> apply2 builtinTrace+  "break" -> apply1 pure+  -- IO: file hashing + type detection+  "hashFile" -> apply2 builtinHashFile+  "readFileType" -> apply1 builtinReadFileType+  -- Serialization+  "fromTOML" -> apply1 builtinFromTOML+  -- Hash conversion+  "convertHash" -> apply1 builtinConvertHash+  -- XML serialization+  "toXML" -> apply1 builtinToXML+  -- Source filtering + path import+  "path" -> apply1 builtinPath+  "filterSource" -> apply2 builtinFilterSource+  -- Experimental feature stubs+  "outputOf" -> apply2 builtinOutputOf+  "fetchTree" -> apply1 builtinFetchTree+  "fetchClosure" -> apply1 builtinFetchClosure+  _ -> throwEvalError ("unknown builtin '" <> name <> "'")+  where+    apply1 f = case args of+      [a] -> f a+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+    apply2 f = case args of+      [a, b] -> f a b+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+    apply3 f = case args of+      [a, b, c] -> f a b c+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")++-- ---------------------------------------------------------------------------+-- Builtin implementations - type checking+-- ---------------------------------------------------------------------------++typeOfValue :: NixValue -> Text+typeOfValue val = case val of+  VInt _ -> "int"+  VFloat _ -> "float"+  VBool _ -> "bool"+  VNull -> "null"+  VStr _ _ -> "string"+  VPath _ -> "path"+  VList _ -> "list"+  VAttrs _ -> "set"+  VLambda {} -> "lambda"+  VBuiltin _ _ -> "lambda"+  VDerivation _ -> "set"+  VCompiledRegex _ -> "lambda"++isNullVal :: NixValue -> Bool+isNullVal VNull = True+isNullVal _ = False++isIntVal :: NixValue -> Bool+isIntVal (VInt _) = True+isIntVal _ = False++isFloatVal :: NixValue -> Bool+isFloatVal (VFloat _) = True+isFloatVal _ = False++isBoolVal :: NixValue -> Bool+isBoolVal (VBool _) = True+isBoolVal _ = False++isStringVal :: NixValue -> Bool+isStringVal (VStr _ _) = True+isStringVal _ = False++isListVal :: NixValue -> Bool+isListVal (VList _) = True+isListVal _ = False++isAttrsVal :: NixValue -> Bool+isAttrsVal (VAttrs _) = True+isAttrsVal _ = False++isFunctionVal :: NixValue -> Bool+isFunctionVal (VLambda {}) = True+isFunctionVal (VBuiltin _ _) = True+isFunctionVal _ = False++-- ---------------------------------------------------------------------------+-- Builtin implementations - list (arity 1)+-- ---------------------------------------------------------------------------++builtinLength :: (MonadEval m) => NixValue -> m NixValue+builtinLength (VList cl) = pure (VInt (fromIntegral (clistLen cl)))+builtinLength other = throwEvalError ("builtins.length: expected a list, got " <> typeName other)++builtinHead :: (MonadEval m) => NixValue -> m NixValue+builtinHead (VList cl)+  | clistLen cl == 0 = throwEvalError "builtins.head: empty list"+  | otherwise = case clistThunks cl of+      (p : _) -> force (Thunk p)+      [] -> throwEvalError "builtins.head: empty list" -- unreachable: clistLen > 0+builtinHead other = throwEvalError ("builtins.head: expected a list, got " <> typeName other)++builtinTail :: (MonadEval m) => NixValue -> m NixValue+builtinTail (VList cl)+  | clistLen cl == 0 = throwEvalError "builtins.tail: empty list"+  | otherwise = pure (VList (clistFromThunks (drop 1 (clistThunks cl))))+builtinTail other = throwEvalError ("builtins.tail: expected a list, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - string (arity 1)+-- ---------------------------------------------------------------------------++-- | Byte length, as upstream: stringLength of a 2-byte character is 2, not 1.+builtinStringLength :: (MonadEval m) => NixValue -> m NixValue+builtinStringLength (VStr s _) = pure (VInt (fromIntegral (BS.length s)))+builtinStringLength other =+  throwEvalError ("builtins.stringLength: expected a string, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - control+-- ---------------------------------------------------------------------------++-- | The error channel is Text and display-only (tryEval discards the+-- message), so throw/abort messages decode lossily.+builtinThrow :: (MonadEval m) => NixValue -> m NixValue+builtinThrow (VStr msg _) = throwCatchableError (bytesToTextLossy msg)+builtinThrow other = throwEvalError ("builtins.throw: expected a string, got " <> typeName other)++builtinAbort :: (MonadEval m) => NixValue -> m NixValue+builtinAbort (VStr msg _) = abortEvaluation (bytesToTextLossy msg)+builtinAbort other = abortEvaluation ("builtins.abort: expected a string, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - attr set (arity 1)+-- ---------------------------------------------------------------------------++builtinAttrNames :: (MonadEval m) => NixValue -> m NixValue+builtinAttrNames (VAttrs attrs) =+  -- Nix returns attribute names lexicographically sorted; the C array is in+  -- interned-symbol order, so sort here (consistent with builtins.attrValues,+  -- which sorts via attrSetElems).+  let thunks = map (evaluated . mkStr) (sort (attrSetKeys attrs))+   in pure (VList (clistFromThunks (map thunkToCPtr thunks)))+builtinAttrNames other =+  throwEvalError ("builtins.attrNames: expected a set, got " <> typeName other)++builtinAttrValues :: (MonadEval m) => NixValue -> m NixValue+builtinAttrValues (VAttrs attrs) =+  pure (VList (clistFromThunks (map thunkToCPtr (attrSetElems attrs))))+builtinAttrValues other =+  throwEvalError ("builtins.attrValues: expected a set, got " <> typeName other)++builtinListToAttrs :: (MonadEval m) => NixValue -> m NixValue+builtinListToAttrs (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  pairs <- mapM listToAttrsPair thunks+  -- Nix listToAttrs uses first-wins: if duplicate name, first element wins.+  let firstWins = Map.fromListWith (\_ kept -> kept) pairs+  pure (VAttrs (attrSetFromMap firstWins))+builtinListToAttrs other =+  throwEvalError ("builtins.listToAttrs: expected a list, got " <> typeName other)++-- | Extract { name, value } from a thunk for listToAttrs.+listToAttrsPair :: (MonadEval m) => Thunk -> m (Text, Thunk)+listToAttrsPair thunk = do+  val <- force thunk+  case val of+    VAttrs attrs -> do+      nameThunk <-+        maybe (throwEvalError "builtins.listToAttrs: element missing 'name'") pure $+          attrSetLookup "name" attrs+      nameVal <- force nameThunk+      case nameVal of+        VStr keyName _ ->+          case attrSetLookup "value" attrs of+            Just valueThunk -> do+              key <- decodedText "builtins.listToAttrs: attribute name" keyName+              pure (key, valueThunk)+            Nothing -> throwEvalError "builtins.listToAttrs: element missing 'value'"+        _ -> throwEvalError "builtins.listToAttrs: 'name' must be a string"+    _ -> throwEvalError "builtins.listToAttrs: element must be a set"++-- ---------------------------------------------------------------------------+-- Builtin implementations - attr set (arity 2)+-- ---------------------------------------------------------------------------++builtinHasAttr :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinHasAttr (VStr key _) (VAttrs attrs) = do+  name <- decodedText "builtins.hasAttr" key+  pure (VBool (attrSetMember name attrs))+builtinHasAttr (VStr _ _) other =+  throwEvalError ("builtins.hasAttr: expected a set, got " <> typeName other)+builtinHasAttr other _ =+  throwEvalError ("builtins.hasAttr: expected a string, got " <> typeName other)++builtinGetAttr :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinGetAttr (VStr key _) (VAttrs attrs) = do+  name <- decodedText "builtins.getAttr" key+  case attrSetLookup name attrs of+    Just thunk -> force thunk+    Nothing -> throwEvalError ("builtins.getAttr: attribute '" <> name <> "' not found")+builtinGetAttr (VStr _ _) other =+  throwEvalError ("builtins.getAttr: expected a set, got " <> typeName other)+builtinGetAttr other _ =+  throwEvalError ("builtins.getAttr: expected a string, got " <> typeName other)++builtinRemoveAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinRemoveAttrs (VAttrs attrs) (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  keys <- mapM forceToString thunks+  pure (VAttrs (attrSetRemoveKeys keys attrs))+  where+    forceToString thunk = do+      val <- force thunk+      case val of+        VStr s _ -> decodedText "builtins.removeAttrs" s+        _ -> throwEvalError "builtins.removeAttrs: key list must contain strings"+builtinRemoveAttrs (VAttrs _) other =+  throwEvalError ("builtins.removeAttrs: expected a list, got " <> typeName other)+builtinRemoveAttrs other _ =+  throwEvalError ("builtins.removeAttrs: expected a set, got " <> typeName other)++builtinIntersectAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinIntersectAttrs (VAttrs a) (VAttrs b) =+  -- Iterate keys of 'a' (typically the smaller set, e.g. functionArgs)+  -- and point-lookup each in 'b' (typically the large set, e.g. nixpkgs).+  -- This avoids materializing all thunks in 'b'.+  let keysA = attrSetKeys a+      result = Map.fromList [(k, thunk) | k <- keysA, Just thunk <- [attrSetLookup k b]]+   in pure (VAttrs (attrSetFromMap result))+builtinIntersectAttrs (VAttrs _) other =+  throwEvalError ("builtins.intersectAttrs: expected a set, got " <> typeName other)+builtinIntersectAttrs other _ =+  throwEvalError ("builtins.intersectAttrs: expected a set, got " <> typeName other)++builtinCatAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinCatAttrs (VStr key _) (VList cl) = do+  name <- decodedText "builtins.catAttrs" key+  let thunks = map Thunk (clistThunks cl)+  vals <- catAttrsCollect name thunks+  pure (VList (clistFromThunks (map thunkToCPtr vals)))+builtinCatAttrs (VStr _ _) other =+  throwEvalError ("builtins.catAttrs: expected a list, got " <> typeName other)+builtinCatAttrs other _ =+  throwEvalError ("builtins.catAttrs: expected a string, got " <> typeName other)++-- | Collect values for a given key from a list of attrsets.+-- Tail-recursive with accumulator to avoid stack overflow on large lists.+catAttrsCollect :: (MonadEval m) => Text -> [Thunk] -> m [Thunk]+catAttrsCollect key = go []+  where+    go !acc [] = pure (reverse acc)+    go !acc (thunk : rest) = do+      val <- force thunk+      case val of+        VAttrs attrs ->+          case attrSetLookup key attrs of+            Just found -> go (found : acc) rest+            Nothing -> go acc rest+        _ -> throwEvalError "builtins.catAttrs: list element must be a set"++-- ---------------------------------------------------------------------------+-- Builtin implementations - list higher-order (arity 2)+-- ---------------------------------------------------------------------------++builtinMap :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinMap func (VList cl) =+  -- Lazy: each element is a deferred application, forced only on demand.+  let thunks = map Thunk (clistThunks cl)+   in pure (VList (clistFromThunks (map (thunkToCPtr . deferApply func) thunks)))+builtinMap _ other =+  throwEvalError ("builtins.map: expected a list, got " <> typeName other)++builtinFilter :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinFilter predFn (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  filtered <- filterThunks predFn thunks+  pure (VList (clistFromThunks (map thunkToCPtr filtered)))+builtinFilter _ other =+  throwEvalError ("builtins.filter: expected a list, got " <> typeName other)++filterThunks :: (MonadEval m) => NixValue -> [Thunk] -> m [Thunk]+filterThunks _ [] = pure []+filterThunks predFn (thunk : rest) = do+  result <- applyValueLazy predFn thunk+  case result of+    VBool True -> (thunk :) <$> filterThunks predFn rest+    VBool False -> filterThunks predFn rest+    _ -> throwEvalError "builtins.filter: predicate must return a bool"++builtinGenList :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinGenList func (VInt n)+  | n < 0 = throwEvalError "builtins.genList: length must be non-negative"+  | otherwise =+      -- Lazy: each element is a deferred @f i@, forced only on demand.+      -- Slot 0 = function.+      let fnThunk = evaluated func+          (sp, sc) = buildCSlots [fnThunk]+          env = newMinimalEnv sp sc+          mkIndexThunk i = mkThunk env (EApp (EResolvedVar 0 0) (ELit (NixInt i)))+       in pure (VList (clistFromThunks (map (thunkToCPtr . mkIndexThunk) [0 .. n - 1])))+builtinGenList _ other =+  throwEvalError ("builtins.genList: expected an integer, got " <> typeName other)++builtinSort :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinSort comparator (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  vals <- mapM force thunks+  sorted <- mergeSort comparator vals+  pure (VList (clistFromThunks (map (thunkToCPtr . evaluated) sorted)))+builtinSort _ other =+  throwEvalError ("builtins.sort: expected a list, got " <> typeName other)++-- | Stable O(n log n) merge sort using a user-supplied comparator.+-- The comparator takes two args (curried) and returns bool.+mergeSort :: (MonadEval m) => NixValue -> [NixValue] -> m [NixValue]+mergeSort _ [] = pure []+mergeSort _ [x] = pure [x]+mergeSort cmp xs = do+  let half = length xs `div` 2+      (left, right) = splitAt half xs+  sortedLeft <- mergeSort cmp left+  sortedRight <- mergeSort cmp right+  mergeSorted cmp sortedLeft sortedRight++mergeSorted :: (MonadEval m) => NixValue -> [NixValue] -> [NixValue] -> m [NixValue]+mergeSorted _ [] ys = pure ys+mergeSorted _ xs [] = pure xs+mergeSorted cmp (x : xs) (y : ys) = do+  -- Stable merge: take the right element only when it is STRICTLY less than the+  -- left (@cmp y x@).  On a tie - neither strictly less - take the left element,+  -- so comparator-equal elements keep their input order, matching C++ Nix's+  -- std::stable_sort.  (Comparing @cmp x y@ instead would emit @y@ on a tie and+  -- reverse equal runs.)+  partial <- applyValue cmp y+  result <- applyValue partial x+  case result of+    VBool True -> (y :) <$> mergeSorted cmp (x : xs) ys+    VBool False -> (x :) <$> mergeSorted cmp xs (y : ys)+    _ -> throwEvalError "builtins.sort: comparator must return a bool"++builtinConcatMap :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinConcatMap func (VList cl) = do+  -- Semi-eager: must force each application to discover list structure for+  -- concatenation, but element thunks within those sub-lists stay lazy.+  let thunks = map Thunk (clistThunks cl)+      deferredApps = map (deferApply func) thunks+  results <- mapM force deferredApps+  concatted <- mapM extractList results+  pure (VList (clistFromThunks (map thunkToCPtr (concat concatted))))+builtinConcatMap _ other =+  throwEvalError ("builtins.concatMap: expected a list, got " <> typeName other)++extractList :: (MonadEval m) => NixValue -> m [Thunk]+extractList (VList cl) = pure (map Thunk (clistThunks cl))+extractList other =+  throwEvalError ("builtins.concatMap: function must return a list, got " <> typeName other)++builtinAny :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinAny predFn (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  result <- anyThunk predFn thunks+  pure (VBool result)+builtinAny _ other =+  throwEvalError ("builtins.any: expected a list, got " <> typeName other)++anyThunk :: (MonadEval m) => NixValue -> [Thunk] -> m Bool+anyThunk _ [] = pure False+anyThunk predFn (thunk : rest) = do+  result <- applyValueLazy predFn thunk+  case result of+    VBool True -> pure True+    VBool False -> anyThunk predFn rest+    _ -> throwEvalError "builtins.any: predicate must return a bool"++builtinAll :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinAll predFn (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  result <- allThunk predFn thunks+  pure (VBool result)+builtinAll _ other =+  throwEvalError ("builtins.all: expected a list, got " <> typeName other)++allThunk :: (MonadEval m) => NixValue -> [Thunk] -> m Bool+allThunk _ [] = pure True+allThunk predFn (thunk : rest) = do+  result <- applyValueLazy predFn thunk+  case result of+    VBool True -> allThunk predFn rest+    VBool False -> pure False+    _ -> throwEvalError "builtins.all: predicate must return a bool"++builtinElem :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinElem needle (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  found <- elemCheck needle thunks+  pure (VBool found)+builtinElem _ other =+  throwEvalError ("builtins.elem: expected a list, got " <> typeName other)++elemCheck :: (MonadEval m) => NixValue -> [Thunk] -> m Bool+elemCheck _ [] = pure False+elemCheck needle (thunk : rest) = do+  val <- force thunk+  eq <- nixEqual force needle val+  if eq then pure True else elemCheck needle rest++builtinElemAt :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinElemAt (VList cl) (VInt idx)+  | idx < 0 || fromIntegral idx >= clistLen cl = elemAtOOB idx cl+  | otherwise =+      -- O(1) direct C array access instead of materializing the whole list+      let ptr = unsafePerformIO (clistGet (unCList cl) (fromIntegral idx))+       in force (Thunk ptr)+  where+    elemAtOOB i c =+      throwEvalError+        ( "builtins.elemAt: index "+            <> T.pack (show i)+            <> " out of bounds for list of length "+            <> T.pack (show (clistLen c))+        )+builtinElemAt (VList _) other =+  throwEvalError ("builtins.elemAt: expected an integer, got " <> typeName other)+builtinElemAt other _ =+  throwEvalError ("builtins.elemAt: expected a list, got " <> typeName other)++builtinPartition :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinPartition predFn (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  (rightThunks, wrongThunks) <- partitionThunks predFn thunks+  pure+    ( VAttrs+        ( attrSetFromMap $+            Map.fromList+              [ ("right", evaluated (VList (clistFromThunks (map thunkToCPtr rightThunks)))),+                ("wrong", evaluated (VList (clistFromThunks (map thunkToCPtr wrongThunks))))+              ]+        )+    )+builtinPartition _ other =+  throwEvalError ("builtins.partition: expected a list, got " <> typeName other)++-- | Tail-recursive partition with accumulator to avoid stack overflow.+partitionThunks :: (MonadEval m) => NixValue -> [Thunk] -> m ([Thunk], [Thunk])+partitionThunks predFn = go [] []+  where+    go !rs !ws [] = pure (reverse rs, reverse ws)+    go !rs !ws (thunk : rest) = do+      result <- applyValueLazy predFn thunk+      case result of+        VBool True -> go (thunk : rs) ws rest+        VBool False -> go rs (thunk : ws) rest+        _ -> throwEvalError "builtins.partition: predicate must return a bool"++builtinGroupBy :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinGroupBy func (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  groups <- groupByCollect func thunks Map.empty+  pure (VAttrs (attrSetFromMap (Map.map (evaluated . VList . clistFromThunks . map thunkToCPtr . reverse) groups)))+builtinGroupBy _ other =+  throwEvalError ("builtins.groupBy: expected a list, got " <> typeName other)++groupByCollect ::+  (MonadEval m) =>+  NixValue ->+  [Thunk] ->+  Map Text [Thunk] ->+  m (Map Text [Thunk])+groupByCollect _ [] acc = pure acc+groupByCollect func (thunk : rest) acc = do+  result <- applyValueLazy func thunk+  case result of+    VStr key _ -> do+      name <- decodedText "builtins.groupBy" key+      groupByCollect func rest (Map.insertWith (++) name [thunk] acc)+    _ -> throwEvalError "builtins.groupBy: function must return a string"++-- ---------------------------------------------------------------------------+-- Builtin implementations - string (arity 2)+-- ---------------------------------------------------------------------------++builtinConcatStringsSep :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinConcatStringsSep (VStr sep sepCtx) (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  pairs <- mapM forceToStrCtx thunks+  let texts = map fst pairs+      mergedCtx = sepCtx <> mconcat (map snd pairs)+  pure (VStr (BS.intercalate sep texts) mergedCtx)+  where+    forceToStrCtx thunk = do+      val <- force thunk+      -- Nix 2.24's coerceToString defaults copyToStore=true and+      -- concatStringsSep passes no override, so a path element is copied into+      -- the store and the result carries its SCPlain context.  Non-string+      -- scalars still error (coerceMore=False), matching interpolation.+      coerceToStringInterp val+builtinConcatStringsSep (VStr _ _) other =+  throwEvalError ("builtins.concatStringsSep: expected a list, got " <> typeName other)+builtinConcatStringsSep other _ =+  throwEvalError ("builtins.concatStringsSep: expected a string, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - arity 3+-- ---------------------------------------------------------------------------++builtinFoldl :: (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue+builtinFoldl op initial (VList cl) =+  foldlStrict op initial (map Thunk (clistThunks cl))+builtinFoldl _ _ other =+  throwEvalError ("builtins.foldl': expected a list, got " <> typeName other)++-- | Strict left fold: apply @op acc elem@ for each element.  The+-- accumulator is forced each step (upstream foldl' strictness); the+-- element is passed as an unforced thunk, as upstream does.+foldlStrict :: (MonadEval m) => NixValue -> NixValue -> [Thunk] -> m NixValue+foldlStrict _ acc [] = pure acc+foldlStrict op acc (thunk : rest) = do+  partial <- applyValue op acc+  stepped <- applyValueLazy partial thunk+  foldlStrict op stepped rest++-- | Byte-indexed slicing, as upstream: offsets and lengths count bytes,+-- and a slice may fall mid-codepoint (the resulting bytes are the value).+builtinSubstring :: (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue+builtinSubstring (VInt start) (VInt len) (VStr s ctx)+  | start < 0 = throwEvalError "builtins.substring: negative start position"+  | otherwise =+      let startPos = fromIntegral start+          -- Nix clamps len to available length (negative len means rest of string)+          available = BS.length s - startPos+          clampedLen =+            if len < 0+              then available+              else min (fromIntegral len) available+       in -- Context is preserved through substring (matching real Nix).