nova-nix 0.8.0.0 → 0.9.0.0

raw patch · 77 files changed

+31122/−19339 lines, 77 filesdep +QuickCheckdep +Win32dep +file-iodep ~directorydep ~filepathdep ~processPVP ok

version bump matches the API change (PVP)

Dependencies added: QuickCheck, Win32, file-io, random, unix

Dependency ranges changed: directory, filepath, process

API changes (from Hackage documentation)

Files

• CHANGELOG.md +123/−0
• README.md +73/−26
• app/Main.hs +541/−252
• cbits/nn_arena.c +10/−0
• cbits/nn_arena.h +12/−1
• cbits/nn_attrset.c +45/−37
• cbits/nn_attrset.h +25/−8
• cbits/nn_bytecode.c +27/−1
• cbits/nn_bytecode.h +40/−5
• cbits/nn_ctxstr.c +9/−7
• cbits/nn_darwinfs.c +31/−0
• cbits/nn_darwinfs.h +18/−0
• cbits/nn_env.c +13/−6
• cbits/nn_env.h +6/−1
• cbits/nn_lambda.c +10/−7
• cbits/nn_list.c +37/−15
• cbits/nn_list.h +16/−2
• cbits/nn_symbol.c +80/−61
• cbits/nn_symbol.h +21/−4
• cbits/nn_thunk.c +66/−71
• cbits/nn_thunk.h +40/−29
• cbits/nn_winfs.h +4/−2
• nova-nix.cabal +57/−16
• src/Nix/Builder.hs +185/−107
• src/Nix/Builder/Unpack.hs +13/−9
• src/Nix/Builtins.hs +263/−110
• src/Nix/Config.hs +608/−92
• src/Nix/DependencyGraph.hs +17/−15
• src/Nix/Derivation.hs +22/−0
• src/Nix/Derivation/StructuredAttrs.hs +177/−0
• src/Nix/Environment.hs +67/−0
• src/Nix/Eval.hs +5692/−5407
• src/Nix/Eval/Arena.hs +36/−5
• src/Nix/Eval/AttrPath.hs +2/−23
• src/Nix/Eval/CAttrSet.hs +30/−10
• src/Nix/Eval/CBytecode.hs +53/−6
• src/Nix/Eval/CList.hs +60/−11
• src/Nix/Eval/CStatus.hs +111/−0
• src/Nix/Eval/CThunk.hs +107/−84
• src/Nix/Eval/CallDepth.hs +67/−0
• src/Nix/Eval/CanonPath.hs +4/−0
• src/Nix/Eval/Compile.hs +78/−56
• src/Nix/Eval/Context.hs +26/−1
• src/Nix/Eval/IO.hs +653/−172
• src/Nix/Eval/Operator.hs +143/−101
• src/Nix/Eval/Policy.hs +228/−0
• src/Nix/Eval/Print.hs +381/−0
• src/Nix/Eval/SourceError.hs +57/−0
• src/Nix/Eval/StringInterp.hs +174/−187
• src/Nix/Eval/Symbol.hs +25/−11
• src/Nix/Eval/Types.hs +194/−84
• src/Nix/Expr/ClosureTrim.hs +43/−31
• src/Nix/Expr/Resolve.hs +297/−160
• src/Nix/Expr/Types.hs +20/−4
• src/Nix/Hash.hs +17/−14
• src/Nix/HostPath.hs +64/−0
• src/Nix/Http.hs +318/−0
• src/Nix/Json.hs +414/−0
• src/Nix/Parser.hs +41/−8
• src/Nix/Parser/Expr.hs +37/−31
• src/Nix/Parser/Lexer.hs +19/−6
• src/Nix/Push.hs +45/−20
• src/Nix/Store.hs +502/−387
• src/Nix/Store/CaseSensitive.hs +110/−11
• src/Nix/Store/DB.hs +62/−0
• src/Nix/Store/EntryName.hs +185/−0
• src/Nix/Store/Exclusive.hs +214/−0
• src/Nix/Store/ExecBit.hs +45/−24
• src/Nix/Store/GC.hs +637/−0
• src/Nix/Store/Handle.hs +138/−0
• src/Nix/Store/Lock.hs +65/−14
• src/Nix/Store/Path.hs +44/−0
• src/Nix/Store/Symlink.hs +89/−0
• src/Nix/Substituter.hs +263/−276
• test/FetchurlFixture.hs +0/−91
• test/HttpFixture.hs +119/−0
• test/Main.hs +16557/−11220