+          pure (VStr (BS.take clampedLen (BS.drop startPos s)) ctx)+builtinSubstring _ _ (VStr _ _) =+  throwEvalError "builtins.substring: start and length must be integers"+builtinSubstring _ _ other =+  throwEvalError ("builtins.substring: expected a string, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin helpers+-- ---------------------------------------------------------------------------++-- | Build a thunk that defers @f arg@ - the application only happens when+-- the thunk is forced.  Reuses the existing eval machinery via a synthetic+-- @EApp (EResolvedVar 0 0) (EResolvedVar 0 1)@ in a self-contained env.+-- Slot 0 = function, slot 1 = argument.+deferApply :: NixValue -> Thunk -> Thunk+deferApply func argThunk =+  let (sp, sc) = buildCSlots [evaluated func, argThunk]+      env = newMinimalEnv sp sc+   in mkSyntheticThunk env deferApplyExpr++-- | Shared expression for 'deferApply'.  Allocated once as a CAF.+deferApplyExpr :: Expr+deferApplyExpr = EApp (EResolvedVar 0 0) (EResolvedVar 0 1)+{-# NOINLINE deferApplyExpr #-}++-- | Permissive coercion used by @builtins.toString@.+--+-- Like 'coerceToString' but additionally handles lists: elements are+-- recursively coerced and joined with spaces, matching real Nix semantics.+-- @toString [1 2 3]@ gives @"1 2 3"@.+-- | The non-copying path coercion: the path text verbatim, no context -+-- upstream's @coerceToString@ with @copyToStore = false@.+coercePathVerbatim :: (MonadEval m) => Text -> m (BS.ByteString, StringContext)+coercePathVerbatim p = pure (TE.encodeUtf8 p, emptyContext)++-- | The copy-to-store path coercion: the path becomes its source store+-- path, carried in the context - upstream's @copyToStore = true@.  Passed+-- into 'coerceToString' so a path reached through an attrset's @outPath@+-- (or a @__toString@ result) coerces exactly as the same path written+-- directly would; a fixed path case in the engine dropped both the copy+-- and the context for every such value.+coercePathToStore :: (MonadEval m) => Text -> m (BS.ByteString, StringContext)+coercePathToStore p = do+  (spText, ctx) <- sourcePathWithContext p+  pure (TE.encodeUtf8 spText, ctx)++coerceToStringPermissive :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)+coerceToStringPermissive (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  parts <- mapM coerceThunk thunks+  let texts = map fst parts+      ctx = mconcat (map snd parts)+  pure (BS.intercalate " " texts, ctx)+  where+    coerceThunk thunk = do+      val <- force thunk+      coerceToStringPermissive val+coerceToStringPermissive other = coerceToString True force applyValue coercePathVerbatim other++-- | Coerce a value to a string for a DERIVATION field (an env value or an+-- arg).  Like 'coerceToStringPermissive', but a path literal is copied into+-- the store: it becomes its source store path, with that path added to the+-- string context so it lands in the derivation's @inputSrcs@ - matching C+++-- Nix's copy-to-store coercion of paths in derivation arguments/environment.+coerceToStoreString :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)+coerceToStoreString (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  parts <- mapM (force >=> coerceToStoreString) thunks+  pure (BS.intercalate " " (map fst parts), mconcat (map snd parts))+coerceToStoreString other = coerceToString True force applyValue coercePathToStore other++-- | Coerce a value for string interpolation (@"${...}"@).  Like+-- 'coerceToString', but a path literal is copied into the store and replaced by+-- its source store path (with context) - matching C++ Nix, where interpolation+-- uses @copyToStore = true@, unlike 'builtins.toString', which does not copy.+coerceToStringInterp :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)+coerceToStringInterp = coerceToString False force applyValue coercePathToStore++-- | The store path a source path literal coerces to, carrying its+-- SCPlain context - the copy-to-store coercion shared by interpolation,+-- derivation arguments/env values, and @builtins.toJSON@.+sourcePathWithContext :: (MonadEval m) => Text -> m (Text, StringContext)+sourcePathWithContext p+  -- An already-in-store path coerces to itself with an SCPlain (Opaque)+  -- reference - never re-copied.  This is the shared choke point for+  -- interpolation, derivation args, concatStringsSep, and toJSON, so all of+  -- them inherit the in-store short-circuit (and the Windows re-NAR fix).+  | Just sp <- enclosingStorePath p = pure (p, plainContext sp)+  | otherwise = do+      spText <- storeSourcePath p+      case parseStorePath defaultStoreDir spText of+        Just sp -> pure (spText, plainContext sp)+        Nothing -> pure (spText, mempty)++-- | The current system platform string.+currentSystemStr :: Text+currentSystemStr = case (System.Info.arch, System.Info.os) of+  ("x86_64", "mingw32") -> "x86_64-windows"+  ("x86_64", "darwin") -> "x86_64-darwin"+  ("aarch64", "darwin") -> "aarch64-darwin"+  ("aarch64", "linux") -> "aarch64-linux"+  ("x86_64", "linux") -> "x86_64-linux"+  (arch, os) -> T.pack arch <> "-" <> T.pack os++-- | Store dir with trailing slash, for building store paths.+storeDirPrefix :: Text+storeDirPrefix = defaultStoreDirText <> "/"++-- ---------------------------------------------------------------------------+-- Builtin implementations - numeric + context+-- ---------------------------------------------------------------------------++isPathVal :: NixValue -> Bool+isPathVal (VPath _) = True+isPathVal _ = False++builtinCeil :: (MonadEval m) => NixValue -> m NixValue+builtinCeil (VFloat f) = intFromDouble "builtins.ceil" ceiling f+builtinCeil (VInt n) = pure (VInt n)+builtinCeil other = throwEvalError ("builtins.ceil: expected a number, got " <> typeName other)++builtinFloor :: (MonadEval m) => NixValue -> m NixValue+builtinFloor (VFloat f) = intFromDouble "builtins.floor" floor f+builtinFloor (VInt n) = pure (VInt n)+builtinFloor other = throwEvalError ("builtins.floor: expected a number, got " <> typeName other)++-- | Round a float to Int64 with the checks Nix 2.24 performs: NaN,+-- infinity, and out-of-range values are eval errors, never a garbage+-- Int64 out of Haskell's unchecked conversion.+intFromDouble :: (MonadEval m) => Text -> (Double -> Integer) -> Double -> m NixValue+intFromDouble ctx rounder f+  | isNaN f = throwEvalError (ctx <> ": NaN cannot be converted to an integer")+  | isInfinite f = throwEvalError (ctx <> ": infinity cannot be converted to an integer")+  | rounded < toInteger (minBound :: Int64) || rounded > toInteger (maxBound :: Int64) =+      throwEvalError (ctx <> ": " <> formatNixFloat f <> " is out of integer range")+  | otherwise = pure (VInt (fromInteger rounded))+  where+    rounded = rounder f++builtinDiscardContext :: (MonadEval m) => NixValue -> m NixValue+builtinDiscardContext (VStr s _) = pure (mkStrBytes s)+builtinDiscardContext other =+  throwEvalError ("builtins.unsafeDiscardStringContext: expected a string, got " <> typeName other)++-- | @builtins.unsafeDiscardOutputDependency@ - downgrade all-outputs (DrvDeep)+-- references to a plain (Opaque) reference on the same @.drv@ path, and KEEP+-- derivation-output (Built) references unchanged, matching upstream.  It+-- formerly dropped both kinds and kept only plain references, losing the+-- @.drv@ reference the downgrade must preserve.  'Set.map' also folds a+-- downgraded element into an existing plain reference on the same path.+builtinDiscardOutputDep :: (MonadEval m) => NixValue -> m NixValue+builtinDiscardOutputDep (VStr s (StringContext ctx)) =+  pure (VStr s (StringContext (Set.map downgrade ctx)))+  where+    downgrade (SCAllOutputs sp) = SCPlain sp+    downgrade other = other+builtinDiscardOutputDep other =+  throwEvalError ("builtins.unsafeDiscardOutputDependency: expected a string, got " <> typeName other)++-- | @builtins.addDrvOutputDependencies@ - the inverse of the+-- 'builtinDiscardOutputDep' downgrade for a single element: upgrade a plain+-- (Opaque) reference to a @.drv@ path into an all-outputs (DrvDeep) reference.+-- Upstream requires the string's context to have exactly one element and+-- errors on a derivation-output (Built) element or a non-@.drv@ plain path.+builtinAddDrvOutputDeps :: (MonadEval m) => NixValue -> m NixValue+builtinAddDrvOutputDeps (VStr s (StringContext ctx)) =+  case Set.toList ctx of+    [only] -> VStr s . StringContext . Set.singleton <$> upgrade only+    _ ->+      throwEvalError+        ( "builtins.addDrvOutputDependencies: the string must have exactly one "+            <> "context element, but has "+            <> T.pack (show (Set.size ctx))+        )+  where+    upgrade (SCPlain sp)+      | ".drv" `T.isSuffixOf` spName sp = pure (SCAllOutputs sp)+      | otherwise =+          throwEvalError+            ( "builtins.addDrvOutputDependencies: path "+                <> storePathToText defaultStoreDir sp+                <> " is not a derivation"+            )+    upgrade (SCAllOutputs sp) = pure (SCAllOutputs sp)+    upgrade (SCDrvOutput _ outName) =+      throwEvalError+        ( "builtins.addDrvOutputDependencies: can only act on derivations, not "+            <> "on a derivation output such as "+            <> outName+        )+builtinAddDrvOutputDeps other =+  throwEvalError ("builtins.addDrvOutputDependencies: expected a string, got " <> typeName other)++-- | Check whether a string has any context elements.+builtinHasContext :: (MonadEval m) => NixValue -> m NixValue+builtinHasContext (VStr _ ctx) = pure (VBool (ctx /= emptyContext))+builtinHasContext other =+  throwEvalError ("builtins.hasContext: expected a string, got " <> typeName other)++-- | Return the context of a string as an attrset.+--+-- Each key is a store path string.  Each value is an attrset with:+--   - @path@: true if there's a SCPlain reference+--   - @allOutputs@: true if there's a SCAllOutputs reference+--   - @outputs@: list of output names from SCDrvOutput references+builtinGetContext :: (MonadEval m) => NixValue -> m NixValue+builtinGetContext (VStr _ (StringContext ctx)) = do+  let grouped = groupContextByPath (Set.toList ctx)+      attrMap = Map.map contextEntryToAttrs grouped+  pure (VAttrs (attrSetFromMap attrMap))+builtinGetContext other =+  throwEvalError ("builtins.getContext: expected a string, got " <> typeName other)++-- | Intermediate representation for grouping context elements by store path.+data ContextEntry = ContextEntry+  { cePath :: !Bool,+    ceAllOutputs :: !Bool,+    ceOutputs :: ![Text]+  }++-- | Group context elements by their store path.+groupContextByPath :: [StringContextElement] -> Map Text ContextEntry+groupContextByPath = foldl' addElement Map.empty+  where+    addElement acc (SCPlain sp) =+      Map.insertWith mergeEntry (spToText sp) (ContextEntry True False []) acc+    addElement acc (SCDrvOutput sp outName) =+      Map.insertWith mergeEntry (spToText sp) (ContextEntry False False [outName]) acc+    addElement acc (SCAllOutputs sp) =+      Map.insertWith mergeEntry (spToText sp) (ContextEntry False True []) acc+    -- 'Set.toList' feeds elements in ascending order and 'old' holds the+    -- earlier (smaller) output names, so 'old ++ new' keeps the rendered+    -- outputs list ascending, as upstream getContext produces it.+    mergeEntry new old =+      ContextEntry+        (cePath new || cePath old)+        (ceAllOutputs new || ceAllOutputs old)+        (ceOutputs old ++ ceOutputs new)+    -- Context keys are identity, not IO: always the canonical /nix/store+    -- spelling, never the platform file-path mapping.+    spToText = storePathToText defaultStoreDir++-- | Convert a ContextEntry to an attrset thunk.+contextEntryToAttrs :: ContextEntry -> Thunk+contextEntryToAttrs entry =+  let fields =+        [("path", evaluated (VBool True)) | cePath entry]+          ++ [("allOutputs", evaluated (VBool True)) | ceAllOutputs entry]+          ++ [("outputs", evaluated (VList (clistFromThunks [thunkToCPtr (evaluated (mkStr o)) | o <- ceOutputs entry]))) | not (null (ceOutputs entry))]+   in evaluated (VAttrs (attrSetFromMap (Map.fromList fields)))++-- | Append context entries to a string from an attrset.+--+-- @builtins.appendContext string contextAttrset@ adds the specified+-- context elements to the string.+builtinAppendContext :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinAppendContext (VStr s ctx) (VAttrs contextAttrs) = do+  newCtx <- parseContextAttrs (attrSetToMap contextAttrs)+  pure (VStr s (ctx <> newCtx))+builtinAppendContext (VStr _ _) other =+  throwEvalError ("builtins.appendContext: second argument must be a set, got " <> typeName other)+builtinAppendContext other _ =+  throwEvalError ("builtins.appendContext: first argument must be a string, got " <> typeName other)++-- | Parse a context attrset into a StringContext.+-- Each key is a store path; each value is an attrset with optional+-- @path@, @allOutputs@, and @outputs@ fields.+parseContextAttrs :: (MonadEval m) => Map Text Thunk -> m StringContext+parseContextAttrs attrs = do+  elements <- mapM parseOneCtx (Map.toList attrs)+  pure (StringContext (Set.fromList (concat elements)))+  where+    parseOneCtx (pathText, thunk) = do+      val <- force thunk+      case val of+        VAttrs inner -> do+          -- The key must parse as a store path, as upstream requires; a+          -- fabricated identity here would flow into derivation inputs.+          sp <- case parseStorePath defaultStoreDir pathText of+            Just parsed -> pure parsed+            Nothing ->+              throwEvalError+                ("builtins.appendContext: context key is not a store path: " <> pathText)+          hasPath <- getBoolAttr "path" inner+          hasAllOuts <- getBoolAttr "allOutputs" inner+          outNames <- getOutputsList inner+          let pathElems = [SCPlain sp | hasPath]+              allOutElems = [SCAllOutputs sp | hasAllOuts]+              outElems = [SCDrvOutput sp o | o <- outNames]+          pure (pathElems ++ allOutElems ++ outElems)+        _ -> throwEvalError "builtins.appendContext: context entry must be a set"++    getBoolAttr key attrs' = case attrSetLookup key attrs' of+      Nothing -> pure False+      Just thunk -> do+        val <- force thunk+        case val of+          VBool b -> pure b+          _ -> pure False++    getOutputsList attrs' = case attrSetLookup "outputs" attrs' of+      Nothing -> pure []+      Just thunk -> do+        val <- force thunk+        case val of+          VList cl -> mapM (forceToOutputName . Thunk) (clistThunks cl)+          _ -> pure []++    forceToOutputName thunk = do+      val <- force thunk+      case val of+        VStr s _ -> decodedText "builtins.appendContext" s+        _ -> throwEvalError "builtins.appendContext: output name must be a string"++-- | For a STRING operand, upstream's rule is textual: everything after+-- the final @/@.  For a PATH operand the value may be native-spelled+-- (eval's base dir can be a native Windows path), so the split is+-- separator-aware via 'canonBaseName'.+builtinBaseNameOf :: (MonadEval m) => NixValue -> m NixValue+builtinBaseNameOf (VStr s ctx) = pure (VStr (lastComponentBytes s) ctx)+builtinBaseNameOf (VPath p) = pure (mkStr (canonBaseName p))+builtinBaseNameOf other =+  throwEvalError ("builtins.baseNameOf: expected a string or path, got " <> typeName other)++-- | Byte-level last component for string operands ('/' is a single byte+-- in UTF-8 and never occurs inside a multi-byte sequence).+lastComponentBytes :: BS.ByteString -> BS.ByteString+lastComponentBytes t = case reverse (filter (not . BS.null) (BC.split '/' t)) of+  [] -> ""+  (final : _) -> final++-- | String operands keep upstream's textual '/'-only rule+-- ('dirComponentBytes'); path operands may be native-spelled and split+-- separator-aware via 'canonDirName'.+builtinDirOf :: (MonadEval m) => NixValue -> m NixValue+builtinDirOf (VStr s ctx) = pure (VStr (dirComponentBytes s) ctx)+builtinDirOf (VPath p) = pure (VPath (canonDirName p))+builtinDirOf other =+  throwEvalError ("builtins.dirOf: expected a string or path, got " <> typeName other)++-- | Byte-level dir component for string operands: everything before the+-- last '/' byte, with upstream's "." / "/" edge results.+dirComponentBytes :: BS.ByteString -> BS.ByteString+dirComponentBytes t =+  case BC.elemIndexEnd '/' t of+    Nothing -> "."+    Just idx ->+      let dir = BS.take idx t+       in if BS.null dir then "/" else dir++builtinConcatLists :: (MonadEval m) => NixValue -> m NixValue+builtinConcatLists (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  sublists <- mapM forceThenExtractList thunks+  pure (VList (clistFromThunks (concat sublists)))+  where+    forceThenExtractList thunk = do+      val <- force thunk+      case val of+        VList innerCl -> pure (clistThunks innerCl)+        _ -> throwEvalError "builtins.concatLists: element must be a list"+builtinConcatLists other =+  throwEvalError ("builtins.concatLists: expected a list, got " <> typeName other)++builtinLessThan :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinLessThan a b = VBool <$> nixCompare force a b++-- ---------------------------------------------------------------------------+-- Builtin implementations - arithmetic + bitwise+-- ---------------------------------------------------------------------------++builtinAdd :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinAdd (VInt a) (VInt b) = either throwEvalError (pure . VInt) (checkedAdd a b)+builtinAdd (VInt a) (VFloat b) = pure (VFloat (fromIntegral a + b))+builtinAdd (VFloat a) (VInt b) = pure (VFloat (a + fromIntegral b))+builtinAdd (VFloat a) (VFloat b) = pure (VFloat (a + b))+builtinAdd l r = throwEvalError ("builtins.add: expected numbers, got " <> typeName l <> " and " <> typeName r)++builtinSub :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinSub (VInt a) (VInt b) = either throwEvalError (pure . VInt) (checkedSub a b)+builtinSub (VInt a) (VFloat b) = pure (VFloat (fromIntegral a - b))+builtinSub (VFloat a) (VInt b) = pure (VFloat (a - fromIntegral b))+builtinSub (VFloat a) (VFloat b) = pure (VFloat (a - b))+builtinSub l r = throwEvalError ("builtins.sub: expected numbers, got " <> typeName l <> " and " <> typeName r)++builtinMul :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinMul (VInt a) (VInt b) = either throwEvalError (pure . VInt) (checkedMul a b)+builtinMul (VInt a) (VFloat b) = pure (VFloat (fromIntegral a * b))+builtinMul (VFloat a) (VInt b) = pure (VFloat (a * fromIntegral b))+builtinMul (VFloat a) (VFloat b) = pure (VFloat (a * b))+builtinMul l r = throwEvalError ("builtins.mul: expected numbers, got " <> typeName l <> " and " <> typeName r)++builtinDiv :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinDiv _ (VInt 0) = throwEvalError "builtins.div: division by zero"+builtinDiv (VInt a) (VInt b)+  -- The one overflowing division: |minBound| has no representation.+  | a == minBound && b == -1 =+      throwEvalError+        ("integer overflow in dividing " <> T.pack (show a) <> " and " <> T.pack (show b))+  | otherwise = pure (VInt (quot a b))+builtinDiv _ (VFloat 0) = throwEvalError "builtins.div: division by zero"+builtinDiv (VInt a) (VFloat b) = pure (VFloat (fromIntegral a / b))+builtinDiv (VFloat a) (VInt b) = pure (VFloat (a / fromIntegral b))+builtinDiv (VFloat a) (VFloat b) = pure (VFloat (a / b))+builtinDiv l r = throwEvalError ("builtins.div: expected numbers, got " <> typeName l <> " and " <> typeName r)++builtinBitAnd :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinBitAnd (VInt a) (VInt b) = pure (VInt (a .&. b))+builtinBitAnd _ _ = throwEvalError "builtins.bitAnd: expected two integers"++builtinBitOr :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinBitOr (VInt a) (VInt b) = pure (VInt (a .|. b))+builtinBitOr _ _ = throwEvalError "builtins.bitOr: expected two integers"++builtinBitXor :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinBitXor (VInt a) (VInt b) = pure (VInt (xor a b))+builtinBitXor _ _ = throwEvalError "builtins.bitXor: expected two integers"++-- ---------------------------------------------------------------------------+-- Builtin implementations - attr set higher-order+-- ---------------------------------------------------------------------------++builtinMapAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinMapAttrs func (VAttrs attrs) =+  -- Each attr value is a deferred @f key val@, forced only on demand.+  -- Eagerly builds all thunks via attrSetMapWithKey - with C arena thunks+  -- (~16 bytes each), this is cheaper than the former MappedAttrs overhead+  -- and keeps all data off the GHC heap.+  -- Slot 0 = function, slot 1 = key, slot 2 = value.+  pure (VAttrs (attrSetMapWithKey deferAttr attrs))+  where+    deferAttr key valThunk =+      let (sp, sc) = buildCSlots [evaluated func, evaluated (mkStr key), valThunk]+          env = newMinimalEnv sp sc+       in mkSyntheticThunk env mapAttrsExpr+builtinMapAttrs _ other =+  throwEvalError ("builtins.mapAttrs: expected a set, got " <> typeName other)++-- | Shared expression for 'builtinMapAttrs'.  Allocated once as a CAF.+mapAttrsExpr :: Expr+mapAttrsExpr = EApp (EApp (EResolvedVar 0 0) (EResolvedVar 0 1)) (EResolvedVar 0 2)+{-# NOINLINE mapAttrsExpr #-}++-- | Formals for lambdas, an empty set for builtins, an error otherwise -+-- including functor sets: upstream's primop never consults+-- @__functionArgs@ (nixpkgs lib.functionArgs handles that in Nix).+builtinFunctionArgs :: (MonadEval m) => NixValue -> m NixValue+builtinFunctionArgs (VLambda _ formals _) = pure (formalsToAttrs formals)+builtinFunctionArgs (VBuiltin _ _) = pure (VAttrs (attrSetFromMap Map.empty))+builtinFunctionArgs other =+  throwEvalError ("builtins.functionArgs: expected a function, got " <> typeName other)++formalsToAttrs :: EvalFormals -> NixValue+formalsToAttrs (EFName _) = VAttrs (attrSetFromMap Map.empty)+formalsToAttrs (EFSet formals _) = formalsListToAttrs formals+formalsToAttrs (EFNamedSet _ formals _) = formalsListToAttrs formals++formalsListToAttrs :: [EvalFormal] -> NixValue+formalsListToAttrs formals =+  VAttrs+    $ attrSetFromMap+    $ Map.fromList+      [(efName f, evaluated (VBool (isJust (efDefault f)))) | f <- formals]++builtinZipAttrsWith :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinZipAttrsWith func (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  attrSets <- mapM forceToAttrSet thunks+  let merged = mergeAllAttrs attrSets+      -- Lazy: each result is a deferred f(name)(values) thunk, not eagerly+      -- evaluated.  Critical for nixpkgs evalModules fixpoint - config is a+      -- self-referencing lazy attrset that must be COMPUTED (holding the lazy+      -- result) before any individual attribute thunks are forced.+      resultPairs = map (deferZip func) (Map.toList merged)+  pure (VAttrs (attrSetFromMap (Map.fromList resultPairs)))+  where+    forceToAttrSet thunk = do+      val <- force thunk+      case val of+        VAttrs attrs -> pure (attrSetToMap attrs)+        _ -> throwEvalError "builtins.zipAttrsWith: list element must be a set"+    mergeAllAttrs = foldl' (\acc m -> Map.unionWith (++) acc (Map.map (: []) m)) Map.empty+    -- Slot 0 = function, slot 1 = name, slot 2 = values list.+    deferZip fn (key, thunkList) =+      let valueList = VList (clistFromThunks (map thunkToCPtr thunkList))+          (slots, slotCount) = buildCSlots [evaluated fn, evaluated (mkStr key), evaluated valueList]+          env = newMinimalEnv slots slotCount+       in (key, mkSyntheticThunk env mapAttrsExpr)+builtinZipAttrsWith _ other =+  throwEvalError ("builtins.zipAttrsWith: expected a list, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - string manipulation+-- ---------------------------------------------------------------------------++builtinReplaceStrings ::+  (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue+builtinReplaceStrings (VList fromCl) (VList toCl) (VStr input inputCtx) = do+  let fromThunks = map Thunk (clistThunks fromCl)+      toThunks = map Thunk (clistThunks toCl)+  when (length fromThunks /= length toThunks) $+    throwEvalError "builtins.replaceStrings: 'from' and 'to' must have the same length"+  froms <- mapM forceStr fromThunks+  -- Match-gated replacement forcing, as upstream: a 'to' element is+  -- forced - and its context joins the result - only the first time its+  -- pattern matches, memoized per index.  An unmatched replacement is+  -- never evaluated, so it may throw or diverge harmlessly.+  --+  -- Matching and stepping are byte-level, as upstream: an empty @from@+  -- element inserts between BYTES, so a 2-byte character gets a+  -- replacement inside it.  Chunks accumulate reversed, one BS.concat+  -- at the end.+  let rules = zip3 [0 :: Int ..] (map fst froms) toThunks+      findRule txt =+        listToMaybe [r | r@(_, from, _) <- rules, BS.null from || from `BS.isPrefixOf` txt]+      forcedTo memo (i, _, toThunk) = case Map.lookup i memo of+        Just hit -> pure (hit, memo)+        Nothing -> do+          forced <- forceStr toThunk+          pure (forced, Map.insert i forced memo)+      step remaining acc memo+        | BS.null remaining = case findRule remaining of+            -- At end of string, still check for an empty-from match.+            Just rule -> do+              ((to, _), advanced) <- forcedTo memo rule+              pure (to : acc, advanced)+            Nothing -> pure (acc, memo)+        | otherwise = case findRule remaining of+            Just rule@(_, from, _) -> do+              ((to, _), advanced) <- forcedTo memo rule+              if BS.null from+                then case BS.uncons remaining of+                  -- empty-from: insert replacement then advance ONE BYTE+                  Just (byte, after) -> step after (BS.singleton byte : to : acc) advanced+                  -- Unreachable: the null string is handled by the guard above.+                  Nothing -> pure (to : acc, advanced)+                else step (BS.drop (BS.length from) remaining) (to : acc) advanced+            Nothing -> case BS.uncons remaining of+              Just (byte, after) -> step after (BS.singleton byte : acc) memo+              Nothing -> pure (acc, memo)+  (revChunks, forcedTos) <- step input [] Map.empty+  let mergedCtx = inputCtx <> mconcat (map snd (Map.elems forcedTos))+  pure (VStr (BS.concat (reverse revChunks)) mergedCtx)+  where+    forceStr thunk = do+      val <- force thunk+      case val of+        VStr s ctx -> pure (s, ctx)+        _ -> throwEvalError "builtins.replaceStrings: elements must be strings"+builtinReplaceStrings _ _ (VStr _ _) =+  throwEvalError "builtins.replaceStrings: first two arguments must be lists"+builtinReplaceStrings _ _ other =+  throwEvalError ("builtins.replaceStrings: expected a string, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - regex (POSIX ERE via regex-tdfa)+-- ---------------------------------------------------------------------------++-- ---------------------------------------------------------------------------+-- Regex compilation cache+-- ---------------------------------------------------------------------------++-- | Global regex compilation cache.  Keyed by the raw pattern bytes+-- (match and split share entries).  Idempotent memoization via+-- unsafePerformIO - same rationale as thunk memoization.+{-# NOINLINE regexCacheRef #-}+regexCacheRef :: IORef (Map BS.ByteString RE.Regex)+regexCacheRef = unsafePerformIO (newIORef Map.empty)++-- | Compile options matching C++ Nix's POSIX ERE semantics: no multiline+-- mode, so @^@\/@$@ anchor only at the string boundaries and @.@ (and a+-- negated bracket class) match a newline.  regex-tdfa's default has+-- multiline=True, which silently diverges on any subject containing @\n@.+wholeStringCompOpt :: RE.CompOption+wholeStringCompOpt = RE.defaultCompOpt {RE.multiline = False}++-- | Compile a regex from its raw pattern bytes, using the global cache to+-- avoid recompilation.  Compiling from bytes makes the PATTERN byte-level+-- too, matching upstream: a multi-byte character in the pattern is a+-- sequence of single-byte atoms, so it lines up with byte-level subjects.+-- Returns Nothing for invalid patterns.  NOINLINE prevents GHC from+-- inlining and floating the unsafePerformIO reads.+{-# NOINLINE cachedCompileRegex #-}+cachedCompileRegex :: BS.ByteString -> Maybe RE.Regex+cachedCompileRegex pat =+  unsafePerformIO $ do+    cache <- atomicModifyIORef' regexCacheRef (\c -> (c, c))+    case Map.lookup pat cache of+      Just compiled -> pure (Just compiled)+      Nothing -> case RE.makeRegexOptsM wholeStringCompOpt RE.defaultExecOpt pat :: Maybe RE.Regex of+        Nothing -> pure Nothing+        Just compiled -> do+          atomicModifyIORef' regexCacheRef (\c -> (Map.insert pat compiled c, ()))+          pure (Just compiled)++-- ---------------------------------------------------------------------------+-- Regex builtins+-- ---------------------------------------------------------------------------++-- | @builtins.match regex str@: match a POSIX ERE against a string.+-- The regex must match the ENTIRE string (like C++ Nix's regex_match).+-- Returns @null@ if no match, or a list of capture group strings+-- (@null@ for non-participating groups).+builtinMatch :: (MonadEval m) => NixValue -> NixValue -> m NixValue+-- Pre-compiled path: regex was compiled at partial-application time.+builtinMatch (VCompiledRegex (CompiledRegex _ compiled)) (VStr str _) =+  matchWithCompiled compiled str+-- Direct 2-arg call: use global compilation cache.+builtinMatch (VStr regex _) (VStr str _) =+  case cachedCompileRegex regex of+    Nothing -> throwEvalError ("builtins.match: invalid regex: " <> bytesToTextLossy regex)+    Just compiled -> matchWithCompiled compiled str+builtinMatch (VStr _ _) other =+  throwEvalError ("builtins.match: expected a string, got " <> typeName other)+builtinMatch (VCompiledRegex _) other =+  throwEvalError ("builtins.match: expected a string, got " <> typeName other)+builtinMatch other _ =+  throwEvalError ("builtins.match: expected a string (regex), got " <> typeName other)++-- | Shared match logic for pre-compiled and freshly-compiled regex paths.+--+-- Whole-string semantics via a span check on the leftmost-longest match:+-- if any whole-string match exists it starts at 0, and POSIX picks the+-- longest match at the leftmost start, so the reported match spans the+-- whole subject exactly when a whole-string match exists.  This is what+-- regex_match gives C++ Nix; textual @^...$@ anchoring is NOT equivalent+-- (it misparses top-level alternation).+matchWithCompiled :: (MonadEval m) => RE.Regex -> BS.ByteString -> m NixValue+matchWithCompiled compiled str =+  case RE.matchOnceText compiled str of+    Just (beforeMatch, match, afterMatch)+      | BS.null beforeMatch,+        BS.null afterMatch ->+          -- match is an Array of (bytes, (offset, len)) pairs.+          -- Index 0 is the full match; indices 1.. are capture groups.+          let captureGroups = drop 1 (Array.elems match)+              -- A non-participating capture group has offset (-1); C++ Nix+              -- yields null for it, not the empty string.+              toThunk (s, (off, _)) =+                if off < 0 then evaluated VNull else evaluated (mkStrBytes s)+           in pure (VList (clistFromThunks (map (thunkToCPtr . toThunk) captureGroups)))+    _ -> pure VNull++-- | @builtins.split regex str@: split a string by a POSIX ERE.+-- Returns an alternating list of non-matched strings and match-group lists.+-- Example: @split "(x)" "axbxc"@ yields @["a" ["x"] "b" ["x"] "c"]@+builtinSplit :: (MonadEval m) => NixValue -> NixValue -> m NixValue+-- Pre-compiled path: regex was compiled at partial-application time.+builtinSplit (VCompiledRegex (CompiledRegex _ compiled)) (VStr str _) =+  splitWithCompiled compiled str+-- Direct 2-arg call: use global compilation cache.+builtinSplit (VStr regex _) (VStr str _) =+  case cachedCompileRegex regex of+    Nothing -> throwEvalError ("builtins.split: invalid regex: " <> bytesToTextLossy regex)+    Just compiled -> splitWithCompiled compiled str+builtinSplit (VStr _ _) other =+  throwEvalError ("builtins.split: expected a string, got " <> typeName other)+builtinSplit (VCompiledRegex _) other =+  throwEvalError ("builtins.split: expected a string, got " <> typeName other)+builtinSplit other _ =+  throwEvalError ("builtins.split: expected a string (regex), got " <> typeName other)++-- | Shared split logic for pre-compiled and freshly-compiled regex paths.+splitWithCompiled :: (MonadEval m) => RE.Regex -> BS.ByteString -> m NixValue+splitWithCompiled compiled str =+  let allMatches = matchAllText compiled str+      result = buildSplitResult str 0 allMatches+   in pure (VList (clistFromThunks (map thunkToCPtr result)))++-- | Build the alternating list for builtins.split.  Offsets from the+-- ByteString regex instance are byte offsets, so slicing is O(1)+-- 'BS.take'/'BS.drop'.+buildSplitResult :: BS.ByteString -> Int -> [Array.Array Int (BS.ByteString, (Int, Int))] -> [Thunk]+buildSplitResult remaining pos [] =+  -- No more matches - emit the rest of the string.+  [evaluated (mkStrBytes (BS.drop pos remaining))]+buildSplitResult remaining pos (match : rest) =+  let elems = Array.elems match+      (_, (matchStart, matchLen)) = case elems of+        (full : _) -> full+        [] -> ("", (pos, 0)) -- defensive: should not happen from matchAllText+        -- Bytes before this match+      before = BS.take (matchStart - pos) (BS.drop pos remaining)+      -- Capture groups (indices 1..)+      groups = drop 1 elems+      -- A non-participating capture group has offset (-1) becomes null (as 'match').+      groupThunks =+        map (\(s, (off, _)) -> if off < 0 then evaluated VNull else evaluated (mkStrBytes s)) groups+      -- Continue after this match+      afterPos = matchStart + matchLen+   in evaluated (mkStrBytes before)+        : evaluated (VList (clistFromThunks (map thunkToCPtr groupThunks)))+        : buildSplitResult remaining afterPos rest++builtinCompareVersions :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinCompareVersions (VStr a _) (VStr b _) =+  pure (VInt (compareVersionParts (splitVersionStr a) (splitVersionStr b)))+builtinCompareVersions _ _ = throwEvalError "builtins.compareVersions: expected two strings"++-- | Convert 'Ordering' to the Nix compareVersions convention: -1, 0, 1.+ordToNix :: Ordering -> Int64+ordToNix LT = -1+ordToNix EQ = 0+ordToNix GT = 1++compareVersionParts :: [BS.ByteString] -> [BS.ByteString] -> Int64+compareVersionParts [] [] = 0+-- When one version runs out, Nix pads the shorter side with an empty+-- component and keeps comparing - so "1.0" > "1.0pre" (empty sorts AFTER+-- "pre"), not "<" as a naive length comparison would give.+compareVersionParts [] (b : bs) =+  case compareComponent "" b of+    EQ -> compareVersionParts [] bs+    cmp -> ordToNix cmp+compareVersionParts (a : as) [] =+  case compareComponent a "" of+    EQ -> compareVersionParts as []+    cmp -> ordToNix cmp+compareVersionParts (a : as) (b : bs) =+  case compareComponent a b of+    EQ -> compareVersionParts as bs+    cmp -> ordToNix cmp++-- | Byte-level alpha classification, as upstream (C @isalpha@ over+-- bytes): a non-ASCII letter is a separator, never an alphabetic+-- component.  Digits need no counterpart - 'isDigit' is @0-9@ only.+isVersionAlpha :: Char -> Bool+isVersionAlpha c = isAsciiLower c || isAsciiUpper c++compareComponent :: BS.ByteString -> BS.ByteString -> Ordering+compareComponent a b+  | a == b = EQ+  | allDigits a && allDigits b = compare (readInt a) (readInt b)+  -- "pre" sorts before everything else (Nix pre-release convention)+  | a == "pre" = LT+  | b == "pre" = GT+  | a == "" = LT+  | b == "" = GT+  -- Alphabetic components sort before numeric in Nix+  | isAlphaComp a && allDigits b = LT+  | allDigits a && isAlphaComp b = GT+  | otherwise = compare a b+  where+    allDigits t = not (BS.null t) && BC.all isDigit t+    isAlphaComp t = case BC.uncons t of+      Just (c, _) -> isVersionAlpha c+      Nothing -> False+    readInt :: BS.ByteString -> Int64+    readInt = BC.foldl' (\acc c -> acc * 10 + fromIntegral (digitToInt c)) (0 :: Int64)++splitVersionStr :: BS.ByteString -> [BS.ByteString]+splitVersionStr t+  | BS.null t = []+  | otherwise =+      let (component, rest) = spanComponent t+       in component : splitVersionAfterComponent rest++splitVersionAfterComponent :: BS.ByteString -> [BS.ByteString]+splitVersionAfterComponent t = case BC.uncons t of+  Nothing -> []+  -- '.' and '-' are both component separators in Nix's version grammar, so a+  -- '-' is skipped, not emitted as a one-character component.+  Just (sep, rest) | sep == '.' || sep == '-' -> splitVersionStr rest+  Just _ -> splitVersionStr t++spanComponent :: BS.ByteString -> (BS.ByteString, BS.ByteString)+spanComponent t = case BC.uncons t of+  Nothing -> ("", "")+  Just (c, rest)+    | isDigit c -> BC.span isDigit t+    | isVersionAlpha c -> BC.span isVersionAlpha t+    | otherwise -> (BS.take 1 t, rest)++builtinSplitVersion :: (MonadEval m) => NixValue -> m NixValue+builtinSplitVersion (VStr s _) =+  pure (VList (clistFromThunks (map (thunkToCPtr . evaluated . mkStrBytes) (splitVersionComponents s))))+builtinSplitVersion other =+  throwEvalError ("builtins.splitVersion: expected a string, got " <> typeName other)++splitVersionComponents :: BS.ByteString -> [BS.ByteString]+splitVersionComponents t = case BC.uncons t of+  Nothing -> []+  Just ('.', rest) -> splitVersionComponents rest+  Just (c, _)+    | isDigit c ->+        let (digits, rest) = BC.span isDigit t+         in digits : splitVersionComponents rest+    | isVersionAlpha c ->+        let (alpha, rest) = BC.span isVersionAlpha t+         in alpha : splitVersionComponents rest+    | otherwise ->+        -- Non-alphanumeric separator byte (e.g. '-', '_'): consume it+        splitVersionComponents (BS.drop 1 t)++builtinParseDrvName :: (MonadEval m) => NixValue -> m NixValue+builtinParseDrvName (VStr s _) =+  let (name, version) = parseName s+   in pure+        ( VAttrs+            ( attrSetFromMap $+                Map.fromList+                  [ ("name", evaluated (mkStrBytes name)),+                    ("version", evaluated (mkStrBytes version))+                  ]+            )+        )+builtinParseDrvName other =+  throwEvalError ("builtins.parseDrvName: expected a string, got " <> typeName other)++parseName :: BS.ByteString -> (BS.ByteString, BS.ByteString)+parseName t =+  case findVersionDash t 0 of+    Nothing -> (t, "")+    Just idx -> (BS.take idx t, BS.drop (idx + 1) t)++findVersionDash :: BS.ByteString -> Int -> Maybe Int+findVersionDash t idx = case BC.uncons (BS.drop idx t) of+  Nothing -> Nothing+  Just ('-', after)+    | Just (d, _) <- BC.uncons after,+      isDigit d ->+        Just idx+  Just _ -> findVersionDash t (idx + 1)++-- ---------------------------------------------------------------------------+-- Builtin implementations - serialization + hashing+-- ---------------------------------------------------------------------------++builtinToJSON :: (MonadEval m) => NixValue -> m NixValue+builtinToJSON val = do+  (json, ctx) <- valueToJSON val+  pure (VStr (TE.encodeUtf8 json) ctx)++-- | JSON is built as 'Text' and encoded once at the top: upstream's+-- serializer (nlohmann) REJECTS invalid UTF-8, so string payloads decode+-- strictly here and invalid bytes are an eval error, matching upstream.+valueToJSON :: (MonadEval m) => NixValue -> m (Text, StringContext)+valueToJSON VNull = pure ("null", emptyContext)+valueToJSON (VBool True) = pure ("true", emptyContext)+valueToJSON (VBool False) = pure ("false", emptyContext)+valueToJSON (VInt n) = pure (T.pack (show n), emptyContext)+valueToJSON (VFloat f)+  -- upstream's serializer (nlohmann dump) writes a non-finite float as null+  | isNaN f || isInfinite f = pure ("null", emptyContext)+  | otherwise = pure (formatJsonFloat f, emptyContext)+valueToJSON (VStr s ctx) = do+  decoded <- decodedText "builtins.toJSON" s+  pure (jsonEscapeString decoded, ctx)+valueToJSON (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  vals <- mapM force thunks+  results <- mapM valueToJSON vals+  let jsonVals = map fst results+      ctx = mconcat (map snd results)+  pure ("[" <> T.intercalate "," jsonVals <> "]", ctx)+valueToJSON (VAttrs attrs) =+  -- C++ Nix serializes an attrset via __toString first, then outPath, and only+  -- falls back to an object when neither is present.+  case (attrSetLookup "__toString" attrs, attrSetLookup "outPath" attrs) of+    (Nothing, Nothing) -> do+      let m = attrSetToMap attrs+          sortedKeys = Map.keys m+      results <- mapM (jsonPair m) sortedKeys+      let pairs = map fst results+          ctx = mconcat (map snd results)+      pure ("{" <> T.intercalate "," pairs <> "}", ctx)+    _ -> do+      (s, ctx) <- coerceToString True force applyValue coercePathToStore (VAttrs attrs)+      decoded <- decodedText "builtins.toJSON" s+      pure (jsonEscapeString decoded, ctx)+  where+    jsonPair attrMap key = case Map.lookup key attrMap of+      Nothing -> pure ("", emptyContext)+      Just thunk -> do+        val <- force thunk+        (jsonVal, ctx) <- valueToJSON val+        pure (jsonEscapeString key <> ":" <> jsonVal, ctx)+-- A path serializes as its source store path, with context - the same+-- copy-to-store coercion as interpolation (upstream value-to-json.cc+-- serializes paths with copyToStore = true).+valueToJSON (VPath p) = do+  (spText, ctx) <- sourcePathWithContext p+  pure (jsonEscapeString spText, ctx)+valueToJSON (VLambda {}) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"+valueToJSON (VBuiltin _ _) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"+valueToJSON (VDerivation _) = throwEvalError "builtins.toJSON: cannot convert a derivation to JSON"+valueToJSON (VCompiledRegex _) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"++jsonEscapeString :: Text -> Text+jsonEscapeString s = "\"" <> T.concatMap escapeChar s <> "\""+  where+    escapeChar '"' = "\\\""+    escapeChar '\\' = "\\\\"+    escapeChar '\n' = "\\n"+    escapeChar '\r' = "\\r"+    escapeChar '\t' = "\\t"+    escapeChar c+      | ord c < 0x20 = "\\u" <> T.pack (padHex 4 (showHex' (ord c)))+      | otherwise = T.singleton c+    padHex n str = replicate (n - length str) '0' ++ str+    showHex' 0 = "0"+    showHex' num = go num ""+      where+        go 0 acc = acc+        go v acc =+          let (q, r) = quotRem v 16+           in go q (hexDigit r : acc)++-- | Safe hex digit lookup (total for 0-15).+hexDigit :: Int -> Char+hexDigit n+  | n >= 0 && n <= 9 = chr (ord '0' + n)+  | n >= 10 && n <= 15 = chr (ord 'a' + n - 10)+  | otherwise = '?' -- unreachable for valid hex++builtinFromJSON :: (MonadEval m) => NixValue -> m NixValue+builtinFromJSON (VStr s _) = do+  -- JSON input must be valid UTF-8 (upstream's parser rejects it too).+  decoded <- decodedText "builtins.fromJSON" s+  case parseJSON (T.strip decoded) of+    Just (val, rest)+      | T.null (T.strip rest) -> pure val+      | otherwise -> throwEvalError "builtins.fromJSON: trailing content after JSON value"+    Nothing -> throwEvalError "builtins.fromJSON: invalid JSON"+builtinFromJSON other =+  throwEvalError ("builtins.fromJSON: expected a string, got " <> typeName other)++parseJSON :: Text -> Maybe (NixValue, Text)+parseJSON t = case T.uncons (T.stripStart t) of+  Nothing -> Nothing+  Just ('n', rest)+    | Just suffix <- T.stripPrefix "ull" rest -> Just (VNull, suffix)+  Just ('t', rest)+    | Just suffix <- T.stripPrefix "rue" rest -> Just (VBool True, suffix)+  Just ('f', rest)+    | Just suffix <- T.stripPrefix "alse" rest -> Just (VBool False, suffix)+  Just ('"', _) -> parseJSONString (T.stripStart t)+  Just ('[', rest) -> parseJSONArray rest+  Just ('{', rest) -> parseJSONObject rest+  Just (c, _)+    | c == '-' || isDigit c -> parseJSONNumber (T.stripStart t)+  _ -> Nothing++parseJSONString :: Text -> Maybe (NixValue, Text)+parseJSONString t = case T.uncons t of+  Just ('"', rest) ->+    let (strVal, remaining) = parseJSONStringContent rest+     in Just (mkStr strVal, remaining)+  _ -> Nothing++-- | Parse JSON string content, O(n) via chunk list + T.concat.