@@ -1,5 +1,128 @@ # Changelog +## 0.9.0.0 - 2026-10-31++On nixpkgs 26.05 and unstable, where 0.8.0.0 failed, CI now holds 22 derivations to the store paths upstream computes, on Nix 2.34.9 and 2.35.4 respectively, alongside Nix 2.24.9 with nixpkgs 24.11.++### Library API++Breaking changes for code that uses nova-nix as a library:++- **`Nix.Expr.Types.Binding`'s `NamedBinding` holds one `AttrKey` where it held an `AttrPath`,** as upstream's `ExprAttrs` holds one name per definition (nixexpr.hh at 2.24.9). The parser already hoisted `a.b.c = v;` into nested sets before evaluation; it now does so as it parses, so no binding carries a path. `Nix.Eval.Compile.BcNamed` holds one `BcAttrKey`, and a named binding's bytecode drops its path-length word. `Nix.Eval.CStatus.CStatusError` includes `CInvariantViolated`, raised through `cInvariantViolated`. In `Nix.Eval.CThunk`, `cthunkNull :: CThunkPtr` and `cthunkBool :: Bool -> CThunkPtr` replace `cthunkNewComputedNull` and `cthunkNewComputedBool`, and the `cthunkSetComputed` setters and `cthunkSetPayload` return `Bool`, whether the thunk took the value, where the setters returned the pending payload. `Nix.Eval.CAttrSet.cattrsetNew` takes the expected entry count as an `Int`, and it, `cattrsetInsert`, `cattrsetUnion`, `cattrsetRemoveKeys` and `Nix.Eval.CList.clistNew` raise `CStatusError` when the C side refuses. (#19)+- **`formatXmlFloat` moved to `Nix.Eval.Print` from `Nix.Eval.StringInterp`, which now prints the value its coercion failure names.** `Nix.Eval.Operator.evalBinary` no longer evaluates `OpAdd`, which its caller handles as it handles the short-circuit operators, because `+` looks at its left operand before the right is evaluated and coerces through the evaluator; `Nix.Eval.Operator` exports `addToInteger` and `addToFloat`, the arithmetic once the left operand is a number. `Nix.Eval.Types` exports `thunkUnderEvaluation`, whether a thunk is being forced, and `typeName` returns upstream's `showType` names. (#250)+- **`Nix.Hash.compressHash` takes and returns a `ByteString`,** the digest it folds and the bytes it folds it to, where both were `[Word8]`. (#48)+- **`Nix.Config` resolves configuration through a file-reading effect, so includes and the file cascade are testable against an in-memory map.** `loadConfig` reads, expands and folds a weakest-first path list plus the `NIX_CONFIG` bytes over a `ReadConfigFile m` (`OsPath -> m (Either ConfigReadFailure ByteString)`, the failure saying whether the file is missing or merely unreadable, which decides how a failed `include` is reported); `expandConfigSource` splices one `ConfigSource`'s includes; `parseConfigLines` replaces `parseConfigText` and yields `ConfigLine`, an assignment or an `IncludeMode` include; and `ConfigLocations` with `configFilePaths` computes upstream's file order from the raw environment and the platform's directories, which the caller supplies so the module carries no platform literal, refusing a relative `NIX_CONF_DIR` as upstream does. `resolveConfig` now folds a flat `[ConfigAssignment]`, failing only on a value a setting cannot take, and `applyConfigText` is gone, since a source's text cannot be applied without the files it includes. (#199)+- **`Nix.Config` carries a source as bytes and its paths as `OsPath`.** `ConfigSource` holds an `OsPath` name and `ByteString` text, `ReadConfigFile m` is `OsPath -> m (Either ConfigReadFailure ByteString)`, `loadConfig` takes `[OsPath]` and the `NIX_CONFIG` bytes, and `configFilePaths` returns `[OsPath]`. `ConfigLocations` takes `NIX_CONF_DIR` and `NIX_USER_CONF_FILES` as the bytes `Nix.Environment.lookupEnvBytes` returns and its directories as `OsPath`. `ConfigLine`'s include target and `ConfigAssignment`'s name and value are `ByteString`, `parseConfigLines` takes an `OsPath` and a `ByteString`, `parseUnsignedSetting` takes `ByteString`s, and `nixConfFileName`, `nixConfDirName` and `nixConfigSourceName` are `OsPath`. The new module `Nix.HostPath` spells bytes as a host path (`hostPathFromBytes`), the spelling `Nix.Store.EntryName` now uses too, and shows one in a message (`hostPathText`). The executable's `filepath` and `directory` floors rise to 1.4.100 and 1.3.8, the first with `System.OsPath` and `System.Directory.OsPath`, as the library's did, and it depends on `file-io` >= 0.1.1 to read a file by its `OsPath`, 0.1.1 being the first whose read does not create a missing file on Windows. (#244)+- **`Nix.Eval.Types.MonadEval` has a new method with no default, `addErrorTrace`, and `Nix.Eval.IO`'s `NixEvalError` and `NixAbortError` carry an `EvalFailure`, a message with its lines of context, where they carried the message alone.** Every instance defined outside this package needs the method. `runEvalIO` still returns the message; the new `runEvalIOTraced` returns the whole `EvalFailure`, and `renderEvalFailure` writes it as upstream reports an error. (#221)+- **`Nix.Eval.Types.NixValue` drops `VDerivation`.** The constructor existed only to carry the build recipe through the derivation value's private `_derivation` attribute, which no longer exists; nothing constructed it any more and no Nix operation could observe one. Exhaustive matches over `NixValue` lose a case. The recipe a build needs is the `.drv` ATerm the evaluator records under its path during evaluation (`Nix.Eval.IO.EvalState`'s `esDrvClosure`, or `lookupSessionDrv` inside the evaluator), which is what the build driver and the test harness now read. (#217) `Nix.Eval` now exports `deferApply`, the shared thunk that applies one value to another when forced; the derivation wrapper's fallback uses it, and library code that built the same synthetic thunk by hand can too. (#230)+- **`Nix.Eval.Types.MonadEval`'s `getEnvVar` takes the bytes of a variable's name and returns the bytes of its value,** `ByteString` both ways where it was `Text`, so every instance defined outside this package changes with it. `Nix.Builtins.parseNixPath`, `splitNixPath` and `isNixPathPseudoUrl` take a `ByteString` and `searchPathRoots` returns them, since a `NIX_PATH` entry is bytes. The new module `Nix.Environment` reads one variable as bytes (`lookupEnvBytes`, answering an `EnvLookup`). Outside Windows the read goes through `unix`'s `System.Posix.Env.ByteString`. (#241)+- **`Nix.Eval.Print` exports `printAmbiguous`, the `ByteString` `Builder` for what `nova-nix eval` prints,** after upstream's printer of the same name. (#259)+- **`Nix.Eval.CList` exports `clistIndex` and `clistDrop`,** a bounds-checked read of one element and the list without its first elements, which shares the source's C array through the C layer's new `nn_list_drop`. (#263)+- **`Nix.DependencyGraph.buildDepGraph` reads each `.drv` in the caller's monad,** `(Monad m) => (StorePath -> m (Either Text Derivation)) -> Derivation -> StorePath -> m (Either Text DepGraph)`, where it took a pure reader. The build driver passes a read in `IO`, which replaces the `unsafePerformIO` read the pure signature forced on it; a pure lookup runs under `Data.Functor.Identity`. (#251)+- **`Nix.Eval.Types.MonadEval` has a new method with no default, `withCallFrame`, and `Nix.Eval.IO.EvalState` a new strict field, `esCallDepth`.** Every instance defined outside this package needs the method; `newEvalState` fills the field with upstream's default ceiling, and a caller with a configured one replaces it. The new module `Nix.Eval.CallDepth` holds the counter type, the default and the entry rule. `Nix.Eval.CBytecode` exports the `OpApp` flag values `appDirect` and `appDeferred`. `Nix.Config.NixConfig` gains `ncMaxCallDepth`, `Nix.Config.applyAssignment` now returns `Either Text NixConfig` because a scalar setting's value can fail to parse, and `Nix.Config.parseUnsignedSetting` is exported. (#222)+- **`Nix.Store.EntryName` decides which NAR entry names and symlink targets a host can hold, replacing `Nix.Store.isSafeNarName`.** `NameRules` (`PosixNames`, `DarwinNames`, `WindowsNames`), `hostNameRules`, and the pure `checkEntryName` and `checkLinkTarget` answer for any platform on any platform; `entryNamePath` and `linkTargetPath` spell an admitted name or target as the running host's `OsPath`, and `shownBytes` renders one in a refusal. `onDiskNameKey` and `caseHackDiskNames` take the `ByteString` names a NAR carries instead of `Text`, `orderLinks` orders `(OsPath, OsPath)` pairs, and `Nix.Store.ExecBit` gains `markExecutableOsPath`. The library's floors rise to directory >= 1.3.8 and filepath >= 1.4.100, the first releases with the `OsPath` APIs it now calls, and the test suite's filepath floor with it. (#84)+- **`Nix.Eval.Types.MonadEval` has three new methods with no defaults,** `evalPolicy`, `checkUri` and `resolveSymlinks`, and `doesPathExist` takes a `PathExistence` first argument (`ExistsAsEntry` or `ExistsAsDirectory`, the two questions `builtins.pathExists` asks); every instance defined outside this package needs them. The new module `Nix.Eval.Policy` holds the policy record (`EvalPolicy`, `unrestrictedPolicy`) and the pure decisions behind the modes (`isAllowedPath`, `isAllowedUri`, `uriAccess` and their messages), and `Nix.Eval.Types` re-exports the record. `Nix.Builtins.builtinEnv` and `builtinEnvWithScope` take an `EvalPolicy` first argument, since the impure constants exist by policy; `Nix.Builtins.searchPathRoots` reads the roots back from a search path, and `isNixPathPseudoUrl` says which entries name a download. `Nix.Eval.IO.EvalState` gains `esPolicy` and `esAllowedPaths`, with `allowEvalPath` to seed the allowed roots. `Nix.Eval` exports `FetchGitArgs (..)` and `gitInputUrl`, the URL form a `fetchGit` input is checked and reported in. `Nix.Config.NixConfig` gains `ncAllowedUris`, `ncRestrictEval` and `ncPureEval`. (#75)+- **`Nix.Eval.Types.mkSyntheticThunk` takes the bytecode index of the code it runs instead of an `Expr`, and every bytecode store opens with five reserved instructions.** A caller compiles once (`Nix.Eval.Compile.compileExpr`) and passes the index, rather than having the code compiled again for each thunk. `Nix.Eval.CBytecode` exports `reservedApply1` and `reservedApply2`, the deferred applications of an env's slots a store starts with, so a fresh store's `cbcOpCount` is 5 and the first instruction compiled lands at index 5. `Nix.Eval.Compile.BcInheritFrom` carries a `BcInheritedName` per name, its symbol and the bc_idx of the select that reads it, where it carried the symbols alone, and the `inherit (from)` encoding stores that select after each symbol. (#269)+- **`Nix.Parser.parseNix` returns `Either SourceError Expr`, and a plain `inherit` is a binding of its own in the AST.** `SourceError` is `SyntaxError ParseError`, the failure it returned before, or `UndefinedVariable Text`, a variable binding found unbound. `parseNix` binds against the root environment's names under the default policy; `parseNixWithScope` binds against the names given, which for evaluation under a policy are `Nix.Builtins.rootScopeNames`, plus a `scopedImport` scope's. `Nix.Expr.Resolve.resolveVars` takes those names and returns `Either Text Expr`; `staticGlobalNames` is now upstream's whole base environment, `impureOnlyGlobalNames` the part `pure-eval` drops, and `undefinedVariableMessage` upstream's wording for the failure. `Nix.Expr.Types.Binding`'s `Inherit (Maybe Expr) [Text]` becomes `Inherit Text Expr`, one per name and holding the variable it copies, and `InheritFrom Expr [Text]`; every match on `Binding` outside this package must cover both. In the bytecode, `Nix.Eval.Compile.BcInherit` carries a symbol and the variable's bc_idx instead of a list of symbols, and `Nix.Eval.CBytecode.bindInheritFrom` is the tag of an `inherit (from)` binding, whose encoding no longer carries a has-from word. (#248)+- **`Nix.Store.Store` has a new strict field, `stGcLease`, `openStore` keys the handle by the directory's canonical spelling, and the store modules grow a garbage-collection surface.** Code that builds a `Store` with the constructor needs the field; `openStore` fills it, and `stDir` is now `canonicalStoreDir` of what was passed. `Nix.Store.GC` is new (`collectGarbage`, which returns `Either` with the refusal of a database keyed under another spelling of the directory, `findRoots`, `addOutLinkRoot`, the pure `reachableFrom`, `referencesMap` and `sweepPlan` with its `SweepPlan`, the abstract `LiveSet` with `withLiveSet` and `isLive`, `GcRoot`, `GcResults`, `gcSummaryLine`, `showFreedBytes`, the roots directory names), as are `Nix.Store.Handle` (`Store`, `openStore`, `closeStore`, `canonicalStoreDir`, `withCollectorLock`, `gcLockFilePath`) and `Nix.Store.Symlink` (`WalkNode`, `classifyWalkNode`, `createSymlinkOfKind`); `Nix.Store` re-exports the first two. `Nix.Store.Lock` adds `LockMode`, `acquireLockFileWith`, `withLockFileWith`, `waitingForLockMessage` and `lockedPathOf`; `Nix.Store.Path` adds `parseStorePathPrefix`, upstream's `toStorePath`; `Nix.Store.DB` adds `queryAllReferences` and the batch `unregisterPathRows`. `deleteStorePathRaw` now takes the collector lock and refuses a path reachable from a root before its referrer check, and `deleteStorePathChecked` is the same delete given a `LiveSet` from `withLiveSet`, for a batch under one lock. (#24)+- **The new module `Nix.Json` holds the JSON value type (`Json`), its rendering as upstream's serializer writes it (`renderJson`, `renderJsonWith`) and a parser that reads JSON as upstream's does (`parseJson`); `formatJsonFloat` moved there from `Nix.Eval.StringInterp`.** The new module `Nix.Derivation.StructuredAttrs` holds the `__json` entry's key, its encoding and decoding, and what a builder makes of it (`withOutputPlaceholders`, `renderAttrsJson`, `renderAttrsShell`, `stringsAttr`). (#36)+- **`Nix.Substituter.httpStatusFailure` is gone, and the transfer layer's retry policy and failure classification live in `Nix.Http`.** `fetchStatusFailure`, which takes the URL and the response's `Status`, replaces it. `Nix.Http` exports `AttemptFailure (..)`, `attemptFailureMessage` and `catchSync`, which `Nix.Substituter` still re-exports; the retry policy (`FetchRetryPolicy (..)`, `defaultFetchRetryPolicy`, `RetryEffects (..)`, `ioRetryEffects`, `retryTransient`, `retryDelayMs`); and the classification (`TransferError (..)` and `statusError`, upstream's verdict on a status, `withTransfer` and `transferBodyReader`, which raise every failure of the connection as an `HttpException`, `transferFailureHandlers`, `fetchStatusFailure`, `fetchExceptionFailure`, which takes an `HttpException` rather than any exception, and `fetchWriteFailure`, for an `IOException` writing a download). `Nix.Substituter.trySubstituteWith` substitutes under a given policy and effects; `trySubstitute` is it at upstream's default, and a build passes its `bcFetchRetry`. (#243)+- **`Nix.Substituter` gains `VerifiedNar`, the only input its strict unpack sink accepts, and stops re-exporting `unpackNarEntry`.** `unpackAndVerify` checked the downloaded bytes against the narinfo's signed NarHash and NarSize before deserializing and writing them, but the bytes had the same `ByteString` type on both sides of the check, so only statement order kept unverified bytes away from the disk writes, and the module's re-export of `unpackNarEntry` offered an unpack that skipped the check altogether. `verifyNar` is now the sole way to obtain a `VerifiedNar` (its constructor is not exported), a module-private sink is the only consumer of one, and `unpackAndVerify` is their composition, so the order is a type the compiler enforces. The wrapper carries the decoded declared digest rather than standing as a bare witness: the registration records its canonical spelling and the on-disk recheck compares against it, where the recheck used to parse the narinfo's NarHash a second time, and the strict recheck now compares a digest exactly as the streaming one does. `unpackNarEntry` stays in `Nix.Store`, which is where its eval-side caller (`builtins.path`, unpacking a NAR this process just serialized) imports it from; the substituter reaches it only through that sink. Upstream has no such type: `LocalStore::addToStore` (local-store.cc at 2.24.9) restores the path through a `TeeSource` over a `HashSink` and compares hash and size after the restore, the order the streaming pipeline mirrors with its cleanup contract; the strict path verifies first, and the wrapper makes that first step unskippable. (#226)+- **`Nix.Expr.Types.StringPart` has a new constructor, `StrEsc`, and `Nix.Eval.StringInterp.stripIndentedChunks` takes a list of the new `StringChunk` type.** An indented-string escape (`'''`, `''$`, `''\n`) was parsed as a constant interpolation, which made it indistinguishable from `${"..."}` by the time indentation was stripped, and upstream strips the two differently. `StrEsc` carries the resolved text as a part of its own, so exhaustive matches over `StringPart` need the case. `StringChunk` (`ChunkLit`, `ChunkEsc`, `ChunkInterp` with its context) replaces the `(Bool, ByteString, StringContext)` triple so an evaluated part keeps its kind, and `concatChunks` joins chunks without stripping, as a double-quoted string does. (#227)+- **The new module `Nix.Eval.Print` exports `printValue`, upstream's value printer, under `PrintInFull` or `PrintForError`.** `Nix.Eval.Operator` exports `evalUpdate`, which takes each operand as an action so the left is checked before the right is evaluated. (#247)+- **`unpackNarEntry`, `newNarUnpackSink`, `caseHackDiskNames`, `onDiskNameKey` and `Nix.Substituter.consumeNarStream` take a `CaseSensitivity` first argument, and `Store` has a new strict field,** `stCaseSensitivity :: CaseSensitivity`. The argument is the destination volume's answer: a caller unpacking into a `Store` passes the field, and one unpacking elsewhere says what kind of volume it writes to instead of inheriting the operating system's default. `Nix.Store.CaseSensitive` exports the type, re-exported from `Nix.Store`, and `probeCaseSensitivity`. (#68)+- **`Nix.Store.ExecBit.serialiseFromPath`, `withNarSource` and `narHashOfPath` take a `NovaCache.NAR.CaseHack` first argument, and `Nix.Store.CaseSensitive` exports `volumeCaseHack` and `processCaseHack`,** re-exported from `Nix.Store`. A store path is read with `volumeCaseHack (stCaseSensitivity store)`, and a source with `processCaseHack`, nova-cache's per-OS default. (#236)+- **`Nix.Store` exports `sinkNarStream` and `NarStreamFailure`, the streaming unpack loop the substituter and the source restore share, and `Nix.Store.ExecBit` exports `withNarSource`.** (#235)+- **Further API changes:** `MonadEval` has a new method with no default, `lookupSessionReferences`. `Nix.Parser.parseNixFile` returns `Either SourceError Expr`. The new module `Nix.Eval.SourceError` holds upstream's messages for a failed read of a source path (`SourceAccess`, `sourceErrorMessage`). `Nix.Eval.Operator` stops exporting `checkedAdd`, `checkedSub` and `checkedMul`. `Nix.Derivation.Platform` gains `I686_Linux` and `I686_Windows`, and `Nix.Builder.BuildConfig` gains `bcFetchRetry`.++### CLI++- **`eval` prints its result as `nix-instantiate --eval` does: a string as its bytes, escaped as upstream escapes it, an attribute name quoted when it is not an identifier, a float to six significant digits, and upstream's markers for an unforced element and a function.** A string is bytes, and the printer decoded it as UTF-8 with replacement before writing it, so `builtins.readFile` of a file holding `a`, the byte 0xFC and `b` printed the three bytes of U+FFFD in the middle, where `nix-instantiate --eval` prints the byte itself and `builtins.stringLength` of the same value is 3. The result now reaches stdout as bytes, with no decode, encoding or newline translation on the way, so on Windows the line ends in LF, as `--aterm` output already did, where it ended in CRLF. The rules are upstream's `printAmbiguous` (print-ambiguous.cc at 2.24.9). A string goes through `printLiteralString` (print.cc): `"` and `\` take a backslash, a newline, carriage return and tab print as `\n`, `\r` and `\t`, and a `$` followed by `{` prints as `\$`, the escape that was missing, so `"\${"` printed as `"${"`, which reads back as an interpolation. An attribute name goes through `printIdentifier`: bare when the lexer reads it back as an identifier and quoted otherwise, so `{ "a b" = 1; "if" = 2; }` prints as written instead of as `{ a b = 1; if = 2; }`. A float is written to a default ostream, so `1.0` prints as `1`, `1.23456789` as `1.23457` and `1234567.0` as `1.23457e+06`, where Haskell's `show` gave `1.0`, `1.23456789` and `1234567.0`. An unforced element prints as `<CODE>` and a function as `<LAMBDA>`, `<PRIMOP>` or `<PRIMOP-APP>`, where nova-nix wrote `<thunk>`, `<lambda>` and `<builtin NAME>`. Every case was compared byte for byte with nix-instantiate 2.33.2. A list or set reached twice under `--strict` still prints in full where upstream writes its `repeated` marker, which needs value identity this printer does not track. (#252)+- **An interrupted command reports `error: interrupted by the user` and exits 1.** A SIGINT reached the CLI's main thread as GHC's `UserInterrupt`, which, uncaught, ended the process by the signal (exit 130) with nothing printed. Upstream's `checkInterrupt` throws `Interrupted("interrupted by the user")`, which `handleExceptions` (libmain/shared.cc at 2.24.9) logs as an error and exits 1 with; the CLI now does the same, and every other asynchronous exception still propagates. (#287)+- **`push --all` selects every valid output path, and a named derivation is refused with the reason.** A store registers its derivations as valid paths like anything else, so `--all` sent them too, and a binary cache serves build outputs only: nova-cache refuses a narinfo for a `.drv` outright, after the path's NAR has already been uploaded. Derivations are recipes a substituter never asks a cache for, so they stay local, and naming one explicitly is refused before anything is uploaded. (#216)+- **`--restrict-eval` and `--pure-eval` on `eval` and `build`, and `restrict-eval`, `pure-eval` and `allowed-uris` in nix.conf and NIX_CONFIG.** Evaluation ran with the process's full ambient authority: any expression could read any file, reach the environment, and fetch from the network. The two flags turn on upstream's modes for one run, and the three settings turn them on for a machine, through the same cascade as `substituters` (a Boolean takes upstream's `true`, `yes`, `1`, `false`, `no`, `0` spellings and any other value is an error; `extra-allowed-uris` appends, and `extra-` on a Boolean names no setting). A flag only turns a mode on, so a machine configured for pure evaluation stays pure whatever the command line says. Under either mode every `--nix-path` and `NIX_PATH` root is allowed, as upstream allows its lookup path, so `--restrict-eval --nix-path nixpkgs=...` evaluates nixpkgs and computes the same `hello.drvPath` as the default mode and as `nix-instantiate --option restrict-eval true`. A root reached through a symlinked directory (macOS's `/tmp` is `/private/tmp`) is allowed under its resolved spelling as well; upstream allows only the given one and refuses the read, a mismatch between its own allow list and its symlink walk rather than a rule. A `channel:`, `flake:` or URL entry names a download this evaluator does not perform and allows nothing; upstream allows such an entry's working-directory spelling only by falling through after a failed download, and a run that cannot fetch should not read more for it. Under `--pure-eval` neither `--nix-path` nor `NIX_PATH` contributes, as upstream drops its lookup path; the bundled `<nix/*>` directory remains, since upstream serves those files from a built-in filesystem and this binary serves them from its data directory, which is why it stays listed in `builtins.nixPath` where upstream shows an empty list. (#75)+- **`nova-nix store gc` collects garbage, `build --out-link PATH` (or `-o PATH`) roots a result, and `store delete` refuses a path a root keeps alive.** `store gc` finds the roots, walks their references, removes every other valid path with its tree, sweeps every store directory entry that is not live (a tree no row describes from a build interrupted before registration, junk, a dead path's lock file) and prints upstream's progress lines on stderr and its summary (`N store paths deleted, X MiB freed`, the `%.2f MiB` of 2.24.9) on stdout; `store gc --print-roots` lists `LINK -> PATH` sorted, each link once, and deletes nothing, as `nix-store --gc --print-roots` does, and like it takes no collector lock, so it does not wait behind a running build. `build --out-link PATH` is nix-build's `-o`: the path is made absolute with `.` and `..` collapsed and its parent directories are created, as upstream's `addPermRoot` and `makeSymlink` do, then `PATH` is created as a symlink to the result and registered as a root, refusing a link inside the store (through `..` as well) or an existing `PATH` that is not a store link (a store link is replaced); the store path prints only once the link exists, so a failed link (Windows without Developer Mode) prints nothing a script would take for success. `build` creates no link unless `--out-link` is given, where nix-build and nix build default to `./result`. `store delete` of a path a root reaches is refused with upstream's words, `Cannot delete path '...' since it is still alive`, and the referrer refusal it already had stays. Upstream refuses a path with an unrooted referrer with the same still-alive line unless that referrer is named in the same invocation, in which case it deletes the named set referrer-first; this delete lists the referrers that stand in the way instead and deletes in argument order, so a chain deletes leaf-first. One invocation resolves every argument first, then runs under one collector lock with one live set, printing upstream's roots line once. The hint names `store gc --print-roots` rather than the `nix-store --query` forms this tool does not have. `--store DIR` is keyed by its canonical spelling (absolute, `.` and `..` collapsed, no trailing separator), as upstream's `absPath` keys a store path, so a store built under one spelling and collected under another is the same store; `store gc` and `store delete` refuse a store whose database holds paths under another spelling of its directory rather than sweep them as dead. (#24)+- **nix.conf `include` and `!include` directives are honored, and the system file and the full XDG cascade are read, in upstream's order.** An include splices the named file in at its line, resolved against the directory of the file being parsed with `.` and `..` collapsed lexically, so a nested include resolves against the nested file and an include from `NIX_CONFIG` must be absolute; `!include` goes on without a file that cannot be read, and `include` of a missing file fails with upstream's own `file '...' included from '...' not found`. The sources are now, weakest first: `$NIX_CONF_DIR/nix.conf` (default `/etc/nix`, an empty variable counting as unset, a relative one refused with upstream's `not an absolute path`, and `.` and `..` in it collapsed, as upstream's settings constructor canonicalizes it); the user files, which are `$NIX_USER_CONF_FILES` when it is set (first listed strongest, an empty value naming no files, empty entries dropped) and otherwise `nix/nix.conf` under the XDG config home and then under each `XDG_CONFIG_DIRS` entry, applied back to front so the config home wins; then `NIX_CONFIG`; then the flags. Every rule was read from `config.cc` and `globals.cc` at 2.24.9 and checked against the running 2.33.2 binary. Two deliberate differences: an `include` whose file exists but cannot be read is an error here (`file '...' included from '...' cannot be read`) where upstream silently drops it (its own TODO questions the swallow), because the only thing `include` promises over `!include` is to fail when the file is unusable, and an include is where a site narrows the substituter or trusted-key set, so dropping it leaves the wider set in force; and an include cycle is refused with a message naming both files where upstream recurses until it crashes. On Windows, where upstream compiles the same `/etc/nix` and `/etc/xdg` literals in and neither names anything, the system file is `%ProgramData%\nix\nix.conf`, the all-users application data directory being the Windows convention for machine-wide application configuration (chosen the way `%APPDATA%` was for the user file, and where the `directory` package maps the system-wide XDG dirs too), with no system file when `%ProgramData%` is unset; `XDG_CONFIG_DIRS` has no default there, since the one directory that answers to it is already read as the system file; `NIX_CONF_DIR` and `XDG_CONFIG_DIRS` are honored when set on every platform; a UNC `NIX_CONF_DIR` keeps its server through the collapse; and `NIX_USER_CONF_FILES` splits on `;` there, since upstream's `:` cannot carry a drive letter. (#199)+- **nix.conf is read as bytes, so an `include` target, `NIX_CONF_DIR` and `NIX_CONFIG` name the files and carry the values upstream's do.** A config file went through a lossy UTF-8 decode and the config variables through base's `lookupEnv` and a conversion to text, so a byte with no UTF-8 reading became U+FFFD, written back as EF BF BD when a file was opened: `include caf\xE9.conf`, a Latin-1 name on Linux, never opened the file it names (a required include failed as not found, an `!include` was dropped), a `NIX_CONF_DIR` holding such a byte named a system file that does not exist, so its settings silently did not apply, and an include beside a user file under such a directory (`NIX_USER_CONF_FILES`, `XDG_CONFIG_HOME`, `XDG_CONFIG_DIRS`) missed in the same way. Upstream keeps each line as bytes and opens the file the target's bytes name (`parseConfigFiles` in `src/libutil/config.cc` at Nix 2.24.9), reading the variables with `getenv`. A source now stays bytes until a setting takes a value from it: the variables are read as bytes, an include target and every config directory reach the open as a host path spelled from those bytes, and a comment or the value of a setting nova-nix does not model is never decoded. A line splits on upstream's separators alone (space, tab, CR, LF): every Unicode space split it before, so `pure-eval = true` followed by a no-break space read as true where upstream refuses the value, and an `allowed-uris` token holding a vertical tab or a form feed became two. A Boolean or integer value is compared as bytes, so such a byte there is upstream's own invalid-value error. Two differences remain. First, a `substituters`, `trusted-public-keys` or `allowed-uris` token with no UTF-8 reading is refused (`setting 'substituters' has invalid value '...': not valid UTF-8`) where upstream keeps the bytes, because each is text everywhere nova-nix uses it (a cache URL, a key matched against a narinfo's signatures, a URI prefix matched against the evaluator's URIs), and the U+FFFD spelling it silently took before names a different cache, key or URI. Second, a message still shows such a byte as U+FFFD where upstream writes the byte itself. On Windows, where a path is UTF-16, a target with no UTF-8 reading names no file, so `include` refuses it and `!include` goes on without it, and a config variable holding an unpaired surrogate is refused, as `NIX_PATH` holding one is. Checked against `nix config show` and `nix-instantiate` 2.33.2, the include case on an HFS+ volume, since APFS refuses such a name. (#244)+- **`NIX_PATH` keeps a `channel:` or `flake:` entry whole and splits an unlisted `scheme://` entry, as upstream's parser does.** A colon stayed inside its entry whenever `//` followed it, so `channel:nixos-24.11` broke into `channel` and `nixos-24.11` while `foo://x` was kept as one entry. Upstream's `EvalSettings::parseNixPath` (`src/libexpr/eval-settings.cc` at Nix 2.24.9) decides at an entry's first colon from the text after the entry's last `=`: `channel` and `flake` keep the entry whole whatever follows, `http`, `https`, `file`, `channel`, `git`, `s3` and `ssh` keep it whole when `//` follows, and the entry then extends through exactly one more colon-free run, so `https://example.com:8080/x` still splits after the host and `channel:channel:x` is `channel:channel` then `x`. The split now follows that rule, matched entry by entry against `builtins.nixPath` from `nix-instantiate` 2.33.2, whose parser is unchanged from 2.24.9. An empty entry is dropped, as upstream's `builtins.nixPath` drops it; it was not inert here, since `<name>` resolved against the filesystem root through it (`NIX_PATH=a::b` made `<etc>` resolve to `/etc`). An entry containing a space is kept whole where upstream's settings round trip would split it, since a Windows path may contain one. The Windows drive rule stays: `C:\x` and `nixpkgs=C:/x` are one entry each, where upstream, which has no drive rule, splits a drive path at its letter. Neither a URL nor a channel entry is fetched yet, so for those entries this changes what `builtins.nixPath` reports, not what `<nixpkgs>` resolves to. (#224)++### Evaluation++- **A derivation with `__structuredAttrs = true` passes its attributes as one JSON object, `__json`, and its drvPath matches upstream's.** Such a derivation was flattened like any other, every attribute coerced to a string, so a nested set or a list of sets failed with `cannot coerce a set to a string`, and nixpkgs packages that set the flag (libxo, sudo, cppitertools, nrr and lutok among them) did not evaluate. Upstream's derivationStrict (the `jsonObject` branch of `derivationStrictInternal`, primops.cc at 2.24.9) converts each attribute with the `printValueAsJSON` behind `builtins.toJSON` and stores the object, rendered by nlohmann's `dump()`, as the single environment entry `__json` beside one entry per output. `args` stays the argument list, `__structuredAttrs` and `__ignoreNulls` stay out of the object, and a null is left out only under `__ignoreNulls`. String context inside the object, a path copied to the store or a derivation's output, becomes the derivation's inputs as it does from the environment. In this mode upstream reads the builder as a string rather than coercing it, reads the system, the output hash fields and each output name as strings without context, and warns that a top-level `allowedReferences`, `allowedRequisites`, `disallowedReferences`, `disallowedRequisites`, `maxSize` or `maxClosureSize` has no effect; nova-nix does the same, with upstream's wording. libxo joins the drvPath parity set, and hand-written derivations covering nested sets, mixed lists, floats, nulls with and without `__ignoreNulls`, a path, a derivation, a placeholder, several outputs and a fixed output match the `.drv` nix-instantiate 2.33.2 writes byte for byte. (#36)+- **`builtins.fromJSON` reads JSON as upstream's nlohmann parser does.** It had a parser of its own, separate from the strict one the builder already uses for a derivation's `__json`, and that parser refused the `\b` and `\f` escapes while accepting what nlohmann refuses: an unterminated string, a trailing comma, a leading zero, a raw control character, a `\u` escape short of four hex digits (read as the letter `u`), a lone surrogate (read as U+FFFD), a number past the double range (read as `null`), and whitespace JSON does not define such as a no-break space. Upstream's `parseJSON` (json-to-value.cc at 2.24.9) hands the string to nlohmann's `sax_parse`, so `builtins.fromJSON` now goes through that same strict parser. The messages for refused input are that parser's, not nlohmann's, which name a line, a column and the last token read. (#276)+- **`builtins.fromJSON` refuses a positive integer past the Nix integer range.** A number above `9223372036854775807` that still fits an unsigned 64-bit value wrapped to a negative int, as Nix 2.24.9 does. Upstream made this an error at 2.25 (`json-to-value.cc`), `unsigned json number 18446744073709551615 outside of Nix integer range`, and `nova-nix` now matches it, as it already did for the integer overflow errors of the same change. A number past 64 bits stays a float, and the unsigned range is unchanged for a builder reading `__json`. (#311)+- **`builtins.stringLength`, `substring`, `unsafeDiscardStringContext`, `unsafeDiscardOutputDependency` and `addDrvOutputDependencies` coerce their string argument as upstream does.** Each refused anything but a string, where upstream calls `coerceToString` at its default arguments (`primops.cc` and `primops/context.cc` at 2.24.9): a path is copied to the store and becomes its store path with context, and a set coerces through `__toString` or `outPath`. A value that cannot be coerced now fails with upstream's `cannot coerce an integer to a string: 1`. 13 of 1,143 sampled top-level attributes on `nixos-unstable` failed on this, nearly all of them .NET packages, and all 13 now produce the store path Hydra built. (#306)+- **`derivation` is upstream's wrapper lambda evaluated as the builtin, so its result has upstream's shape: `outputName`, `all` and `drvAttrs` are present, every output attribute is a complete derivation set, and nothing internal leaks.** The builtin hand-built its result as a set with `drvPath`, `outPath`, `type` and one `{ drvPath, outPath, type }` set per output, plus a private `_derivation` attribute carrying the build recipe. nixpkgs reads what upstream's `src/libexpr/primops/derivation.nix` produces: `lib.customisation.extendDerivation` does `inherit (drv.${outputName}) type outputName`, which failed with `attribute 'outputName' not found` for firefox at the top level and for openjdk, gtk3, systemd and emacs one level down, and the leaked attribute reached `nodePackages.typescript` through an attribute enumeration as a value that cannot be coerced to a string. The source of that wrapper, byte for byte at 2.24.9 minus its documentation comment, is now the value of `derivation` in both the root scope and `builtins`, closed over the three names it reads, and `derivationStrict` returns what upstream's primop returns: `drvPath` with its whole-derivation context and one path per output with that output's context. The laziness is the wrapper's: `derivationStrict` is reached only through `outPath` and `drvPath`, so forcing a derivation to weak head normal form still forces none of its inputs. Upstream's three output-list rules in `derivationStrict` come with it: an output named `drvPath`, a repeated output name and an empty list are refused with upstream's messages. `builtins.functionArgs derivation` is now `{ outputs = true; }`, as upstream's lambda reports. `nix-instantiate` 2.33.2 agrees on every attribute of the result for a two-output derivation, on the hello and dependent drvPath parity cases, and on `nodePackages.typescript`, which now evaluates to upstream's drvPath. (#217)+- **`build` reads the derivation it realizes from the `.drv` the evaluator recorded, and prints the output the value names as its default.** The driver took the recipe from the derivation value's private `_derivation` attribute, which is gone. Every derivation an evaluation computes is recorded under its `.drv` path as the exact bytes that path hashes, for writing the input closure before a build; the root's own recipe now comes from the same record, so what is built is what was hashed. A `.drv` lists its outputs by name, sorted, with no notion of a default, so the output whose path `build` prints is the value's `outputName`, the first of its `outputs`, which is the output upstream's `nix-build` realizes and prints (`nix-build.cc`, `queryOutputName`), with upstream's message for a set that lacks the attribute. `eval --aterm` prints the recorded bytes rather than a re-serialization; the two are identical, and the recorded bytes are the ones whose hash is the path. (#217)+- **A derivation's `name`, `builder` and `system` are read as upstream's `derivationStrict` reads them.** The name is read with `forceStringNoCtx` (primops.cc at 2.24.9): `name = 1` evaluated, coerced to `"1"`, and is now `expected a string but found an integer: 1`, and a name with context is refused with upstream's `the string '...' is not allowed to refer to a store path (such as '...')`, naming the context element upstream lists first; an absent name is `attribute 'name' missing`. A path as the builder or system is copied to the store, as its environment entry already was, so `builder = ./b.sh` puts the store path in the .drv's builder field, where nova-nix wrote the source path and so computed a drvPath upstream does not. An empty builder or system is refused as absent, `required attribute 'builder' missing`, the builder checked first, where nova-nix accepted it. An invalid name reports upstream's `invalid derivation name: name '.' is not valid. Please pass a different 'name'.` and its kin. The same `(such as '...')` now ends the refusal of context in a structured derivation's fields. (#281)+- **A failure inside `derivationStrict` names the attribute and the derivation it came from, in upstream's words and layout.** `cannot coerce a set to a string` arrived with no position and no context, so finding which of a closure's thousands of attributes held the set took a bisection by hand. Upstream processes each attribute of a derivation inside a `catch` that adds `while evaluating attribute 'foo' of derivation 'x'` (derivationStrictInternal, primops.cc at 2.24.9), and so does nova-nix now, for the per-attribute coercion, the structured-attributes serialization and the string fields a structured derivation reads, `system`, `builder`, `outputs` and `args`; the name carries upstream's two lines for it, `__structuredAttrs` and `__ignoreNulls` the lines their `forceBool` adds, and a non-Boolean value for either is refused with upstream's `expected a Boolean` message. A failure several derivations deep names each attribute on the way, outermost first. The report is upstream's `showErrorInfo` layout: `error:` alone on the first line, each line of context after an ellipsis and a blank line, the message on an `error:` line of its own, and every line after the first indented to align with it, a multi-line message included; `build` reports an evaluation failure the same way, where it printed `eval error:`. What it cannot print is what upstream prints with a position: nova-nix tracks none, so the `while calling the 'derivationStrict' builtin` and `whose name attribute is located at` lines and the code excerpts under each line are absent, as is `--show-trace`; every line of context is printed. The lines are context only: a message is unchanged, and a throw stays catchable by `builtins.tryEval`. (#221)+- **A derivation attribute carrying another derivation's `drvPath` brings that `.drv`'s whole closure into the derivation, as upstream's does.** Upstream's `derivationStrict` takes the closure of the `.drv` (`computeFSClosure`, primops.cc at 2.24.9) and adds every path in it to `inputSrcs` and every `.drv` in it to `inputDrvs` with all its outputs; nova-nix added the one `.drv` to `inputDrvs` and nothing to `inputSrcs`, so `derivation { ...; x = "${dep.drvPath}"; }` had a drvPath upstream does not compute. The closure follows each `.drv`'s inputs and the references a `builtins.toFile` text recorded when this evaluation wrote it. (#294)+- **Restricted and pure evaluation gate the filesystem, the environment and the network the way upstream's `restrict-eval` and `pure-eval` do.** Under either mode a read (`readFile`, `import`, `readDir`, `readFileType`, `hashFile`, `builtins.path`, `filterSource`, a path coerced into the store) is refused unless the path lies within an allowed prefix or is an ancestor of one, with upstream's `CanonPath::isAllowed` rule and upstream's message, `access to absolute path '...' is forbidden in restricted mode` (or `in pure evaluation mode (use '--impure' to override)`), which `tryEval` does not catch. The check walks the path through its symlinks prefix by prefix, as 2.24.9's accessor does (`SourceAccessor::resolveSymlinks` through a `FilteringSourceAccessor::maybeLstat` that throws at 2.24.9), so a symlink inside an allowed root that points outside is refused at its target, and the refusal names the first prefix outside the allow list, `/etc` for `/etc/passwd` when nothing under `/etc` is allowed; 2.33.2 names the full path, because its `maybeLstat` answers nothing instead of throwing, and 2.24.9's source is followed. `readFileType` and a symlink read name the path asked for, since upstream checks those without a walk, and refuse a symlink anywhere above the path (`path '...' is a symlink`), as upstream's accessor does beneath its allow list, so the type of a path reached through a symlinked directory is never revealed. An `import` of a directory is checked at the `default.nix` it resolves to as well as at the path named, as upstream's `parseExprFromFile` walks the file it reads after `resolveExprPath` appends the name, so a `default.nix` that is a symlink outside the roots is refused at its target. `pathExists` answers false for a refused path, as upstream turns the refusal into false, and checks a symlink at the final component in place rather than following it, as upstream resolves only the ancestors there, so a link inside the roots exists whatever it points at; a trailing slash demands a directory and follows the link, as it does upstream. The allowed set starts as the search path roots and grows as the evaluation produces store objects, as upstream's `allowPath` grows it: a `toFile` result, a fetched tree, a copied source and a `builtins.path` result are readable afterwards, and the fetchers' scratch directories are the evaluator's own. `getEnv` answers the empty string under either mode (`prim_getEnv`). Under `restrict-eval` a fetch is refused unless `allowed-uris` admits it, with upstream's `isAllowedURI` rule (equal to a prefix, under it at a `/` boundary, or a bare scheme such as `https:`) and message (`access to URI '...' is forbidden in restricted mode`); a path or `file://` URI is checked against the allowed paths instead (`checkURI`). `fetchGit` is checked in the form upstream renders its input, `git+https://host/repo?exportIgnore=1` with the pins in key order, so an `allowed-uris` prefix has to be written for that form, as it does upstream, and a local repository given as a path is `git+file://`. Under `pure-eval` the search path holds only the bundled `<nix/*>` directory and a `<name>` miss says `cannot look up '<name>' in pure evaluation mode (use '--impure' to override)` (still catchable, as the default mode's miss is); `builtins.currentTime` and `builtins.currentSystem` do not exist; `builtins.storePath` is refused (`'builtins.storePath' is not allowed in pure evaluation mode`); `fetchurl` and `fetchTarball` need a `sha256` (`in pure evaluation mode, 'fetchurl' requires a 'sha256' argument`); `fetchGit` needs a `rev` (`in pure evaluation mode, 'fetchGit' will not fetch unlocked input '...'`, 2.24.9's wording where 2.33.2 says `doesn't fetch`, and a rev is what locks a git input at 2.24.9); and `~/x` is refused (`the path '~/x' can not be resolved in pure mode`, upstream's parser message, raised here where the expansion is). Every message was recorded from `nix-instantiate` under `--option restrict-eval true` and `--option pure-eval true` and matched byte for byte on the final error line. Two divergences are deliberate: `builtins.findFile` over an explicit list treats a candidate the policy refuses as absent (2.24.9 probes outside its accessor and hands the path back, an existence oracle; 2.33.2 refuses from there), and the closure of a search path root that is a store path is not allowed with it, since evaluation holds no store database handle. The default is unrestricted, as upstream's is. (#75)+- **A string that spells a relative path is refused wherever a path is coerced from a string, and a search path miss carries upstream's hint.** `builtins.readFile "foo"`, `import "foo"`, `pathExists`, `readDir`, `readFileType`, `hashFile`, `filterSource`, `storePath` and `scopedImport` read a relative string against the working directory (and `import` against the importing file's directory); upstream's `coerceToPath` refuses one with `string 'foo' doesn't represent an absolute path`, observed from `nix-instantiate` 2.33.2 in every mode, and so does nova-nix now. An absolute string is canonicalized like a path value, as upstream's `CanonPath` does. The refusal is also what keeps the access policy sound: a relative string would be checked against one location and opened at another. The miss message for `<name>` is now `file 'name' was not found in the Nix search path (add it using $NIX_PATH or -I)`, upstream's text. (#75)+- **Function calls nested past `max-call-depth` (10000 by default) are refused with upstream's "stack overflow; max-call-depth exceeded".** nova-nix had no ceiling: the counter recursion `f 100000`, which upstream rejects, evaluated here to 100000, and ten million frames evaluated in 12 s at 1.8 GB. The counter is evaluator state, carried per frame by each evaluator (the pure one enforces it too), and it counts what upstream's `EvalState::callFunction` counts (eval.cc at 2.24.9): every application of a lambda, of a builtin (a partial application included) and of a functor (two frames, its inner call being a `callFunction` of its own), a `__toString` coercion, and the operators upstream's parser desugars into builtin calls, `-`, `*`, `/`, `<`, `<=`, `>`, `>=` and unary `-` (parser.y at 2.24.9). The applications builtins build (`map`, `genList`, `mapAttrs`, `zipAttrsWith`) are upstream's app values: applied where their result is forced, with the frame opening before the function is forced, so a `mapAttrs` or `zipAttrsWith` callback's name application runs a frame below its value application, as upstream's two nested app values do; `builtins.sort` with `builtins.lessThan` itself as the comparator opens no frame per comparison, upstream's `prim_sort` bypass. The check runs on entry against the frames already active, so with the default ceiling 10001 nested lambda calls pass and 10002 fail, and the counter recursion passes at 9999 and fails at 10000, its deepest frame being the `n - 1` forced inside `f 0`; every boundary was confirmed against nix-instantiate 2.33.2. The error is an eval error that `tryEval` does not catch, as upstream's `EvalError` is. The ceiling reads from nix.conf and NIX_CONFIG through the cascade `substituters` uses, a plain assignment replacing and `extra-max-call-depth` being an unknown name since upstream accepts `extra-` on list settings only, with upstream's integer grammar: decimal digits, an optional leading `+`, and an optional `K`, `M`, `G` or `T` binary unit suffix in either case; anything else, or a value past `unsigned int`, is refused as `setting 'max-call-depth' has invalid value '...'`. One divergence: upstream narrows a unit product silently, so `5G` becomes 1073741824 there, while here it is refused like any other value outside the range. (#222)+- **A variable that no enclosing scope binds and no enclosing `with` could supply fails the expression before anything is evaluated, with upstream's `undefined variable 'y'`.** It was an error only where evaluation reached it, so `let x = y; in 1` and `if true then 1 else y` evaluated to 1, and `builtins.tryEval (let x = y; in 1)` to `{ success = true; value = 1; }`, three expressions nix-instantiate 2.24.9 and 2.33.2 both reject. Upstream binds every variable when it parses a source (`ExprVar::bindVars`, nixexpr.cc at 2.24.9) and raises `UndefinedVarError` there unless a `with` encloses the name, an error `tryEval` does not catch. Resolution here now does the same, once per source: the expression or file given on the command line, every `import` when it is forced, so a file with an unbound variable on a branch its importer never takes fails at the import, and `scopedImport`, whose scope's names are bound around the file as upstream binds them, so a `with` in that file no longer shadows them. A name under a `with` still waits for evaluation (`with {}; let x = y; in 1` is 1, and `with {}; y` fails when evaluated), `inherit x;` is checked like any other variable, and `inherit (s) x;` checks only `s`, selecting `x` when it is forced. With several unbound variables, upstream reports the first in its own binding order, which follows its symbol table, and nova-nix the first in the source. `__curPos`, which upstream's parser reads as a position rather than a variable, is exempt from the check and still fails only when forced, since nova-nix does not evaluate it yet. nix-instantiate 2.33.2 and nova-nix both bind every one of the 36860 `.nix` files in the nixpkgs 24.11 revision the parity job pins. (#248)+- **The root scope binds every name upstream's base environment does: `__typeOf` and the other `__`-prefixed builtins, and `fetchMercurial`.