+parseJSONStringContent :: Text -> (Text, Text)+parseJSONStringContent = go []+  where+    go !chunks t = case T.uncons t of+      Nothing -> (T.concat (reverse chunks), "")+      Just ('"', rest) -> (T.concat (reverse chunks), rest)+      Just ('\\', rest) -> case T.uncons rest of+        Just ('"', r) -> go ("\"" : chunks) r+        Just ('\\', r) -> go ("\\" : chunks) r+        Just ('/', r) -> go ("/" : chunks) r+        Just ('n', r) -> go ("\n" : chunks) r+        Just ('r', r) -> go ("\r" : chunks) r+        Just ('t', r) -> go ("\t" : chunks) r+        Just ('u', r) -> case parseHex4 r of+          Just (hi, r2)+            -- UTF-16 surrogate pair: high surrogate followed by \uXXXX low+            | hi >= 0xD800 && hi <= 0xDBFF ->+                case T.stripPrefix "\\u" r2 of+                  Just r3 -> case parseHex4 r3 of+                    Just (lo, r4)+                      | lo >= 0xDC00 && lo <= 0xDFFF ->+                          let combined = 0x10000 + (hi - 0xD800) * 0x400 + (lo - 0xDC00)+                           in go (T.singleton (chr combined) : chunks) r4+                    _ -> go (T.singleton (chr hi) : chunks) r2+                  Nothing -> go (T.singleton (chr hi) : chunks) r2+          Just (codepoint, r2) ->+            go (T.singleton (chr codepoint) : chunks) r2+          Nothing -> go ("u" : chunks) r+        _ -> (T.concat (reverse chunks), rest)+      Just (c, rest) -> go (T.singleton c : chunks) rest++parseHex4 :: Text -> Maybe (Int, Text)+parseHex4 t+  | T.length t >= 4 =+      let hex = T.take 4 t+       in if T.all isHexDigit hex+            then Just (readHex4 hex, T.drop 4 t)+            else Nothing+  | otherwise = Nothing++readHex4 :: Text -> Int+readHex4 = T.foldl' (\acc c -> acc * 16 + digitToInt c) 0++parseJSONNumber :: Text -> Maybe (NixValue, Text)+parseJSONNumber t =+  let (numStr, rest) = T.span (\c -> isDigit c || c == '.' || c == '-' || c == 'e' || c == 'E' || c == '+') t+   in if T.null numStr+        then Nothing+        else+          if T.any (\c -> c == '.' || c == 'e' || c == 'E') numStr+            then case reads (T.unpack numStr) :: [(Double, String)] of+              [(d, "")] -> Just (VFloat d, rest)+              _ -> Nothing+            else case reads (T.unpack numStr) :: [(Integer, String)] of+              [(n, "")] -> Just (jsonInteger n, rest)+              _ -> Nothing++-- | Nix value for a JSON integer literal, as upstream's nlohmann-based+-- parser produces it: a value in int64 range is an int; a positive value+-- that fits only uint64 still arrives as an int (nlohmann hands it over+-- unsigned, upstream stores it into the signed NixInt, two's-complement);+-- anything wider than 64 bits falls back to a float.+jsonInteger :: Integer -> NixValue+jsonInteger n+  | n >= toInteger (minBound :: Int64) && n <= toInteger (maxBound :: Word64) = VInt (fromInteger n)+  | otherwise = VFloat (fromInteger n)++parseJSONArray :: Text -> Maybe (NixValue, Text)+parseJSONArray t = parseJSONArrayElements (T.stripStart t) []++parseJSONArrayElements :: Text -> [Thunk] -> Maybe (NixValue, Text)+parseJSONArrayElements t acc = case T.uncons (T.stripStart t) of+  Just (']', rest) -> Just (VList (clistFromThunks (map thunkToCPtr (reverse acc))), rest)+  _ -> case parseJSON t of+    Just (val, rest) ->+      let stripped = T.stripStart rest+       in case T.uncons stripped of+            Just (',', rest2) -> parseJSONArrayElements rest2 (evaluated val : acc)+            Just (']', rest2) -> Just (VList (clistFromThunks (map thunkToCPtr (reverse (evaluated val : acc)))), rest2)+            _ -> Nothing+    Nothing -> Nothing++parseJSONObject :: Text -> Maybe (NixValue, Text)+parseJSONObject t = parseJSONObjectEntries (T.stripStart t) Map.empty++parseJSONObjectEntries :: Text -> Map Text Thunk -> Maybe (NixValue, Text)+parseJSONObjectEntries t acc = case T.uncons (T.stripStart t) of+  Just ('}', rest) -> Just (VAttrs (attrSetFromMap acc), rest)+  -- Keys read via 'parseJSONStringContent' directly: they become attr+  -- names (Text), not string values.+  Just ('"', afterQuote) ->+    let (key, rest) = parseJSONStringContent afterQuote+     in case T.uncons (T.stripStart rest) of+          Just (':', rest2) -> case parseJSON rest2 of+            Just (val, rest3) ->+              let stripped = T.stripStart rest3+                  updated = Map.insert key (evaluated val) acc+               in case T.uncons stripped of+                    Just (',', rest4) -> parseJSONObjectEntries rest4 updated+                    Just ('}', rest4) -> Just (VAttrs (attrSetFromMap updated), rest4)+                    _ -> Nothing+            Nothing -> Nothing+          _ -> Nothing+  _ -> Nothing++builtinHashString :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinHashString (VStr algo _) (VStr input _) = do+  -- The payload IS the hashed bytes - no encode step, so a mid-codepoint+  -- substring hashes to the sha256 of exactly those bytes, as upstream.+  algoName <- decodedText "builtins.hashString" algo+  hashBytesWithAlgo "hashString" algoName input+builtinHashString (VStr _ _) other =+  throwEvalError ("builtins.hashString: expected a string, got " <> typeName other)+builtinHashString other _ =+  throwEvalError ("builtins.hashString: expected a string, got " <> typeName other)++digestToHex :: (BA.ByteArrayAccess a) => a -> Text+digestToHex = bytesToHexText . BA.convert++-- ---------------------------------------------------------------------------+-- Builtin implementations - deep evaluation+-- ---------------------------------------------------------------------------++builtinDeepSeq :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinDeepSeq first second = do+  deepForce first+  pure second++deepForce :: (MonadEval m) => NixValue -> m ()+deepForce (VList cl) = mapM_ ((force >=> deepForce) . Thunk) (clistThunks cl)+deepForce (VAttrs attrs) = mapM_ (force >=> deepForce) (attrSetElems attrs)+deepForce _ = pure ()++-- | @builtins.seq a b@ - evaluate @a@ to WHNF, then return @b@.+builtinSeq :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinSeq !_first = pure++-- | @builtins.trace msg val@ - print @msg@ to stderr, return @val@.+builtinTrace :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinTrace msgVal result = do+  msg <- case msgVal of+    VStr s _ -> pure (bytesToTextLossy s)+    other -> pure (showValueForTrace other)+  traceMessage ("trace: " <> msg)+  pure result++-- | @builtins.warn msg val@ - print warning to stderr, return @val@.+builtinWarn :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinWarn msgVal result = do+  msg <- case msgVal of+    VStr s _ -> pure (bytesToTextLossy s)+    other -> pure (showValueForTrace other)+  traceMessage ("warning: " <> msg)+  pure result++-- | Pretty-print a value for trace/warn, matching C++ Nix's printValue.+showValueForTrace :: NixValue -> Text+showValueForTrace (VInt n) = T.pack (show n)+showValueForTrace (VFloat f) = formatNixFloat f+showValueForTrace (VBool True) = "true"+showValueForTrace (VBool False) = "false"+showValueForTrace VNull = "null"+showValueForTrace (VPath p) = p+showValueForTrace other = "<<" <> typeName other <> ">>"++-- ---------------------------------------------------------------------------+-- Builtin implementations - graph traversal+-- ---------------------------------------------------------------------------++builtinGenericClosure :: (MonadEval m) => NixValue -> m NixValue+builtinGenericClosure (VAttrs attrs) = do+  startSetThunk <-+    maybe (throwEvalError "builtins.genericClosure: missing 'startSet'") pure $+      attrSetLookup "startSet" attrs+  operatorThunk <-+    maybe (throwEvalError "builtins.genericClosure: missing 'operator'") pure $+      attrSetLookup "operator" attrs+  startSetVal <- force startSetThunk+  operatorVal <- force operatorThunk+  case startSetVal of+    VList cl -> do+      let items = map Thunk (clistThunks cl)+      result <- closureLoop operatorVal (Seq.fromList items) [] []+      pure (VList (clistFromThunks (map (thunkToCPtr . evaluated) result)))+    _ -> throwEvalError "builtins.genericClosure: 'startSet' must be a list"+builtinGenericClosure other =+  throwEvalError ("builtins.genericClosure: expected a set, got " <> typeName other)++-- | BFS loop for genericClosure.  Uses Data.Sequence for O(1) queue+-- append (the old list-based version was O(n) per operator call).+-- seenKeys is still a linear scan - Nix value equality is monadic so+-- Set/HashMap is not directly applicable without specialising on key type.+closureLoop ::+  (MonadEval m) =>+  NixValue ->+  Seq Thunk ->+  [NixValue] ->+  [NixValue] ->+  m [NixValue]+closureLoop _ Empty _ acc = pure (reverse acc)+closureLoop operator (thunk :<| rest) seenKeys acc = do+  item <- force thunk+  key <- extractKey item+  alreadySeen <- keyInList key seenKeys+  if alreadySeen+    then closureLoop operator rest seenKeys acc+    else do+      newItems <- applyValue operator item+      case newItems of+        VList newCl ->+          closureLoop operator (rest <> Seq.fromList (map Thunk (clistThunks newCl))) (key : seenKeys) (item : acc)+        _ -> throwEvalError "builtins.genericClosure: operator must return a list"++extractKey :: (MonadEval m) => NixValue -> m NixValue+extractKey (VAttrs attrs) =+  case attrSetLookup "key" attrs of+    Just thunk -> force thunk+    Nothing -> throwEvalError "builtins.genericClosure: item missing 'key' attribute"+extractKey _ = throwEvalError "builtins.genericClosure: item must be a set with 'key'"++keyInList :: (MonadEval m) => NixValue -> [NixValue] -> m Bool+keyInList _ [] = pure False+keyInList key (seen : rest) = do+  eq <- nixEqual force key seen+  if eq then pure True else keyInList key rest++-- ---------------------------------------------------------------------------+-- IO builtins (delegate to MonadEval methods)+-- ---------------------------------------------------------------------------++-- | Coerce a value to a path 'Text'.  Accepts 'VPath' and 'VStr';+-- throws a type error for anything else.  A string operand is a byte+-- string naming a filesystem path, so it decodes strictly.+coerceToPath :: (MonadEval m) => Text -> NixValue -> m Text+coerceToPath _ (VPath p) = pure p+coerceToPath name (VStr s _) = decodedText ("builtins." <> name) s+coerceToPath name other =+  throwEvalError ("builtins." <> name <> ": expected a path or string, got " <> typeName other)++builtinImport :: (MonadEval m) => NixValue -> m NixValue+builtinImport (VPath p) = importFile p+builtinImport (VStr s _) = importFile =<< decodedText "import" s+builtinImport other =+  throwEvalError ("import: expected a path or string, got " <> typeName other)++builtinReadFile :: (MonadEval m) => NixValue -> m NixValue+builtinReadFile val = do+  p <- coerceToPath "readFile" val+  bytes <- readFileBytes p+  -- The value is the file's RAW BYTES, as upstream: no BOM stripping, no+  -- UTF-16 transcoding, no replacement characters (the auto-decode stays+  -- on the parser/import path only).  The only rejection is NUL, which a+  -- Nix string cannot represent upstream.+  when (BS.elem 0 bytes) $+    throwEvalError+      ("builtins.readFile: the contents of the file '" <> p <> "' cannot be represented as a Nix string")+  pure (mkStrBytes bytes)++builtinPathExists :: (MonadEval m) => NixValue -> m NixValue+builtinPathExists val = do+  p <- coerceToPath "pathExists" val+  VBool <$> doesPathExist p++builtinReadDir :: (MonadEval m) => NixValue -> m NixValue+builtinReadDir val = do+  p <- coerceToPath "readDir" val+  entries <- listDirectory p+  pure (VAttrs (attrSetFromMap (Map.fromList [(name, evaluated (mkStr fileType)) | (name, fileType) <- entries])))++-- ---------------------------------------------------------------------------+-- Builtin implementations - environment + paths+-- ---------------------------------------------------------------------------++builtinGetEnv :: (MonadEval m) => NixValue -> m NixValue+builtinGetEnv (VStr name _) = do+  varName <- decodedText "builtins.getEnv" name+  mkStr <$> getEnvVar varName+builtinGetEnv other =+  throwEvalError ("builtins.getEnv: expected a string, got " <> typeName other)++builtinToPath :: (MonadEval m) => NixValue -> m NixValue+builtinToPath (VPath p) = pure (VPath p)+builtinToPath (VStr rawBytes _) = do+  s <- decodedText "builtins.toPath" rawBytes+  case T.uncons s of+    Nothing -> throwEvalError "builtins.toPath: empty path"+    -- Canonicalized like every other path production site, as upstream.+    Just ('/', _) -> pure (VPath (canonPathValue s))+    Just _ -> throwEvalError ("builtins.toPath: path must be absolute, got " <> s)+builtinToPath other =+  throwEvalError ("builtins.toPath: expected a string or path, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - store path operations+-- ---------------------------------------------------------------------------++builtinPlaceholder :: (MonadEval m) => NixValue -> m NixValue+builtinPlaceholder (VStr outputName _) = do+  name <- decodedText "builtins.placeholder" outputName+  pure (mkStr (hashPlaceholder name))+builtinPlaceholder other =+  throwEvalError ("builtins.placeholder: expected a string, got " <> typeName other)++builtinStorePath :: (MonadEval m) => NixValue -> m NixValue+builtinStorePath (VPath p) = validateStorePath p+builtinStorePath (VStr s _) = validateStorePath =<< decodedText "builtins.storePath" s+builtinStorePath other =+  throwEvalError ("builtins.storePath: expected a path or string, got " <> typeName other)++-- | @builtins.storePath@ - mark an already-in-store path as such.  Upstream+-- returns a STRING carrying an Opaque (SCPlain) context entry for the enclosing+-- store path, NOT a bare path: the Opaque marker is what stops a later coercion+-- from re-serialising (re-NARing) the already-present path into a new store+-- path.  Returning a context-free path (the old behavior) re-copied the path on+-- coercion - a wrong store path on Unix, and a file-not-found on Windows, where+-- the canonical @/nix/store@ text is not the on-disk location.+validateStorePath :: (MonadEval m) => Text -> m NixValue+validateStorePath p = case enclosingStorePath p of+  Just sp -> pure (VStr (TE.encodeUtf8 p) (plainContext sp))+  Nothing -> throwEvalError ("builtins.storePath: not a valid store path: " <> p)++-- | The store path enclosing an absolute path under the store dir, or+-- 'Nothing' if the path is not in the store.  Accepts a bare store path and a+-- subpath (@\/nix\/store\/\<hash\>-\<name\>\/sub@ resolves to its+-- @\<hash\>-\<name\>@ component), the way upstream marks the enclosing store+-- path Opaque for either.  The component passes the same charset+-- validation as every other store-path parse boundary.+enclosingStorePath :: Text -> Maybe StorePath+enclosingStorePath p = do+  rest <- T.stripPrefix storeDirPrefix p+  parseStorePathBaseName (T.takeWhile (/= '/') rest)++-- ---------------------------------------------------------------------------+-- Builtin implementations - Nix search path+-- ---------------------------------------------------------------------------++builtinFindFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinFindFile (VList cl) (VStr name _) = do+  fileName <- decodedText "builtins.findFile" name+  let searchPath = map Thunk (clistThunks cl)+  entries <- mapM forceSearchEntry searchPath+  findFirst entries fileName+builtinFindFile (VList _) other =+  throwEvalError ("builtins.findFile: expected a string, got " <> typeName other)+builtinFindFile other _ =+  throwEvalError ("builtins.findFile: expected a list, got " <> typeName other)++-- | Extract {prefix, path} from a search path entry thunk.+forceSearchEntry :: (MonadEval m) => Thunk -> m (Text, Text)+forceSearchEntry thunk = do+  val <- force thunk+  case val of+    VAttrs attrs -> do+      prefixThunk <-+        maybe (throwEvalError "builtins.findFile: entry missing 'prefix'") pure $+          attrSetLookup "prefix" attrs+      pathThunk <-+        maybe (throwEvalError "builtins.findFile: entry missing 'path'") pure $+          attrSetLookup "path" attrs+      prefixVal <- force prefixThunk+      pathVal <- force pathThunk+      prefix <- case prefixVal of+        VStr s _ -> decodedText "builtins.findFile" s+        _ -> throwEvalError "builtins.findFile: 'prefix' must be a string"+      path <- case pathVal of+        VStr s _ -> decodedText "builtins.findFile" s+        VPath s -> pure s+        _ -> throwEvalError "builtins.findFile: 'path' must be a string or path"+      pure (prefix, path)+    _ -> throwEvalError "builtins.findFile: search path entry must be a set"++-- | Iterate search path entries, checking for a match.+-- A miss is a CATCHABLE error (upstream raises ThrownError here):+-- nixpkgs' impure.nix wraps @<nixpkgs-overlays>@ in @tryEval@ and+-- relies on catching the miss.+findFirst :: (MonadEval m) => [(Text, Text)] -> Text -> m NixValue+findFirst [] name =+  throwCatchableError ("file '" <> name <> "' was not found in the Nix search path")+findFirst ((prefix, path) : rest) name+  | prefix == name || (not (T.null prefix) && (prefix <> "/") `T.isPrefixOf` name) =+      let suffix = if prefix == name then "" else T.drop (T.length prefix + 1) name+          candidate = canonPathValue (if T.null suffix then path else path <> "/" <> suffix)+       in do+            exists <- doesPathExist candidate+            if exists+              then pure (VPath candidate)+              else findFirst rest name+  | T.null prefix =+      let candidate = canonPathValue (path <> "/" <> name)+       in do+            exists <- doesPathExist candidate+            if exists+              then pure (VPath candidate)+              else findFirst rest name+  | otherwise = findFirst rest name++-- ---------------------------------------------------------------------------+-- Builtin implementations - store file creation+-- ---------------------------------------------------------------------------++builtinToFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinToFile (VStr name _) (VStr contents ctx) = do+  fileName <- decodedText "builtins.toFile" name+  refs <- toFileRefs ctx+  -- The contents are stored (and hashed) as their raw bytes.+  storePath <- writeToStore fileName contents refs+  -- Upstream returns a STRING whose context is the new path itself; the+  -- refs travel through the store path computation, not the eval context.+  let selfContext = maybe emptyContext plainContext (parseStorePath defaultStoreDir storePath)+  pure (VStr (TE.encodeUtf8 storePath) selfContext)+builtinToFile (VStr _ _) other =+  throwEvalError ("builtins.toFile: expected a string, got " <> typeName other)+builtinToFile other _ =+  throwEvalError ("builtins.toFile: expected a string, got " <> typeName other)++-- | The store-path references a toFile output may carry: the contents'+-- plain-path context, in sorted order.  A derivation-output reference is+-- an error, exactly as upstream ("files created by builtins.toFile may+-- not reference derivations").+toFileRefs :: (MonadEval m) => StringContext -> m [StorePath]+toFileRefs (StringContext elems) = mapM refOf (Set.toAscList elems)+  where+    refOf (SCPlain sp) = pure sp+    refOf (SCDrvOutput _ _) =+      throwEvalError "builtins.toFile: files created by toFile may not reference derivations"+    refOf (SCAllOutputs _) =+      throwEvalError "builtins.toFile: files created by toFile may not reference derivations"++-- ---------------------------------------------------------------------------+-- Builtin implementations - scoped import+-- ---------------------------------------------------------------------------++builtinScopedImport :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinScopedImport (VAttrs attrs) pathVal = do+  p <- coerceToPath "scopedImport" pathVal+  let scope = Map.toList (attrSetToMap attrs)+  scopedImportFile scope p+builtinScopedImport other _ =+  throwEvalError ("builtins.scopedImport: expected a set, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - network fetchers+-- ---------------------------------------------------------------------------++builtinFetchurl :: (MonadEval m) => NixValue -> m NixValue+builtinFetchurl (VStr url _) = do+  urlText <- decodedText "builtins.fetchurl" url+  fetchUrlSimple urlText Nothing+builtinFetchurl (VAttrs attrs) = do+  url <- forceAttrStr "builtins.fetchurl" "url" attrs+  sha256 <- forceOptionalAttrStr attrs "sha256"+  fetchUrlSimple url sha256+builtinFetchurl other =+  throwEvalError ("builtins.fetchurl: expected a string or set, got " <> typeName other)++builtinFetchTarball :: (MonadEval m) => NixValue -> m NixValue+builtinFetchTarball (VStr url _) = do+  urlText <- decodedText "builtins.fetchTarball" url+  fetchAndExtractTarball urlText Nothing tarballSourceName+builtinFetchTarball (VAttrs attrs) = do+  url <- forceAttrStr "builtins.fetchTarball" "url" attrs+  sha256 <- forceOptionalAttrStr attrs "sha256"+  nameOverride <- forceOptionalAttrStr attrs "name"+  fetchAndExtractTarball url sha256 (fromMaybe tarballSourceName nameOverride)+builtinFetchTarball other =+  throwEvalError ("builtins.fetchTarball: expected a string or set, got " <> typeName other)++-- | Upstream's default store name for fetched source trees.+tarballSourceName :: Text+tarballSourceName = "source"++-- | Download a tarball, extract it, verify the optional sha256 pin, and+-- copy the tree to its content-addressed store path.  The pin is the+-- recursive NAR hash of the EXTRACTED tree, as upstream.  Download and+-- extraction share one shell pipeline to avoid binary-as-text encoding+-- issues.  The scratch dir is exclusively created with an unpredictable+-- name ('createScratchDir') and removed once the tree reaches the store.+fetchAndExtractTarball :: (MonadEval m) => Text -> Maybe Text -> Text -> m NixValue+fetchAndExtractTarball url mSha256 name = do+  extractDir <- createScratchDir "nova-nix-tarball-"+  -- The -- separator prevents argument injection from the URL.+  (code, _, errOut) <-+    runProcess+      "sh"+      [ "-c",+        "curl -sSfL -- \"$1\" | tar -xz -C \"$2\" --strip-components=1",+        "--",+        url,+        extractDir+      ]+      ""+  case code of+    0 -> do+      pin <- traverse (decodeSha256Pin "builtins.fetchTarball") mSha256+      storePath <-+        copyPathToStore+          extractDir+          name+          (fmap ("builtins.fetchTarball: " <> url,) pin)+      removeScratchDir extractDir+      pure (VPath storePath)+    _ -> do+      removeScratchDir extractDir+      throwEvalError ("builtins.fetchTarball: " <> errOut)++-- | Transports 'builtinFetchGit' accepts.  Also spelled into the+-- clone's @protocol.*.allow@ config, so git enforces the same set+-- internally.+allowedGitSchemes :: [Text]+allowedGitSchemes = ["http", "https", "ssh", "git", "file"]++-- | Validate a fetchGit URL's transport before anything spawns.  git's+-- transport-helper syntax (@\<helper\>::\<address\>@) makes the helper+-- name a command to run as the transport (@ext::@ runs a shell command,+-- @fd::@ reads a descriptor), so evaluating an expression carrying such+-- a URL would execute it.  Accepted: an allowlisted explicit scheme, an+-- scp-like remote, or a local path.  Left carries the eval-error text.+checkGitUrl :: Text -> Either Text Text+checkGitUrl url+  | T.null url = Left "builtins.fetchGit: empty url"+  | not (T.null schemeRest),+    schemeShaped scheme,+    T.toLower scheme `elem` allowedGitSchemes =+      Right url+  | not (T.null schemeRest) = Left (disallowed scheme)+  | Just helper <- helperPrefix = Left (disallowed helper)+  | otherwise = Right url+  where+    (scheme, schemeRest) = T.breakOn "://" url+    -- RFC 3986 scheme shape; anything else before :// is not a scheme.+    schemeShaped s = case T.uncons s of+      Just (leading, rest) -> asciiAlpha leading && T.all schemeChar rest+      Nothing -> False+    schemeChar c = asciiAlpha c || isDigit c || c == '+' || c == '-' || c == '.'+    asciiAlpha c = isAsciiLower c || isAsciiUpper c+    -- <helper>:: counts only when the prefix is shaped like a helper+    -- name; "[::1]"-style scp hosts contain :: but are not helpers.+    helperPrefix = case T.breakOn "::" url of+      (prefix, rest)+        | not (T.null rest),+          T.null prefix || T.all helperChar prefix ->+            Just prefix+      _ -> Nothing+    helperChar c = asciiAlpha c || isDigit c || c == '-' || c == '_'+    disallowed t =+      "builtins.fetchGit: transport '" <> t <> "' is not allowed in url: " <> url++-- | What @git fetch@ asks for when the caller pinned no @ref@: the+-- remote's default branch.+defaultFetchRef :: Text+defaultFetchRef = "HEAD"++-- | What @git checkout@ resolves when the caller pinned no @rev@: the+-- tip of whatever the fetch just brought down.+fetchHeadRef :: Text+fetchHeadRef = "FETCH_HEAD"++-- | Characters upstream's @refRegexS@ allows after the first one.+gitRefTrailingPunctuation :: [Char]+gitRefTrailingPunctuation = "_./@+-"++-- | Validate a @ref@ against upstream's @refRegexS@+-- (@[a-zA-Z0-9\@][a-zA-Z0-9_.\/\@+-]*@).  The leading class excludes+-- @-@, and that is the load-bearing part: git parses options after the+-- remote name, so a @ref@ of @--upload-pack=\<cmd\>@ names the command+-- git runs as the transport.  Left carries the eval-error text.+checkGitRef :: Text -> Either Text Text+checkGitRef ref = case T.uncons ref of+  Just (leading, rest)+    | refLeadChar leading,+      T.all refChar rest ->+        Right ref+  _ -> Left ("builtins.fetchGit: ref is not a valid git ref name: " <> ref)+  where+    refLeadChar c = asciiAlphaNum c || c == '@'+    refChar c = asciiAlphaNum c || c `elem` gitRefTrailingPunctuation+    asciiAlphaNum c = isAsciiLower c || isAsciiUpper c || isDigit c++-- | Hex characters in a full SHA-1.+gitRevHexLength :: Int+gitRevHexLength = 40++-- | Validate a @rev@ against upstream's @revRegexS@ (@[0-9a-fA-F]{40}@).+-- Upstream parses it as a SHA-1 @Hash@ before it reaches git, which+-- rejects a tag or an abbreviated prefix as well as a leading @-@: a+-- \"pinned\" fetch that still resolves through git's DWIM rules is not+-- pinned.  Left carries the eval-error text.+checkGitRev :: Text -> Either Text Text+checkGitRev rev+  | T.length rev == gitRevHexLength,+    T.all isHexDigit rev =+      Right rev+  | otherwise = Left ("builtins.fetchGit: rev is not a full SHA-1: " <> rev)++-- | @-c@ config pinning the clone to 'allowedGitSchemes': every+-- transport defaults to never, each allowed scheme is re-enabled.  This+-- enforces what URL validation cannot see up front - a helper reached+-- indirectly, or a @remote-\<helper\>@ binary on PATH.+gitTransportConfig :: [Text]+gitTransportConfig =+  [ "-c",+    "protocol.allow=never",+    -- Keep checkout bytes platform-independent: no CRLF rewriting.+    "-c",+    "core.autocrlf=false",+    "-c",+    "core.eol=lf",+    -- Fail loudly rather than hash a symlink as a plain file (Git for+    -- Windows' fallback when it can't create real symlinks).+    "-c",+    "core.symlinks=true"+  ]+    ++ concat [["-c", "protocol." <> scheme <> ".allow=always"] | scheme <- allowedGitSchemes]++-- | The parsed arguments of a @builtins.fetchGit@ call.  A record+-- rather than positional threading: eight independent knobs invite+-- transposition, and the names keep every site readable.+data FetchGitArgs = FetchGitArgs+  { fgaUrl :: !Text,+    fgaName :: !Text,+    fgaRef :: !(Maybe Text),+    fgaRev :: !(Maybe Text),+    fgaSubmodules :: !Bool,+    fgaShallow :: !Bool,+    fgaAllRefs :: !Bool,+    fgaNarHash :: !(Maybe Text)+  }++-- | The attributes @builtins.fetchGit@ accepts.  Anything outside the+-- set is an error rather than a silent drop - an ignored attribute is+-- exactly how an unhonored pin stays invisible.  Upstream refuses the+-- same way ("input attribute '...' not supported by scheme 'git'",+-- observed from nix-instantiate 2.33.2).+fetchGitSupportedAttrs :: [Text]+fetchGitSupportedAttrs = ["url", "name", "ref", "rev", "submodules", "shallow", "allRefs", "narHash"]++builtinFetchGit :: (MonadEval m) => NixValue -> m NixValue+builtinFetchGit (VStr rawUrl _) = do+  url <- decodedText "builtins.fetchGit" rawUrl+  fetchGit+    FetchGitArgs+      { fgaUrl = url,+        fgaName = "source",+        fgaRef = Nothing,+        fgaRev = Nothing,+        fgaSubmodules = False,+        fgaShallow = False,+        fgaAllRefs = False,+        fgaNarHash = Nothing+      }+builtinFetchGit (VAttrs attrs) = do+  case filter (`notElem` fetchGitSupportedAttrs) (Map.keys (attrSetToMap attrs)) of+    (unsupported : _) ->+      throwEvalError ("builtins.fetchGit: attribute '" <> unsupported <> "' not supported")+    [] -> pure ()+  url <- forceAttrStr "builtins.fetchGit" "url" attrs+  name <- fromMaybe "source" <$> forceOptionalAttrStr attrs "name"+  ref <- forceOptionalAttrStr attrs "ref"+  rev <- forceOptionalAttrStr attrs "rev"+  submodules <- forceOptionalAttrBool "builtins.fetchGit" attrs "submodules" False+  shallow <- forceOptionalAttrBool "builtins.fetchGit" attrs "shallow" False+  allRefs <- forceOptionalAttrBool "builtins.fetchGit" attrs "allRefs" False+  narHash <- forceOptionalAttrStr attrs "narHash"+  fetchGit+    FetchGitArgs+      { fgaUrl = url,+        fgaName = name,+        fgaRef = ref,+        fgaRev = rev,+        fgaSubmodules = submodules,+        fgaShallow = shallow,+        fgaAllRefs = allRefs,+        fgaNarHash = narHash+      }+builtinFetchGit other =+  throwEvalError ("builtins.fetchGit: expected a string or set, got " <> typeName other)++-- | Fetch one revision into the store; returns upstream's @fetchGit@+-- attrset (@outPath@, @rev@, @shortRev@, @revCount@, @submodules@,+-- @lastModified@, @lastModifiedDate@, @narHash@).  @ref@ and @rev@ are+-- validated to upstream's shapes before they reach git (see+-- 'checkGitRef' and 'checkGitRev'); neither may lead with @-@.+fetchGit :: (MonadEval m) => FetchGitArgs -> m NixValue+fetchGit args =+  case (,,) <$> checkGitUrl (fgaUrl args) <*> traverse checkGitRef (fgaRef args) <*> traverse checkGitRev (fgaRev args) of+    Left err -> throwEvalError err+    Right (url, checkedRef, checkedRev) -> do+      let name = fgaName args+          submodules = fgaSubmodules args+          shallow = fgaShallow args+      -- Only a pinned rev is cached: a bare ref means "whatever this branch+      -- points at now", which a note taken earlier cannot answer.+      cached <- case checkedRev of+        Nothing -> pure Nothing+        Just rev -> do+          entry <- lookupFetchCache (fetchCacheKey url name rev submodules shallow)+          case entry >>= decodeFetchCache of+            Nothing -> pure Nothing+            Just fields -> do+              -- The note is only good while the tree it names is still+              -- there, and a hit has to re-record the write the fetch it+              -- stands in for would have recorded: on disk and registered+              -- are different facts, and a derivation naming an+              -- unregistered outPath fails to build.+              adopted <- adoptStorePath (fcStorePath fields)+              pure (if adopted then Just fields else Nothing)+      fields <- case cached of+        Just hit -> pure hit+        Nothing -> fetchGitUncached args {fgaUrl = url} checkedRef checkedRev+      -- A declared narHash pins the tree; a mismatch is an error on the+      -- hit and fresh paths alike, never a silent recompute.  Upstream's+      -- orientation: "expected" is what the fetch produced, "got" is the+      -- declared pin (observed from nix-instantiate 2.33.2).+      case fgaNarHash args of+        Nothing -> pure ()+        Just declared ->+          let computed = "sha256-" <> fcNarHash fields+           in unless (declared == computed) $+                throwEvalError+                  ("builtins.fetchGit: NAR hash mismatch in '" <> url <> "', expected '" <> computed <> "' but got '" <> declared <> "'")+      pure (fetchGitResult submodules fields)++-- | The fetch-everything refspec @allRefs@ selects, upstream's exact+-- spelling: every remote ref lands under the same local name, so a+-- pinned rev reachable from ANY ref becomes fetchable even when the+-- remote refuses a direct SHA want.+allRefsFetchSpec :: Text+allRefsFetchSpec = "refs/*:refs/*"++-- | The fetch itself, when nothing is remembered about it.  @checkedRef@+-- and @checkedRev@ have already passed 'checkGitRef'\/'checkGitRev'.+-- The scratch clone is removed on success once the tree is copied out,+-- and by 'onEvalError' when any step throws: a failing fetch must not+-- leave the clone behind.+fetchGitUncached :: (MonadEval m) => FetchGitArgs -> Maybe Text -> Maybe Text -> m FetchCache+fetchGitUncached args checkedRef checkedRev = do+  cloneDir <- createScratchDir "nova-nix-fetchgit-"+  fetchGitInClone args checkedRef checkedRev cloneDir+    `onEvalError` removeScratchDir cloneDir++-- | Every step of an uncached fetch that can throw, run under+-- 'fetchGitUncached''s scratch-dir cleanup.+fetchGitInClone :: (MonadEval m) => FetchGitArgs -> Maybe Text -> Maybe Text -> Text -> m FetchCache+fetchGitInClone args checkedRef checkedRev cloneDir = do+  let ctx = "builtins.fetchGit"+      git = gitRun ctx cloneDir+      url = fgaUrl args+      name = fgaName args+      submodules = fgaSubmodules args+      shallow = fgaShallow args+      depthArgs = if shallow then ["--depth", "1"] else []+      -- An allRefs fetch writes every remote ref, including the one the+      -- scratch clone's unborn HEAD names, which git refuses in a repo+      -- with a worktree (upstream fetches into a BARE cache repo and+      -- never hits this).  The refusal protects a checked-out branch+      -- from moving under the worktree; the explicit checkout below+      -- replaces the worktree state anyway, so allowing it is safe.+      updateHeadArgs = ["--update-head-ok" | fgaAllRefs args]+      -- Upstream's refspec ternary, in its order.  @allRefs@ fetches+      -- everything.  Otherwise a pinned rev is itself the refspec: a+      -- depth-1 fetch of a branch tip cannot contain any other revision,+      -- so asking the remote for the SHA is what lets @shallow@ and+      -- @rev@ compose (and what finds a rev not on the fetched ref).  A+      -- server may refuse a SHA it does not advertise; that surfaces as+      -- git's own fetch error, the same surface upstream has, and+      -- @allRefs = true@ is the caller's way around it.+      fetchTarget+        | fgaAllRefs args = allRefsFetchSpec+        | Just pinned <- checkedRev = pinned+        | otherwise = fromMaybe defaultFetchRef checkedRef+      -- The pinned rev when there is one; under an allRefs fetch with+      -- only a ref, that ref (FETCH_HEAD after a refs/* fetch is+      -- whichever ref arrived last, not the named one); otherwise+      -- whatever the fetch brought down.+      checkoutTarget = case (checkedRev, fgaAllRefs args, checkedRef) of+        (Just pinned, _, _) -> pinned+        (Nothing, True, Just ref) -> ref+        _ -> fetchHeadRef+  _ <- git ["init", "--quiet", "."]+  _ <- git ["remote", "add", "origin", "--", url]+  -- @--@ before the remote: git keeps parsing options after it, so+  -- without a separator a refspec is indistinguishable from a flag.+  _ <- git (["fetch", "--quiet"] ++ depthArgs ++ updateHeadArgs ++ ["--", "origin", fetchTarget])+  -- Trailing @--@, not leading: @git checkout -- X@ reads X as a+  -- pathspec, the opposite of what a leading separator means elsewhere.+  _ <- git ["checkout", "--quiet", checkoutTarget, "--"]+  when submodules $+    void (git ["submodule", "update", "--init", "--recursive"])+  markExecutablesFromIndex ctx cloneDir+  rev <- git ["rev-parse", "HEAD"]+  -- Truncated history cannot answer rev-list: the count would be the+  -- fetch depth, not the revision's depth, and @revCount@ can reach a+  -- derivation's environment.  Upstream reports 0 under @shallow@ (its+  -- fetcher skips computing the attribute and eval fills the default;+  -- observed from nix-instantiate 2.33.2), so 0 is recorded here and+  -- cache hits replay it.+  revCount <-+    if shallow+      then pure 0+      else decodeDecimal ctx =<< git ["rev-list", "--count", "HEAD"]+  lastModifiedText <- git ["show", "-s", "--format=%ct", "HEAD"]+  removeGitMetadata ctx cloneDir+  storePath <- copyPathToStore cloneDir name Nothing+  narHash <- narHashOfPath cloneDir+  removeScratchDir cloneDir+  lastModified <- decodeDecimal ctx lastModifiedText+  let fields =+        FetchCache+          { fcStorePath = storePath,+            fcRev = rev,+            fcRevCount = revCount,+            fcLastModified = lastModified,+            fcNarHash = bytesToBase64 narHash+          }+  -- Remembered only for a pinned revision; see fetchGit.  @allRefs@ is+  -- deliberately not in the key: it changes only whether a fetch can+  -- succeed, never what a given revision's entry holds.+  case checkedRev of+    Nothing -> pure ()+    Just pinned -> writeFetchCache (fetchCacheKey url name pinned submodules shallow) (encodeFetchCache fields)+  pure fields++-- | Mark every file git records as executable (mode 100755) in the+-- checked-out tree.  A no-op on Unix; on Windows the mode has nowhere to+-- live on disk, so it's read back from the index before @.git@ is stripped.+markExecutablesFromIndex :: (MonadEval m) => Text -> Text -> m ()+markExecutablesFromIndex ctx cloneDir = do+  listing <- gitRun ctx cloneDir ["ls-files", "--recurse-submodules", "--stage", "-z"]+  mapM_ markOne (T.split (== '\0') listing)+  where+    markOne row+      | Just rest <- T.stripPrefix "100755 " row,+        (_, tabbed) <- T.breakOn "\t" rest,+        Just relPath <- T.stripPrefix "\t" tabbed,+        not (T.null relPath) =+          setExecutableFile (cloneDir <> "/" <> relPath)+      | otherwise = pure ()++-- | What @builtins.fetchGit@ hands back, from the few facts about a fetch+-- that are worth keeping.  Shared by the fetch and by the cache, so the two+-- cannot describe the same tree differently.+data FetchCache = FetchCache+  { fcStorePath :: !Text,+    fcRev :: !Text,+    fcRevCount :: !Integer,+    fcLastModified :: !Integer,+    fcNarHash :: !Text+  }+  deriving (Eq, Show)++fetchGitResult :: Bool -> FetchCache -> NixValue+fetchGitResult submodules fields =+  let lastModifiedDate =+        T.pack+          ( formatTime+              defaultTimeLocale+              "%Y%m%d%H%M%S"+              (posixSecondsToUTCTime (fromIntegral (fcLastModified fields)))+          )+   in VAttrs+        ( attrSetFromMap $+            Map.fromList+              [ ("outPath", evaluated (VPath (canonPathValue (fcStorePath fields)))),+                ("rev", evaluated (mkStr (fcRev fields))),+                ("shortRev", evaluated (mkStr (T.take 7 (fcRev fields)))),+                ("revCount", evaluated (VInt (fromIntegral (fcRevCount fields)))),+                ("submodules", evaluated (VBool submodules)),+                ("lastModified", evaluated (VInt (fromIntegral (fcLastModified fields)))),+                ("lastModifiedDate", evaluated (mkStr lastModifiedDate)),+                ("narHash", evaluated (mkStr ("sha256-" <> fcNarHash fields)))+              ]+        )++-- | What a remembered fetch is filed under.  Everything that decides what+-- comes back is in the key, so a hit cannot describe a different fetch: the+-- URL, the store name, the revision, whether submodules were taken, and+-- whether the clone was shallow.+--+-- @shallow@ is in the key even though it cannot change the tree, because it+-- decides @revCount@: a shallow fetch reports 0 where a full clone of the+-- same rev counts the real depth.  Sharing an entry between the two would+-- let whichever ran first decide what the other sees, and @revCount@ can+-- reach a derivation's environment, so that is a reproducibility problem+-- rather than a stale-data one.+--+-- The leading version tag invalidates every entry written before a change+-- in what the fields mean.  It last moved for the Windows executable bit,+-- which changes the @narHash@ of any tree holding an executable file.+fetchCacheKey :: Text -> Text -> Text -> Bool -> Bool -> Text+fetchCacheKey url name rev submodules shallow =+  T.intercalate+    "\n"+    [ "fetchGit-2",+      url,+      name,+      rev,+      if submodules then "submodules" else "no-submodules",+      if shallow then "shallow" else "full"+    ]++-- | One field per line, in a fixed order.  Anything that does not read back+-- as exactly five lines is treated as no entry at all.+encodeFetchCache :: FetchCache -> Text+encodeFetchCache fields =+  T.intercalate+    "\n"+    [ fcStorePath fields,+      fcRev fields,+      T.pack (show (fcRevCount fields)),+      T.pack (show (fcLastModified fields)),+      fcNarHash fields+    ]++decodeFetchCache :: Text -> Maybe FetchCache+decodeFetchCache raw = case T.splitOn "\n" raw of+  [storePath, rev, revCount, lastModified, narHash] -> do+    count <- readDecimalMaybe revCount+    modified <- readDecimalMaybe lastModified+    -- Every field is checked, the last one included.  Truncation before+    -- the last field yields fewer than five and is rejected above, but a+    -- write cut inside narHash still yields five and would otherwise+    -- decode as valid with a short hash - and an entry is trusted for as+    -- long as its store path survives.+    validBase64Sha256 narHash+    pure+      FetchCache+        { fcStorePath = storePath,+          fcRev = rev,+          fcRevCount = count,+          fcLastModified = modified,+          fcNarHash = narHash+        }+  _ -> Nothing+  where+    readDecimalMaybe t = case TR.decimal t of+      Right (value, rest) | T.null rest -> Just value+      _ -> Nothing+    -- Base64 of 32 bytes: 44 characters, the last one the single pad.+    validBase64Sha256 t =+      if T.length t == 44 && T.all isBase64Char (T.init t) && T.last t == '='+        then Just ()+        else Nothing+    isBase64Char c = isAsciiUpper c || isAsciiLower c || isDigit c || c == '+' || c == '/'++-- | Run one git subcommand under the same transport allowlist as the URL+-- check.  Returns trimmed stdout; a nonzero exit throws with git's stderr.+gitRun :: (MonadEval m) => Text -> Text -> [Text] -> m Text+gitRun ctx cloneDir args = do+  (code, out, err) <- runProcess "git" (gitTransportConfig ++ ["-C", cloneDir] ++ args) ""+  if code == 0+    then pure (T.strip out)+    else throwEvalError (ctx <> ": git " <> T.unwords args <> " failed: " <> err)++-- | Strip every @.git@ entry (clone's own, and each submodule's) before the+-- tree is copied to the store.  Walked directly, not shelled out to+-- @find@\/@rm@: no @sh@ on a bare Windows install.+removeGitMetadata :: (MonadEval m) => Text -> Text -> m ()+removeGitMetadata _ctx = go+  where+    go dir = do+      entries <- listDirectory dir+      forM_ entries $ \(name, fileType) ->+        let path = dir <> "/" <> name+         in if name == ".git"+              then removeScratchDir path+              else when (fileType == "directory") $ go path++-- | Parse a decimal from trusted git stdout (@rev-list --count@, @show+-- --format=%ct@); a failure means git itself misbehaved.+decodeDecimal :: (MonadEval m) => Text -> Text -> m Integer+decodeDecimal ctx t = case TR.decimal t of+  Right (n, rest) | T.null rest -> pure n+  _ -> throwEvalError (ctx <> ": expected a decimal integer from git, got " <> t)++-- | Resolve the system temp directory.  Checks @TMPDIR@ (Unix), then+-- @TEMP@ (Windows), falls back to @\/tmp@.+getTempDir :: (MonadEval m) => m Text+getTempDir = do+  candidates <- mapM getEnvVar ["TMPDIR", "TEMP"]+  pure (fromMaybe "/tmp" (find (not . T.null) candidates))++-- | Fetch a URL and optionally verify its hash.+fetchUrlSimple :: (MonadEval m) => Text -> Maybe Text -> m NixValue+fetchUrlSimple url mSha256 = do+  -- The store name derives from the URL alone, so an unusable name fails+  -- here, before the download side effect.  