** Upstream installs each primop and constant under the name it registers and under that name less `__` in `builtins` (`addPrimOp` and `addConstant`, eval.cc at 2.24.9), so `__typeOf 1` is `"int"` there and was an undefined variable here, and with binding checked before evaluation `if false then __typeOf 1 else 2` would have been refused where upstream gives 2. The root scope is now built from the 114 names `createBaseEnv` and the default-enabled `RegisterPrimOp`s produce, each holding the value `builtins` holds under its unprefixed name. Under `pure-eval` it drops `__currentTime` and `__currentSystem`, as upstream drops its `impureOnly` constants, so binding rejects them there. `fetchMercurial` is the one name nova-nix does not implement: it is bound, so binding accepts it, and calling it fails with `unknown builtin 'fetchMercurial'`; `builtins` still does not list it. (#248)+- **An inherited value is evaluated in the scope around the binding set, not in the set itself.** `rec { ${"q"} = 0; x = 1; y = rec { ${"a"} = 1; inherit x; }; }.y.x` recursed forever, because the inner set looked `x` up by name from its own scope and found the attribute it was defining; upstream gives 1, evaluating an Inherited attribute in the enclosing environment (`ExprAttrs::eval` and `ExprLet::eval`, eval.cc at 2.24.9), and so does nova-nix now. A plain `inherit` carries its variable, bound like any other, so the evaluator has no name lookup of its own for one, and an inherit clause that repeats a name is refused when parsed with `attribute 'x' already defined`, as upstream's per-name check refuses it. (#248)+- **Indented strings strip exactly what upstream strips: whitespace-only lines, the opener's own line, and spaces but never tabs.** The stripping was approximate in four ways. A string with no measured line (blank lines and spaces only) kept every space, because the minimum indent started at zero when nothing contributed; upstream starts it at a sentinel, so such a string loses every leading space, and `''` followed by a blank line and an indented closer is `"\n"`, not the eight spaces of the closer. A tab counted as indentation and was stripped; upstream measures only spaces, so a tab fixes the minimum at its column and survives into the value. The closing `''`'s own indentation survived as a trailing line of spaces; upstream removes a final line of spaces from the last part after stripping. And the opener's trailing spaces survived as a line of their own, because only a bare newline after `''` was dropped; upstream's lexer consumes `''`, any spaces and one newline as the opener, so content starts on the next line. The same transcription corrects how escapes meet stripping: upstream's scan skips an escape (it ends a line's leading whitespace without being measured) while its strip runs over escapes as over any literal, so the spaces after an escaped newline are stripped but never measured, and `''  a''\n  b''` is `"a\nb"` where it was `"a\n  b"`. Every rule is `ParserState::stripIndentation` and the `IND_STRING_OPEN` lexer rule at Nix 2.24.9, unchanged through 2.33.2, and every case was checked against nix-instantiate 2.33.2. nixpkgs concatenates `+ ''`, a blank line, `''` into shell hooks constantly, and clang's drvPath differed from upstream's for that reason alone. (#220)+- **A builtin that takes a path coerces its argument as upstream's `coerceToPath` does.** `readFile`, `readDir`, `pathExists`, `hashFile`, `readFileType`, `import`, `scopedImport`, `builtins.path`, `filterSource`, `toPath` and `storePath` each refused anything but a path or a string in a message of nova-nix's own; upstream runs the argument through `coerceToPath` (eval.cc at 2.24.9), which takes a path as itself, follows a set's `__toString`, and coerces anything else to a string that must be absolute. So `builtins.readFile { outPath = "/etc/hosts"; }` reads the file, and `builtins.readFile 1` is `cannot coerce an integer to a string: 1`. `builtins.path { path = 1; }` read the relative path `1`, and `builtins.toPath` gave a path where upstream gives the coerced path as a string with its context, which interpolation does not copy. `baseNameOf` and `dirOf` coerce what is not a path as upstream's `coerceToString` does, so an `outPath` or a `__toString` answers, and `dirOf` of a set gives a string. (#283)+- **`builtins.pathExists` checks the final symlink in place and demands a directory for a trailing slash, `builtins.readFileType` refuses a symlink above its path, and `builtins.path`, `filterSource` and path coercion resolve a symlink root.** Upstream's `prim_pathExists` (2.24.9) resolves a plain argument through its ancestors only and lstats the final component, so a dangling symlink exists, and resolves a string ending in `/` or `/.` fully and requires a directory, so `builtins.pathExists "/etc/passwd/"` is `false`; nova-nix followed the final link (a dangling one read as absent) and erased the trailing slash in canonicalization. `readFileType` lstats its argument without resolution, and upstream's accessor refuses a symlink anywhere in the parent chain with `path '...' is a symlink` (`PosixSourceAccessor::assertNoSymlinks`) in every mode, so `builtins.readFileType /tmp/x` on macOS, where `/tmp` is a symlink, fails exactly as it does under `nix-instantiate`; nova-nix answered the target's type. `builtins.path`, `builtins.filterSource` and a path coerced into the store now resolve their root through its symlinks before reading the tree, as upstream's `addPath` and `copyPathToStore` do, so a root that is a symlink stores what it points at under the root's own name and lands at upstream's store path; nova-nix tried to store a symlink. (#75)+- **Interpolating a path that is a symlink copies what it points to.** `"${./link}"` stored the link itself, where upstream's `copyPathToStore` stores `path.resolveSymlinks()` under the path's own name (eval.cc at 2.24.9). The store path therefore differed from upstream's, and so did the drvPath of every derivation that interpolates such a path. (#279)+- **A list coerces to a string as upstream joins it.** `builtins.toString [ [ ] 1 ]` was `" 1"` and is now `"1"`: upstream's `coerceToString` (eval.cc at 2.24.9) puts a space after every element but the last, except after one that is itself an empty list, where nova-nix joined every element with a space. A list now coerces wherever upstream's permissive coercion runs, so `toString { __toString = s: [ 1 2 ]; }` and `toString { outPath = [ 1 2 ]; }` are `"1 2"`, where nova-nix refused the list, and a derivation attribute or argument holding a list joins the same way. Interpolation still refuses a list, as upstream's does. (#282)+- **`builtins.storePath` follows a symlink into the store and refuses with upstream's messages.** Upstream's `prim_storePath` resolves a path's symlinks unless the path is itself a store path (primops.cc at 2.24.9), so a link outside the store pointing into it names the store path it reaches, where nova-nix refused it. A path outside the store is `path '/x' is not in the Nix store`, naming the resolved path, and a component under the store that is no store path is the `StorePath` constructor's refusal (path.cc), `'x' is too short to be a valid store path` or `store path '...' contains illegal base-32 character 'E'`, where nova-nix said `builtins.storePath: not a valid store path` for all of them. (#293)+- **`builtins.toXML` writes upstream's document and keeps the contexts of the strings in it, so a NixOS toplevel evaluates to upstream's drvPath.** The writer was an approximation of `printValueAsXML` (value-to-xml.cc and xml-writer.cc at 2.24.9) in five ways. It indented by list and set nesting rather than by element: the value under `<expr>` started at column 0 and an `<attr>`'s value sat at the attribute's own indent, where upstream's `XMLWriter` indents every element two spaces per element open around it. A newline in an attribute value was written raw; upstream writes `&#xA;`, since an XML parser normalizes a literal one to a space. Every function was `<function />`; upstream writes a lambda's argument pattern, `<varpat name="x" />` or an `<attrspat>` listing the formals in name order with the `@` binding and the ellipsis as attributes, and a primop as `<unevaluated />`. A derivation was written as a plain set, and since its `all` and output attributes refer back to it the writer never finished; upstream writes a `<derivation drvPath=... outPath=...>` element for it, holding its attributes the first time its drvPath appears and only `<repeated />` every time after. And the result was a plain string, where `prim_toXML` gives it the contexts of the strings it wrote. NixOS writes GRUB's installer configuration with `pkgs.writeText "grub-config.xml" (builtins.toXML ...)`, so the configuration's text and its missing inputs made the toplevel's drvPath differ from upstream's. Every case was checked against nix-instantiate 2.24.9 and 2.33.2, and the toplevel joins the parity case set. (#221)+- **`builtins.toJSON` escapes backspace and form feed as `\b` and `\f`, as upstream does.** It wrote them as `\u0008` and `\u000c`. Upstream serializes through nlohmann's `dump()`, whose escaper has two-character escapes for the quote, the backslash, backspace, form feed, newline, carriage return and tab, and `\u00xx` only for the other control characters. The same rendering now writes a structured derivation's `__json`, whose bytes are hashed into its store path. (#36)+- **`builtins.toJSON` converts a set with `outPath` through the `outPath` value itself, and a set with `__toString` through upstream's coercion of the result.** Either kind of set was coerced to a string with the derivation-environment rules, so `{ outPath = { a = 1; }; }` and `{ outPath = [ 1 2 ]; }` failed with `cannot coerce`, `{ outPath = 1; }` and `{ __toString = s: 1; }` became the string `"1"`, and `{ __toString = s: ./x; }` copied `x` to the store. Upstream's `printValueAsJSON` (value-to-json.cc at 2.24.9, unchanged in 2.33.2) converts the `outPath` value as it converts any value, so those become `{"a":1}`, `[1,2]` and `1`, and a path there is still copied to the store with its context. It coerces a `__toString` result through `tryAttrsToString` with `coerceMore` and `copyToStore` both off, so an integer is an error, a path is its own absolute text with no store copy and no context, and a string keeps its context. A structured derivation's `__json` is built by the same conversion, so its attributes follow the same rules. Every case was compared with nix-instantiate 2.33.2. (#36)+- **An environment value's bytes reach the evaluator unchanged, as upstream's do.** `builtins.getEnv` and `builtins.nixPath` read a variable through base's `lookupEnv`, which decodes it with the file-system encoding and carries a byte with no UTF-8 reading as a lone surrogate, and the conversion to text then replaced that with U+FFFD: `NIX_PATH` holding the byte 0xFC followed by `=/x` gave a three-byte prefix (EF BF BD) where `nix-instantiate` 2.33.2 gives the one byte. Upstream reads a variable with `getenv` and keeps its bytes (`getEnv` in `src/libutil/environment-variables.cc` at Nix 2.24.9). On POSIX the evaluator now makes the same call through the unix package, for the name as well as the value, so `builtins.getEnv` of a name that is not valid UTF-8 looks that variable up instead of failing. `NIX_PATH` is split and parsed as bytes, as upstream's parser is, and a search path prefix is compared byte for byte (`suffixIfPotentialMatch`), so an entry whose prefix has no UTF-8 reading no longer stops a `<name>` lookup from reaching the entries after it. A matching entry whose path has no UTF-8 reading is an error, since path values are text here, and such a root adds nothing to the restricted-mode allow list instead of a lossy spelling of itself. A Windows environment is UTF-16: a value becomes its UTF-8 bytes, and one holding an unpaired surrogate, which has no UTF-8 form, is refused rather than approximated (`builtins.getEnv` raises an evaluation error, a `NIX_PATH` fails setting up the evaluation), the rule the NAR serializer applies to such a file name. The read also stops catching every exception as "unset", which turned an interrupt arriving during the read into an empty value. (#253)+- **`-`, `*`, `/`, the arithmetic and bitwise builtins and the comparisons fail with upstream's messages.** Each is an upstream primop (`prim_sub`, `prim_mul`, `prim_div`, `prim_add`, `prim_bitAnd` and its kin, `prim_lessThan`, primops.cc at 2.24.9) that checks its operands with `forceInt`, or with `forceFloat` once either is a float. So `1 - {}` reports `expected an integer but found a set: { }` where nova-nix said `cannot apply subtraction to an integer and a set`, `1.0 - {}` reports `expected a float but found a set: { }`, and `builtins.bitAnd 1 {}` names the value it refuses where nova-nix said `builtins.bitAnd: expected two integers`. Division looks at its divisor first, as upstream's does: `1 / {}` fails the divisor's `forceFloat`, and a zero divisor is `division by zero` before the dividend is checked, so `{} / 0` is a division by zero, for `/` and `builtins.div` alike (nova-nix prefixed the builtin's message). Comparing two types is `cannot compare an integer with a set`, and comparing a type with no order is `cannot compare a Boolean with a Boolean; values of that type are incomparable`, where nova-nix wrote `cannot compare an integer and a set` and `cannot compare a Boolean and a Boolean`; a lambda and a primop are one type there, upstream's `nFunction`. From 2.25 upstream appends both values to a comparison's message, and 2.24.9's wording is kept. (#278)+- **`+` and string coercion fail with upstream's messages, and a message that names a type names it as upstream's `showType` does.** `1 + "a"` reported `cannot coerce an integer to a string with the + operator` and now reports `cannot add a string to an integer`, and `"a" + 1`, `"${1}"` and `builtins.toString {}` report `cannot coerce an integer to a string: 1` and `cannot coerce a set to a string: { }`, the messages of upstream's `ExprConcatStrings::eval` and `coerceToString` (eval.cc at 2.24.9). The left operand of `+` is dealt with before the right is evaluated, and its type alone decides the operation, as upstream's loop decides it: an integer or float makes `+` arithmetic and refuses a right operand that is not a number, and anything else makes it a strict concatenation. So `true + 1` fails to coerce the Boolean instead of failing to add it, and `{} + throw "b"` fails on the set without evaluating the throw, an error `builtins.tryEval` does not catch. Upstream copies a path into the store only when the left operand is a string, so `{ outPath = ./src; } + "x"` is now the path's own text with no context, where nova-nix copied the source. A store-path context appended to a path reports upstream's `a string that refers to a store path cannot be appended to a path`, and an interpolated path literal looks for one only once every piece has coerced, as upstream does, so a later piece that fails to coerce is the error reported. A string with context is `a string with context`, a primop `the built-in function 'map'` and a partial application of one `the partially applied built-in function 'map'`, where nova-nix said `a string` and `a built-in function`, in every type error and in a selection path's error alike. (#250)+- **The value a type error shows, and the one `builtins.trace` prints, is a set's attributes and a list's items as upstream's `printValue` prints them (print.cc at 2.24.9), where nova-nix printed `<<a set>>` and `<<a list>>`.** Attributes print by name, and in an error with `_type` and `type` first, as upstream sorts them whenever the print is bounded. An error's print shows at most ten attributes and ten items over the whole value and ten levels of nesting, and counts what it leaves out, the bounds of upstream's `errorPrintOptions` (print-options.hh). Nothing is forced: an entry not yet evaluated prints as upstream's thunk marker, a primop as its primop marker, and a thunk being forced as upstream's marker for a possible infinite recursion. Which entries are thunks follows nova-nix's evaluator, which agrees with upstream's for a literal written in the set or list, a function's argument and anything already forced, and not for an indented string, a `~/` path, a variable bound to a literal by `let` or `rec`, or a global such as `map`, all of which upstream hands over as values. A function value carries neither its name nor its source position, so a lambda's marker is the bare word where upstream adds both, and a set or list reached twice prints again where upstream marks it repeated. (#250)+- **Integer overflow and negation fail as upstream does.** An overflowing `+`, `-` or `*` reports upstream's `integer overflow in adding 9223372036854775807 + 1`; upstream checks these from 2.25, and 2.24.9 leaves them to undefined C++ arithmetic. Dividing the smallest integer by -1, which 2.24.9 does check, reports its `overflow in integer division`, where nova-nix wrote `integer overflow in dividing a and b`. Unary minus is upstream's `__sub 0 e` (parser.y at 2.24.9) in every respect, so `-(0.0)` is positive zero and `builtins.toJSON (-0.0)` is `"0.0"`, and `-{ }` fails with `expected an integer but found a set: { }`. (#250)+- **A failed read of a source path reports upstream's message, not GHC's.** `builtins.readFile ./nope` reported `/d/nope: withBinaryFile: does not exist (No such file or directory)` and now reports `opening file '/d/nope': No such file or directory`, the wording of upstream's `PosixSourceAccessor` (posix-source-accessor.cc at 2.24.9), which names the access and the path and appends the system error. An absent path under an lstat (`readFileType`, interpolation, `builtins.path`, `filterSource`, the target of an `import`) is `path '/d/nope' does not exist`, as `SourceAccessor::lstat` has it, and a path reached through a file counts as absent there; a file is opened with `opening file`, a directory read as a file is `reading from file '/d/dir': Is a directory`, and a directory is listed with `reading directory`. Each names the path as upstream does: resolved through its symlinks for a read, `readDir` and a copy, as given for `readFileType`. A failure inside the walk of a copied directory still carries GHC's text. (#277)+- **A non-set operand of `//` and a non-function passed to `builtins.functionArgs` fail with upstream's messages.** `null // {}` reported `cannot merge null and a set` and now reports `expected a set but found null: null`, the message of `evalAttrs`, which upstream's `ExprOpUpdate::eval` runs on the left operand and then the right (eval.cc at 2.24.9). A non-set left therefore fails before the right is evaluated, so `builtins.tryEval (null // throw "b")` raises the type error instead of catching the throw. 2.33.2 checks the right operand first; 2.24.9 is followed. `builtins.functionArgs 1` reports upstream's `'functionArgs' requires a function` (`prim_functionArgs`, primops.cc). The offending value is printed as upstream's `printValue` prints it, and `builtins.trace` shares that printer, so a float it prints has upstream's six significant digits: `trace: 1.23457e+06`, where it printed `trace: 1234567`. (#245)+- **`builtins.warn` refuses a message that is not a string, as upstream does.** It printed any value as the warning; upstream's `prim_warn` forces the message with `forceString` (primops.cc at 2.24.9), so `builtins.warn 1 2` fails with `expected a string but found an integer: 1`, which `builtins.tryEval` does not catch. Upstream keeps the argument a string to leave room for extending it; `builtins.trace` remains the way to print any value. (#249)+- **`builtins.deepSeq`, `builtins.trace` and `builtins.warn` finish with their first argument before they force their second.** Upstream's `prim_deepSeq` forces the first argument deeply, `prim_trace` prints it and `prim_warn` warns with it, and only then does each force the second (primops.cc at 2.24.9). nova-nix forced both arguments before the builtin ran, so `builtins.deepSeq { a = throw "a"; } (throw "b")` failed with `b` where upstream fails with `a`, `builtins.trace "hi" (throw "b")` failed without printing the trace, and a value printed inside `deepSeq`'s second argument still showed unforced thunks. `builtins.warn`'s line now carries upstream's `evaluation warning:` prefix, where nova-nix wrote `warning:`. (#285)+- **`builtins.head` and `builtins.tail` no longer copy the list, and `head`, `tail`, `elemAt` and `length` fail with upstream's messages.** `head` built a Haskell list of every element to return the first, and `tail` built one to copy all but the first into a new C list. `head` now indexes the C array as `elemAt` does, and `tail` returns a new header over the same array, which is safe because a list is never written after construction; upstream's `prim_tail` copies (primops.cc). A copy per call made a chain of tails quadratic in time and in arena memory, which is freed only when evaluation ends: folding `tail` 9999 times over a 10000-element list took 0.72 s and 449 MB and now takes 0.01 s and 33 MB, and `head` of an 800000-element list takes 0.13 s, as `elemAt` does, where it took 0.20 s. The messages are 2.24.9's. An index outside the list fails with `list index 5 is out of bounds`, which `head` of an empty list reports too as `list index 0 is out of bounds`, since upstream's `prim_head` is its `elemAt` at index 0; `tail` of an empty list fails with `'tail' called on an empty list`, a non-list with `forceList`'s `expected a list but found an integer: 1`, and a non-integer index with `expected an integer but found a string: "x"`, checked before the list because upstream forces the index first. 2.26.0 reworded the empty-list and bounds messages, so nix-instantiate 2.33.2 prints `'builtins.head' called on an empty list` and `'builtins.elemAt' called with index 5 on a list of size 2`. (#48)+- **`map`, `genList`, `concatMap`, `mapAttrs` and `zipAttrsWith` no longer compile code for every element they make, and an `inherit (from)` no longer compiles its selects each time it is evaluated.** Each element these builtins make is a deferred application, and its three or five instructions were compiled afresh per element into the bytecode store, which is freed only when evaluation ends, so the store grew with every element mapped; an `inherit (from)` likewise compiled the select of each name it inherits every time its binding ran. Every store now opens with that application code at fixed indices, and each element runs it in an env of its own holding the function and its arguments, as upstream builds an app value per element (`mkApp` in primops.cc at 2.24.9); `genList` passes the index as an argument value, as `prim_genList` allocates an int per element. The compiler makes each inherited name's select once, with its binding, as upstream's parser makes an `ExprSelect` per name (parser.y at 2.24.9). Evaluating `hello.drvPath` on the pinned nixpkgs 24.11 compiles 102800 instructions where it compiled 862288 and peaks at 116 MB resident where it peaked at 127 MB, and mapping over 100000 elements compiles 79 instructions where it compiled 600074. `map` and `concatMap` also share one thunk for the function across their elements, where they allocated one per element. A `genList` that is built and never forced costs more than it did, since an env and an int per element replace three instructions: building a million elements takes 0.27 s of user time and 260 MB, against 0.19 s and 226 MB. (#48)+- **Store paths, derivations and string literals evaluate with less work.** A store path's hash was folded to its 20 bytes through a fresh 20-element list for every byte of the digest; it is now XOR'd together a chunk at a time, the same bytes upstream's `compressHash` produces by folding byte `i` into position `i mod 20` (hash.cc). A derivation's `.drv` text was rendered twice, once to hash for its path and once to record for the build, where upstream's `writeDerivation` hashes and writes one rendering; it is rendered once. A string with no interpolation went through the general path an interpolated string takes; it is now its bytes, as upstream's parser makes it an `ExprString` holding its value (parser.y). `hello.drvPath` allocates 2082 MB where it allocated 2203 MB and takes 0.90 s of user time where it took 0.96 s, 2000 derivations allocate 292 MB where they allocated 623 MB, and a million evaluations of `if a == "a" then "b" else "a"` take 0.65 s where they took 0.92 s. (#48)+- **Reaching the C data layer outside the `arenaInit` .. `arenaDestroy` window raises `ArenaNotInitialized` instead of crashing the process.** Evaluating anything before `Nix.Eval.Arena.arenaInit`, or after `arenaDestroy`, was a SIGSEGV, so a library user who left the bracket out could not tell a missing setup step from memory corruption. Each C sub-arena's one allocation funnel now reports failure through the sentinel its callers already check (NULL, `UINT32_MAX`, `NN_SYMBOL_INVALID`) instead of dereferencing state it does not have, and the Haskell boundary asks `nn_arena_live` on that failure path and raises the new `Nix.Eval.CStatus.CStatusError`: `ArenaNotInitialized` naming the C entry point that refused, or `CAllocationFailed` when the arena is live and the allocation itself failed. The question is asked only after a failure, so evaluation pays one sentinel comparison per allocation and nothing more, and `hello.drvPath` evaluates in the same time. Upstream guards the same boundary with `assert(gcInitialised)` in the `EvalState` constructor, an abort rather than an error a caller can catch, which is the one place this diverges on purpose. `checkedCPtr` moves to `Nix.Eval.CStatus` and runs in `IO`, so the arena is asked at the moment the call failed rather than when a lazy message is rendered; the bytecode emitters raise `CStatusError` where they raised an `IOError`; and the thunk allocators, slot arrays and list construction now check their C result, where a NULL previously flowed on to the next dereference or became a silently empty list. Parsing needs no arena. `ArenaNotInitialized` is a setup diagnosis rather than an error to catch and retry in the same process: GHC updates a thunk whose evaluation raised with that exception, so a shared value whose evaluation reached C before the window re-raises it inside a later, live arena. (#206)+- **The C data layer reports a failed or oversized allocation as `CAllocationFailed` instead of aborting the process, and its 32-bit counts no longer wrap.** The symbol table, the attribute set's insert, union and key removal, and the bookkeeping behind lists, closures and context strings called `abort()` when an allocation failed, so evaluation ended with SIGABRT and no way for a caller to recover. Each now refuses through its status, the Haskell boundary raises `Nix.Eval.CStatus.CAllocationFailed` naming the C entry point, and `builtins.tryEval` does not catch it. That is upstream's shape: its collector turns exhaustion into `std::bad_alloc` (eval-gc.cc at 2.24.9), which `tryEval` lets through and the CLI reports as an error. Upstream's symbol table still aborts at its own `uint32_t` ceiling (`ChunkedVector::addChunk`); refusing there instead is deliberate. The 32-bit arithmetic is now checked where it wrapped. An attribute set holds at most 4294967295 entries, the ceiling upstream's `Bindings` has, and its doubling and union sizes are computed in 64 bits; a key past index 2^31 was reported absent and is now found. A string of 4 GiB or more is refused where its length was truncated to 32 bits, so that it read back as only its first bytes, and a list of 2^32 or more elements is refused where its count wrapped to a shorter allocation. `nn_list_new` and `nn_list_drop` report failure through a status of their own, since the NULL they returned also meant the empty list. A thunk whose force fails while its value is being stored is left re-forceable, and a refused thunk state transition raises the new `CInvariantViolated` instead of being ignored. The `null`, `true` and `false` thunks are shared static cells, as upstream shares `vNull`, `vTrue` and `vFalse`: they need no arena, so forcing one before `arenaInit` no longer raises `ArenaNotInitialized` for the rest of the process, and one kept across `arenaDestroy` no longer points into freed memory. Re-initializing the symbol table frees the previous one. (#19)++### Store++- **The store has garbage-collector roots, a reachability walk, a sweep, and a store-wide lock that keeps a collection and a writer apart.** Roots live under the store's own metadata directory, `.nova-nix/gcroots`, since this store has no state directory apart from that one and a store copied as one directory then keeps its roots. Both of upstream's permanent-root forms are read: a symlink whose target lies in the store, which roots the store path the target lies in (the path itself, a trailing-separator spelling of it, or anything beneath it, upstream's `toStorePath`), and a regular file named `<hash>-<name>`, which is the form that needs no symlink privilege. An out-link's indirect root is a regular file under `gcroots/auto`, named by a digest of the link's absolute path and holding that path, where upstream's is a symlink to the link; the record has to be writable on every platform the store runs on, and a symlink on Windows needs Developer Mode. The record is published by rename, so a listing under the shared lease never reads a torn one. A record whose out-link is gone is removed on the next walk with upstream's `removing stale link` line; a symlink root naming a path the database does not hold is skipped with its `skipping invalid root` line, a regular-file root naming one is dropped silently, and an entry the walk cannot read is reported with its `cannot read potential root` line and skipped, each as upstream does. The walk is pure over the references map; dead rows go in one transaction, because the outputs of one derivation reference each other both ways and no order of one-row deletes gets through a cycle; trees go one by one after the rows, so an interruption leaves inert unregistered trees rather than rows describing nothing. What the sweep removes is every store directory entry that is not live, as upstream's sweep removes it: a dead path's tree, a store-shaped tree no row describes, junk, and a dead path's lock file. A live path's lock file stays: upstream's holders delete their lock files on release, so its sweep reclaims crash debris, while here a holder never deletes and the live path's lock file is its normal state. A dead row with no tree is unregistered without a line or a count, since upstream's sweep walks the directory and never meets one, and what is announced and counted is what upstream announces and counts. The store directory is keyed by its canonical spelling from the moment it is opened (absolute, `.` and `..` collapsed, no trailing separator, symlinks unresolved, as upstream's `absPath` keys a `--store` path), so one directory named two ways keys one set of rows; a database holding a path under another spelling of the directory would compare as dead throughout, so the collector and the checked delete refuse it rather than sweep a rooted closure over a text mismatch. Upstream serializes collection against writers with a shared-or-exclusive `gc.lock` plus a socket; nova-nix keeps the lock and drops the socket: every open store handle holds `.nova-nix/gc.lock` shared from open to close, and a collection (or a checked delete) trades the handle's lease for the exclusive lock, so it runs only while no other process has the store open. An opener arriving meanwhile waits, announced with upstream's `waiting for the big garbage collector lock...`; upstream's own opener never waits there, since it hands its roots to the running collector through the socket, so the collector's line is the one that names the wait. A handle whose lease cannot be renewed after a collection keeps a surrendered lease rather than none, so it still closes. Listing the roots needs only the handle's shared lease, as upstream's listing takes no collector lock. The per-path locks the builder and substituter hold were not enough on their own: they cover a path while it is being produced, not the window between a dependency's registration and the build that consumes it, nor the writers that register without one (the `.drv` closure, the eval-time store writes). Not implemented, and stated in the module: runtime roots (upstream's `/proc` scan on Linux and `lsof` elsewhere), temporary roots, `keep-derivations` and `keep-outputs` (the builder records no deriver, so an unrooted `.drv` and the sources only it references are collected), and the `.links` optimization sweep. (#24)+- **The store probes whether its volume folds case when it opens, and case-hacks sibling names only where it does.** Whether two NAR entries differing only by case can share a directory was decided at compile time by operating system, so a store on a case-sensitive APFS volume still had `makefile` written beside `Makefile` as `makefile~nix~case~hack~1`. The store now asks the volume (`pathconf(_PC_CASE_SENSITIVE)` on macOS, the Win32 default on Windows, inherent on Linux) and carries the answer in the new `Store` field `stCaseSensitivity`; every NAR materialization keys names by it, and a volume that does not fold gets its true names. Upstream's `use-case-hack` is a per-process setting defaulting to on for Darwin (archive.cc at 2.24.9), so upstream case-hacks on a case-sensitive macOS volume as well; that spelling is a workaround for folding, and a volume that does not fold needs none, so this is a deliberate divergence in on-disk spelling only, since either tree re-serializes to the same NAR. (#68)+- **A store path is read back under its volume's case-hack mode, so a case-sensitive macOS store keeps a name that literally ends in `~nix~case~hack~N`.** The store case-hacks sibling names only where its volume folds, but the serializer stripped the suffix by operating system (nova-cache's `defaultCaseHack`, on for macOS and Windows). On a case-sensitive macOS volume nothing is ever hacked, yet every registration, on-disk recheck, adoption check, fixed-output check, push and evaluation read of a store path stripped the suffix, and the unpack refused an incoming NAR entry carrying it, so a tree holding such a name could not be substituted or registered. Upstream ties both directions to one per-process setting, `use-case-hack`, on for Darwin (archive.cc at 2.24.9), so it strips and hacks alike on every macOS volume. The store now reads its own paths under its probed volume's answer: stripped where the volume folds, as before and as upstream, and verbatim where it does not, which is upstream with `use-case-hack` off, and an incoming name carrying the suffix is refused only where the volume strips it. A path read as a source, outside any store, keeps the per-process setting, as upstream's every read does. (#236)+- **A NAR entry name or symlink target the host's filesystem can hold is materialized as its bytes, as upstream restores it on POSIX; each platform refuses only what its own filesystems cannot hold.** The store refused, on every platform, a name with no UTF-8 reading and every name Windows reserves (a device stem such as `aux.c` or `con.h`, a colon, a backslash, a trailing dot or space), so a NAR that `nix-store --restore` unpacks on Linux and macOS failed here. Upstream's restore appends each name to the destination path and hands each target to `symlink` as bytes (`RestoreSink` in fs-sink.cc at Nix 2.24.9), refusing only what the archive grammar refuses: an empty name, `.`, `..`, a `/` or a NUL (`parse` in archive.cc), which stay refused on every platform. Linux now holds every other name and target byte for byte, through the strict and the streaming unpack alike. macOS refuses a name that is not UTF-8 or holds a Unicode noncharacter: APFS refuses both at the create, and HFS+ stores such a name with each byte outside UTF-8 (and U+FFFE and U+FFFF) rewritten as a `%XX` escape, a tree that no longer reproduces its NAR. A link target keeps its bytes there. Windows refuses a device name, a trailing dot or space, a character Win32 reserves (`<>:"\|?*` and the controls), and a name or target with no UTF-16 form. Names reach `open`, `mkdir` and `symlink` as `OsPath` bytes rather than through the locale's codec, which could not encode a UTF-8 name under an ASCII file-system encoding. A store tree is therefore no longer guaranteed to materialize identically on every platform: a path holding a name some host cannot hold is refused when it is substituted onto that host, naming the entry and the reason, and materializes everywhere else. (#84)+- **A sibling pair the volume folds but the case-hack key keeps apart fails at the write, naming the entry, instead of silently replacing the earlier one.** On a folding volume the store keys sibling names by their uppercase, and that is not the volume's own fold table: APFS reads capital and small sharp s (U+1E9E, U+00DF) as one name while the key keeps them apart. Both NAR unpack paths created or truncated each file and merged directories, so the second entry of such a pair landed on the first, `builtins.path` returned a store path its tree did not reproduce, and a later build refused to register it with advice that re-evaluation could not follow. Every regular file and directory an unpack writes is now created exclusively, so the volume decides and the collision fails where upstream's restore makes it fail (`RestoreSink` in fs-sink.cc at 2.24.9: `O_CREAT | O_EXCL` for a file, a refused `create_directory` for a directory), with upstream's text. A file reads `creating file '"<path>"': File exists`, the inner quotes being `std::quoted`, through which upstream streams a `std::filesystem::path`, and a directory over a directory reads `path '<path>' already exists`. A directory over anything else reads `creating directory '<path>': File exists`, and a link `creating symlink from '<path>' -> '<target>': File exists`: 2.24.9 printed the C++ library's `filesystem_error` text for these two, which is implementation-defined and differs by platform, and 2.25 wrapped it in these messages, which are followed. The unpack's root is created the same way, so `unpackNarEntry` and the streaming sink refuse a destination that already holds an entry rather than writing into it, as upstream's restore does; every caller clears a stale destination first. `copyPathInto`, the fallback for a build output that cannot be renamed into place, creates exclusively as well and raises the same refusals. (#234)+- **A coerced source path is restored into the store from a dump of the source, as upstream restores one, so a sibling pair the source's volume keeps apart and the store's folds is case-hacked instead of failing the build.** The build driver copied each coerced source (`src = ./dir`) file by file and registered whatever landed under the store path evaluation had computed from the source, with nothing checking that the copy reproduced it. On a folding store, a source from a case-sensitive volume holding `Makefile` and `makefile` merged and was registered under the two-file address. Upstream never copies: `LocalStore::addToStoreFromDump` restores the dump it hashed (`restorePath`, local-store.cc at 2.24.9), so its case-hack applies on the way in. The store now does the same and holds `Makefile` and `makefile~nix~case~hack~1` under the path, NAR hash and size nix-instantiate 2.33.2 records for that source. The source's NAR streams from the walk through the hash into the streaming unpack sink, so no file is held whole. The dump must reproduce the address evaluation computed, so a source edited between evaluation and the build is refused rather than registered under a hash its bytes no longer have, and the restored tree is rechecked on disk before its row exists. `builtins.path` without a filter, `fetchTarball` and `fetchGit` likewise unpack the NAR entry they hashed rather than copying the source, as a filtered `builtins.path` already did. Sources follow the store's per-platform name rules (#84): on Linux and macOS a device stem such as `aux.c`, a colon or a trailing dot restores as its bytes, as the copy stored it and as upstream does. (#235)++### Builder++- **A derivation carrying `__json` is built as upstream builds one: its attributes reach the builder as `.attrs.json` and `.attrs.sh` in the build directory, named by `NIX_ATTRS_JSON_FILE` and `NIX_ATTRS_SH_FILE`, and not as environment variables.** The builder copied every environment entry of the `.drv` into the build's environment, so a structured derivation's builder saw one `__json` variable and neither of the files stdenv's setup script looks for. Upstream takes the mode from the presence of `__json` (`ParsedDerivation`, parsed-derivations.cc at 2.24.9), sets `outputs` to an object naming each output's path, writes the object to `.attrs.json` and the part of it bash can hold to `.attrs.sh`, and passes no attribute and no output through the environment (`initTmpDir` and `writeStructuredAttrs`, local-derivation-goal.cc at 2.24.9). The shell file follows `writeStructuredAttrsShell`: a string single-quoted, an integral number in decimal, null as `''`, a boolean as `1` or nothing, an array or object of those as `declare -a` or `declare -A`, and anything else, or any name that is not a shell identifier, left out. nova-nix now does each of these, rewriting placeholders and store paths in both files as it does in the environment, and reads `impureEnvVars` from the object, where it must be a list of strings. A structured build here wrote `.attrs.json` and `.attrs.sh` byte-identical to a Nix 2.33.2 build of the same derivation, the store directory aside. Upstream writes a number through `static_cast<int>`, so an integer keeps its low 32 bits, and a float past `int`'s range is undefined behavior there; nova-nix writes what an aarch64 build of upstream writes, the saturated value, where an x86-64 build writes `-2147483648`. `outputChecks`, `exportReferencesGraph` and `unsafeDiscardReferences` are neither enforced nor exported in this mode, as their flat-mode counterparts are not. (#36)+- **An x86_64 host runs i686 derivations of its own operating system natively, as upstream's default extra-platforms does.** `i686-linux` and `i686-windows` are platforms of their own now rather than unrecognized strings. A derivation for `i686-windows` spawns directly on an x86_64 Windows host, where WoW64 runs it, and `i686-linux` does the same on an x86_64 Linux host, where the kernel does; upstream adds `i686-linux` to its extra platforms on `x86_64-linux` by default and has no Windows entry yet, so the Windows rule is the same one applied to the platform upstream has not reached. On any other host an i686 derivation is refused or launched through `--exec-wrapper` like any foreign system. (#213)+- **`builtin:fetchurl` retries a transient failure with backoff before moving to the next URL, as upstream's transfer layer does.** One timeout, reset or 5xx against a flapping host used to end that URL's attempt at once, so a short outage on every listed mirror cost the whole fetch. Each URL now gets upstream's five attempts (the `download-attempts` default in `libstore/filetransfer.hh` at 2.24.9), waiting 250 ms before the first retry and doubling after that, with upstream's jitter on the exponent, and each retry is announced on stderr with upstream's `; retrying in N ms` suffix. Upstream's classification decides what a retry can outlive (`libstore/filetransfer.cc` at 2.24.9): a 404 or 410, a 401, 403 or 407, any other 4xx except 408 and 429, a 501, 505 or 511, a malformed or unsupported URL, a redirect loop, a failure writing the output, and a download that verifies wrong are deterministic and move straight to the next URL; everything else, name resolution and TLS included, is retried. A retry restarts the download from the first byte with a fresh hash, where upstream resumes from the written offset only when the server accepts ranges. The policy lives in `BuildConfig` as `bcFetchRetry`, a `FetchRetryPolicy` whose default is upstream's, and the retry loop, delay formula and both classifications are exported from `Nix.Http` with their effects injected, so the policy is tested without a clock or a network. (#238)+- **An interrupt during a push, a fetch cache read or write, a store derivation read or an archive unpack stops the process instead of being read as a missing file, a cache miss or a failed push.** Each of these caught every exception, so a Ctrl-C or a killed thread arriving mid-operation became its fallback value and execution went on: a push reported `push failed: user interrupt` or `HTTP error for <url>: user interrupt` as if the cache had refused it, a fetch cache entry being read became a miss and one being written was dropped, a `.drv` being read became a missing derivation (a failed build or a modulo-hash error), a source tree being verified on disk became a mismatch and was deleted or refused, and an archive being unpacked failed the `builtin:unpack` build. Each now catches only the failure it expects: an `IOException` for a file read, write or removal, an `HttpException` for a push request, and the `ErrorCall` the zstd decoder raises for a corrupt frame. A push, which also meets sqlite and serializer failures, catches every synchronous exception through `Nix.Http.catchSync` and lets an asynchronous one through. Upstream draws the same line by type: `Interrupted` is a `BaseError` beside `Error` rather than under it (`src/libutil/signals.hh` and `src/libutil/error.hh` at 2.24.9), and its fallbacks catch `Error`, as substitution does (`substitution-goal.cc`). A push reads each response body through the transfer layer, so a connection lost mid-body is reported as an HTTP error like any other failure of the request. (#251)++### Substitution++- **The substituter retries a narinfo or NAR download under upstream's transfer-layer policy, the one `builtin:fetchurl` uses.** Upstream serves every download through one `FileTransfer` (`libstore/filetransfer.cc` at 2.24.9) with one backoff and one table of the failures that are never retried, and the substituter kept an older policy of its own. A narinfo fetch was not retried at all, so a single timeout, reset or 5xx on the narinfo cost the path its substitution and, with no other cache holding it, a local build; it now gets upstream's five attempts. A NAR download retried every 5xx and every failure the HTTP client raised, so a 501, 505 or 511 and a redirect loop spent five attempts on an answer that cannot change; they now stop at once, as upstream's never-retried statuses and curl results do, while a 4xx other than 408 and 429 stops at once as before. The delays between attempts become upstream's 250 ms doubling with jitter on the exponent, where the NAR retry waited 0.5, 1, 1.5 and 2 seconds, and each retry is announced on stderr with upstream's `; retrying in N ms` suffix. A narinfo answered 404, 410, 401, 403 or 407 is a miss and is never retried, where only a 404 was a miss and the other four were substitution errors: upstream's transfer layer calls the first two `NotFound` and the rest `Forbidden`, and its binary cache store reads both as the file not being in that cache, since an S3 bucket that cannot be listed answers a missing key with 403. A NAR the narinfo named and the cache answers the same way stops after one request, as before and as upstream's `SubstituteGone` does. An unreachable cache therefore costs each narinfo the full retry budget before the scan moves on (the delays alone come to four to five seconds), as it does upstream, which disables a failing cache for a minute only when `fallback` is set. A connection reset in the middle of a body is now a transport failure, retried like any other, in `builtin:fetchurl` too: the HTTP client wraps what fails while a response is opened but hands the body reader over unwrapped, so a reset mid-body arrived as a bare `IOException` and was taken for a failure writing the output, where curl's receive errors are transient upstream. `bcFetchRetry` governs the substituter's requests as well as `builtin:fetchurl`'s, as upstream's one `download-attempts` setting governs every transfer. (#243)+- **Every HTTP request nova-nix's own client makes identifies itself, as upstream's do.** Only `builtin:fetchurl` sent a User-Agent; the substituter and `push` sent none. A request with no User-Agent is what bot mitigation in front of a server scores lowest: Cloudflare in front of cache.novavero.ai challenged such requests from a GitHub runner and passed the same requests carrying `nova-nix/VERSION`, so the public cache could be read by a person's browser and not by the tool built to read it. Upstream sends `curl/VERSION Nix/VERSION` on every request. The header is now set in one place for the fetcher, the substituter and `push`, with the version Cabal built in. `builtins.fetchurl` and `builtins.fetchTarball` run `curl`, which sends its own User-Agent. (#215)++### Windows packages++- **`pkgs/windows/fetchurl.nix` understands nixpkgs' `mirror://<site>/<path>` scheme, and hello and sed fetch through `mirror://gnu/`.** A recipe named a hand-picked handful of hosts, so one unreachable host could fail the fetch. The site's hosts now come from `pkgs/windows/mirrors.nix`, a verbatim copy of the sets this package set uses from nixpkgs' `pkgs/build-support/fetchurl/mirrors.nix` at the commit the file names, so a recipe spells its source the way the nixpkgs recipe for the same package does and gets the whole list, tried in nixpkgs' order. nixpkgs expands the scheme in its fetch builder at build time; `builtin:fetchurl` runs no shell, so the expansion happens at eval and the derivation records the expanded list, which drops the `ftp://` host the HTTP client cannot fetch. An unknown site is an eval error naming the recipe's URL, where nixpkgs' build script only warns; a mirror URL with no path (`mirror://gnu`) is an eval error too, where nixpkgs expands it to the bare hosts. The source output paths are unchanged (they are fixed by the hash); the source and package derivation paths change, as they describe the new URL list. (#238)++### Distribution++- **Each Hackage upload carries the library's documentation, built on the pinned toolchain.** Hackage's own documentation builder runs a GHC older than the base floor this package declares, so it could not plan the build, and the package page showed a failed build report and no documentation. The Hackage workflow now builds the haddocks for the library and uploads them after the sdist, and a docs-only run uploads them for a version that is already on Hackage. (#211)+- **The public cache carries the current Windows Hello closure, refreshed on every push to main.** cache.novavero.ai was seeded by hand once and nothing republished it when the recipes changed, so a fresh Windows store pointed at it substituted the MinGW-w64 toolchain and built everything else. A publish job after the Windows end-to-end job builds the closure, runs Hello and pushes it, and a second job substitutes that closure into a fresh store from the public cache alone and fails on any local build, so a stale cache turns CI red instead of causing a silent rebuild. (#212)+- **The `default.nix` at the repository root is removed.** It pinned nixpkgs 24.11, whose newest GHC cannot satisfy this package's `base >= 4.22`, so it could not build nova-nix, and nothing used it. (#317)++### Dependencies++- **`unix` (POSIX) and `Win32` (Windows) become direct dependencies, at `unix >= 2.8 && < 2.9` and `Win32 >= 2.9 && < 2.15`.** `base` has no exclusive open, and the store's unpack now needs one, so it calls the platform's own (`openFd` with `O_EXCL`, `CreateFileW` with `CREATE_NEW`). Both are GHC boot packages that `directory` and `process` already pulled into every build, so the solver resolves the versions it already had. The floors are the APIs used: unix 2.8 is the first whose `openFd` takes `creat` and `cloexec` in its flags, and Win32 2.9 the first whose `hANDLEToHandle` serves the native Windows I/O manager. (#234)+- **New dependencies and raised floors.** The library adds `random >= 1.2 && < 1.4` and the executable adds `file-io >= 0.1.1 && < 0.2`. `directory` rises to `>= 1.3.8` in the library and executable, and `filepath` to `>= 1.4.100` in all three. The test suite adds `http-types >= 0.12 && < 0.13` and `QuickCheck >= 2.12.5 && < 2.19`, and requires `process >= 1.6.12`.+ ## 0.8.0.0 - 2026-10-08  0.7.0.0 was published on GitHub but not uploaded to Hackage, so on Hackage this release follows 0.6.0.0. Library users upgrading from 0.6.0.0 should read the 0.7.0.0 entries below as well.