Upstream rejects the same+  -- names when it adds the fetched file to the store.+  let name = urlBaseName url+  case checkStorePathName name of+    Left err -> throwEvalError ("builtins.fetchurl: " <> storePathNameErrorText err)+    Right () -> pure ()+  -- Download to a file, not through the text-mode stdout pipe (which mangles+  -- binary), read the raw bytes, verify the pin if one was given, then store at+  -- the canonical fixed-output path.+  tmpDir <- getTempDir+  let tmpFile = tmpDir <> "/nova-nix-fetchurl-" <> sha256Hex (TE.encodeUtf8 url)+  (code, _, stderr) <- runProcess "curl" ["-sSfL", "-o", tmpFile, "--", url] ""+  if code /= 0+    then throwEvalError ("builtins.fetchurl: fetch failed: " <> stderr)+    else do+      bytes <- readFileBytes tmpFile+      mapM_ (verifyFetchPin "builtins.fetchurl" url bytes) mSha256+      storePath <- addFixedOutputFile name bytes+      pure (VPath storePath)++-- | Store name for a fetched URL: its basename (minus query/fragment), matching+-- C++ Nix's @baseNameOf url@ default so the fixed-output path agrees with it.+urlBaseName :: Text -> Text+urlBaseName url =+  let stripped = T.takeWhile (\c -> c /= '?' && c /= '#') url+      base = T.takeWhileEnd (/= '/') stripped+   in if T.null base then "source" else base++-- | Verify fetched bytes against a user-supplied sha256 pin, erroring on+-- mismatch.  Accepts SRI, @sha256:@-prefixed, and bare digest forms.+verifyFetchPin :: (MonadEval m) => Text -> Text -> BS.ByteString -> Text -> m ()+verifyFetchPin ctx url bytes expectedStr = do+  expected <- decodeSha256Pin ctx expectedStr+  let got = sha256Digest bytes+  when (expected /= got) $+    throwEvalError+      ( ctx+          <> ": hash mismatch for "+          <> url+          <> "\n  expected: "+          <> expectedStr+          <> "\n  got:      sha256:"+          <> bytesToHexText got+      )++-- | Decode a sha256 pin to raw bytes, reusing the convertHash decoders (SRI,+-- @sha256:@-prefixed, or a bare hex/nix32/base64 digest).+decodeSha256Pin :: (MonadEval m) => Text -> Text -> m BS.ByteString+decodeSha256Pin ctx s+  | Just (algo, b64) <- parseSRI s = do+      requireSha256 algo+      decodeSRI ctx algo b64+  | Just (algo, rest) <- parseAlgoPrefix s = do+      requireSha256 algo+      snd <$> decodeWithAlgo algo rest+  | otherwise = snd <$> decodeWithAlgo "sha256" s+  where+    -- The pin names a sha256 digest specifically, so a spelling carrying+    -- its own algorithm tag must carry sha256 - a sha512 pin here is an+    -- error at decode time, as upstream's typed Hash parse.+    requireSha256 "sha256" = pure ()+    requireSha256 algo =+      throwEvalError (ctx <> ": hash '" <> s <> "' should have type 'sha256', not '" <> algo <> "'")++-- | Force a required string attribute from an attrset, using full Nix string+-- coercion (VStr, VPath, VInt, VBool, VAttrs via __toString/outPath).+-- A coercion failure (or a throwing attr value) propagates with its own+-- message, as upstream - swallowing it here once masked user throws.+-- The Text result decodes strictly: callers use it as a name, URL, or+-- platform string, none of which may carry invalid UTF-8 here.+forceAttrStr :: (MonadEval m) => Text -> Text -> AttrSet -> m Text+forceAttrStr builtin key attrs = do+  bytes <- forceAttrBytes builtin key attrs+  decodedText builtin bytes++-- | Like 'forceAttrStr' but returns the coerced RAW BYTES - for+-- derivation fields (builder) that flow byte-exact into the ATerm.+forceAttrBytes :: (MonadEval m) => Text -> Text -> AttrSet -> m BS.ByteString+forceAttrBytes builtin key attrs =+  case attrSetLookup key attrs of+    Nothing -> throwEvalError (builtin <> ": missing required attribute '" <> key <> "'")+    Just thunk -> do+      val <- force thunk+      (s, _ctx) <- coerceToString True force applyValue coercePathVerbatim val+      pure s++-- | Force an optional string attribute via full Nix coercion.  A present+-- but uncoercible (or throwing) value is an error, not 'Nothing'.+forceOptionalAttrStr :: (MonadEval m) => AttrSet -> Text -> m (Maybe Text)+forceOptionalAttrStr attrs key =+  case attrSetLookup key attrs of+    Nothing -> pure Nothing+    Just thunk -> do+      val <- force thunk+      (s, _ctx) <- coerceToString True force applyValue coercePathVerbatim val+      Just <$> decodedText "string attribute" s++-- | Force an optional boolean attribute; present but non-boolean is an error,+-- not a silent coercion.+forceOptionalAttrBool :: (MonadEval m) => Text -> AttrSet -> Text -> Bool -> m Bool+forceOptionalAttrBool builtin attrs key def =+  case attrSetLookup key attrs of+    Nothing -> pure def+    Just thunk -> do+      val <- force thunk+      case val of+        VBool b -> pure b+        other -> throwEvalError (builtin <> ": attribute '" <> key <> "' should be a bool, but is " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - derivation construction+-- ---------------------------------------------------------------------------++-- | Resolve an input derivation's modulo hash (hex) for the ATerm substitution+-- 'toATermForHash' performs.  The drv-hash cache is populated bottom-up as each+-- derivation is evaluated, so an in-session input hits directly.  A miss - a+-- cross-session reference, or a path fabricated by @builtins.appendContext@ -+-- reads the input @.drv@ from the store and recurses, exactly as upstream+-- @hashDerivationModulo@ does.  A miss whose @.drv@ cannot be read (pure+-- evaluation, or a @.drv@ absent from the store) fails loudly: a divergent+-- derivation hash is never emitted from a guessed input hash.  Reading the+-- store is an effect, so hashing a dependent derivation is an IO-evaluator+-- capability - pure evaluation, which cannot read the store, cannot do it.+resolveInputModulo :: (MonadEval m) => (StorePath, [Text]) -> m (Text, [Text])+resolveInputModulo (sp, outs) = do+  let inputPathText = storePathToText defaultStoreDir sp+  cached <- lookupDrvHash inputPathText+  case cached of+    Just hex -> pure (hex, outs)+    Nothing -> do+      mDrv <- readStoreDerivation sp+      case mDrv of+        Just inputDrv -> do+          hex <- derivationModuloHex inputDrv+          cacheDrvHash inputPathText hex+          pure (hex, outs)+        Nothing ->+          throwEvalError+            ( "derivation: cannot compute the input-derivation modulo hash for "+                <> inputPathText+                <> " - it was not evaluated in this session and its .drv is not "+                <> "readable from the store (dependent-derivation hashing needs the IO evaluator)"+            )++-- | The derivation-modulo hash (hex) of a derivation, matching upstream+-- @hashDerivationModulo@: a fixed-output derivation hashes the+-- @fixed:out:\<algo\>:\<hash\>:\<path\>@ form; an input-addressed derivation+-- substitutes each input's modulo hash into its ATerm and hashes that.  These+-- are the same two rules 'builtinDerivationStrict' applies when it first+-- computes a derivation's hash, so a store-read input yields the value it had+-- in-session.+derivationModuloHex :: (MonadEval m) => Derivation -> m Text+derivationModuloHex drv = case drvOutputs drv of+  [DerivationOutput "out" outPath algoField hashHex]+    | not (T.null algoField) && not (T.null hashHex) ->+        let outPathText = storePathToText defaultStoreDir outPath+            fixedForm = "fixed:out:" <> algoField <> ":" <> hashHex <> ":" <> outPathText+         in pure (bytesToHexText (sha256Digest (TE.encodeUtf8 fixedForm)))+  _ -> do+    inputSubst <- mapM resolveInputModulo (Map.toList (drvInputDrvs drv))+    pure (bytesToHexText (sha256Digest (toATermForHash False (Just inputSubst) drv)))++-- | The full output-name list of an all-outputs (upstream DrvDeep) reference:+-- every output name of the referenced @.drv@, which upstream's derivationStrict+-- inserts into the consuming derivation's inputDrvs.  Mirrors the+-- 'resolveInputModulo' ladder - an in-session derivation from the recorded+-- ATerm ('lookupSessionDrv'), else a cross-session @.drv@ read from the store+-- ('readStoreDerivation'), else a loud error rather than a dropped reference+-- (which would under-hash the dependent).  Pure evaluation can read neither+-- source, so a dependent carrying an all-outputs reference errors there,+-- consistent with dependent-derivation hashing being an IO-evaluator capability.+resolveAllOutputNames :: (MonadEval m) => StorePath -> m [Text]+resolveAllOutputNames sp = do+  let drvPathText = storePathToText defaultStoreDir sp+  session <- lookupSessionDrv drvPathText+  case session of+    Just drv -> pure (outputNamesOf drv)+    Nothing -> do+      onDisk <- readStoreDerivation sp+      case onDisk of+        Just drv -> pure (outputNamesOf drv)+        Nothing ->+          throwEvalError+            ( "derivation: cannot resolve the output names of the all-outputs reference "+                <> drvPathText+                <> " - it was not evaluated in this session and its .drv is not "+                <> "readable from the store (all-outputs references need the IO evaluator)"+            )+  where+    outputNamesOf = map doName . drvOutputs++-- | Eager derivation computation - @builtins.derivationStrict@.  Forces all+-- input attrs into env vars, content-hashes, and returns the full derivation+-- attrset (drvPath, outPath, per-output, _derivation).  Called LAZILY by the+-- @derivation@ wrapper ('builtinDerivationLazy'), so forcing a derivation to+-- WHNF never forces this - matching C++ Nix's derivationStrict/derivation split.+builtinDerivationStrict :: (MonadEval m) => NixValue -> m NixValue+builtinDerivationStrict (VAttrs attrs) = do+  -- Extract required attributes.  The name and system are Text (they feed+  -- store-path and platform machinery); the builder stays raw bytes - it+  -- lands byte-exact in the ATerm's builder field.+  drvName <- forceAttrStr "derivation" "name" attrs+  -- The name becomes the store-path name of the .drv and of every output,+  -- so it must satisfy the store-path name rules.  The path constructors+  -- re-check what they build; this early check reports the offending+  -- FIELD rather than a composed path name.+  case checkStorePathName drvName of+    Left err ->+      throwEvalError+        ("derivation: invalid derivation name '" <> drvName <> "': " <> storePathNameReasonText (spneReason err))+    Right () -> pure ()+  system <- forceAttrStr ("derivation \"" <> drvName <> "\"") "system" attrs+  builder <- forceAttrBytes ("derivation \"" <> drvName <> "\"") "builder" attrs++  -- __ignoreNulls: when true, null-valued attrs are dropped from the+  -- derivation env (stdenv.mkDerivation sets it); when absent or false,+  -- null coerces to "" like any other coerceMore value - C++ Nix semantics.+  ignoreNulls <- case attrSetLookup "__ignoreNulls" attrs of+    Nothing -> pure False+    Just thunk -> do+      val <- force thunk+      case val of+        VBool b -> pure b+        other -> throwEvalError ("derivation: '__ignoreNulls' must be a boolean, got " <> typeName other)++  -- Extract optional outputs (default ["out"])+  outputNames <- case attrSetLookup "outputs" attrs of+    Nothing -> pure ["out"]+    Just thunk -> do+      val <- force thunk+      case val of+        VList cl -> mapM (forceToText . Thunk) (clistThunks cl)+        -- A null outputs attr is dropped by __ignoreNulls, falling back to+        -- the default output set; without it, null is an error as upstream.+        VNull | ignoreNulls -> pure ["out"]+        _ -> throwEvalError "derivation: 'outputs' must be a list of strings"++  -- Each output name composes into a store-path name (drvName-<output>)+  -- and names the on-disk location the builder later clears and moves+  -- onto, so it must satisfy the same store-path name rules (the+  -- composed length is re-checked at construction).+  forM_ outputNames $ \outName ->+    case checkStorePathName outName of+      Left err ->+        throwEvalError+          ( "derivation \""+              <> drvName+              <> "\": invalid derivation output name '"+              <> outName+              <> "': "+              <> storePathNameReasonText (spneReason err)+          )+      Right () -> pure ()++  -- Extract optional args (default []).  Path literals in args (e.g. stdenv's+  -- ./default-builder.sh) are copied into the store; their source paths flow+  -- into inputSrcs via the returned context.+  (builderArgs, argsContext) <- case attrSetLookup "args" attrs of+    Nothing -> pure ([], mempty)+    Just thunk -> do+      val <- force thunk+      case val of+        VList cl -> do+          parts <- mapM (\t -> force (Thunk t) >>= coerceToStoreString) (clistThunks cl)+          pure (map fst parts, mconcat (map snd parts))+        VNull | ignoreNulls -> pure ([], mempty)+        _ -> throwEvalError "derivation: 'args' must be a list of strings"++  -- Materialize once, reuse for both env collection and result merge+  let materialized = attrSetToMap attrs++  -- Collect string-coercible attrs into the build env, EXCLUDING "args"+  -- (C++ Nix puts args in the Derive() args field, never the env).  The+  -- per-output env vars ($out, ...) are added below.  Carries merged context.+  (drvEnvPairs, envContext) <- collectDrvEnvWithContext ignoreNulls (Map.delete "__ignoreNulls" (Map.delete "args" materialized))++  let fullContext = envContext <> argsContext+      builtInputDrvs = extractInputDrvs fullContext+      inputSrcs = extractInputSrcs fullContext+      allOutputRefs = extractAllOutputRefs fullContext+  -- All-outputs (DrvDeep) references - e.g. an embedded @dep.drvPath@ - add the+  -- referenced .drv to inputDrvs with ALL its output names, as upstream's+  -- derivationStrict does.  Merged in BEFORE drvRefs and the modulo+  -- substitution so both the dependent's own .drv hash and its output paths+  -- account for the reference.+  deepInputDrvs <-+    Map.fromList <$> mapM (\drvSp -> (,) drvSp <$> resolveAllOutputNames drvSp) allOutputRefs+  let inputDrvs = Map.unionWith (++) builtInputDrvs deepInputDrvs+      platform = textToPlatform system+      baseEnv = Map.fromList drvEnvPairs+      drvRefs = inputSrcs ++ Map.keys inputDrvs+      drvFileName = drvName <> ".drv"+      -- Build a Derivation sharing this call's inputs/platform/builder/args.+      mkDrv outs env =+        Derivation+          { drvOutputs = outs,+            drvInputDrvs = inputDrvs,+            drvInputSrcs = inputSrcs,+            drvPlatform = platform,+            drvBuilder = builder,+            drvArgs = builderArgs,+            drvEnv = env+          }+      -- Output carrying only its name; the path is masked at render time.+      maskedOutput name = DerivationOutput name maskedOutputPath "" ""++  -- Fixed-output derivations (fetchurl etc.) are content-addressed and hash+  -- via the @fixed:out:@ scheme; input-addressed derivations recurse through+  -- the modulo hashes of their inputs.+  mFixed <- detectFixedOutput attrs++  -- Path construction returns Left on a name the store rules reject; the+  -- early field checks above make that unreachable here except through+  -- composition (drvName <> ".drv", drvName-output past the length cap),+  -- which only the constructors see.+  let drvContext = "derivation \"" <> drvName <> "\""+  (drvPathText, drvSP, outPaths, completeDrv) <- case mFixed of+    Just (foAlgo, foMode, foDigest) -> do+      foPath <- storePathOrThrow drvContext (makeFixedOutputPath drvName foAlgo foMode foDigest)+      let foPathText = storePathToText defaultStoreDir foPath+          algoField = (if foMode == "recursive" then "r:" else "") <> foAlgo+          foHashHex = bytesToHexText foDigest+          foModulo =+            sha256Digest+              (TE.encodeUtf8 ("fixed:out:" <> algoField <> ":" <> foHashHex <> ":" <> foPathText))+          contents =+            mkDrv+              [DerivationOutput "out" foPath algoField foHashHex]+              (Map.insert "out" (TE.encodeUtf8 foPathText) baseEnv)+      drvSp <- storePathOrThrow drvContext (makeTextPath drvFileName (sha256Digest (toATerm contents)) drvRefs)+      let drvText = storePathToText defaultStoreDir drvSp+      cacheDrvHash drvText (bytesToHexText foModulo)+      pure (drvText, drvSp, [("out", foPathText)], contents)+    Nothing -> do+      inputSubst <- mapM resolveInputModulo (Map.toList inputDrvs)+      let maskedEnv = foldr (`Map.insert` "") baseEnv outputNames+          maskedDrv = mkDrv (map maskedOutput outputNames) maskedEnv+          -- Masked modulo hash yields this derivation's own output paths.+          moduloMasked = sha256Digest (toATermForHash True (Just inputSubst) maskedDrv)+      outStorePaths <-+        mapM+          (\n -> (,) n <$> storePathOrThrow drvContext (makeOutputPath n moduloMasked drvName))+          outputNames+      let outPathTexts = [(n, storePathToText defaultStoreDir sp) | (n, sp) <- outStorePaths]+          realEnv = foldr (\(n, t) e -> Map.insert n (TE.encodeUtf8 t) e) baseEnv outPathTexts+          contents = mkDrv [DerivationOutput n sp "" "" | (n, sp) <- outStorePaths] realEnv+          -- Unmasked modulo hash (real outputs, inputs substituted) cached for+          -- when this derivation is itself an input to another.+          moduloUnmasked = sha256Digest (toATermForHash False (Just inputSubst) contents)+      drvSp <- storePathOrThrow drvContext (makeTextPath drvFileName (sha256Digest (toATerm contents)) drvRefs)+      let drvText = storePathToText defaultStoreDir drvSp+      cacheDrvHash drvText (bytesToHexText moduloUnmasked)+      pure (drvText, drvSp, outPathTexts, contents)++  -- Record this derivation's full .drv ATerm (the exact bytes whose hash is its+  -- store path) so the build driver can materialize the entire input-.drv+  -- closure before building.  Bottom-up eval guarantees every transitive input+  -- is recorded by the time a dependent is.+  recordDrvAterm drvPathText (toATerm completeDrv)++  let mainOutPath = case outPaths of+        ((_, p) : _) -> p+        [] -> ""+      -- The default output is the FIRST in @outputs@ (matching C++ Nix, which+      -- returns @(head outputsList).value@) - not necessarily @out@.+      mainOutName = case outPaths of+        ((n, _) : _) -> n+        [] -> "out"++  -- Context for output paths: each output carries SCDrvOutput context+  -- Context for drvPath: carries SCAllOutputs context+  let drvPathCtx = StringContext (Set.singleton (SCAllOutputs drvSP))+      outPathCtx outName = StringContext (Set.singleton (SCDrvOutput drvSP outName))++  -- Build per-output attrsets matching Nix: drv.out = { outPath, drvPath, type }+  let mkOutputAttrs outName outP =+        let outCtx = outPathCtx outName+            outputAttrMap =+              Map.fromList+                [ ("outPath", evaluated (VStr (TE.encodeUtf8 outP) outCtx)),+                  ("drvPath", evaluated (VStr (TE.encodeUtf8 drvPathText) drvPathCtx)),+                  ("type", evaluated (mkStr "derivation"))+                ]+         in evaluated (VAttrs (attrSetFromMap outputAttrMap))++  -- Build result attrset: original attrs + drvPath, outPath, type, per-output attrs+  let baseAttrs =+        Map.fromList $+          [ ("type", evaluated (mkStr "derivation")),+            ("drvPath", evaluated (VStr (TE.encodeUtf8 drvPathText) drvPathCtx)),+            ("outPath", evaluated (VStr (TE.encodeUtf8 mainOutPath) (outPathCtx mainOutName))),+            ("name", evaluated (mkStr drvName)),+            ("system", evaluated (mkStr system)),+            ("builder", evaluated (mkStrBytes builder)),+            ("_derivation", evaluated (VDerivation completeDrv))+          ]+            ++ [(outName, mkOutputAttrs outName outP) | (outName, outP) <- outPaths]+      -- Merge original attrs underneath so computed attrs take priority+      resultAttrs = Map.union baseAttrs materialized++  pure (VAttrs (attrSetFromMap resultAttrs))+builtinDerivationStrict other =+  throwEvalError ("derivation: expected a set, got " <> typeName other)++-- | Detect a fixed-output derivation.  Returns @Just (algo, mode, rawDigest)@+-- when @outputHash@ is present and non-empty (fetchurl, fetchgit, ...), else+-- 'Nothing' for an ordinary input-addressed derivation.  @mode@ is+-- @\"flat\"@ or @\"recursive\"@; @algo@ is e.g. @\"sha256\"@.+detectFixedOutput :: (MonadEval m) => AttrSet -> m (Maybe (Text, Text, BS.ByteString))+detectFixedOutput attrs =+  case attrSetLookup "outputHash" attrs of+    Nothing -> pure Nothing+    Just thunk -> do+      val <- force thunk+      case val of+        VStr rawHash _+          | not (BS.null rawHash) -> do+              ohash <- decodedText "derivation: outputHash" rawHash+              ohAlgo <- optDrvStrAttr "outputHashAlgo" attrs+              ohMode <- optDrvStrAttr "outputHashMode" attrs+              (algo, digest) <- normalizeFixedHash ohash ohAlgo+              let mode = if ohMode == "recursive" then "recursive" else "flat"+              pure (Just (algo, mode, digest))+        _ -> pure Nothing++-- | Read an optional string attribute, defaulting to @\"\"@ when absent or+-- not a string.+optDrvStrAttr :: (MonadEval m) => Text -> AttrSet -> m Text+optDrvStrAttr key attrs =+  case attrSetLookup key attrs of+    Nothing -> pure ""+    Just thunk -> do+      val <- force thunk+      case val of+        VStr s _ -> decodedText ("derivation: " <> key) s+        _ -> pure ""++-- | Decode a fixed-output hash (SRI @algo-base64@, @algo:hash@, or a bare+-- hash plus a separate algorithm) to its algorithm name and raw bytes.+-- A non-empty @outputHashAlgo@ must name a known algorithm and agree with+-- the algorithm an SRI or prefixed spelling carries: the enforced+-- algorithm must be the declared one, never a silent substitute.