@@ -4,22 +4,31 @@ [![Hackage](https://img.shields.io/hackage/v/nova-nix.svg)](https://hackage.haskell.org/package/nova-nix) [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE) -nova-nix is an implementation of [Nix](https://nixos.org) for Windows, written-in Haskell with a C99 data layer. It also builds and runs on macOS and Linux.-It has its own parser, evaluator, store, builder and binary-cache substituter,-and does not need an existing Nix installation.+nova-nix exists to make [Nix](https://nixos.org) work natively on Windows:+the same language, the same `/nix/store` paths and the same binary caches as+upstream Nix, without WSL or an existing Nix installation. +It is an implementation of Nix in Haskell with a C99 data layer, and it has+its own parser, evaluator, store, builder and binary-cache substituter. It+also builds and runs on macOS and Linux.+ nova-nix is experimental. Read [Limitations](#limitations) before relying on it.  ## Status -- **Evaluation matches upstream Nix on the cases CI checks.** On a pinned-  nixpkgs 24.11 revision, `hello.drvPath` and a dependent derivation evaluate-  to the same store paths as Nix 2.24.9, and 23 smaller evaluation cases-  produce the same output. CI runs this comparison on every change. A matching-  `drvPath` means the whole build-time closure behind it matches too. How much-  of the rest of nixpkgs evaluates has not been measured yet ([#29]).+- **Evaluation matches upstream Nix on the cases CI checks.** 22 derivations+  evaluate to the same store paths as upstream on three pinned pairings: Nix+  2.24.9 with nixpkgs 24.11, Nix 2.34.9 with nixpkgs 26.05, and Nix 2.35.4+  with nixpkgs unstable. They span the native, i686 and musl stdenv+  bootstraps, cross-compilation to aarch64 Linux and Windows, multi-output+  packages such as curl and systemd, sources fetched through git, GitHub,+  PyPI and the cargo and Go vendoring fetchers, a NixOS initrd and system,+  and fixtures for derivation inputs, `builtins.toFile` and+  `builtins.fetchGit`. 49 smaller evaluation cases produce the same output.+  CI runs this comparison on every change. A matching `drvPath` means the+  whole build-time closure behind it matches too. How much of the rest of+  nixpkgs evaluates has not been measured yet ([#29]). - **Windows builds run natively.** CI builds GNU Hello on a Windows runner   through a stage-1 stdenv. Its toolchain is 17 MinGW-w64 packages and 22   MSYS2 packages, each fetched as a fixed-output derivation pinned by SHA-256@@ -28,19 +37,46 @@   with a toolchain built from source is tracked in [#26]. - **Binary caches work in both directions.** `nova-nix push` uploads a   closure, and `build --substituter` downloads signed NARs instead of-  building. CI checks the round trip on Linux against a local nova-cache-  server.+  building. CI checks this two ways. On Linux, two fixtures are pushed to a+  local nova-cache server and substituted into a second empty store with+  signature verification on: a small tree whose two copies must serialize+  to the same NAR, and a 320 MiB tree that must substitute under a 128 MiB+  heap cap. On every push to main, a Windows job builds the Hello closure,+  runs Hello and publishes the closure to the public cache at+  [cache.novavero.ai](https://cache.novavero.ai), and a second Windows job+  builds the same closure into an empty store with that cache as its only+  substituter, fails if any path is built locally, and runs the result.  ### Limitations  - No flakes, no `nix-shell` or `nix develop`, and no daemon or multi-user mode.-- No garbage collection yet ([#24]). `nova-nix store delete` removes-  individual paths.+- Evaluation is slower than upstream's. CI's 22 `drvPath` cases take 10 to 13+  times as long in total, and a full NixOS system takes 22 to 30 times as long.+- `build --substituter` works through a package's build closure from the+  leaves up, so a package a cache holds still downloads its build-time+  dependencies ([#307]).+- Garbage collection has no runtime roots: `nova-nix store gc` keeps what+  `build --out-link` registered and what the operator roots under the store's+  `.nova-nix/gcroots`, not what a running program has open. `keep-derivations`+  and `keep-outputs` are not implemented, so an unrooted `.drv` is collected.+  `build` creates no result link unless `--out-link` is given, where+  `nix-build` defaults to `./result`.+- `--restrict-eval` and `--pure-eval` exist (and `restrict-eval`, `pure-eval`+  and `allowed-uris` in nix.conf), gating reads, the environment and fetches+  the way upstream's modes do. The closure of a search path root that is a+  store path is not allowed along with it, and the bundled `<nix/*>` directory+  stays listed in `builtins.nixPath` under `--pure-eval`, where upstream+  shows an empty list.+- The Windows store is `C:\nix\store`, where upstream's Windows default is+  `%PROGRAMDATA%\nix\store`, so the two do not share store paths on Windows+  ([#309]). - On Windows a build's process tree runs in a job object, so stopping a build-  stops everything it started. There is no filesystem or network isolation-  yet ([#25]).+  stops everything it started. No platform has filesystem or network+  isolation yet ([#25]). - nova-nix itself needs neither WSL nor Cygwin, but the current Windows stdenv   runs its build scripts with MSYS2's bash.+- `builtins.fetchurl` runs `curl`, `builtins.fetchTarball` runs `sh`, `curl` and+  `tar`, and `builtins.fetchGit` runs `git`, each from `PATH`. - Store paths that contain symlinks need Windows Developer Mode or an elevated   shell. nova-nix creates native symlinks and fails rather than falling back   to a copy.@@ -82,7 +118,9 @@ $ nova-nix eval FILE.nix                          # evaluate a file $ nova-nix build FILE.nix -A ATTR                 # build an attribute of it $ nova-nix build FILE.nix --substituter URL --trusted-key KEY  # try a cache first-$ nova-nix push --cache URL --key-file KEY --all  # upload the store to a cache+$ nova-nix build FILE.nix --out-link result       # link the result and root it+$ nova-nix store gc                               # delete everything unrooted+$ nova-nix push --cache URL --key-file FILE --all  # upload every path except derivations $ nova-nix --help ``` @@ -105,12 +143,19 @@ ```  The first build fetches 40 pinned archives (the 39 toolchain packages and the-Hello source), then builds the MSYS2 seed, the MinGW-w64 seed and Hello.+Hello source), then builds the MSYS2 seed, the MinGW-w64 seed and Hello. The+[public cache](https://cache.novavero.ai) holds this closure as CI last built+it from main, so a build that names the cache downloads what it holds and+builds only what it lacks: +```console+> bin\nova-nix build pkgs\windows\hello.nix --substituter https://cache.novavero.ai --trusted-key cache.novavero.ai-1:9gQ7tLWMM+2tdC9H5sKMJltDIPfD7X2GWlZe8Aa8hHQ=+```+ ## How it works  - **Parser** (`Nix.Parser`): a hand-written recursive-descent parser for the-  Nix 2.24 language.+  Nix language. - **Evaluator** (`Nix.Eval`): the AST compiles to a small bytecode that a lazy   evaluator runs, memoizing thunks and detecting infinite recursion. The   evaluator is generic over `MonadEval`, with a pure instance for tests and an@@ -122,11 +167,11 @@   symbols, context strings, lambdas and bytecode are C99 structures outside   the GHC heap, freed together when an evaluation session ends. Haskell calls   into C, and C never calls back.-- **Store** (`Nix.Store`): a content-addressed store at `/nix/store`, or-  `C:\nix\store` on Windows, with SQLite metadata, reference scanning and-  per-path locks that follow upstream's protocol.-- **Builder** (`Nix.Builder`): orders derivations by their dependencies, tries-  substitution first, and runs each builder in a scrubbed environment.+- **Store** (`Nix.Store`): a store at `/nix/store`, or `C:\nix\store` on+  Windows, with SQLite metadata, reference scanning and per-path locks.+- **Builder** (`Nix.Builder`): orders derivations by their dependencies,+  substitutes each one a cache holds, and runs the rest in a scrubbed+  environment. - **Substituter** (`Nix.Substituter`): the HTTP binary-cache protocol, with   Ed25519 signature checks and xz, zstd and bzip2 decompression, built on   [nova-cache](https://github.com/Novavero-AI/nova-cache).@@ -146,6 +191,7 @@ import Nix.Builtins (builtinEnv) import Nix.Eval (eval, runPureEval) import Nix.Eval.Arena (arenaDestroy, arenaInit)+import Nix.Eval.Policy (unrestrictedPolicy) import Nix.Parser (parseNix)  main :: IO ()@@ -153,7 +199,7 @@   -- The first argument is what relative path literals resolve against.   case parseNix "/tmp" "<expr>" "let x = 5; in x * 2 + 1" of     Left err -> print err-    Right expr -> print (runPureEval (eval (builtinEnv 0 []) expr))+    Right expr -> print (runPureEval (eval (builtinEnv unrestrictedPolicy 0 []) expr)) ```  This prints `Right (VInt 11)`. Evaluation needs the C data layer, so it must@@ -184,7 +230,8 @@  Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE). -[#24]: https://github.com/Novavero-AI/nova-nix/issues/24 [#25]: https://github.com/Novavero-AI/nova-nix/issues/25 [#26]: https://github.com/Novavero-AI/nova-nix/issues/26 [#29]: https://github.com/Novavero-AI/nova-nix/issues/29+[#307]: https://github.com/Novavero-AI/nova-nix/issues/307+[#309]: https://github.com/Novavero-AI/nova-nix/issues/309

@@ -12,38 +12,53 @@ -- this module is in the executable stanza. module Main (main) where -import Control.Exception (IOException, displayException, try)-import Control.Monad (void, (>=>))+import Control.Exception (AsyncException (UserInterrupt), IOException, displayException, handleJust, try)+import Control.Monad (join, mfilter, void, (>=>)) import qualified Data.ByteString as BS+import qualified Data.ByteString.Builder as BB import qualified Data.ByteString.Char8 as BC import Data.IORef (readIORef)+import Data.List (find) import qualified Data.Map.Strict as Map-import Data.Maybe (catMaybes)+import Data.Maybe (catMaybes, mapMaybe) import qualified Data.Text as T import qualified Data.Text.Encoding as TE import qualified Data.Text.IO as TIO import Data.Version (showVersion) import Nix.Builder (BuildConfig (..), BuildResult (..), buildWithDeps, defaultBuildConfig, execWrapperConfig)-import Nix.Builtins (builtinEnv, parseNixPath)+import Nix.Builtins (builtinEnv, isNixPathPseudoUrl, parseNixPath, rootScopeNames, searchPathRoots) import Nix.Config (NixConfig (..)) import qualified Nix.Config as Config-import Nix.Derivation (Derivation (..), DerivationOutput (..), toATerm)-import Nix.Eval (MonadEval, NixValue (..), Thunk (..), attrSetFromMap, attrSetLookup, attrSetToAscList, attrSetToMap, eval, evaluated, force, readThunkValue)+import Nix.Derivation (Derivation (..), DerivationOutput (..), fromATerm)+import Nix.Environment (EnvLookup (..), lookupEnvBytes)+import Nix.Eval (Env, EvalPolicy (..), MonadEval, NixValue (..), Thunk (..), attrSetFromMap, attrSetLookup, attrSetToMap, eval, evaluated, force, readThunkValue) import Nix.Eval.Arena (arenaInit) import Nix.Eval.AttrPath (selectAttrPath)-import Nix.Eval.IO (EvalState (..), newEvalState, runEvalIO)-import Nix.Eval.Types (bytesToTextLossy, clistFromThunks, clistThunks, thunkToCPtr)-import Nix.Parser (parseNix, readFileAutoEncoding)-import Nix.Push (PushCompression (..), PushConfig (..), PushSummary (..), loadApiKeyFile, parsePushCompression, pushCompressionValues, pushPaths)-import Nix.Store (DeleteOutcome (..), Store (..), closeStore, deleteStorePathRaw, materializeEvalSources, materializeEvalStoreWrites, openStore, queryAllValidPaths, resolveDeleteTarget, writeDrv, writeDrvClosure)-import Nix.Store.Path (StoreDir (..), StorePath, defaultStoreDir, parseStorePath, parseStorePathBaseName, platformStoreDir, storePathToFilePath)+import Nix.Eval.CallDepth (topLevelCallDepth)+import Nix.Eval.CanonPath (canonPathValue)+import Nix.Eval.IO (EvalState (..), allowEvalPath, newEvalState, renderEvalFailure, runEvalIOTraced)+import Nix.Eval.Print (printAmbiguous)+import Nix.Eval.Types (clistFromThunks, clistThunks, thunkToCPtr)+import Nix.Expr.Resolve (undefinedVariableMessage)+import Nix.Expr.Types (Expr)+import Nix.HostPath (hostPathFromBytes, hostPathText)+import Nix.Parser (SourceError (..), parseNixWithScope, readFileAutoEncoding)+import Nix.Push (PushCompression (..), PushConfig (..), PushSummary (..), isDerivationPath, loadApiKeyFile, outputPathsOnly, parsePushCompression, pushCompressionValues, pushPaths, storePathBasename)+import Nix.Store (DeleteOutcome (..), GcRoot (..), LiveSet, Store (..), addOutLinkRoot, canonicalStoreDir, closeStore, collectGarbage, deleteStorePathChecked, findRoots, gcSummaryLine, materializeEvalSources, materializeEvalStoreWrites, openStore, queryAllValidPaths, resolveDeleteTarget, withLiveSet, writeDrv, writeDrvClosure)+import Nix.Store.Path (StoreDir (..), StorePath, defaultStoreDir, parseStorePath, parseStorePathBaseName, platformStoreDir, storePathToFilePath, storePathToText) import Nix.Substituter (CacheConfig (..)) import Paths_nova_nix (getDataDir, version)-import System.Directory (Permissions (executable), XdgDirectory (XdgConfig), canonicalizePath, doesFileExist, findExecutable, getCurrentDirectory, getPermissions, getTemporaryDirectory, getXdgDirectory)+import System.Directory (Permissions (executable), canonicalizePath, doesFileExist, findExecutable, getCurrentDirectory, getPermissions, getTemporaryDirectory, makeAbsolute)+import qualified System.Directory.OsPath as OsDir import System.Environment (getArgs, getExecutablePath, lookupEnv)-import System.Exit (exitFailure)+import System.Exit (ExitCode (..), exitFailure, exitWith)+import qualified System.File.OsPath as OsFile import System.FilePath (takeDirectory, takeFileName, (</>))-import System.IO (BufferMode (..), hPutStrLn, hSetBuffering, hSetEncoding, stderr, stdout, utf8)+import System.IO (BufferMode (..), hPutStrLn, hSetBinaryMode, hSetBuffering, hSetEncoding, stderr, stdout, utf8)+import System.IO.Error (isDoesNotExistError)+import qualified System.Info as SI+import System.OsPath (OsPath)+import qualified System.OsPath as OP  -- --------------------------------------------------------------------------- -- Argument parsing@@ -63,15 +78,21 @@     -- | @SYSTEM=PATH@ launchers for derivations this machine cannot execute     -- directly, e.g. @x86_64-windows=/path/to/wine@.     optExecWrappers :: ![String],+    -- | @--restrict-eval@: upstream's restrict-eval, turned on for this run.+    optRestrictEval :: !Bool,+    -- | @--pure-eval@: upstream's pure-eval, turned on for this run.+    optPureEval :: !Bool,     optCommand :: !Command   }  data Command   = CmdEvalFile !FilePath   | CmdEvalExpr !T.Text-  | CmdBuild !BuildTarget !(Maybe T.Text)+  | CmdBuild !BuildTarget !(Maybe T.Text) !(Maybe FilePath)   | CmdPush !PushArgs   | CmdStoreDelete ![String]+  | -- | @store gc@: collect, or with the flag only list the roots.+    CmdStoreGc !Bool   | -- | No command given.  Usage on stderr, non-zero: a bare invocation is     -- a usage error, and a caller testing the exit status must see one.     CmdUsage@@ -91,12 +112,14 @@ -- | Arguments to the build command, while the target is still unknown. data BuildArgs = BuildArgs   { baTarget :: !(Maybe BuildTarget),-    baAttrPath :: !(Maybe T.Text)+    baAttrPath :: !(Maybe T.Text),+    -- | Where to create the result symlink, registered as a GC root.+    baOutLink :: !(Maybe FilePath)   }  -- | Build arguments before any flag is parsed. emptyBuildArgs :: BuildArgs-emptyBuildArgs = BuildArgs Nothing Nothing+emptyBuildArgs = BuildArgs Nothing Nothing Nothing  -- | Arguments to the push command. data PushArgs = PushArgs@@ -115,7 +138,7 @@ -- silent drop: an unknown or typo'd flag once ended parsing and quietly -- discarded everything after it (e.g. a requested @--substituter@). parseArgs :: [String] -> Either String CliOpts-parseArgs = go (CliOpts [] False False Nothing Nothing Nothing [] CmdUsage)+parseArgs = go (CliOpts [] False False Nothing Nothing Nothing [] False False CmdUsage)   where     go opts [] = Right opts     -- Answered before anything else is looked at, and the rest of the line@@ -137,6 +160,10 @@       go (opts {optTrustedKey = Just key}) rest     go opts ("--exec-wrapper" : spec : rest) =       go (opts {optExecWrappers = optExecWrappers opts ++ [spec]}) rest+    go opts ("--restrict-eval" : rest) =+      go (opts {optRestrictEval = True}) rest+    go opts ("--pure-eval" : rest) =+      go (opts {optPureEval = True}) rest     go opts ("eval" : rest) = goEval opts rest     go opts ("build" : rest) = goBuild opts emptyBuildArgs rest     go opts ("push" : rest) = goPush opts emptyPushArgs rest@@ -155,6 +182,10 @@     -- much after the subcommand as before it.     goEval opts ("--store" : dir : rest) =       goEval (opts {optStore = Just dir}) rest+    goEval opts ("--restrict-eval" : rest) =+      goEval (opts {optRestrictEval = True}) rest+    goEval opts ("--pure-eval" : rest) =+      goEval (opts {optPureEval = True}) rest     goEval opts ("--expr" : expr : rest) =       go (opts {optCommand = CmdEvalExpr (T.pack expr)}) rest     goEval _ [flag]@@ -181,12 +212,19 @@       goBuild (opts {optNixPaths = optNixPaths opts ++ [T.pack val]}) buildArgs rest     goBuild opts buildArgs ("--exec-wrapper" : spec : rest) =       goBuild (opts {optExecWrappers = optExecWrappers opts ++ [spec]}) buildArgs rest+    goBuild opts buildArgs ("--restrict-eval" : rest) =+      goBuild (opts {optRestrictEval = True}) buildArgs rest+    goBuild opts buildArgs ("--pure-eval" : rest) =+      goBuild (opts {optPureEval = True}) buildArgs rest     goBuild opts buildArgs ("--expr" : expr : rest) =       withTarget opts buildArgs (TargetExpr (T.pack expr)) rest     goBuild opts buildArgs (flag : path : rest)       | flag `elem` attrFlags = case baAttrPath buildArgs of           Just _ -> Left "build accepts one attribute path"           Nothing -> goBuild opts (buildArgs {baAttrPath = Just (T.pack path)}) rest+      | flag `elem` outLinkFlags = case baOutLink buildArgs of+          Just _ -> Left "build accepts one --out-link"+          Nothing -> goBuild opts (buildArgs {baOutLink = Just path}) rest     goBuild _ _ [flag]       | flag `elem` valueFlags = Left (flag ++ " requires a value")     goBuild _ _ (arg@('-' : _) : _) = Left ("unknown build flag: " ++ arg)@@ -199,7 +237,7 @@       Nothing -> goBuild opts (buildArgs {baTarget = Just target}) rest     finishBuild opts buildArgs = case baTarget buildArgs of       Nothing -> Left "build requires a FILE.nix argument or --expr EXPR"-      Just target -> Right opts {optCommand = CmdBuild target (baAttrPath buildArgs)}+      Just target -> Right opts {optCommand = CmdBuild target (baAttrPath buildArgs) (baOutLink buildArgs)}     -- Sub-parser for push: flags and explicit store paths in any order.     goPush opts pushArgs [] = Right opts {optCommand = CmdPush pushArgs}     goPush opts pushArgs ("--store" : dir : rest) =@@ -218,9 +256,10 @@     goPush opts pushArgs (path : rest) =       goPush opts (pushArgs {paPaths = paPaths pushArgs ++ [path]}) rest     -- Sub-parser for store maintenance verbs.-    goStore _ [] = Left "store: expected a subcommand (delete)"+    goStore _ [] = Left "store: expected a subcommand (delete, gc)"     goStore opts ("delete" : rest) = goStoreDelete opts [] rest-    goStore _ (sub : _) = Left ("unknown store subcommand: " ++ sub ++ " (expected: delete)")+    goStore opts ("gc" : rest) = goStoreGc opts False rest+    goStore _ (sub : _) = Left ("unknown store subcommand: " ++ sub ++ " (expected: delete, gc)")     goStoreDelete opts paths []       | null paths = Left "store delete: name at least one store path"       | otherwise = Right opts {optCommand = CmdStoreDelete paths}@@ -231,12 +270,22 @@     goStoreDelete _ _ (arg@('-' : _) : _) = Left ("unknown store delete flag: " ++ arg)     goStoreDelete opts paths (path : rest) =       goStoreDelete opts (paths ++ [path]) rest+    goStoreGc opts printRoots [] = Right opts {optCommand = CmdStoreGc printRoots}+    goStoreGc opts printRoots ("--store" : dir : rest) =+      goStoreGc (opts {optStore = Just dir}) printRoots rest+    goStoreGc opts _ ("--print-roots" : rest) = goStoreGc opts True rest+    goStoreGc _ _ [flag]+      | flag `elem` valueFlags = Left (flag ++ " requires a value")+    goStoreGc _ _ (arg : _) = Left ("unknown store gc argument: " ++ arg)     -- Flags that consume the following argument as their value.     valueFlags =       ["--nix-path", "--store", "--substituter", "--trusted-key", "--exec-wrapper", "--expr", "--cache", "--key-file", "--compression"]         ++ attrFlags+        ++ outLinkFlags     -- Attribute selection, under both of upstream's spellings.     attrFlags = ["-A", "--attr"]+    -- The result link, under both of nix-build's spellings.+    outLinkFlags = ["-o", "--out-link"]  -- | Upstream C++ Nix's name for this directory, so an operator who knows -- one knows the other.@@ -245,9 +294,36 @@  -- | The environment variable carrying inline nix.conf settings, above the -- config files and below the command line in precedence.-nixConfigVar :: String+nixConfigVar :: BS.ByteString nixConfigVar = "NIX_CONFIG" +-- | The directory holding the system nix.conf, in place of @/etc/nix@.+nixConfDirVar :: BS.ByteString+nixConfDirVar = "NIX_CONF_DIR"++-- | The user config files, first strongest, in place of the XDG cascade.+nixUserConfFilesVar :: BS.ByteString+nixUserConfFilesVar = "NIX_USER_CONF_FILES"++-- | The XDG config dirs, searched for @nix\/nix.conf@ after the config home.+xdgConfigDirsVar :: BS.ByteString+xdgConfigDirsVar = "XDG_CONFIG_DIRS"++-- | Windows' all-users application data directory, the machine-wide+-- config directory there.+programDataVar :: BS.ByteString+programDataVar = "ProgramData"++-- | Upstream's @sysconfdir@ on Unix, which libstore's meson.build forces+-- absolute, so @\/etc\/nix@ is the compiled-in system directory.+posixSysconfDir :: FilePath+posixSysconfDir = "/etc"++-- | The XDG base directory spec's default for @XDG_CONFIG_DIRS@, the+-- literal upstream's @getConfigDirs@ falls back to.+posixXdgConfigDirs :: [FilePath]+posixXdgConfigDirs = ["/etc/xdg"]+ -- | Where a release archive keeps the bundled expressions, relative to the -- directory holding @bin@. bundledDataSubdir :: FilePath@@ -286,7 +362,7 @@ -- The data dir is appended last so user paths take priority. mergeSearchPaths :: [T.Text] -> FilePath -> [Thunk] -> [Thunk] mergeSearchPaths extraPaths dataDir envPaths =-  concatMap parseNixPath extraPaths ++ envPaths ++ parseNixPath (T.pack dataDir)+  concatMap (parseNixPath . TE.encodeUtf8) extraPaths ++ envPaths ++ parseNixPath (TE.encodeUtf8 (T.pack dataDir))  -- --------------------------------------------------------------------------- -- Main@@ -297,8 +373,9 @@   hSetBuffering stdout LineBuffering   -- UTF-8 on both output handles regardless of the console code page:   -- locale encodings THROW on any character they cannot represent, so a-  -- store path or eval result containing one would otherwise abort the-  -- whole invocation mid-print on legacy Windows consoles.+  -- store path or message containing one would otherwise abort the whole+  -- invocation mid-print on legacy Windows consoles.  An eval result does+  -- not pass through this: 'printResult' writes it as bytes.   hSetEncoding stdout utf8   hSetEncoding stderr utf8   -- Initialize C data layer (symbol interning, thunk arena, env allocator)@@ -306,18 +383,36 @@   args <- getArgs   dataDir <- resolveDataDir   opts <- either (failWith . T.pack) pure (parseArgs args)-  case optCommand opts of-    CmdEvalFile filePath -> evalFile (chosenStoreDir opts) (optStrict opts) (optNixPaths opts) dataDir filePath+  config <- loadNixConfig+  storeDir <- chosenStoreDir opts+  -- SIGINT reaches the main thread as UserInterrupt, which uncaught ends+  -- the process by the signal with nothing said.  Upstream's checkInterrupt+  -- throws Interrupted, a BaseError its handleExceptions logs and exits 1+  -- with (libmain/shared.cc at 2.24.9).+  handleJust userInterrupt (const reportInterrupt) $ case optCommand opts of+    CmdEvalFile filePath -> evalFile config opts storeDir dataDir filePath     CmdEvalExpr expr-      | optAterm opts -> evalExprAterm (chosenStoreDir opts) (optNixPaths opts) dataDir expr-      | otherwise -> evalExpr (chosenStoreDir opts) (optStrict opts) (optNixPaths opts) dataDir expr-    CmdBuild target attrPath -> buildCommand opts dataDir target attrPath-    CmdPush pushArgs -> pushCommand opts pushArgs-    CmdStoreDelete paths -> storeDeleteCommand opts paths+      | optAterm opts -> evalExprAterm config opts storeDir dataDir expr+      | otherwise -> evalExpr config opts storeDir dataDir expr+    CmdBuild target attrPath outLink -> buildCommand config opts storeDir dataDir target attrPath outLink+    CmdPush pushArgs -> pushCommand storeDir pushArgs+    CmdStoreDelete paths -> storeDeleteCommand storeDir paths+    CmdStoreGc printRoots -> storeGcCommand storeDir printRoots     CmdUsage -> mapM_ (hPutStrLn stderr) usageLines >> exitFailure     CmdHelp -> mapM_ putStrLn usageLines     CmdVersion -> putStrLn versionLine +-- | 'UserInterrupt' alone: every other asynchronous exception keeps+-- propagating.+userInterrupt :: AsyncException -> Maybe ()+userInterrupt UserInterrupt = Just ()+userInterrupt _ = Nothing++reportInterrupt :: IO a+reportInterrupt = do+  hPutStrLn stderr "error: interrupted by the user"+  exitWith (ExitFailure 1)+ -- | What @--version@ reports.  Cabal's version, which is the one the publish -- workflow's tag guard checks a tag against, so a downloaded binary names -- exactly the release it came from and a bug report can say which build.@@ -337,14 +432,17 @@     "  build FILE.nix         Build a derivation from a .nix file",     "  build --expr 'EXPR'    Build a derivation from an inline expression",     "  push --cache URL       Push store paths (and their closures) to a binary cache",-    "  store delete PATH...   Remove store paths, refused while other valid paths reference them",+    "  store delete PATH...   Remove store paths, refused while a root or another valid path keeps them",+    "  store gc               Remove every store path not reachable from a root",     "",     "Flags:",     "  --strict               Deep-force all thunks before printing (warning: OOM on large results)",     "  --aterm                With eval --expr, print the derivation's .drv ATerm",     "  -A, --attr ATTRPATH    With build: select a dotted attribute path (a.b.c)",+    "  -o, --out-link PATH    With build: create PATH as a symlink to the result and register it as a GC root",+    "  --print-roots          With store gc: list the roots as LINK -> PATH and delete nothing",     "  --nix-path NAME=PATH   Add search path (repeatable, merged with NIX_PATH)",-    "  --all                  With push: select every valid path in the store",+    "  --all                  With push: select every valid path except derivations",     "  --key-file PATH        With push: file holding the cache API key",     "  --compression KIND     With push: artifact packaging (" <> T.unpack pushCompressionValues <> "; default none)",     "  --exec-wrapper S=PATH  Run system S's derivations through PATH (repeatable),",@@ -352,10 +450,18 @@     "  --store DIR            Use DIR as the store (default: the platform store)",     "  --substituter URL      Try this binary cache before building",     "  --trusted-key K        Public key (name:base64) for the substituter",+    "  --restrict-eval        Confine reads to the search path roots and what the",+    "                         evaluation itself writes; fetch only allowed-uris",+    "  --pure-eval            Confine reads as --restrict-eval does, with no search",+    "                         path, no currentTime, currentSystem or storePath, and",+    "                         pinned fetches only (allowed-uris applies only under",+    "                         --restrict-eval)",     "",-    "  substituters and trusted-public-keys also read from",-    "  $XDG_CONFIG_HOME/nix/nix.conf and $NIX_CONFIG; the flags above",-    "  add to whatever those configure.",+    "  substituters, trusted-public-keys, max-call-depth, restrict-eval,",+    "  pure-eval and allowed-uris also read from nix.conf, in upstream's",+    "  order: $NIX_CONF_DIR (default " <> systemConfDirName <> "), the XDG",+    "  nix/nix.conf files or $NIX_USER_CONF_FILES, then $NIX_CONFIG; the",+    "  flags above add to whatever those configure.",     "",     "  --help                 Print this text and exit",     "  --version              Print the version and exit"@@ -384,74 +490,126 @@ exprSourceName :: T.Text exprSourceName = "<expr>" +-- | The evaluation policy for this run: the config cascade's settings,+-- with either flag turning its mode on.  A flag only turns a mode on, so+-- a machine configured for pure evaluation stays that way whatever the+-- command line says, which is the direction a confinement should fail in.+evalPolicyFor :: CliOpts -> NixConfig -> EvalPolicy+evalPolicyFor opts config =+  EvalPolicy+    { epRestrictEval = optRestrictEval opts || ncRestrictEval config,+      epPureEval = optPureEval opts || ncPureEval config,+      epAllowedUris = ncAllowedUris config+    }++-- | The evaluation state and root environment for one command.  Upstream's+-- constructor decides the same things in the same order (eval.cc at+-- 2.24.9): under pure-eval the lookup path is empty, so neither+-- @--nix-path@ nor @NIX_PATH@ contributes, and only the bundled @<nix/*>@+-- directory remains, which upstream serves from an in-memory corepkgs+-- filesystem and this binary serves from its data directory (so it stays+-- visible in @builtins.nixPath@, where upstream shows nothing); under+-- either mode every search path root is allowed, as @resolveLookupPathPath@+-- allows the lookup path, so @-I nixpkgs=...@ is what makes a nixpkgs+-- tree readable.+--+-- Each root is allowed under its given spelling and under its resolved+-- one.  The access walk follows symlinks, so a root reached through a+-- symlinked directory (macOS's @/tmp@ is @/private/tmp@) is checked under+-- the resolved spelling; upstream allows only the given one and refuses+-- the read, which is a mismatch between its own allow list and walk, not+-- a rule worth keeping.+setUpEval :: CliOpts -> NixConfig -> StoreDir -> FilePath -> FilePath -> IO (EvalState, Env)+setUpEval opts config storeDir dataDir baseDir = do+  let policy = evalPolicyFor opts config+  st0 <- newEvalState storeDir baseDir+  let searchPaths+        | epPureEval policy = parseNixPath (TE.encodeUtf8 (T.pack dataDir))+        | otherwise = mergeSearchPaths (optNixPaths opts) dataDir (esSearchPaths st0)+      st =+        st0+          { esSearchPaths = searchPaths,+            esPolicy = policy,+            esCallDepth = topLevelCallDepth (ncMaxCallDepth config)+          }+  -- A relative root resolves against the working directory, as upstream's+  -- absPath does.  A pseudo-URL entry (channel:, flake:, a listed scheme)+  -- names a download this evaluator never performs and allows nothing:+  -- upstream allows such an entry's working-directory spelling only by+  -- falling through after a failed download (resolveLookupPathPath), and+  -- a run that cannot fetch should not widen what it may read.  A root+  -- with no UTF-8 reading allows nothing: allowed paths are text, so no+  -- read can name it, and a lossy spelling would allow a different path.+  roots <- mapM rootSpellings (mapMaybe textRoot (filter (not . isNixPathPseudoUrl) (searchPathRoots searchPaths)))+  mapM_ (allowEvalPath st) (concat roots)+  pure (st, builtinEnv policy (esTimestamp st) searchPaths)+  where+    textRoot = either (const Nothing) Just . TE.decodeUtf8'+    rootSpellings root = do+      given <- makeAbsolute (T.unpack root)+      resolved <- canonicalizePath given+      pure (map (canonPathValue . T.pack) [given, resolved])++-- | Parse and bind source against the names the root environment+-- 'setUpEval' builds will bind, which depend on the policy.+parseForEval :: CliOpts -> NixConfig -> FilePath -> T.Text -> T.Text -> Either SourceError Expr+parseForEval opts config = parseNixWithScope (rootScopeNames (evalPolicyFor opts config))+ -- | Evaluate a .nix file and print the result.-evalFile :: StoreDir -> Bool -> [T.Text] -> FilePath -> FilePath -> IO ()-evalFile storeDir strict extraPaths dataDir rawFilePath = do+evalFile :: NixConfig -> CliOpts -> StoreDir -> FilePath -> FilePath -> IO ()+evalFile config opts storeDir dataDir rawFilePath = do   (filePath, source) <- readSourceFile rawFilePath-  case parseNix (takeDirectory filePath) (T.pack filePath) source of-    Left err -> do-      hPutStrLn stderr ("parse error: " ++ show err)-      exitFailure+  case parseForEval opts config (takeDirectory filePath) (T.pack filePath) source of+    Left err -> failSource err     Right expr -> do-      st0 <- newEvalState storeDir (takeDirectory filePath)-      let searchPaths = mergeSearchPaths extraPaths dataDir (esSearchPaths st0)-          st = st0 {esSearchPaths = searchPaths}-      result <--        runEvalIO st $-          eval (builtinEnv (esTimestamp st) searchPaths) expr >>= finalize strict+      (st, env) <- setUpEval opts config storeDir dataDir (takeDirectory filePath)+      result <- runEvalIOTraced st (eval env expr >>= finalize (optStrict opts))       case result of-        Left err -> do-          TIO.hPutStrLn stderr ("error: " <> err)+        Left failure -> do+          TIO.hPutStrLn stderr (renderEvalFailure failure)           exitFailure-        Right forced -> TIO.putStrLn (prettyValue forced)+        Right forced -> printResult forced  -- | Evaluate an inline expression and print the result.-evalExpr :: StoreDir -> Bool -> [T.Text] -> FilePath -> T.Text -> IO ()-evalExpr storeDir strict extraPaths dataDir source = do+evalExpr :: NixConfig -> CliOpts -> StoreDir -> FilePath -> T.Text -> IO ()+evalExpr config opts storeDir dataDir source = do   cwd <- getCurrentDirectory-  case parseNix cwd exprSourceName source of-    Left err -> do-      hPutStrLn stderr ("parse error: " ++ show err)-      exitFailure+  case parseForEval opts config cwd exprSourceName source of+    Left err -> failSource err     Right expr -> do-      st0 <- newEvalState storeDir cwd-      let searchPaths = mergeSearchPaths extraPaths dataDir (esSearchPaths st0)-          st = st0 {esSearchPaths = searchPaths}-      result <--        runEvalIO st $-          eval (builtinEnv (esTimestamp st) searchPaths) expr >>= finalize strict+      (st, env) <- setUpEval opts config storeDir dataDir cwd+      result <- runEvalIOTraced st (eval env expr >>= finalize (optStrict opts))       case result of-        Left err -> do-          TIO.hPutStrLn stderr ("error: " <> err)+        Left failure -> do+          TIO.hPutStrLn stderr (renderEvalFailure failure)           exitFailure-        Right forced -> TIO.putStrLn (prettyValue forced)+        Right forced -> printResult forced  -- | Evaluate an inline expression to a derivation and print its ATerm (.drv -- contents), for diffing nova-nix's serialization against upstream Nix.-evalExprAterm :: StoreDir -> [T.Text] -> FilePath -> T.Text -> IO ()-evalExprAterm storeDir extraPaths dataDir source = do+evalExprAterm :: NixConfig -> CliOpts -> StoreDir -> FilePath -> T.Text -> IO ()+evalExprAterm config opts storeDir dataDir source = do   cwd <- getCurrentDirectory-  case parseNix cwd exprSourceName source of-    Left err -> do-      hPutStrLn stderr ("parse error: " ++ show err)-      exitFailure+  case parseForEval opts config cwd exprSourceName source of+    Left err -> failSource err     Right expr -> do-      st0 <- newEvalState storeDir cwd-      let searchPaths = mergeSearchPaths extraPaths dataDir (esSearchPaths st0)-          st = st0 {esSearchPaths = searchPaths}-      result <- runEvalIO st $ do-        val <- eval (builtinEnv (esTimestamp st) searchPaths) expr+      (st, env) <- setUpEval opts config storeDir dataDir cwd+      result <- runEvalIOTraced st $ do+        val <- eval env expr         forceDerivationAttrs val         pure val       case result of-        Left err -> do-          TIO.hPutStrLn stderr ("error: " <> err)+        Left failure -> do+          TIO.hPutStrLn stderr (renderEvalFailure failure)           exitFailure         Right val -> do-          (drv, _) <- extractDerivation val-          -- Raw ATerm bytes (BC.putStrLn bypasses the handle encoding),-          -- so the printed .drv diffs byte-exactly against upstream's.-          BC.putStrLn (toATerm drv)+          drvSP <- derivationPath val+          drvClosure <- readIORef (esDrvClosure st)+          aterm <- recordedAterm drvClosure drvSP+          -- The recorded bytes, not a re-serialization: these are what the+          -- path hashes.  BC.putStrLn bypasses the handle encoding, so the+          -- printed .drv diffs byte-exactly against upstream's.+          BC.putStrLn aterm  -- | Parse, evaluate, extract derivation, build, and print result. -- The file argument is canonicalized for the same reason as in 'evalFile'.@@ -465,9 +623,11 @@   cwd <- getCurrentDirectory   pure (cwd, exprSourceName, source) --- | Force the attributes 'extractDerivation' goes on to read.  @derivation@+-- | Force the attributes 'derivationPath' goes on to read.  @derivation@ -- is a lazy wrapper, and 'readThunkValue' answers 'Nothing' for a thunk that -- was never forced, so skipping this reports a real derivation as not one.+-- Forcing @drvPath@ is also what computes the derivation and records its+-- @.drv@ in the session closure ('recordedAterm'). forceDerivationAttrs :: (MonadEval m) => NixValue -> m () forceDerivationAttrs val = case val of   VAttrs attrs ->@@ -476,50 +636,51 @@       derivationAttrKeys   _ -> pure () --- | What a build needs forced: the marker, the wrapper, and the path whose--- closure the build driver writes.+-- | What a build needs forced: the marker, the path whose closure the+-- build driver writes, and the output it realizes. derivationAttrKeys :: [T.Text]-derivationAttrKeys = ["type", "_derivation", "drvPath"]+derivationAttrKeys = ["type", "drvPath", "outputName"] -buildCommand :: CliOpts -> FilePath -> BuildTarget -> Maybe T.Text -> IO ()-buildCommand opts dataDir target attrPath = do-  let storeDir = chosenStoreDir opts-  configSources <- loadConfigSources-  caches <- either failWith pure (resolveCaches configSources (optSubstituter opts) (optTrustedKey opts))+buildCommand :: NixConfig -> CliOpts -> StoreDir -> FilePath -> BuildTarget -> Maybe T.Text -> Maybe FilePath -> IO ()+buildCommand config opts storeDir dataDir target attrPath outLink = do+  let caches = resolveCaches config (optSubstituter opts) (optTrustedKey opts)   wrappers <- either failWith pure (execWrapperConfig (optExecWrappers opts)) >>= checkExecWrappers   (baseDir, sourceName, source) <- loadBuildSource target-  case parseNix baseDir sourceName source of-    Left err -> do-      hPutStrLn stderr ("parse error: " ++ show err)-      exitFailure+  case parseForEval opts config baseDir sourceName source of+    Left err -> failSource err     Right expr -> do-      st0 <- newEvalState storeDir baseDir-      let searchPaths = mergeSearchPaths (optNixPaths opts) dataDir (esSearchPaths st0)-          st = st0 {esSearchPaths = searchPaths}-      result <- runEvalIO st $ do-        root <- eval (builtinEnv (esTimestamp st) searchPaths) expr+      (st, env) <- setUpEval opts config storeDir dataDir baseDir+      result <- runEvalIOTraced st $ do+        root <- eval env expr         selected <- case attrPath of           Nothing -> pure (Right root)           Just path -> selectAttrPath path root         -- Forced after selection, not before: forcing the root leaves the-        -- selected value's own attributes unforced, and extractDerivation+        -- selected value's own attributes unforced, and derivationPath         -- then reports a real derivation as not being one.         either (pure . Left) (\val -> Right val <$ forceDerivationAttrs val) selected       case result of-        Left err -> do-          TIO.hPutStrLn stderr ("eval error: " <> err)+        Left failure -> do+          TIO.hPutStrLn stderr (renderEvalFailure failure)           exitFailure         Right (Left selectionErr) -> do           TIO.hPutStrLn stderr ("error: " <> selectionErr)           exitFailure         Right (Right val) -> do-          (drv, drvSP) <- extractDerivation val+          drvSP <- derivationPath val+          outputName <- defaultOutputName drvSP val           -- The full .drv closure (root + every transitive input) recorded-          -- during evaluation; written to the store before building.+          -- during evaluation; written to the store before building.  The+          -- root's own recipe is read from the same map, so what is built+          -- is what its path hashes.           drvClosure <- readIORef (esDrvClosure st)+          drv <- recordedDerivation drvClosure drvSP+          -- Resolved before the build, as nix-build resolves the output it+          -- realizes before building anything.+          outputPath <- namedOutputPath drv outputName           sourceCache <- readIORef (esSourcePathCache st)           storeWrites <- readIORef (esStoreWriteCache st)-          store <- openStore (chosenStoreDir opts)+          store <- openStore storeDir           -- Materialize eval-coerced source paths (src = ./file, path           -- interpolation): evaluation computes their store paths as text           -- only - the parity runner's store is not writable - so the build@@ -529,55 +690,84 @@           -- register them; a derivation naming one needs them valid first.           materializeEvalStoreWrites store storeWrites           buildResult <- buildAndRegister store caches wrappers drvClosure drv drvSP+          -- The root is registered before the handle closes: the handle's+          -- lease is what keeps a concurrent collection from running+          -- between the build's end and the link's creation.  The path+          -- prints after the link exists, as nix-build prints it, so a+          -- failed link prints nothing a script would take for success.+          rooted <- case buildResult of+            BuildSuccess _ -> traverse (\link -> addOutLinkRoot store link outputPath) outLink+            BuildFailure _ _ -> pure Nothing           closeStore store-          case buildResult of-            BuildSuccess sp ->-              TIO.putStrLn (T.pack (storePathToFilePath (chosenStoreDir opts) sp))-            BuildFailure msg code -> do+          case (buildResult, rooted) of+            (BuildFailure msg code, _) -> do               TIO.hPutStrLn stderr ("build failed (exit " <> T.pack (show code) <> "): " <> msg)               exitFailure+            (BuildSuccess _, Just (Left err)) -> failWith ("build: " <> err)+            (BuildSuccess _, _) ->+              TIO.putStrLn (T.pack (storePathToFilePath (stDir store) outputPath)) --- | Extract a Derivation and its store path from an evaluated value.--- The value must be a VAttrs with type = "derivation", a _derivation key--- holding the Derivation struct, and a drvPath key holding the .drv store path.--- Both are computed by builtinDerivation during evaluation.-extractDerivation :: NixValue -> IO (Derivation, StorePath)-extractDerivation (VAttrs attrs) = do-  -- Check type = "derivation"+-- | The @.drv@ store path of an evaluated derivation value: a set with+-- @type = "derivation"@ whose @drvPath@ has been forced+-- ('forceDerivationAttrs').  Store paths are ASCII, so the byte payload+-- decodes strictly.+derivationPath :: NixValue -> IO StorePath+derivationPath (VAttrs attrs) = do   case attrSetLookup "type" attrs of     Just thunk | Just (VStr "derivation" _) <- readThunkValue thunk -> pure ()-    _ -> do-      hPutStrLn stderr "error: result is not a derivation (no type = \"derivation\")"-      exitFailure-  drv <- case attrSetLookup "_derivation" attrs of-    Just thunk | Just (VDerivation d) <- readThunkValue thunk -> pure d-    _ -> do-      hPutStrLn stderr "error: derivation result missing _derivation field"-      exitFailure-  -- Extract drvPath - this is the store path of the .drv file itself,-  -- computed by hashing the ATerm serialization during evaluation.-  -- Store paths are ASCII, so the byte payload decodes strictly.-  drvSP <- case attrSetLookup "drvPath" attrs of+    _ -> failWith "error: result is not a derivation (no type = \"derivation\")"+  case attrSetLookup "drvPath" attrs of     Just thunk       | Just (VStr pathBytes _) <- readThunkValue thunk,         Right path <- TE.decodeUtf8' pathBytes ->-          case parseStorePath defaultStoreDir path of-            Just sp -> pure sp-            Nothing -> do-              TIO.hPutStrLn stderr ("error: invalid drvPath: " <> path)-              exitFailure-    _ -> do-      hPutStrLn stderr "error: derivation result missing drvPath"-      exitFailure-  pure (drv, drvSP)-extractDerivation _ = do-  hPutStrLn stderr "error: result is not a derivation"-  exitFailure+          maybe (failWith ("error: invalid drvPath: " <> path)) pure (parseStorePath defaultStoreDir path)+    _ -> failWith "error: derivation result missing drvPath"+derivationPath _ = failWith "error: result is not a derivation" --- | The store directory selected by @--store@, or the platform default.-chosenStoreDir :: CliOpts -> StoreDir-chosenStoreDir opts = maybe platformStoreDir StoreDir (optStore opts)+-- | The output a build realizes and prints: the value's @outputName@, the+-- first of its @outputs@, which is what upstream's nix-build builds and+-- prints for a derivation (nix-build.cc, @queryOutputName@), with its+-- message for a set that lacks the attribute.+defaultOutputName :: StorePath -> NixValue -> IO T.Text+defaultOutputName drvSP val = case val of+  VAttrs attrs+    | Just thunk <- attrSetLookup "outputName" attrs,+      Just (VStr nameBytes _) <- readThunkValue thunk,+      Right name <- TE.decodeUtf8' nameBytes ->+        pure name+  _ -> failWith ("error: derivation '" <> storePathToText defaultStoreDir drvSP <> "' lacks an 'outputName' attribute") +-- | The path of a named output.  A @.drv@ lists its outputs by name, so+-- the default output is found here by name, never by position.+namedOutputPath :: Derivation -> T.Text -> IO StorePath+namedOutputPath drv outputName =+  case find ((== outputName) . doName) (drvOutputs drv) of+    Just out -> pure (doPath out)+    Nothing -> failWith ("error: derivation has no output named '" <> outputName <> "'")++-- | The @.drv@ ATerm evaluation recorded under a derivation path: the exact+-- bytes whose hash is the path.  Every derivation computed in a session is+-- recorded when its @drvPath@ is forced ('esDrvClosure'), so an absent entry+-- means the path was never computed by this evaluation.+recordedAterm :: Map.Map T.Text BS.ByteString -> StorePath -> IO BS.ByteString+recordedAterm drvClosure drvSP =+  case Map.lookup (storePathToText defaultStoreDir drvSP) drvClosure of+    Just aterm -> pure aterm+    Nothing -> failWith ("error: no .drv was recorded for " <> storePathToText defaultStoreDir drvSP)++-- | The 'Derivation' a recorded ATerm describes ('recordedAterm').+recordedDerivation :: Map.Map T.Text BS.ByteString -> StorePath -> IO Derivation+recordedDerivation drvClosure drvSP = do+  aterm <- recordedAterm drvClosure drvSP+  either (failWith . (("error: the recorded .drv for " <> storePathToText defaultStoreDir drvSP <> " does not parse: ") <>)) pure (fromATerm aterm)++-- | The store directory selected by @--store@, or the platform default,+-- under the canonical spelling 'openStore' keys the store by, so what+-- evaluation and every command print is the spelling the database+-- holds.+chosenStoreDir :: CliOpts -> IO StoreDir+chosenStoreDir opts = canonicalStoreDir (maybe platformStoreDir StoreDir (optStore opts))+ -- | Default priority for a config- or CLI-configured substituter -- (cache.nixos.org is 40). substituterPriority :: Int@@ -599,44 +789,147 @@   | url <- ncSubstituters config   ] --- | Resolve the caches from the config sources plus the CLI flags.  The--- sources are ordered weakest first (user file, then @NIX_CONFIG@); the--- CLI @--substituter@ and @--trusted-key@ append on top, the highest+-- | The caches from the resolved config plus the CLI flags.  The CLI+-- @--substituter@ and @--trusted-key@ append on top, the highest -- precedence, so a flag adds to the configured set rather than being -- overridden by it.-resolveCaches :: [T.Text] -> Maybe String -> Maybe String -> Either T.Text [CacheConfig]-resolveCaches sources mUrl mKey = do-  base <- Config.resolveConfig sources-  let withCli =-        base-          { ncSubstituters = ncSubstituters base ++ maybe [] (\url -> [T.pack url]) mUrl,-            ncTrustedPublicKeys = ncTrustedPublicKeys base ++ maybe [] (\key -> [T.pack key]) mKey-          }-  pure (configToCaches withCli)+resolveCaches :: NixConfig -> Maybe String -> Maybe String -> [CacheConfig]+resolveCaches base mUrl mKey =+  configToCaches+    base+      { ncSubstituters = ncSubstituters base ++ maybe [] (\url -> [T.pack url]) mUrl,+        ncTrustedPublicKeys = ncTrustedPublicKeys base ++ maybe [] (\key -> [T.pack key]) mKey+      } --- | The nix.conf sources, weakest first: the user file, then @NIX_CONFIG@.--- Reading is best effort - a missing or unreadable file is simply absent ---- but a file that IS read and does not parse is a hard error downstream,--- so a malformed security-relevant setting cannot pass for no setting.-loadConfigSources :: IO [T.Text]-loadConfigSources = do-  userFile <- readUserConfigFile-  nixConfigEnv <- lookupEnv nixConfigVar-  pure (catMaybes [userFile, T.pack <$> nixConfigEnv])+-- | Resolve nix.conf from the system file, the user-file cascade and+-- @NIX_CONFIG@, the file locations coming from the environment and the+-- platform's XDG defaults.  A file that cannot be read is absent, but one+-- that is read and does not parse is a hard error, so a malformed+-- security-relevant setting cannot pass for no setting.+loadNixConfig :: IO NixConfig+loadNixConfig = do+  locations <- configLocations+  nixConfigBytes <- configVariable nixConfigVar+  paths <- either configError pure (Config.configFilePaths locations)+  Config.loadConfig readConfigFile paths nixConfigBytes+    >>= either configError pure+  where+    configError = failWith . ("error: " <>) --- | Read @$XDG_CONFIG_HOME\/nix\/nix.conf@ (the user config file), or--- 'Nothing' when it is absent or unreadable.-readUserConfigFile :: IO (Maybe T.Text)-readUserConfigFile = do-  dir <- getXdgDirectory XdgConfig "nix"-  let path = dir </> "nix.conf"-  present <- doesFileExist path-  if not present-    then pure Nothing-    else do-      result <- try (BS.readFile path) :: IO (Either IOException BS.ByteString)-      pure (either (const Nothing) (Just . TE.decodeUtf8Lenient) result)+-- | A variable the configuration reads, as its bytes, the way upstream's+-- @getEnv@ reads it.  A Windows value holding an unpaired UTF-16+-- surrogate has no bytes nova-nix can carry, so it is refused, as+-- @NIX_PATH@ holding one is.+configVariable :: BS.ByteString -> IO (Maybe BS.ByteString)+configVariable name = do+  found <- lookupEnvBytes name+  case found of+    EnvUnset -> pure Nothing+    EnvValue value -> pure (Just value)+    EnvUnpairedSurrogate ->+      failWith ("error: " <> TE.decodeLatin1 name <> " holds an unpaired UTF-16 surrogate, which has no UTF-8 form") +-- | A variable naming a directory or a list of them, as a host path.+configVariablePath :: BS.ByteString -> IO (Maybe OsPath)+configVariablePath name = configVariable name >>= traverse (variableHostPath name)++-- | A variable's bytes as a host path.  Every value 'configVariable'+-- answers has one, since a Windows value arrives as UTF-8, so the+-- refusal is for completeness.+variableHostPath :: BS.ByteString -> BS.ByteString -> IO OsPath+variableHostPath name value =+  maybe (failWith ("error: " <> TE.decodeLatin1 name <> " is not valid UTF-8, so it names no Windows path")) pure (hostPathFromBytes value)++-- | Where the config files are on this machine.  @NIX_CONF_DIR@ and+-- @XDG_CONFIG_DIRS@ are honoured on every platform; the defaults behind+-- them are the platform's.  Upstream compiles @\/etc\/nix@ in as the+-- system directory and falls back to @\/etc\/xdg@ for the dirs on every+-- platform, Windows included, where neither names anything (a path with+-- no drive resolves against the current drive).  The Windows analogues+-- are chosen here the way the user file's was (@%APPDATA%@ for the XDG+-- config home, the @directory@ package's own mapping): the system file is+-- @%ProgramData%\\nix\\nix.conf@, the all-users application data directory+-- being where Windows keeps machine-wide application configuration (it is+-- also where @directory@ maps the system-wide XDG dirs), and there is no+-- system file when @%ProgramData%@ is unset; the dirs default to none,+-- because the one Windows directory that answers to them is already the+-- system file, and a file read twice applies its @extra-@ settings twice.+-- The config home comes from @directory@ (@~\/.config@ on Unix,+-- @%APPDATA%@ on Windows, @XDG_CONFIG_HOME@ only when it is absolute); the+-- dirs list is filtered the same way, since 'splitSearchPath' turns an+-- empty POSIX entry into @.@, where upstream's tokenizer drops it, and the+-- XDG spec says a relative entry is ignored.+configLocations :: IO Config.ConfigLocations+configLocations = do+  confDir <- configVariable nixConfDirVar+  systemConfDir <- platformSystemConfDir+  userFiles <- configVariable nixUserConfFilesVar+  home <- OsDir.getXdgDirectory OsDir.XdgConfig mempty+  configDirs <- configVariablePath xdgConfigDirsVar+  defaultConfigDirs <- traverse OP.encodeFS platformConfigDirs+  pure+    Config.ConfigLocations+      { Config.clConfDir = confDir,+        Config.clSystemConfDir = systemConfDir,+        Config.clUserConfFiles = userFiles,+        Config.clConfigHome = home,+        Config.clConfigDirs = maybe defaultConfigDirs (filter OP.isAbsolute . OP.splitSearchPath) configDirs+      }++-- | Where the platform's machine-wide config directory comes from, with+-- @nix@ beneath it either way: a fixed path (upstream's @sysconfdir@ on+-- Unix) or an environment variable naming it (@%ProgramData%@ on+-- Windows).  One value serves both the lookup and the help text, so the+-- two cannot disagree.+data SystemConfDirSource = FixedConfDir !FilePath | EnvConfDir !BS.ByteString++platformSystemConfDirSource :: SystemConfDirSource+platformSystemConfDirSource = case SI.os of+  "mingw32" -> EnvConfDir programDataVar+  _ -> FixedConfDir posixSysconfDir++-- | The machine-wide config directory the system file is read from unless+-- @NIX_CONF_DIR@ moves it: upstream's @sysconfdir\/nix@ on Unix;+-- @%ProgramData%\\nix@ on Windows, or none when that variable is unset or+-- empty.+platformSystemConfDir :: IO (Maybe OsPath)+platformSystemConfDir = case platformSystemConfDirSource of+  FixedConfDir dir -> Just . (OP.</> Config.nixConfDirName) <$> OP.encodeFS dir+  EnvConfDir var -> do+    value <- mfilter (not . BS.null) <$> configVariable var+    traverse (fmap (OP.</> Config.nixConfDirName) . variableHostPath var) value++-- | 'platformSystemConfDir' as the help text names it: the path on Unix,+-- the variable on Windows.+systemConfDirName :: String+systemConfDirName = case platformSystemConfDirSource of+  FixedConfDir dir -> dir </> nixDirName+  EnvConfDir var -> "%" <> BC.unpack var <> "%" </> nixDirName+  where+    nixDirName = T.unpack (hostPathText Config.nixConfDirName)++-- | What @XDG_CONFIG_DIRS@ names when it is unset: the spec's default on+-- Unix, nothing on Windows (see 'configLocations').+platformConfigDirs :: [FilePath]+platformConfigDirs = case SI.os of+  "mingw32" -> []+  _ -> posixXdgConfigDirs++-- | A config file's bytes, or why it could not be read: nothing at the+-- path, or something that will not open (a directory, a permission+-- refusal).  The open takes the 'OsPath' itself, so a POSIX name reaches+-- it as the bytes it was spelled from rather than through the locale's+-- codec.  Only 'IOException' is caught: an interrupt must abort the run,+-- not read as an absent file.+readConfigFile :: OsPath -> IO (Either Config.ConfigReadFailure BS.ByteString)+readConfigFile path = do+  result <- try (OsFile.readFile' path) :: IO (Either IOException BS.ByteString)+  pure (either (Left . classify) Right result)+  where+    classify err+      | isDoesNotExistError err = Config.ConfigFileMissing+      | otherwise = Config.ConfigFileUnreadable+ -- | Resolve every launcher before any building starts, so a typo'd path is -- a configuration error now rather than a build failure after the whole -- closure has been realized.  A bare name resolves through @PATH@, the way@@ -685,8 +978,8 @@ -- ---------------------------------------------------------------------------  -- | Push the closure of the selected store paths to a binary cache.-pushCommand :: CliOpts -> PushArgs -> IO ()-pushCommand opts pushArgs = do+pushCommand :: StoreDir -> PushArgs -> IO ()+pushCommand storeDir pushArgs = do   cacheUrl <- case paCacheUrl pushArgs of     Just url -> pure (T.dropWhileEnd (== '/') (T.pack url))     Nothing -> failWith "push: --cache URL is required"@@ -702,7 +995,7 @@   compression <- case paCompressionArg pushArgs of     Nothing -> pure PushNone     Just value -> either (failWith . ("push: " <>)) pure (parsePushCompression (T.pack value))-  store <- openStore (chosenStoreDir opts)+  store <- openStore storeDir   rootsResult <- resolvePushRoots store pushArgs   case rootsResult of     Left err -> do@@ -722,42 +1015,69 @@                 <> " already cached"             ) --- | Delete store paths: registration rows and on-disk trees.  Paths are--- processed in argument order and the first failure stops the run, so a+-- | Delete store paths: registration rows and on-disk trees.  Every+-- argument is resolved before anything is touched; the paths are then+-- deleted in argument order under one collector lock and one live set,+-- with upstream's roots line printed once per invocation as its+-- @--delete@ prints it, and the first failure stops the run, so a -- reference chain deletes leaf-first in one invocation.-storeDeleteCommand :: CliOpts -> [String] -> IO ()-storeDeleteCommand opts rawPaths = do-  store <- openStore (chosenStoreDir opts)-  result <- deleteEach store rawPaths+storeDeleteCommand :: StoreDir -> [String] -> IO ()+storeDeleteCommand storeDir rawPaths = do+  targets <- either (failWith . prefixed) pure (traverse (resolveDeleteTarget storeDir . T.pack) rawPaths)+  store <- openStore storeDir+  result <- withLiveSet store (\live -> deleteEach store live targets)   closeStore store-  either failWith pure result+  either (failWith . prefixed) pure (join result)   where-    deleteEach _ [] = pure (Right ())-    deleteEach store (raw : rest) =-      case resolveDeleteTarget (stDir store) (T.pack raw) of-        Left err -> pure (Left ("store delete: " <> err))-        Right basename -> do-          outcome <- deleteStorePathRaw store basename-          case outcome of-            Left err -> pure (Left ("store delete: " <> err))-            Right removed -> do-              TIO.putStrLn ("deleted " <> basename <> describeOutcome removed)-              deleteEach store rest+    prefixed err = "store delete: " <> err+    deleteEach :: Store -> LiveSet -> [T.Text] -> IO (Either T.Text ())+    deleteEach _ _ [] = pure (Right ())+    deleteEach store live (basename : rest) = do+      outcome <- deleteStorePathChecked store live basename+      case outcome of+        Left err -> pure (Left err)+        Right removed -> do+          TIO.putStrLn ("deleted " <> basename <> describeOutcome removed)+          deleteEach store live rest     describeOutcome removed       | doRowRemoved removed && doTreeRemoved removed = ""       | doRowRemoved removed = " (no tree on disk)"       | otherwise = " (unregistered tree)" --- | Resolve push roots: every valid path with @--all@, otherwise each named--- path.  Named paths may be full store paths in either store-dir form, or a--- bare @hash-name@ basename.+-- | Collect garbage, or list the roots.  The summary line is upstream's+-- (@PrintFreed@), on stdout; the progress lines come from the library on+-- stderr.  @--print-roots@ lists @LINK -> PATH@ sorted, each once, as+-- @nix-store --gc --print-roots@ does, and deletes nothing; it runs+-- under the handle's own lease, as upstream's listing takes no+-- collector lock, so it does not wait behind a running build.+storeGcCommand :: StoreDir -> Bool -> IO ()+storeGcCommand storeDir printRoots = do+  store <- openStore storeDir+  if printRoots+    then do+      roots <- findRoots store+      closeStore store+      mapM_ (\root -> TIO.putStrLn (T.pack (grLink root) <> " -> " <> grPath root)) roots+    else do+      results <- collectGarbage store+      closeStore store+      either (failWith . ("store gc: " <>)) (TIO.putStrLn . gcSummaryLine) results++-- | Resolve push roots: every valid non-derivation path with @--all@, otherwise+-- each named path.  Named paths may be full store paths in either store-dir+-- form, or a bare @hash-name@ basename.  A named derivation is refused+-- here, with the rule, rather than by the cache's 400 after its NAR has+-- already been uploaded. resolvePushRoots :: Store -> PushArgs -> IO (Either T.Text [StorePath]) resolvePushRoots store pushArgs   | paAll pushArgs = do       pathTexts <- queryAllValidPaths (stDB store)-      pure (traverse parseDbPath pathTexts)-  | otherwise = pure (traverse parseArgPath (paPaths pushArgs))+      pure (outputPathsOnly <$> traverse parseDbPath pathTexts)+  | otherwise = pure (traverse parseArgPath (paPaths pushArgs) >>= refuseDerivations)   where+    refuseDerivations roots = case filter isDerivationPath roots of+      [] -> Right roots+      drv : _ -> Left ("push: " <> storePathBasename drv <> " is a derivation; a binary cache serves build outputs, not recipes")     -- DB rows are rendered with the OPENED store's dir - parsing against     -- platformStoreDir made 'push --all --store DIR' fail on every row of     -- a non-default store.@@ -783,6 +1103,13 @@   TIO.hPutStrLn stderr msg   exitFailure +-- | Fail on source that does not parse or bind.  An unbound variable is an+-- evaluation error upstream, raised before evaluation starts, and reads as+-- one here.+failSource :: SourceError -> IO a+failSource (SyntaxError err) = failWith ("parse error: " <> T.pack (show err))+failSource (UndefinedVariable name) = failWith ("error: " <> undefinedVariableMessage name)+ -- --------------------------------------------------------------------------- -- Output formatting -- ---------------------------------------------------------------------------@@ -812,49 +1139,11 @@   pure (VAttrs (attrSetFromMap (Map.map evaluated forced))) deepForceValue val = pure val --- | Nix-style pretty-printing of a fully forced value.-prettyValue :: NixValue -> T.Text-prettyValue (VInt n) = T.pack (show n)-prettyValue (VFloat f) = T.pack (show f)-prettyValue (VBool True) = "true"-prettyValue (VBool False) = "false"-prettyValue VNull = "null"-prettyValue (VStr s _) = "\"" <> escapeNixString (bytesToTextLossy s) <> "\""-prettyValue (VPath p) = p-prettyValue (VList cl) =-  wrapNixSeq "[" "]" (map (prettyThunk . Thunk) (clistThunks cl))-prettyValue (VAttrs attrs) =-  let entries = attrSetToAscList attrs-      rendered = map (\(k, t) -> k <> " = " <> prettyThunk t <> ";") entries-   in wrapNixSeq "{" "}" rendered-prettyValue (VLambda {}) = "<lambda>"-prettyValue (VBuiltin name _) = "<builtin " <> name <> ">"-prettyValue (VCompiledRegex _) = "<compiled-regex>"-prettyValue (VDerivation drv) =-  case drvOutputs drv of-    (out : _) -> "<derivation " <> T.pack (storePathToFilePath platformStoreDir (doPath out)) <> ">"-    [] -> "<derivation>"---- | Render a bracketed sequence the way upstream prints one: the brackets are--- separated from the contents by a space, and an empty sequence is @[ ]@ or--- @{ }@ rather than the two spaces that a bare join of no elements leaves--- between them.-wrapNixSeq :: T.Text -> T.Text -> [T.Text] -> T.Text-wrapNixSeq open close [] = open <> " " <> close-wrapNixSeq open close parts = open <> " " <> T.intercalate " " parts <> " " <> close---- | Pretty-print a thunk.  After deep-forcing, all thunks should be--- computed thunks render their value; pending thunks render as a placeholder.-prettyThunk :: Thunk -> T.Text-prettyThunk thunk = maybe "<thunk>" prettyValue (readThunkValue thunk)---- | Escape a string for Nix-style output (quotes, backslashes, newlines, tabs, carriage returns).-escapeNixString :: T.Text -> T.Text-escapeNixString = T.concatMap escapeChar-  where-    escapeChar '\\' = "\\\\"-    escapeChar '"' = "\\\""-    escapeChar '\n' = "\\n"-    escapeChar '\t' = "\\t"-    escapeChar '\r' = "\\r"-    escapeChar c = T.singleton c+-- | Write an eval result and its newline to stdout as bytes.  A string's+-- payload need not be UTF-8, so nothing on this path decodes or re-encodes+-- it: the handle is put in binary mode, as hPutBuilder asks, and no+-- encoding or newline translation applies.+printResult :: NixValue -> IO ()+printResult val = do+  hSetBinaryMode stdout True+  BB.hPutBuilder stdout (printAmbiguous val <> BB.char7 '\n')