+normalizeFixedHash :: (MonadEval m) => Text -> Text -> m (Text, BS.ByteString)+normalizeFixedHash ohash ohAlgo+  | Just (algo, b64) <- parseSRI ohash = do+      requireDeclaredAlgo algo+      bytes <- decodeSRI "derivation" algo b64+      pure (algo, bytes)+  | Just (algo, rest) <- parseAlgoPrefix ohash = do+      requireDeclaredAlgo algo+      decodeWithAlgo algo rest+  | not (T.null ohAlgo) = decodeWithAlgo ohAlgo ohash+  | otherwise =+      throwEvalError ("derivation: cannot determine outputHash algorithm for " <> ohash)+  where+    -- 'decodeSha256Pin's requireSha256 with the expected type supplied by+    -- @outputHashAlgo@ instead of fixed at sha256 (upstream's typed Hash+    -- parse, hash.cc parseAny with an expected type).  An unknown declared+    -- algorithm is an error even when the spelling carries its own tag.+    requireDeclaredAlgo embedded+      | T.null ohAlgo = pure ()+      | Nothing <- hashAlgoBytes ohAlgo =+          throwEvalError ("unknown hash algorithm '" <> ohAlgo <> "'")+      | embedded == ohAlgo = pure ()+      | otherwise =+          throwEvalError+            ("derivation: hash '" <> ohash <> "' should have type '" <> ohAlgo <> "', not '" <> embedded <> "'")++-- | Lazy @derivation@ wrapper, mirroring upstream's+-- @src/libexpr/primops/derivation.nix@.+-- Returns a WHNF attrset whose @drvPath@/@outPath@/output-path/@_derivation@+-- attrs are LAZY thunks that defer to 'builtinDerivationStrict'.  Forcing a+-- derivation to WHNF therefore does NOT force its input/env closure - which is+-- essential for nixpkgs, where merely referencing a derivation (e.g.+-- @drv != null@, @assert (libxcrypt != null)@) must not build its whole closure.+--+-- The lazy thunks are built with the same synthetic-select pattern used by+-- @inherit (from)@: a single shared @strict@ thunk (so the eager computation+-- runs at most once) selected from via fresh minimal envs.+builtinDerivationLazy :: (MonadEval m) => NixValue -> m NixValue+builtinDerivationLazy (VAttrs attrs) = do+  -- Output names are cheap (matches @drvAttrs @ { outputs ? [ "out" ], ... }@).+  outputNames <- case attrSetLookup "outputs" attrs of+    Nothing -> pure ["out"]+    Just thunk -> do+      val <- force thunk+      case val of+        VList cl -> mapM (forceToText . Thunk) (clistThunks cl)+        _ -> throwEvalError "derivation: 'outputs' must be a list of strings"+  -- One shared thunk computing @derivationStrict attrs@, forced only when an+  -- output path / drvPath is actually read.+  let drvAttrsThunk = evaluated (VAttrs attrs)+      strictBuiltinThunk = evaluated (VBuiltin "derivationStrict" [])+      strictThunk =+        let (sp, sc) = buildCSlots [drvAttrsThunk, strictBuiltinThunk]+            envDS = newMinimalEnv sp sc+         in mkSyntheticThunk envDS (EApp (EResolvedVar 0 1) (EResolvedVar 0 0))+      selectStrict field =+        let (sp, sc) = buildCSlots [strictThunk]+            envF = newMinimalEnv sp sc+         in mkSyntheticThunk envF (ESelect (EResolvedVar 0 0) [StaticKey field] Nothing)+  -- WHNF spine: input attrs (unforced) overlaid with the lazy computed attrs.+  let computedAttrs =+        Map.fromList $+          [ ("type", evaluated (mkStr "derivation")),+            ("drvPath", selectStrict "drvPath"),+            ("outPath", selectStrict "outPath"),+            ("_derivation", selectStrict "_derivation")+          ]+            ++ [(outName, selectStrict outName) | outName <- outputNames]+      resultAttrs = Map.union computedAttrs (attrSetToMap attrs)+  pure (VAttrs (attrSetFromMap resultAttrs))+builtinDerivationLazy other =+  throwEvalError ("derivation: expected a set, got " <> typeName other)++-- | Force a thunk to a Text string via full Nix coercion (strict decode:+-- used for output names, which are ASCII-shaped identity components).+forceToText :: (MonadEval m) => Thunk -> m Text+forceToText thunk = do+  val <- force thunk+  (s, _ctx) <- coerceToString True force applyValue coercePathVerbatim val+  decodedText "derivation" s++-- | Collect all derivation attributes into env pairs via full Nix coercion+-- (__toString, outPath, list-to-space-separated-string), along with the+-- merged string context from all collected values.  Values are RAW BYTES:+-- they flow byte-exact into the ATerm env section (and its hash).+--+-- A coercion failure (a thrown attr value, an uncoercible function, a failed+-- import inside the value) fails the WHOLE derivation, as in C++ Nix.+-- Swallowing it silently produces a wrong .drv - this exact bug once turned+-- a seed derivation with 17 failed src attrs into an empty no-input drv that+-- "built" successfully.  Null attrs are dropped only under __ignoreNulls;+-- otherwise null coerces to @""@ like any other coerceMore value.+collectDrvEnvWithContext :: (MonadEval m) => Bool -> Map Text Thunk -> m ([(Text, BS.ByteString)], StringContext)+collectDrvEnvWithContext ignoreNulls attrs = do+  let pairs = Map.toList attrs+  results <- mapM coerceEnvAttr pairs+  let envPairs = catMaybes [fmap (\(k, v, _) -> (k, v)) r | r <- results]+      mergedCtx = mconcat [ctx | Just (_, _, ctx) <- results]+  pure (envPairs, mergedCtx)+  where+    coerceEnvAttr (key, thunk) = do+      val <- force thunk+      case val of+        VNull | ignoreNulls -> pure Nothing+        _ -> do+          (s, ctx) <- coerceToStoreString val+          pure (Just (key, s, ctx))++-- ---------------------------------------------------------------------------+-- Builtin implementations - hashFile, readFileType+-- ---------------------------------------------------------------------------++-- | @builtins.hashFile algo path@ - hash raw bytes of a file on disk.+-- Returns base-16 hex string, matching @builtins.hashString@ output format.+builtinHashFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinHashFile (VStr algo _) (VPath path) = do+  algoName <- decodedText "builtins.hashFile" algo+  bytes <- readFileBytes path+  hashBytesWithAlgo "hashFile" algoName bytes+builtinHashFile (VStr algo _) (VStr path _) = do+  algoName <- decodedText "builtins.hashFile" algo+  filePath <- decodedText "builtins.hashFile" path+  bytes <- readFileBytes filePath+  hashBytesWithAlgo "hashFile" algoName bytes+builtinHashFile (VStr _ _) other =+  throwEvalError ("builtins.hashFile: expected a path, got " <> typeName other)+builtinHashFile other _ =+  throwEvalError ("builtins.hashFile: expected a string, got " <> typeName other)++-- | Shared hash dispatch for raw 'ByteString' input.+hashBytesWithAlgo :: (MonadEval m) => Text -> Text -> BS.ByteString -> m NixValue+hashBytesWithAlgo ctx algo bytes = case algo of+  "sha256" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA256)))+  "sha512" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA512)))+  "sha1" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA1)))+  "md5" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.MD5)))+  _ -> throwEvalError ("builtins." <> ctx <> ": unknown hash algorithm '" <> algo <> "'")++-- | @builtins.readFileType path@ - classify a filesystem entry.+-- Returns @"regular"@, @"directory"@, @"symlink"@, or @"unknown"@.+builtinReadFileType :: (MonadEval m) => NixValue -> m NixValue+builtinReadFileType (VPath path) = mkStr <$> getFileType path+builtinReadFileType (VStr path _) = do+  filePath <- decodedText "builtins.readFileType" path+  mkStr <$> getFileType filePath+builtinReadFileType other =+  throwEvalError ("builtins.readFileType: expected a path, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - convertHash+-- ---------------------------------------------------------------------------++-- | @builtins.convertHash { hash, hashAlgo?, toHashFormat }@ - convert+-- between hash representations.  Supports base16, nix32, base64, and sri.+builtinConvertHash :: (MonadEval m) => NixValue -> m NixValue+builtinConvertHash (VAttrs attrs) = do+  hashVal <- requireStrAttr "convertHash" "hash" attrs+  toFmt <- requireStrAttr "convertHash" "toHashFormat" attrs+  -- Detect input format and decode to raw bytes + algo+  (algo, rawBytes) <- decodeHashInput attrs hashVal+  -- Encode to target format+  case toFmt of+    "base16" -> pure (mkStr (bytesToHexText rawBytes))+    "nix32" -> pure (mkStr (Nix32.encode rawBytes))+    "base32" -> pure (mkStr (Nix32.encode rawBytes)) -- deprecated alias+    "base64" -> pure (mkStr (bytesToBase64 rawBytes))+    "sri" -> pure (mkStr (algo <> "-" <> bytesToBase64 rawBytes))+    _ -> throwEvalError ("builtins.convertHash: unknown toHashFormat '" <> toFmt <> "'")+builtinConvertHash other =+  throwEvalError ("builtins.convertHash: expected a set, got " <> typeName other)++-- | Extract algo + raw bytes from the hash input, handling SRI, prefixed, and plain formats.+decodeHashInput :: (MonadEval m) => AttrSet -> Text -> m (Text, BS.ByteString)+decodeHashInput attrs hashStr+  -- SRI format: algo-base64+  | Just (algo, b64) <- parseSRI hashStr = do+      bytes <- decodeSRI "convertHash" algo b64+      pure (algo, bytes)+  -- Prefixed format: algo:hex or algo:nix32+  | Just (algo, rest) <- parseAlgoPrefix hashStr =+      decodeWithAlgo algo rest+  -- Plain hash - need hashAlgo attribute+  | otherwise = do+      algo <- requireStrAttr "convertHash" "hashAlgo" attrs+      decodeWithAlgo algo hashStr++-- | Decode a bare hash string for a known algorithm, keyed by length as+-- upstream (@hash.cc@ @Hash@ parsing): an algorithm's base16, nix32, and+-- base64 spellings have pairwise distinct lengths, so the input length+-- selects the decoder and every other length is an error.  Trying decoders+-- in sequence instead mis-reads edge inputs - an all-hex-digit string of+-- nix32 length is a nix32 hash, and a truncated hash must be rejected, not+-- decoded by whichever shorter format happens to accept it.+decodeWithAlgo :: (MonadEval m) => Text -> Text -> m (Text, BS.ByteString)+decodeWithAlgo algo s = case hashAlgoBytes algo of+  Nothing -> throwEvalError ("unknown hash algorithm '" <> algo <> "'")+  Just size+    | T.length s == hexHashLen size -> accept size "base16" (hexToBytes s)+    | T.length s == nix32HashLen size -> accept size "nix32" (rightToMaybe (Nix32.decode s))+    | T.length s == base64HashLen size -> accept size "base64" (rightToMaybe (decodeBase64Pure s))+    | otherwise ->+        throwEvalError ("hash '" <> s <> "' has wrong length for hash algorithm '" <> algo <> "'")+  where+    accept size spelling decoded = case decoded of+      Just bytes | BS.length bytes == size -> pure (algo, bytes)+      _ -> throwEvalError ("hash '" <> s <> "' is not a valid " <> spelling <> " " <> algo <> " hash")+    rightToMaybe = either (const Nothing) Just++-- | Decode an SRI digest (@algo-base64@) with the decoded-length check+-- every spelling gets upstream (hash.cc checks SRI too): well-formed+-- base64 of the wrong byte count is an invalid hash at eval time, not a+-- short digest that defers failure to fetch or build time.  Shared by+-- convertHash, the fetch pins, and fixed-output outputHash.+decodeSRI :: (MonadEval m) => Text -> Text -> Text -> m BS.ByteString+decodeSRI ctx algo b64 = case hashAlgoBytes algo of+  -- Unreachable via parseSRI (it admits only known algorithm tags), but+  -- this helper must not silently skip the check for an unknown one.+  Nothing -> throwEvalError ("unknown hash algorithm '" <> algo <> "'")+  Just size -> do+    bytes <- decodeBase64E ctx b64+    when (BS.length bytes /= size) $+      throwEvalError+        ("hash '" <> algo <> "-" <> b64 <> "' has wrong length for hash algorithm '" <> algo <> "'")+    pure bytes++-- | Parse @sha256-base64...@ SRI format.+parseSRI :: Text -> Maybe (Text, Text)+parseSRI t = case T.breakOn "-" t of+  (algo, rest)+    | not (T.null rest) && algo `elem` ["sha256", "sha512", "sha1", "md5"] ->+        Just (algo, T.drop 1 rest)+  _ -> Nothing++-- | Parse @sha256:value@ prefixed format.+parseAlgoPrefix :: Text -> Maybe (Text, Text)+parseAlgoPrefix t = case T.breakOn ":" t of+  (algo, rest)+    | not (T.null rest) && algo `elem` ["sha256", "sha512", "sha1", "md5"] ->+        Just (algo, T.drop 1 rest)+  _ -> Nothing++-- | Require a string attribute from an attrset.+requireStrAttr :: (MonadEval m) => Text -> Text -> AttrSet -> m Text+requireStrAttr ctx key attrs = case attrSetLookup key attrs of+  Just thunk -> do+    val <- force thunk+    case val of+      VStr s _ -> decodedText ("builtins." <> ctx) s+      _ -> throwEvalError ("builtins." <> ctx <> ": " <> key <> " must be a string")+  Nothing -> throwEvalError ("builtins." <> ctx <> ": missing required attribute '" <> key <> "'")++-- ---------------------------------------------------------------------------+-- Base64 encode/decode - delegates to nova-cache (base64-bytestring under the hood)+-- ---------------------------------------------------------------------------++-- | Encode bytes to base64.+bytesToBase64 :: BS.ByteString -> Text+bytesToBase64 = B64.encode++-- | Decode base64 text to bytes (pure).+decodeBase64Pure :: Text -> Either Text BS.ByteString+decodeBase64Pure t =+  -- Strip whitespace and any existing padding, then re-pad to a multiple of+  -- 4.  base64-bytestring's 'decode' requires correct padding, so SRI hashes+  -- (correctly-padded standard base64, e.g. @sha256-...NQ=@) would otherwise be+  -- rejected once their trailing @=@ was removed.+  let stripped = T.filter (\c -> c /= '\n' && c /= '\r' && c /= '=') t+      padLen = (4 - (T.length stripped `mod` 4)) `mod` 4+      padded = stripped <> T.replicate padLen "="+   in case B64.decode padded of+        Right bytes -> Right bytes+        Left _ -> Left "invalid base64"++-- | Decode base64 with error context for builtins.+decodeBase64E :: (MonadEval m) => Text -> Text -> m BS.ByteString+decodeBase64E ctx t = case decodeBase64Pure t of+  Right bytes -> pure bytes+  Left _ -> throwEvalError ("builtins." <> ctx <> ": invalid base64 encoding")++-- ---------------------------------------------------------------------------+-- Builtin implementations - fromTOML+-- ---------------------------------------------------------------------------++-- | @builtins.fromTOML str@ - parse a TOML document to a Nix value.+-- Hand-rolled parser covering the TOML v1.0 subset used by nixpkgs:+-- bare/quoted keys, dotted keys, basic/literal strings (multiline),+-- integers (dec/hex/oct/bin), floats (inc. inf/nan), booleans,+-- inline tables, arrays, array-of-tables, and standard tables.+-- Datetimes are represented as strings (matching real Nix).+builtinFromTOML :: (MonadEval m) => NixValue -> m NixValue+builtinFromTOML (VStr s _) = do+  -- TOML is UTF-8 by definition; upstream's parser rejects invalid bytes.+  decoded <- decodedText "builtins.fromTOML" s+  case parseTOML decoded of+    Right val -> pure val+    Left err -> throwEvalError ("builtins.fromTOML: " <> err)+builtinFromTOML other =+  throwEvalError ("builtins.fromTOML: expected a string, got " <> typeName other)++-- | Intermediate TOML value before conversion to NixValue.+data TOMLValue+  = TOMLStr !Text+  | TOMLInt !Int64+  | TOMLFloat !Double+  | TOMLBool !Bool+  | TOMLArray ![TOMLValue]+  | TOMLTable !(Map Text TOMLValue)+  deriving (Show)++-- | Parse a TOML document into a NixValue.+parseTOML :: Text -> Either Text NixValue+parseTOML input = do+  table <- parseTOMLDoc (T.lines input)+  pure (tomlToNix (TOMLTable table))++-- | Convert a TOMLValue to NixValue.+tomlToNix :: TOMLValue -> NixValue+tomlToNix val = case val of+  TOMLStr s -> mkStr s+  TOMLInt n -> VInt n+  TOMLFloat d -> VFloat d+  TOMLBool b -> VBool b+  TOMLArray xs -> VList (clistFromThunks (map (thunkToCPtr . evaluated . tomlToNix) xs))+  TOMLTable m -> VAttrs (attrSetFromMap (Map.map (evaluated . tomlToNix) m))++-- | Parse all lines of a TOML document into a table.+parseTOMLDoc :: [Text] -> Either Text (Map Text TOMLValue)+parseTOMLDoc lns = go lns [] Map.empty+  where+    go [] _ root = Right root+    go (line : rest) currentPath root+      | T.null stripped || T.isPrefixOf "#" stripped =+          -- Empty line or comment+          go rest currentPath root+      | T.isPrefixOf "[[" stripped && T.isSuffixOf "]]" stripped =+          -- Array of tables: [[key]]+          let keyStr = T.strip (T.drop 2 (T.dropEnd 2 stripped))+              keys = parseDottedKey keyStr+           in go rest keys (insertArrayTable keys root)+      | T.isPrefixOf "[" stripped && T.isSuffixOf "]" stripped =+          -- Standard table: [key]+          let keyStr = T.strip (T.drop 1 (T.dropEnd 1 stripped))+              keys = parseDottedKey keyStr+           in go rest keys (ensureTable keys root)+      | otherwise =+          -- Key = value pair.  The value may span physical lines (arrays+          -- and multi-line strings - the Cargo.lock shapes), so join+          -- until brackets and multi-line string delimiters balance.+          let (logical, remaining) = joinLogicalLine stripped rest+           in case parseKVLine logical of+                Right (keys, val) ->+                  go remaining currentPath (insertNested (currentPath ++ keys) val root)+                Left err -> Left err+      where+        stripped = T.strip line++-- | Which TOML string form a scan position is inside.+data TomlStringState = TSNone | TSBasic | TSLiteral | TSMultiBasic | TSMultiLiteral+  deriving (Eq)++-- | Scanner state for joining physical lines into one logical+-- key = value line: array-bracket depth outside strings, plus the+-- string form currently open.+data TomlScan = TomlScan+  { tsBracketDepth :: !Int,+    tsString :: !TomlStringState+  }++emptyTomlScan :: TomlScan+emptyTomlScan = TomlScan 0 TSNone++-- | Whether a logical value is still open at end of line: inside a+-- multi-line string, or under an unclosed array bracket.  A single-line+-- string left open is NOT continuable (TOML basic\/literal strings+-- cannot span lines) - the value parser reports that case.+tomlNeedsMoreLines :: TomlScan -> Bool+tomlNeedsMoreLines st =+  tsBracketDepth st > 0+    || tsString st == TSMultiBasic+    || tsString st == TSMultiLiteral++-- | Scan one physical line, returning the state at end of line and the+-- line's visible text: a comment outside strings is cut here, where the+-- string context is still known ('#' inside any string form is content).+scanTomlLine :: TomlScan -> Text -> (TomlScan, Text)+scanTomlLine st0 line = go st0 line 0+  where+    go st t !seen = case T.uncons t of+      Nothing -> (st, line)+      Just (c, rest) ->+        let one newSt = go newSt rest (seen + 1)+            jump n newSt = go newSt (T.drop (n - 1) rest) (seen + n)+         in case tsString st of+              TSBasic+                | c == '\\' -> jump 2 st+                | c == '"' -> one st {tsString = TSNone}+                | otherwise -> one st+              TSLiteral+                | c == '\'' -> one st {tsString = TSNone}+                | otherwise -> one st+              TSMultiBasic+                | c == '\\' -> jump 2 st+                | c == '"', Just _ <- T.stripPrefix "\"\"" rest -> jump 3 st {tsString = TSNone}+                | otherwise -> one st+              TSMultiLiteral+                | c == '\'', Just _ <- T.stripPrefix "''" rest -> jump 3 st {tsString = TSNone}+                | otherwise -> one st+              TSNone+                | c == '#' -> (st, T.take seen line)+                | c == '"', Just _ <- T.stripPrefix "\"\"" rest -> jump 3 st {tsString = TSMultiBasic}+                | c == '"' -> one st {tsString = TSBasic}+                | c == '\'', Just _ <- T.stripPrefix "''" rest -> jump 3 st {tsString = TSMultiLiteral}+                | c == '\'' -> one st {tsString = TSLiteral}+                | c == '[' -> one st {tsBracketDepth = tsBracketDepth st + 1}+                | c == ']' -> one st {tsBracketDepth = max 0 (tsBracketDepth st - 1)}+                | otherwise -> one st++-- | Join physical lines into one logical key = value line, returning it+-- with the unconsumed lines.  An unterminated construct at end of input+-- hands what accumulated to the value parser, which reports the specific+-- failure.+joinLogicalLine :: Text -> [Text] -> (Text, [Text])+joinLogicalLine firstLine rest0 =+  let (st0, visible0) = scanTomlLine emptyTomlScan firstLine+   in go st0 [visible0] rest0+  where+    -- Reversed line chunks, joined once - O(n) in the logical line's+    -- length instead of the O(n^2) of appending per physical line.+    go st !chunks remaining+      | not (tomlNeedsMoreLines st) = (T.intercalate "\n" (reverse chunks), remaining)+      | otherwise = case remaining of+          [] -> (T.intercalate "\n" (reverse chunks), [])+          (next : more) ->+            let (advanced, visible) = scanTomlLine st next+             in go advanced (visible : chunks) more++-- | Parse a key = value line.+parseKVLine :: Text -> Either Text ([Text], TOMLValue)+parseKVLine line =+  let (keyPart, afterEq) = splitAtEquals line+   in case T.uncons afterEq of+        Nothing -> Left ("expected '=' in: " <> line)+        Just _ -> do+          let val = T.strip afterEq+          parsed <- parseTOMLValue val+          Right (parseDottedKey (T.strip keyPart), parsed)++-- | Split a line at the first unquoted '=' sign.+-- O(n) via bulk spans into a chunk list instead of O(n^2) T.snoc.+splitAtEquals :: Text -> (Text, Text)+splitAtEquals = go []+  where+    keyPart chunks = T.concat (reverse chunks)+    go !chunks t = case T.uncons t of+      Nothing -> (keyPart chunks, T.empty)+      Just ('=', rest) -> (keyPart chunks, rest)+      Just ('"', rest) ->+        let (quoted, after) = T.break (== '"') rest+         in case T.uncons after of+              Just ('"', r) -> go ("\"" : quoted : "\"" : chunks) r+              _ -> go (quoted : "\"" : chunks) after+      Just ('\'', rest) ->+        let (quoted, after) = T.break (== '\'') rest+         in case T.uncons after of+              Just ('\'', r) -> go ("'" : quoted : "'" : chunks) r+              _ -> go (quoted : "'" : chunks) after+      Just (_, _) ->+        let (plain, after) = T.break (\c -> c == '=' || c == '"' || c == '\'') t+         in go (plain : chunks) after++-- | Parse dotted key like @foo.bar."baz qux"@ into @["foo", "bar", "baz qux"]@.