@@ -14,7 +14,17 @@  */  #include "nn_arena.h"+#include "nn_bytecode.h"+#include "nn_env.h"+#include "nn_symbol.h" #include "nn_thunk.h"++int+nn_arena_live(void)+{+    return nn_symbol_live() && nn_thunk_live() && nn_env_live()+        && nn_bytecode_live();+}  uint32_t nn_arena_stableptr_count(void)

@@ -10,7 +10,14 @@  * PATH, LIST, ATTRS, CTXSTR) are skipped.  *  * Used by Haskell-side Arena.hs to free all StablePtrs before- * destroying the sub-arenas (thunk, env, symbol).+ * destroying the sub-arenas (thunk, env, symbol, bytecode).+ *+ * nn_arena_live answers whether every sub-arena is inside its init ..+ * destroy window.  Outside it, each sub-arena's allocators report+ * failure through their ordinary sentinel (NULL, UINT32_MAX,+ * NN_SYMBOL_INVALID) instead of touching freed or never-allocated+ * state; the Haskell boundary asks this on that failure path to tell a+ * missing arenaInit from exhaustion.  */  #ifndef NN_ARENA_H@@ -20,6 +27,10 @@  /* Bulk-free all tracked attribute sets (called during arena teardown). */ void nn_attrset_free_all(void);++/* Nonzero when the symbol table, thunk arena, env allocator and bytecode+ * store are all initialized. */+int nn_arena_live(void);  /* Count how many thunk payloads are StablePtrs (need freeing).  * Iterates all thunks, checks state + val_tag. */

@@ -17,7 +17,6 @@ #include "nn_attrset.h" #include "nn_assert.h" -#include <stdio.h> #include <stdlib.h> #include <string.h> @@ -27,20 +26,20 @@ static uint32_t g_tracked_count = 0; static uint32_t g_tracked_cap   = 0; -static void nn_attrset_track(nn_attrset_t *set)+/* Returns 0, or -1 when the tracking array cannot grow. */+static int nn_attrset_track(nn_attrset_t *set) {     if (g_tracked_count >= g_tracked_cap) {+        if (g_tracked_cap > UINT32_MAX / 2) return -1;         uint32_t new_cap = g_tracked_cap ? g_tracked_cap * 2 : 256;         nn_attrset_t **new_arr = (nn_attrset_t **)realloc(             g_tracked, (size_t)new_cap * sizeof(nn_attrset_t *));-        if (!new_arr) {-            fprintf(stderr, "nn_attrset_track: realloc failed\n");-            abort();-        }+        if (!new_arr) return -1;         g_tracked = new_arr;         g_tracked_cap = new_cap;     }     g_tracked[g_tracked_count++] = set;+    return 0; }  void nn_attrset_free_all(void)@@ -79,9 +78,17 @@  /* --- Helpers --- */ -/* Grow arrays to at least new_cap.  Returns 0 on success, -1 on failure. */-static int grow(nn_attrset_t *set, uint32_t new_cap)+/* Double the capacity, stopping at NN_ATTRSET_MAX_ENTRIES; the doubling+ * is computed in uint64_t so it cannot wrap.  Returns 0, or -1 with the+ * capacity unchanged when the set is at the ceiling or an allocation+ * fails (an array that did grow is kept, only larger). */+static int grow(nn_attrset_t *set) {+    if (set->capacity >= NN_ATTRSET_MAX_ENTRIES) return -1;+    uint64_t doubled = (uint64_t)set->capacity * 2;+    uint32_t new_cap = doubled > NN_ATTRSET_MAX_ENTRIES+                           ? NN_ATTRSET_MAX_ENTRIES : (uint32_t)doubled;+     nn_symbol_t *new_keys = (nn_symbol_t *)realloc(         set->keys, (size_t)new_cap * sizeof(nn_symbol_t));     if (!new_keys) return -1;@@ -97,8 +104,8 @@ }  /* Binary search for a symbol in the sorted keys array.- * Returns the index if found, or -1. */-static int32_t bsearch_key(const nn_symbol_t *keys, uint32_t count, nn_symbol_t key)+ * Returns the index if found, or NN_ATTRSET_NOT_FOUND. */+static uint32_t bsearch_key(const nn_symbol_t *keys, uint32_t count, nn_symbol_t key) {     uint32_t lo = 0;     uint32_t hi = count;@@ -109,10 +116,10 @@         } else if (keys[mid] > key) {             hi = mid;         } else {-            return (int32_t)mid;+            return mid;         }     }-    return -1;+    return NN_ATTRSET_NOT_FOUND; }  /* --- Lifecycle --- */@@ -130,14 +137,12 @@     set->capacity = capacity;     set->frozen = 0; -    if (!set->keys || !set->values) {+    if (!set->keys || !set->values || nn_attrset_track(set) != 0) {         free(set->keys);         free(set->values);         free(set);         return NULL;     }--    nn_attrset_track(set);     return set; } @@ -151,18 +156,13 @@  /* --- Construction --- */ -void nn_attrset_insert(nn_attrset_t *set, nn_symbol_t key, void *value)+int nn_attrset_insert(nn_attrset_t *set, nn_symbol_t key, void *value) {-    if (set->count >= set->capacity) {-        if (grow(set, set->capacity * 2) != 0) {-            fprintf(stderr, "nn_attrset_insert: grow failed (capacity %u)\n",-                    (unsigned)set->capacity);-            abort();-        }-    }+    if (set->count >= set->capacity && grow(set) != 0) return -1;     set->keys[set->count] = key;     set->values[set->count] = value;     set->count++;+    return 0; }  void nn_attrset_freeze(nn_attrset_t *set)@@ -265,12 +265,12 @@  void *nn_attrset_lookup(const nn_attrset_t *set, nn_symbol_t key) {-    int32_t idx = bsearch_key(set->keys, set->count, key);-    if (idx < 0) return NULL;+    uint32_t idx = bsearch_key(set->keys, set->count, key);+    if (idx == NN_ATTRSET_NOT_FOUND) return NULL;     return set->values[idx]; } -int32_t nn_attrset_index(const nn_attrset_t *set, nn_symbol_t key)+uint32_t nn_attrset_index(const nn_attrset_t *set, nn_symbol_t key) {     return bsearch_key(set->keys, set->count, key); }@@ -310,32 +310,40 @@     /* The merge-join below assumes both inputs are sorted; every set this      * module produces is frozen (hence sorted), so guard it in debug. */     NN_ASSERT(a->frozen && b->frozen, "nn_attrset_union: inputs must be frozen");-    /* Merge-join: all keys from both, b wins on conflict. */-    uint32_t cap = a->count + b->count;+    /* Merge-join: all keys from both, b wins on conflict.  The sum of two+     * uint32_t counts needs 33 bits; sized at the ceiling instead, the+     * result still holds any union with enough shared keys to fit, and+     * an insert refuses the one that does not. */+    uint64_t total = (uint64_t)a->count + b->count;+    uint32_t cap = total > NN_ATTRSET_MAX_ENTRIES+                       ? NN_ATTRSET_MAX_ENTRIES : (uint32_t)total;     nn_attrset_t *result = nn_attrset_new(cap);-    if (!result) { fprintf(stderr, "nn_attrset_union: alloc failed\n"); abort(); }+    if (!result) return NULL;     uint32_t ia = 0, ib = 0; +    /* A refused result stays tracked, so teardown frees it. */     while (ia < a->count && ib < b->count) {+        int status;         if (a->keys[ia] < b->keys[ib]) {-            nn_attrset_insert(result, a->keys[ia], a->values[ia]);+            status = nn_attrset_insert(result, a->keys[ia], a->values[ia]);             ia++;         } else if (a->keys[ia] > b->keys[ib]) {-            nn_attrset_insert(result, b->keys[ib], b->values[ib]);+            status = nn_attrset_insert(result, b->keys[ib], b->values[ib]);             ib++;         } else {             /* Same key - b wins (right-biased //). */-            nn_attrset_insert(result, b->keys[ib], b->values[ib]);+            status = nn_attrset_insert(result, b->keys[ib], b->values[ib]);             ia++;             ib++;         }+        if (status != 0) return NULL;     }     while (ia < a->count) {-        nn_attrset_insert(result, a->keys[ia], a->values[ia]);+        if (nn_attrset_insert(result, a->keys[ia], a->values[ia]) != 0) return NULL;         ia++;     }     while (ib < b->count) {-        nn_attrset_insert(result, b->keys[ib], b->values[ib]);+        if (nn_attrset_insert(result, b->keys[ib], b->values[ib]) != 0) return NULL;         ib++;     } @@ -350,7 +358,7 @@ {     NN_ASSERT(set->frozen, "nn_attrset_remove_keys: input must be frozen");     nn_attrset_t *result = nn_attrset_new(set->count);-    if (!result) { fprintf(stderr, "nn_attrset_remove_keys: alloc failed\n"); abort(); }+    if (!result) return NULL;     uint32_t i;      for (i = 0; i < set->count; i++) {@@ -364,8 +372,8 @@                 break;             }         }-        if (!skip) {-            nn_attrset_insert(result, set->keys[i], set->values[i]);+        if (!skip && nn_attrset_insert(result, set->keys[i], set->values[i]) != 0) {+            return NULL;         }     } 

@@ -21,6 +21,12 @@  * teardown's per-set primitive and must not be called on a tracked set (it  * would then be double-freed by nn_attrset_free_all).  * Values (StablePtrs) are NOT freed by nn_attrset_free - Haskell owns them.+ *+ * Counts and indices are uint32_t.  A set holds at most+ * NN_ATTRSET_MAX_ENTRIES entries, the ceiling upstream's Bindings has+ * (its size_t is uint32_t), so every index is below NN_ATTRSET_NOT_FOUND.+ * An operation that would pass it, or that the allocator refuses,+ * reports failure instead of aborting.  */  #ifndef NN_ATTRSET_H@@ -35,10 +41,16 @@ /* Opaque attribute set handle. */ typedef struct nn_attrset nn_attrset_t; +/* Most entries one set can hold. */+#define NN_ATTRSET_MAX_ENTRIES UINT32_MAX++/* nn_attrset_index's answer for an absent key: no index reaches it. */+#define NN_ATTRSET_NOT_FOUND UINT32_MAX+ /* --- Lifecycle --- */ -/* Allocate a new empty attribute set with space for `capacity` entries.- * Returns NULL on allocation failure. */+/* Allocate a new empty attribute set with space for `capacity` entries+ * (0 picks a small default).  Returns NULL on allocation failure. */ nn_attrset_t *nn_attrset_new(uint32_t capacity);  /* Free the attribute set structure.  Does NOT free the value pointers@@ -50,8 +62,10 @@ /* Append a key-value pair.  Keys need not be sorted or unique at this  * stage - duplicates are resolved at freeze time (last insert wins,  * matching Nix // merge semantics).- * Grows the internal arrays if capacity is exceeded. */-void nn_attrset_insert(nn_attrset_t *set, nn_symbol_t key, void *value);+ * Grows the internal arrays if capacity is exceeded.  Returns 0, or -1+ * with the set unchanged when it already holds NN_ATTRSET_MAX_ENTRIES+ * entries or cannot grow. */+int nn_attrset_insert(nn_attrset_t *set, nn_symbol_t key, void *value);  /* Sort entries by symbol ID and deduplicate (last writer wins).  * Must be called exactly once before any lookup/keys/values access.@@ -64,9 +78,9 @@  * the key is not present.  O(log n) binary search. */ void *nn_attrset_lookup(const nn_attrset_t *set, nn_symbol_t key); -/* Return the index of a key, or -1 if not found.+/* Return the index of a key, or NN_ATTRSET_NOT_FOUND.  * Useful for updating value slots in place. */-int32_t nn_attrset_index(const nn_attrset_t *set, nn_symbol_t key);+uint32_t nn_attrset_index(const nn_attrset_t *set, nn_symbol_t key);  /* Update the value at a known index.  Index must be valid (0 <= idx < count).  * Used for lazy materialization: slot starts NULL, gets filled on first force. */@@ -99,12 +113,15 @@ /* Create a new set that is the right-biased union of `a` and `b`  * (keys in `b` override `a`).  Both inputs must be frozen.  * The result is returned frozen and is arena-tracked (freed by- * nn_attrset_free_all) - do NOT pass it to nn_attrset_free. */+ * nn_attrset_free_all) - do NOT pass it to nn_attrset_free.  Returns+ * NULL when the union would pass NN_ATTRSET_MAX_ENTRIES or an+ * allocation fails. */ nn_attrset_t *nn_attrset_union(const nn_attrset_t *a, const nn_attrset_t *b);  /* Create a new set with the given keys removed.  Input must be frozen.  * The result is returned frozen and is arena-tracked (freed by- * nn_attrset_free_all) - do NOT pass it to nn_attrset_free. */+ * nn_attrset_free_all) - do NOT pass it to nn_attrset_free.  Returns+ * NULL when an allocation fails. */ nn_attrset_t *nn_attrset_remove_keys(     const nn_attrset_t *set,     const nn_symbol_t *keys,