+parseDottedKey :: Text -> [Text]+parseDottedKey t+  | T.null t = []+  | otherwise = case T.uncons t of+      Just ('"', rest) ->+        let (key, after) = T.break (== '"') rest+         in key : parseDottedKey (T.drop 1 (T.stripStart (dropDot after)))+      Just ('\'', rest) ->+        let (key, after) = T.break (== '\'') rest+         in key : parseDottedKey (T.drop 1 (T.stripStart (dropDot after)))+      _ ->+        let (key, after) = T.break (\c -> c == '.' || c == '"') t+         in T.strip key : case T.uncons after of+              Nothing -> []+              Just _ -> parseDottedKey (T.drop 1 (T.stripStart after))+  where+    dropDot txt = case T.uncons txt of+      Just ('.', rest) -> rest+      _ -> txt++-- | Parse a TOML value (right side of '=').+parseTOMLValue :: Text -> Either Text TOMLValue+parseTOMLValue t =+  let stripped = T.strip t+      -- Strip inline comments (not inside strings)+      cleaned = stripInlineComment stripped+   in case T.uncons cleaned of+        Nothing -> Left "empty value"+        Just ('"', _)+          | T.isPrefixOf "\"\"\"" cleaned -> parseMultilineBasicStr (T.drop 3 cleaned)+          | otherwise -> parseBasicStr (T.drop 1 cleaned)+        Just ('\'', _)+          | T.isPrefixOf "'''" cleaned -> parseMultilineLiteralStr (T.drop 3 cleaned)+          | otherwise -> parseLiteralStr (T.drop 1 cleaned)+        Just ('{', _) -> parseInlineTable cleaned+        Just ('[', _) -> parseInlineArray cleaned+        Just ('t', _)+          | T.isPrefixOf "true" cleaned -> Right (TOMLBool True)+        Just ('f', _)+          | T.isPrefixOf "false" cleaned -> Right (TOMLBool False)+        Just ('i', _)+          | T.isPrefixOf "inf" cleaned -> Right (TOMLFloat (1 / 0))+        Just ('+', rest)+          | T.isPrefixOf "inf" rest -> Right (TOMLFloat (1 / 0))+          | T.isPrefixOf "nan" rest -> Right (TOMLFloat (0 / 0))+        Just ('-', rest)+          | T.isPrefixOf "inf" rest -> Right (TOMLFloat (negate (1 / 0)))+          | T.isPrefixOf "nan" rest -> Right (TOMLFloat (0 / 0))+        Just ('n', _)+          | T.isPrefixOf "nan" cleaned -> Right (TOMLFloat (0 / 0))+        _ -> parseTOMLNumberOrDatetime cleaned++-- | Strip inline comment from a value (not inside quotes).+-- O(n) via bulk spans into a chunk list instead of O(n^2)+-- per-character T.cons (each cons copies the whole tail).+stripInlineComment :: Text -> Text+stripInlineComment = go (0 :: Int) []+  where+    finish chunks = T.concat (reverse chunks)+    go depth !chunks t = case T.uncons t of+      Nothing -> finish chunks+      Just ('#', _) | depth == 0 -> finish chunks+      Just ('"', rest)+        | depth == 0 ->+            let (str, after) = T.break (== '"') rest+             in go depth (T.take 1 after : str : "\"" : chunks) (T.drop 1 after)+      Just ('[', rest) -> go (depth + 1) ("[" : chunks) rest+      Just ('{', rest) -> go (depth + 1) ("{" : chunks) rest+      Just (']', rest) -> go (max 0 (depth - 1)) ("]" : chunks) rest+      Just ('}', rest) -> go (max 0 (depth - 1)) ("}" : chunks) rest+      Just (c, rest) ->+        -- c is plain (or a quote/hash inside brackets, kept as content);+        -- take it plus the whole plain run after it in one span.+        let (plain, after) = T.break scanBreak rest+         in go depth (plain : T.singleton c : chunks) after+    scanBreak c = c == '#' || c == '"' || c == '[' || c == '{' || c == ']' || c == '}'++-- | Parse a basic (double-quoted) TOML string.+-- O(n) via chunk list + T.concat instead of O(n^2) T.snoc.+parseBasicStr :: Text -> Either Text TOMLValue+parseBasicStr = go []+  where+    go !chunks t = case T.uncons t of+      Nothing -> Left "unterminated basic string"+      Just ('"', _) -> Right (TOMLStr (T.concat (reverse chunks)))+      Just ('\\', rest) -> case T.uncons rest of+        Just ('n', r) -> go ("\n" : chunks) r+        Just ('t', r) -> go ("\t" : chunks) r+        Just ('r', r) -> go ("\r" : chunks) r+        Just ('\\', r) -> go ("\\" : chunks) r+        Just ('"', r) -> go ("\"" : chunks) r+        Just ('b', r) -> go ("\b" : chunks) r+        Just ('f', r) -> go ("\f" : chunks) r+        Just ('u', r) -> case parseHex4 r of+          Just (cp, r2) -> go (T.singleton (chr cp) : chunks) r2+          Nothing -> Left "invalid \\u escape"+        _ -> Left "invalid escape sequence"+      Just (c, rest) -> go (T.singleton c : chunks) rest++-- | Parse a literal (single-quoted) TOML string.+parseLiteralStr :: Text -> Either Text TOMLValue+parseLiteralStr t =+  let (content, rest) = T.break (== '\'') t+   in case T.uncons rest of+        Just ('\'', _) -> Right (TOMLStr content)+        _ -> Left "unterminated literal string"++-- | Parse a multiline basic string.+parseMultilineBasicStr :: Text -> Either Text TOMLValue+parseMultilineBasicStr t =+  case T.breakOn "\"\"\"" t of+    (content, rest)+      | T.isPrefixOf "\"\"\"" rest ->+          Right (TOMLStr (T.replace "\\\n" "" (stripLeadingNewline content)))+      | otherwise -> Left ("unterminated multiline basic string, remaining: " <> T.take 20 rest)++-- | Parse a multiline literal string.+parseMultilineLiteralStr :: Text -> Either Text TOMLValue+parseMultilineLiteralStr t =+  case T.breakOn "'''" t of+    (content, rest)+      | T.isPrefixOf "'''" rest -> Right (TOMLStr (stripLeadingNewline content))+      | otherwise -> Left "unterminated multiline literal string"++-- | Strip a leading newline (TOML spec: first newline after opening quotes is trimmed).+stripLeadingNewline :: Text -> Text+stripLeadingNewline t = case T.uncons t of+  Just ('\n', rest) -> rest+  Just ('\r', rest) -> case T.uncons rest of+    Just ('\n', r) -> r+    _ -> rest+  _ -> t++-- | Parse a TOML number or datetime.+parseTOMLNumberOrDatetime :: Text -> Either Text TOMLValue+parseTOMLNumberOrDatetime s+  -- Hex, octal, binary integers+  | T.isPrefixOf "0x" s || T.isPrefixOf "0X" s = parseHexInt (T.drop 2 s)+  | T.isPrefixOf "0o" s || T.isPrefixOf "0O" s = parseOctInt (T.drop 2 s)+  | T.isPrefixOf "0b" s || T.isPrefixOf "0B" s = parseBinInt (T.drop 2 s)+  -- Contains date separators, so treat as a datetime string+  | T.any (== 'T') s && T.any (== '-') s = Right (TOMLStr s)+  | T.count "-" s >= 2 && T.any isDigit s = Right (TOMLStr s)+  | T.any (== ':') s && T.any isDigit s = Right (TOMLStr s)+  -- Float (has dot or exponent)+  | T.any (== '.') s || T.any (\c -> c == 'e' || c == 'E') s = parseFloat s+  -- Plain integer+  | otherwise = parseInt s++-- | Parse a plain decimal integer, ignoring underscores.+parseInt :: Text -> Either Text TOMLValue+parseInt t =+  let cleaned = T.filter (/= '_') t+      (sign, digits) = case T.uncons cleaned of+        Just ('+', rest) -> (1 :: Integer, rest)+        Just ('-', rest) -> (-1, rest)+        _ -> (1, cleaned)+   in case readDecimal digits of+        Just n -> tomlInt t (sign * n)+        Nothing -> Left ("invalid integer: " <> t)++parseHexInt :: Text -> Either Text TOMLValue+parseHexInt t =+  let cleaned = T.filter (/= '_') t+   in case readHexT cleaned of+        Just n -> tomlInt t n+        Nothing -> Left ("invalid hex integer: " <> t)++parseOctInt :: Text -> Either Text TOMLValue+parseOctInt t =+  let cleaned = T.filter (/= '_') t+   in case readOctT cleaned of+        Just n -> tomlInt t n+        Nothing -> Left ("invalid octal integer: " <> t)++parseBinInt :: Text -> Either Text TOMLValue+parseBinInt t =+  let cleaned = T.filter (/= '_') t+   in case readBinT cleaned of+        Just n -> tomlInt t n+        Nothing -> Left ("invalid binary integer: " <> t)++-- | Finish a parsed TOML integer: a value outside the 64-bit signed range+-- is a parse error, as upstream's TOML parser reports - silently wrapping+-- would hand the evaluator a different number than the document wrote.+tomlInt :: Text -> Integer -> Either Text TOMLValue+tomlInt original n+  | n < toInteger (minBound :: Int64) || n > toInteger (maxBound :: Int64) =+      Left ("integer out of 64-bit range: " <> original)+  | otherwise = Right (TOMLInt (fromInteger n))++parseFloat :: Text -> Either Text TOMLValue+parseFloat t =+  let cleaned = T.filter (/= '_') t+   in case readDouble cleaned of+        Just d -> Right (TOMLFloat d)+        Nothing -> Left ("invalid float: " <> t)++-- Digit readers accumulate an unbounded 'Integer'; 'tomlInt' applies the+-- 64-bit range gate after any sign, so the minimum int64 (whose magnitude+-- alone exceeds the maximum) still parses.++-- | Read an unbounded decimal integer from Text.+readDecimal :: Text -> Maybe Integer+readDecimal t+  | T.null t = Nothing+  | T.all isDigit t = Just (T.foldl' (\acc c -> acc * 10 + fromIntegral (digitToInt c)) 0 t)+  | otherwise = Nothing++readHexT :: Text -> Maybe Integer+readHexT t+  | T.null t = Nothing+  | T.all isHexDigit t = Just (T.foldl' (\acc c -> acc * 16 + fromIntegral (digitToInt c)) 0 t)+  | otherwise = Nothing++readOctT :: Text -> Maybe Integer+readOctT t+  | T.null t = Nothing+  | T.all isOctDigit t =+      Just (T.foldl' (\acc c -> acc * 8 + fromIntegral (digitToInt c)) 0 t)+  | otherwise = Nothing++readBinT :: Text -> Maybe Integer+readBinT t+  | T.null t = Nothing+  | T.all (\c -> c == '0' || c == '1') t =+      Just (T.foldl' (\acc c -> acc * 2 + fromIntegral (digitToInt c)) 0 t)+  | otherwise = Nothing++readDouble :: Text -> Maybe Double+readDouble t = case reads (T.unpack t) of+  [(d, "")] -> Just d+  _ -> Nothing++-- | Parse an inline table: @{ key = val, ... }@.+parseInlineTable :: Text -> Either Text TOMLValue+parseInlineTable t = case T.uncons t of+  Just ('{', rest) ->+    let inner = T.strip (T.dropWhileEnd (== '}') (T.strip rest))+     in if T.null inner+          then Right (TOMLTable Map.empty)+          else do+            pairs <- mapM parseInlineKV (splitCommas inner)+            Right (TOMLTable (Map.fromList (concatMap flattenPair pairs)))+  _ -> Left "expected '{'"+  where+    flattenPair (keys, val) = case keys of+      [] -> []+      [k] -> [(k, val)]+      (k : ks) -> [(k, nestKeys ks val)]+    nestKeys [] v = v+    nestKeys (k : ks) v = TOMLTable (Map.singleton k (nestKeys ks v))++-- | Parse an inline array: @[ val, ... ]@.+parseInlineArray :: Text -> Either Text TOMLValue+parseInlineArray t = case T.uncons t of+  Just ('[', rest) ->+    let inner = T.strip (T.dropWhileEnd (== ']') (T.strip rest))+     in if T.null inner+          then Right (TOMLArray [])+          else do+            vals <- mapM (parseTOMLValue . T.strip) (splitCommas inner)+            Right (TOMLArray vals)+  _ -> Left "expected '['"++-- | Parse a single key=value pair in an inline table.+parseInlineKV :: Text -> Either Text ([Text], TOMLValue)+parseInlineKV t =+  let (keyPart, afterEq) = splitAtEquals (T.strip t)+   in do+        val <- parseTOMLValue (T.strip afterEq)+        Right (parseDottedKey (T.strip keyPart), val)++-- | Split on commas not inside brackets or braces.+-- O(n) via chunk list + T.concat instead of O(n^2) T.snoc.+splitCommas :: Text -> [Text]+splitCommas = go (0 :: Int) []+  where+    finalize chunks =+      let t = T.concat (reverse chunks)+       in [t | not (T.null (T.strip t))]+    go _ !chunks t | T.null t = finalize chunks+    go depth !chunks t = case T.uncons t of+      Nothing -> finalize chunks+      Just (',', rest) | depth == 0 -> T.concat (reverse chunks) : go 0 [] rest+      Just ('[', rest) -> go (depth + 1) ("[" : chunks) rest+      Just ('{', rest) -> go (depth + 1) ("{" : chunks) rest+      Just (']', rest) -> go (max 0 (depth - 1)) ("]" : chunks) rest+      Just ('}', rest) -> go (max 0 (depth - 1)) ("}" : chunks) rest+      Just ('"', rest) ->+        let (str, after) = T.break (== '"') rest+            consumed = "\"" <> str <> T.take 1 after+         in go depth (consumed : chunks) (T.drop 1 after)+      Just (c, rest) -> go depth (T.singleton c : chunks) rest++-- | Insert a value at a nested key path into a table.+insertNested :: [Text] -> TOMLValue -> Map Text TOMLValue -> Map Text TOMLValue+insertNested [] _ m = m+insertNested [k] v m = Map.insert k v m+insertNested (k : ks) v m = case Map.lookup k m of+  -- Under a [[table]] header the path crosses an array of tables: keys+  -- belong to its LAST element, not to a table replacing the array.+  Just (TOMLArray xs)+    | (TOMLTable lastInner : prev) <- reverse xs ->+        Map.insert k (TOMLArray (reverse prev ++ [TOMLTable (insertNested ks v lastInner)])) m+  Just (TOMLTable inner) -> Map.insert k (TOMLTable (insertNested ks v inner)) m+  _ -> Map.insert k (TOMLTable (insertNested ks v Map.empty)) m++-- | Ensure a table path exists (for @[table]@ headers).+ensureTable :: [Text] -> Map Text TOMLValue -> Map Text TOMLValue+ensureTable [] m = m+ensureTable [k] m = case Map.lookup k m of+  Just (TOMLTable _) -> m+  Nothing -> Map.insert k (TOMLTable Map.empty) m+  _ -> m+ensureTable (k : ks) m =+  let sub = case Map.lookup k m of+        Just (TOMLTable inner) -> inner+        _ -> Map.empty+   in Map.insert k (TOMLTable (ensureTable ks sub)) m++-- | Insert an entry into an array-of-tables (@[[table]]@).+insertArrayTable :: [Text] -> Map Text TOMLValue -> Map Text TOMLValue+insertArrayTable [] m = m+insertArrayTable [k] m = case Map.lookup k m of+  Just (TOMLArray xs) -> Map.insert k (TOMLArray (xs ++ [TOMLTable Map.empty])) m+  Nothing -> Map.insert k (TOMLArray [TOMLTable Map.empty]) m+  _ -> Map.insert k (TOMLArray [TOMLTable Map.empty]) m+insertArrayTable (k : ks) m =+  let sub = case Map.lookup k m of+        Just (TOMLTable inner) -> inner+        Just (TOMLArray xs) ->+          -- Descend into the last element of the array+          case reverse xs of+            (TOMLTable inner : _) -> inner+            _ -> Map.empty+        _ -> Map.empty+      updated = insertArrayTable ks sub+   in case Map.lookup k m of+        Just (TOMLArray xs) ->+          case reverse xs of+            (TOMLTable _ : prev) ->+              Map.insert k (TOMLArray (reverse prev ++ [TOMLTable updated])) m+            _ -> Map.insert k (TOMLTable updated) m+        _ -> Map.insert k (TOMLTable updated) m++-- ---------------------------------------------------------------------------+-- Builtin implementations - toXML+-- ---------------------------------------------------------------------------++-- | @builtins.toXML val@ - convert a Nix value to its XML representation.+-- Matches the format defined by the Nix manual: strings, ints, floats,+-- bools, nulls, lists, and attrsets map to their XML counterparts.+-- Built over BYTES: upstream's serializer copies string payloads into the+-- output with only the four ASCII escapes, so invalid UTF-8 passes+-- through raw rather than erroring (unlike toJSON, whose upstream+-- serializer validates).+builtinToXML :: (MonadEval m) => NixValue -> m NixValue+builtinToXML val = do+  xml <- valueToXML 0 val+  pure (mkStrBytes ("<?xml version='1.0' encoding='utf-8'?>\n<expr>\n" <> xml <> "</expr>\n"))++valueToXML :: (MonadEval m) => Int -> NixValue -> m BS.ByteString+valueToXML depth val = case val of+  VStr s _ ->+    pure (indent depth <> "<string value=" <> xmlQuote s <> " />\n")+  VInt n ->+    pure (indent depth <> "<int value=\"" <> BC.pack (show n) <> "\" />\n")+  VFloat d ->+    pure (indent depth <> "<float value=\"" <> TE.encodeUtf8 (formatXmlFloat d) <> "\" />\n")+  VBool True ->+    pure (indent depth <> "<bool value=\"true\" />\n")+  VBool False ->+    pure (indent depth <> "<bool value=\"false\" />\n")+  VNull ->+    pure (indent depth <> "<null />\n")+  VPath p ->+    pure (indent depth <> "<path value=" <> xmlQuote (TE.encodeUtf8 p) <> " />\n")+  VList cl -> do+    let thunks = map Thunk (clistThunks cl)+    items <- mapM (force >=> valueToXML (depth + 1)) thunks+    pure (indent depth <> "<list>\n" <> BS.concat items <> indent depth <> "</list>\n")+  VAttrs attrs -> do+    let pairs = attrSetToAscList attrs+    items <- mapM (attrToXML (depth + 1)) pairs+    pure (indent depth <> "<attrs>\n" <> BS.concat items <> indent depth <> "</attrs>\n")+  VLambda {} ->+    pure (indent depth <> "<function />\n")+  VBuiltin _ _ ->+    pure (indent depth <> "<function />\n")+  VDerivation _ ->+    pure (indent depth <> "<derivation />\n")+  VCompiledRegex _ ->+    pure (indent depth <> "<function />\n")+  where+    attrToXML d (name, thunk) = do+      v <- force thunk+      inner <- valueToXML d v+      pure (indent d <> "<attr name=" <> xmlQuote (TE.encodeUtf8 name) <> ">\n" <> inner <> indent d <> "</attr>\n")++indent :: Int -> BS.ByteString+indent n = BC.replicate (n * 2) ' '++xmlQuote :: BS.ByteString -> BS.ByteString+xmlQuote s = "\"" <> BC.concatMap escapeChar s <> "\""+  where+    escapeChar '<' = "&lt;"+    escapeChar '>' = "&gt;"+    escapeChar '&' = "&amp;"+    escapeChar '"' = "&quot;"+    escapeChar c = BC.singleton c++-- ---------------------------------------------------------------------------+-- Builtin implementations - builtins.path+-- ---------------------------------------------------------------------------++-- | @builtins.path { path; name?; filter?; sha256?; recursive?; }@+--+-- Copy a path to the store and return the store path as a string with+-- context.  @name@ defaults to the basename of @path@.  @filter@ is+-- accepted but not yet applied (copies everything).+builtinPath :: (MonadEval m) => NixValue -> m NixValue+builtinPath (VAttrs attrs) = do+  pathStr <- forceAttrStr "builtins.path" "path" attrs+  nameOverride <- forceOptionalAttrStr attrs "name"+  expectedDigest <- case attrSetLookup "sha256" attrs of+    Nothing -> pure Nothing+    Just thunk -> do+      pinVal <- force thunk+      case pinVal of+        VStr pin _ -> do+          pinText <- decodedText "builtins.path" pin+          Just <$> decodeSha256Pin "builtins.path" pinText+        other -> throwEvalError ("builtins.path: 'sha256' must be a string, got " <> typeName other)+  let name = fromMaybe (canonBaseName pathStr) nameOverride+      pinSubject = "builtins.path: " <> pathStr+  storePathText <- case attrSetLookup "filter" attrs of+    Nothing -> copyPathToStore pathStr name (fmap (pinSubject,) expectedDigest)+    Just filterThunk -> do+      filterFn <- force filterThunk+      narBytes <- filteredSourceNar filterFn pathStr+      -- The sha256 pin applies to the FILTERED tree, as upstream.+      let filteredDigest = sha256Digest narBytes+      case expectedDigest of+        Just expected+          | expected /= filteredDigest ->+              throwEvalError+                ( pinSubject+                    <> ": hash mismatch: expected sha256:"+                    <> bytesToHexText expected+                    <> ", got sha256:"+                    <> bytesToHexText filteredDigest+                )+        _ -> pure ()+      addSourceNar name narBytes+  pure (sourceResultString storePathText)+builtinPath other =+  throwEvalError ("builtins.path: expected an attribute set, got " <> typeName other)++-- | The result value both source importers return: the store path as a+-- string carrying itself as context.+sourceResultString :: Text -> NixValue+sourceResultString storePathText =+  case parseStorePath defaultStoreDir storePathText of+    Just sp -> VStr (TE.encodeUtf8 storePathText) (plainContext sp)+    Nothing -> VStr (TE.encodeUtf8 storePathText) emptyContext++-- | Serialise a source tree to a NAR, keeping only entries the Nix filter+-- function accepts - upstream's addToStore filtering: the filter receives+-- @(path, type)@ for every entry BELOW the root (the root itself is never+-- filtered), and rejecting a directory prunes its whole subtree.  Child+-- paths hand the filter @parent/name@ with a forward slash; both path+-- styles reach Nix code only through separator-agnostic helpers like+-- @baseNameOf@.+filteredSourceNar :: (MonadEval m) => NixValue -> Text -> m BS.ByteString+filteredSourceNar filterFn rootPath = do+  rootType <- getFileType rootPath+  entry <- buildEntry rootPath rootType+  pure (NAR.serialise entry)+  where+    buildEntry path fileType = case fileType of+      "regular" -> do+        executable <- isExecutableFile path+        bytes <- readFileBytes path+        pure (NAR.NarRegular executable bytes)+      "symlink" -> NAR.NarSymlink . TE.encodeUtf8 <$> readSymlinkTarget path+      "directory" -> do+        children <- listDirectory path+        kept <- mapM (keepChild path) children+        pure (NAR.NarDirectory (catMaybes kept))+      other -> throwEvalError ("builtins.path: unsupported file type '" <> other <> "' at " <> path)+    keepChild parent (name, childType) = do+      let childPath = parent <> "/" <> name+      keep <- filterAccepts childPath childType+      if keep+        then Just . (,) (TE.encodeUtf8 name) <$> buildEntry childPath childType+        else pure Nothing+    filterAccepts path fileType = do+      partial <- applyValue filterFn (mkStr path)+      result <- applyValue partial (mkStr fileType)+      case result of+        VBool b -> pure b+        other -> throwEvalError ("builtins.path: the filter function must return a Boolean, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - filterSource+-- ---------------------------------------------------------------------------++-- | @builtins.filterSource filter path@ - copy a path to the store,+-- filtering entries via a predicate.  The filter function receives+-- @(path, type)@ where type is @"regular"@, @"directory"@, @"symlink"@,+-- or @"unknown"@.  Equivalent to @builtins.path@ with a filter and the+-- source's basename as the store name.+builtinFilterSource :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinFilterSource filterFn (VPath path) = filterSourceInto filterFn path+builtinFilterSource filterFn (VStr path _) =+  filterSourceInto filterFn =<< decodedText "builtins.filterSource" path+builtinFilterSource _ other =+  throwEvalError ("builtins.filterSource: expected a path, got " <> typeName other)++filterSourceInto :: (MonadEval m) => NixValue -> Text -> m NixValue+filterSourceInto filterFn path = do+  narBytes <- filteredSourceNar filterFn path+  storePathText <- addSourceNar (canonBaseName path) narBytes+  pure (sourceResultString storePathText)  -- --------------------------------------------------------------------------- -- Builtin stubs - experimental features