@@ -21,6 +21,20 @@ #define NN_BC_DEFAULT_OP_CAPACITY    65536u #define NN_BC_DEFAULT_DATA_CAPACITY 131072u +/* --- Reserved instructions (layout in nn_bytecode.h) --- */++static const nn_op_t g_reserved_ops[] = {+    { .opcode = NN_OP_RESOLVED_VAR, .arg1 = 0, .arg2 = 0 },+    { .opcode = NN_OP_RESOLVED_VAR, .arg1 = 0, .arg2 = 1 },+    { .opcode = NN_OP_APP, .flags = NN_APP_DEFERRED, .arg1 = 0, .arg2 = 1 },+    { .opcode = NN_OP_RESOLVED_VAR, .arg1 = 0, .arg2 = 2 },+    { .opcode = NN_OP_APP, .flags = NN_APP_DEFERRED,+      .arg1 = NN_BC_RESERVED_APPLY1, .arg2 = 3 },+};++typedef char nn_bc_reserved_count_check_[+    (sizeof g_reserved_ops / sizeof g_reserved_ops[0] == NN_BC_RESERVED_COUNT) ? 1 : -1];+ /* --- Global state --- */  static nn_op_t  *g_ops          = NULL;@@ -38,11 +52,13 @@     if (g_ops) nn_bytecode_destroy();      if (op_capacity == 0)   op_capacity   = NN_BC_DEFAULT_OP_CAPACITY;+    if (op_capacity < NN_BC_RESERVED_COUNT) op_capacity = NN_BC_RESERVED_COUNT;     if (data_capacity == 0) data_capacity = NN_BC_DEFAULT_DATA_CAPACITY;      g_ops         = (nn_op_t *)malloc((size_t)op_capacity * sizeof(nn_op_t));     if (!g_ops) { fprintf(stderr, "nn_bytecode_init: ops alloc failed\n"); abort(); }-    g_op_count    = 0;+    memcpy(g_ops, g_reserved_ops, sizeof g_reserved_ops);+    g_op_count    = NN_BC_RESERVED_COUNT;     g_op_capacity = op_capacity;      g_data          = (uint32_t *)malloc((size_t)data_capacity * sizeof(uint32_t));@@ -51,6 +67,11 @@     g_data_capacity = data_capacity; } +int nn_bytecode_live(void)+{+    return g_ops != NULL;+}+ void nn_bytecode_destroy(void) {     free(g_ops);@@ -68,6 +89,10 @@  static int ensure_op_space(void) {+    /* No store before nn_bytecode_init or after nn_bytecode_destroy.+     * Doubling a zero capacity would realloc to zero bytes and the+     * emit would then write past it. */+    if (!g_ops) return -1;     if (g_op_count < g_op_capacity) return 0;     uint32_t new_cap = g_op_capacity * 2;     if (new_cap < g_op_capacity) return -1; /* overflow guard */@@ -80,6 +105,7 @@  static int ensure_data_space(void) {+    if (!g_data) return -1;     if (g_data_count < g_data_capacity) return 0;     uint32_t new_cap = g_data_capacity * 2;     if (new_cap < g_data_capacity) return -1; /* overflow guard */

@@ -50,6 +50,11 @@ #define NN_OP_SEARCH_PATH   23 #define NN_OP_PATH_STR      24 +/* --- App flags (NN_OP_APP) --- */++#define NN_APP_DIRECT    0+#define NN_APP_DEFERRED  1+ /* --- UnaryOp flags (NN_OP_UNARY) --- */  #define NN_UNARY_NOT     0@@ -83,11 +88,13 @@  #define NN_STRPART_LIT    0 #define NN_STRPART_INTERP 1+#define NN_STRPART_ESC    2  /* --- Binding type tags (data buffer) --- */ -#define NN_BIND_NAMED    0-#define NN_BIND_INHERIT  1+#define NN_BIND_NAMED         0+#define NN_BIND_INHERIT       1+#define NN_BIND_INHERIT_FROM  2  /* --- CaptureInfo type tags (data buffer) --- */ @@ -117,12 +124,40 @@     uint32_t arg3;       /* Child index, data offset, etc. */ } nn_op_t; +/* --- Reserved instructions ---+ *+ * nn_bytecode_init lays these down at the front of every store, so each+ * index below names the same code for the store's whole life, and the+ * next init lays them down again.  They are the code of the application+ * thunks a builtin makes once per element (map, genList, mapAttrs and+ * the like): each such thunk runs it against a minimal env of its own,+ * whose slots hold the function and its arguments.  The store is freed+ * only by nn_bytecode_destroy, so code compiled per element would grow+ * it with the element count.+ *+ *   0  RESOLVED_VAR  level 0, slot 0+ *   1  RESOLVED_VAR  level 0, slot 1+ *   2  APP deferred  0 applied to 1     slot 0 applied to slot 1+ *   3  RESOLVED_VAR  level 0, slot 2+ *   4  APP deferred  2 applied to 3     that applied to slot 2+ */++#define NN_BC_RESERVED_APPLY1  2u+#define NN_BC_RESERVED_APPLY2  4u+#define NN_BC_RESERVED_COUNT   5u+ /* --- Lifecycle --- */ -/* Initialize the global bytecode store.  op_capacity is initial- * instruction slots (0 = default 65536).  data_capacity is initial- * data buffer slots (0 = default 131072).  Both grow automatically. */+/* Initialize the global bytecode store and lay down the reserved+ * instructions.  op_capacity is initial instruction slots (0 = default+ * 65536; never fewer than NN_BC_RESERVED_COUNT).  data_capacity is+ * initial data buffer slots (0 = default 131072).  Both grow+ * automatically.  Outside the init .. destroy window both emitters+ * return UINT32_MAX. */ void nn_bytecode_init(uint32_t op_capacity, uint32_t data_capacity);++/* Nonzero between nn_bytecode_init and nn_bytecode_destroy. */+int nn_bytecode_live(void);  /* Destroy the global bytecode store, freeing all memory. */ void nn_bytecode_destroy(void);

@@ -9,7 +9,6 @@ #include "nn_ctxstr.h" #include "nn_assert.h" -#include <stdio.h> #include <stdlib.h> #include <string.h> @@ -21,23 +20,23 @@ static uint32_t      g_tracked_count = 0; static uint32_t      g_tracked_capacity = 0; -static void+/* Returns 0, or -1 when the tracking array cannot grow. */+static int track(nn_ctxstr_t *s) {     if (g_tracked_count >= g_tracked_capacity) {+        if (g_tracked_capacity > UINT32_MAX / 2) return -1;         uint32_t new_cap = g_tracked_capacity == 0                                ? NN_CTXSTR_INITIAL_CAPACITY                                : g_tracked_capacity * 2;         nn_ctxstr_t **new_arr = (nn_ctxstr_t **)realloc(             g_tracked, (size_t)new_cap * sizeof(nn_ctxstr_t *));-        if (!new_arr) {-            fprintf(stderr, "nn_ctxstr_track: realloc failed\n");-            abort();-        }+        if (!new_arr) return -1;         g_tracked = new_arr;         g_tracked_capacity = new_cap;     }     g_tracked[g_tracked_count++] = s;+    return 0; }  /* --- Lifecycle --- */@@ -57,7 +56,10 @@     s->text = text;     s->ctx_count = ctx_count;     memset(s->ctx, 0, (size_t)ctx_count * sizeof(nn_sce_t));-    track(s);+    if (track(s) != 0) {+        free(s);+        return NULL;+    }     return s; } 

@@ -0,0 +1,31 @@+#include "nn_darwinfs.h"++#ifdef __APPLE__++#include <unistd.h>++int nn_path_case_sensitive(const char *path) {+  long answer;++  /* pathconf returns the queried value, not a status: -1 is the error+   * return (errno set), 0 means the volume folds, and a positive value+   * means it does not. */+  answer = pathconf(path, _PC_CASE_SENSITIVE);+  if (answer < 0) {+    return -1;+  }+  return answer > 0 ? 1 : 0;+}++#else /* !__APPLE__ */++/* _PC_CASE_SENSITIVE is a Darwin extension: Linux has no pathconf name for+ * case sensitivity (its filesystems are case-sensitive by convention, the+ * same assumption upstream Nix makes there), and Windows decides per+ * directory through nn_winfs.h rather than per volume. */+int nn_path_case_sensitive(const char *path) {+  (void)path;+  return -1;+}++#endif

@@ -0,0 +1,18 @@+/* Platform filesystem capabilities the store layer probes at runtime.+ * macOS-only functionality.  Every other platform compiles the constant+ * -1 stub because the cabal c-sources entry is unconditional and the+ * C99 strict job lints every C file under cbits on Linux; the Haskell+ * side picks the platform's answer at compile time and never calls the+ * stub. */+#ifndef NN_DARWINFS_H+#define NN_DARWINFS_H++/* Whether the filesystem holding PATH (which must exist) compares names+ * case-sensitively: pathconf(_PC_CASE_SENSITIVE), a Darwin extension of+ * the POSIX call.  Returns 1 when sensitive, 0 when folding, and -1 when+ * there is no answer - the path does not exist, the filesystem does not+ * implement the query, or a non-macOS build - and the caller falls back+ * to the platform default. */+int nn_path_case_sensitive(const char *path);++#endif

@@ -69,19 +69,20 @@     if (bytes > UINT32_MAX - (NN_ENV_ALIGN - 1)) return NULL;     bytes = align_up(bytes, NN_ENV_ALIGN); +    /* No pages before nn_env_init or after nn_env_destroy.  Opening a+     * first page here instead would hand out memory the next+     * nn_env_init frees, under every pointer built from it. */+    if (!g_current_page) return NULL;+     /* used <= capacity always holds, so capacity - used cannot underflow;      * the additive form (used + bytes > capacity) overflows uint32_t for      * near-4GB requests and would pass the check, then memset past the      * end of a 256 KB page. */-    if (!g_current_page || bytes > g_current_page->capacity - g_current_page->used) {+    if (bytes > g_current_page->capacity - g_current_page->used) {         uint32_t page_cap = bytes > NN_ENV_PAGE_SIZE ? bytes : NN_ENV_PAGE_SIZE;         struct nn_env_page *page = alloc_page(page_cap);         if (!page) return NULL;-        if (g_current_page) {-            g_current_page->next = page;-        } else {-            g_first_page = page;-        }+        g_current_page->next = page;         g_current_page = page;     } @@ -108,6 +109,12 @@      /* Initialize global empty env */     memset(&g_empty_env, 0, sizeof(g_empty_env));+}++int+nn_env_live(void)+{+    return g_first_page != NULL; }  void

@@ -35,8 +35,13 @@ /* --- Lifecycle --- */  /* Initialize the global env allocator.  Must be called once before- * any nn_env_* calls (except nn_env_destroy). */+ * any nn_env_* calls (except nn_env_destroy, nn_env_live and+ * nn_env_empty); outside the init .. destroy window every allocating+ * call returns NULL. */ void nn_env_init(void);++/* Nonzero between nn_env_init and nn_env_destroy. */+int nn_env_live(void);  /* Destroy the global env allocator, freeing all page memory.  * All pointers returned by any nn_env_* function become invalid. */

@@ -9,7 +9,6 @@ #include "nn_lambda.h" #include "nn_assert.h" -#include <stdio.h> #include <stdlib.h> #include <string.h> @@ -19,20 +18,20 @@ static uint32_t g_tracked_count = 0; static uint32_t g_tracked_cap   = 0; -static void nn_lambda_track(nn_lambda_t *lam)+/* Returns 0, or -1 when the tracking array cannot grow. */+static int nn_lambda_track(nn_lambda_t *lam) {     if (g_tracked_count >= g_tracked_cap) {+        if (g_tracked_cap > UINT32_MAX / 2) return -1;         uint32_t new_cap = g_tracked_cap ? g_tracked_cap * 2 : 256;         nn_lambda_t **new_arr = (nn_lambda_t **)realloc(             g_tracked, (size_t)new_cap * sizeof(nn_lambda_t *));-        if (!new_arr) {-            fprintf(stderr, "nn_lambda_track: realloc failed\n");-            abort();-        }+        if (!new_arr) return -1;         g_tracked = new_arr;         g_tracked_cap = new_cap;     }     g_tracked[g_tracked_count++] = lam;+    return 0; }  /* --- Lifecycle --- */@@ -70,7 +69,11 @@         lam->entries = NULL;     } -    nn_lambda_track(lam);+    if (nn_lambda_track(lam) != 0) {+        free(lam->entries);+        free(lam);+        return NULL;+    }     return lam; } 

@@ -10,7 +10,6 @@ #include "nn_env.h" #include "nn_assert.h" -#include <stdio.h> #include <stdlib.h>  /* --- Global tracking for bulk cleanup --- */@@ -19,45 +18,68 @@ static uint32_t g_tracked_count = 0; static uint32_t g_tracked_cap   = 0; -static void nn_list_track(nn_list_t *list)+/* Returns 0, or -1 when the tracking array cannot grow. */+static int nn_list_track(nn_list_t *list) {     if (g_tracked_count >= g_tracked_cap) {+        if (g_tracked_cap > UINT32_MAX / 2) return -1;         uint32_t new_cap = g_tracked_cap ? g_tracked_cap * 2 : 256;         nn_list_t **new_arr = (nn_list_t **)realloc(             g_tracked, (size_t)new_cap * sizeof(nn_list_t *));-        if (!new_arr) {-            fprintf(stderr, "nn_list_track: realloc failed\n");-            abort();-        }+        if (!new_arr) return -1;         g_tracked = new_arr;         g_tracked_cap = new_cap;     }     g_tracked[g_tracked_count++] = list;+    return 0; }  /* --- Lifecycle --- */ -nn_list_t *-nn_list_new(uint32_t count)+int+nn_list_new(nn_list_t **out, uint32_t count) {-    if (count == 0) return NULL;+    *out = NULL;+    if (count == 0) return 0;      nn_list_t *list = (nn_list_t *)malloc(sizeof(nn_list_t));-    if (!list) return NULL;+    if (!list) return -1;      /* Items array via the env page allocator (O(1) bump allocation).      * nn_env_alloc_slots returns void**, which we cast to nn_thunk**.-     * All slots are zero-initialized (NULL pointers). */+     * All slots are zero-initialized (NULL pointers).  When tracking+     * fails the items array stays in its page, which only nn_env_destroy+     * releases. */     list->items = (struct nn_thunk **)nn_env_alloc_slots(count);     list->count = count; -    if (!list->items) {+    if (!list->items || nn_list_track(list) != 0) {         free(list);-        return NULL;+        return -1;     } -    nn_list_track(list);-    return list;+    *out = list;+    return 0;+}++int+nn_list_drop(nn_list_t **out, const nn_list_t *list, uint32_t n)+{+    *out = NULL;+    if (!list || n >= list->count) return 0;++    nn_list_t *rest = (nn_list_t *)malloc(sizeof(nn_list_t));+    if (!rest) return -1;++    rest->items = list->items + n;+    rest->count = list->count - n;+    if (nn_list_track(rest) != 0) {+        free(rest);+        return -1;+    }++    *out = rest;+    return 0; }  void

@@ -11,7 +11,12 @@  *  * Lists are immutable after construction: allocate with nn_list_new,  * fill via nn_list_set, then read with nn_list_get/nn_list_count.+ * nn_list_drop builds a suffix over its source's items array, which+ * that immutability makes safe to share.  *+ * NULL is the empty list, so a constructor cannot also use it to report+ * failure: each returns 0 or -1 and hands the list back through `out`.+ *  * Lifecycle: constructed during evaluation, freed via nn_list_free_all()  * at arena teardown.  Not thread-safe - single-threaded evaluation only.  */@@ -37,8 +42,17 @@ /* Allocate a new list with space for `count` thunk pointers.  * The items array is allocated via the env page allocator (O(1)).  * The header is malloc'd and tracked for bulk cleanup.- * Returns NULL on allocation failure or if count is 0. */-nn_list_t *nn_list_new(uint32_t count);+ * Returns 0 with *out the new list, or NULL when count is 0; returns -1+ * with *out NULL when an allocation fails. */+int nn_list_new(nn_list_t **out, uint32_t count);++/* The elements of `list` from index `n` on, as a new tracked header over+ * the same items array: O(1) whatever the length, where a copy would+ * add count - n slots to pages nothing frees before evaluation end.+ * Returns 0 with *out the suffix, or NULL when no element remains+ * (`list` empty or n >= count); returns -1 with *out NULL when the+ * header cannot be allocated. */+int nn_list_drop(nn_list_t **out, const nn_list_t *list, uint32_t n);  /* Free all tracked list headers at once (arena-style cleanup).  * Items arrays are freed by nn_env_destroy (page allocator).

@@ -20,6 +20,7 @@ /* --- Configuration --- */  #define NN_SYMBOL_DEFAULT_CAPACITY   4096+#define NN_SYMBOL_MAX_INITIAL        (UINT32_C(1) << 30)  /* slot table is twice this */ #define NN_SYMBOL_LOAD_PERCENT         75 #define NN_SYMBOL_ARENA_INITIAL  (256 * 1024)  /* 256 KB */ @@ -52,7 +53,7 @@      /* Contiguous string arena. */     char              *arena;-    size_t             arena_used;+    size_t             arena_used;  /* never above NN_SYMBOL_ARENA_LIMIT */     size_t             arena_cap; } g_sym; @@ -69,72 +70,58 @@     return h; } -/* --- Arena --- */+/* --- Growth --- */ -/* Ensure the arena has room for `needed` more bytes. */-static void arena_ensure(size_t needed)-{-    if (g_sym.arena_used + needed <= g_sym.arena_cap) return;+/* Each reserve step returns 0, or -1 when the table cannot grow, and+ * changes no symbol, so nn_symbol_intern can refuse after any of them. */ +/* Room for `needed` more arena bytes; the caller has kept the total+ * within NN_SYMBOL_ARENA_LIMIT, which fits size_t on every 64-bit+ * target. */+static int arena_reserve(size_t needed)+{+    size_t want = g_sym.arena_used + needed;     size_t new_cap = g_sym.arena_cap;-    while (new_cap < g_sym.arena_used + needed) {-        new_cap *= 2;-    }-    char *new_arena = (char *)realloc(g_sym.arena, new_cap);-    if (!new_arena) {-        fprintf(stderr, "nn_symbol: arena realloc failed (requested %zu bytes)\n", new_cap);-        abort();-    }-    g_sym.arena = new_arena;-    g_sym.arena_cap = new_cap;-}+    if (want <= new_cap) return 0; -/* Copy `len` bytes into the arena, returning the start offset. */-static uint32_t arena_push(const char *str, size_t len)-{-    arena_ensure(len + 1);  /* +1 for null terminator */-    if (g_sym.arena_used > (size_t)UINT32_MAX) {-        fprintf(stderr, "nn_symbol: arena offset exceeds uint32_t range\n");-        abort();+    while (new_cap < want) {+        new_cap = new_cap > SIZE_MAX / 2 ? want : new_cap * 2;     }-    uint32_t offset = (uint32_t)g_sym.arena_used;-    memcpy(g_sym.arena + offset, str, len);-    g_sym.arena[offset + len] = '\0';-    g_sym.arena_used += len + 1;-    return offset;+    char *grown = (char *)realloc(g_sym.arena, new_cap);+    if (!grown) return -1;+    g_sym.arena = grown;+    g_sym.arena_cap = new_cap;+    return 0; } -/* --- Entry array --- */--/* Ensure the entry array has room for one more symbol. */-static void entries_ensure(void)+/* Room for one more entry.  Entries are 1-indexed, so count + 1 must+ * stay below the capacity. */+static int entries_reserve(void) {-    /* count is 0-based count, entries are 1-indexed, so we need count+1 < cap */-    if (g_sym.count + 1 < g_sym.entries_cap) return;+    if (g_sym.count + 1 < g_sym.entries_cap) return 0;+    if (g_sym.entries_cap > UINT32_MAX / 2) return -1;      uint32_t new_cap = g_sym.entries_cap * 2;-    nn_symbol_entry_t *new_entries = (nn_symbol_entry_t *)realloc(+    nn_symbol_entry_t *grown = (nn_symbol_entry_t *)realloc(         g_sym.entries, (size_t)new_cap * sizeof(nn_symbol_entry_t));-    if (!new_entries) {-        fprintf(stderr, "nn_symbol: entries realloc failed\n");-        abort();-    }-    g_sym.entries = new_entries;+    if (!grown) return -1;+    g_sym.entries = grown;     g_sym.entries_cap = new_cap;+    return 0; } -/* --- Hash table --- */--/* Rebuild the hash table at double capacity. */-static void slots_grow(void)+/* Rebuild the hash table at double capacity.  The slot capacity is a+ * uint32_t power of two, so it stops at 2^31; with the load kept under+ * NN_SYMBOL_LOAD_PERCENT that bounds the symbol count well below+ * UINT32_MAX, which is why no separate ID ceiling is checked. */+static int slots_grow(void) {+    if (g_sym.slots_cap > UINT32_MAX / 2) return -1;+     uint32_t new_cap = g_sym.slots_cap * 2;     uint32_t new_mask = new_cap - 1;     nn_slot_t *new_slots = (nn_slot_t *)calloc((size_t)new_cap, sizeof(nn_slot_t));-    if (!new_slots) {-        fprintf(stderr, "nn_symbol: slots calloc failed\n");-        abort();-    }+    if (!new_slots) return -1;      uint32_t i;     for (i = 0; i < g_sym.slots_cap; i++) {@@ -150,17 +137,22 @@     g_sym.slots = new_slots;     g_sym.slots_cap = new_cap;     g_sym.slots_mask = new_mask;+    return 0; }  /* --- Public API --- */  void nn_symbol_init(uint32_t initial_capacity) {+    if (g_sym.slots) nn_symbol_destroy();+     uint32_t cap = NN_SYMBOL_DEFAULT_CAPACITY;     if (initial_capacity > cap) {-        /* Round up to power of two. */-        cap = 1;-        while (cap < initial_capacity) cap *= 2;+        /* Round up to a power of two.  The hint is clamped so that the+         * rounding and the slot table's doubling cannot wrap uint32_t. */+        uint32_t want = initial_capacity < NN_SYMBOL_MAX_INITIAL+                            ? initial_capacity : NN_SYMBOL_MAX_INITIAL;+        while (cap < want) cap *= 2;     }      memset(&g_sym, 0, sizeof(g_sym));@@ -186,6 +178,11 @@     g_sym.arena_used = 0; } +int nn_symbol_live(void)+{+    return g_sym.slots != NULL;+}+ void nn_symbol_destroy(void) {     free(g_sym.entries);@@ -196,6 +193,16 @@  nn_symbol_t nn_symbol_intern(const char *str, size_t len) {+    /* No table before nn_symbol_init or after nn_symbol_destroy: the+     * probe below would dereference a NULL slot array.  The invalid+     * sentinel is the one value the Haskell boundary refuses to wrap. */+    if (!g_sym.slots) return NN_SYMBOL_INVALID;++    /* A length past uint32_t can be neither stored nor already present;+     * truncated into the entry it would read back as a shorter string.+     * Refused here, before a byte of str is read. */+    if ((uint64_t)len > UINT32_MAX) return NN_SYMBOL_INVALID;+     /* An empty string arrives from Haskell's zero-copy marshalling as      * (NULL, 0).  memcpy/memcmp require valid pointers even for a zero      * length, so normalize at the boundary.  Empty symbols are reachable@@ -214,7 +221,7 @@          if (g_sym.slots[idx].hash == hash) {             nn_symbol_entry_t *e = &g_sym.entries[id];-            if (e->len == (uint32_t)len &&+            if (e->len == len &&                 memcmp(g_sym.arena + e->offset, str, len) == 0) {                 return (nn_symbol_t)id;             }@@ -222,12 +229,29 @@         idx = (idx + 1) & g_sym.slots_mask;     } -    /* Not found - insert new symbol. */-    entries_ensure();+    /* Not found - insert.  Everything the insert needs is reserved before+     * any of it is committed, so a refusal leaves the table as it was.+     * The slot table grows ahead of the insert that would reach the load+     * limit, which keeps an empty slot for every later probe to stop at. */+    if ((uint64_t)len >= NN_SYMBOL_ARENA_LIMIT - (uint64_t)g_sym.arena_used)+        return NN_SYMBOL_INVALID;+    if (arena_reserve(len + 1) != 0) return NN_SYMBOL_INVALID;+    if (entries_reserve() != 0) return NN_SYMBOL_INVALID;+    if ((uint64_t)(g_sym.count + 1) * 100 >= (uint64_t)g_sym.slots_cap * NN_SYMBOL_LOAD_PERCENT) {+        if (slots_grow() != 0) return NN_SYMBOL_INVALID;+        idx = hash & g_sym.slots_mask;+        while (g_sym.slots[idx].id != 0) {+            idx = (idx + 1) & g_sym.slots_mask;+        }+    }+     g_sym.count++;     uint32_t new_id = g_sym.count;  /* 1-based */+    uint32_t offset = (uint32_t)g_sym.arena_used; -    uint32_t offset = arena_push(str, len);+    memcpy(g_sym.arena + offset, str, len);+    g_sym.arena[offset + len] = '\0';+    g_sym.arena_used += len + 1;      g_sym.entries[new_id].offset = offset;     g_sym.entries[new_id].len = (uint32_t)len;@@ -235,11 +259,6 @@      g_sym.slots[idx].hash = hash;     g_sym.slots[idx].id = new_id;--    /* Grow hash table if load exceeds threshold. */-    if ((uint64_t)g_sym.count * 100 >= (uint64_t)g_sym.slots_cap * NN_SYMBOL_LOAD_PERCENT) {-        slots_grow();-    }      return (nn_symbol_t)new_id; }

@@ -12,6 +12,12 @@  *  * Lifecycle: nn_symbol_init() before evaluation, nn_symbol_destroy()  * after.  Not thread-safe - single-threaded evaluation only.+ *+ * Offsets and lengths are uint32_t, so the string arena holds at most+ * NN_SYMBOL_ARENA_LIMIT bytes, terminators included.  An intern that+ * would cross it, or that needs a table to grow past its uint32_t+ * capacity or past what the allocator gives, is refused with+ * NN_SYMBOL_INVALID and leaves the table as it was.  */  #ifndef NN_SYMBOL_H@@ -29,13 +35,21 @@ /* Invalid symbol constant. */ #define NN_SYMBOL_INVALID ((nn_symbol_t)0) +/* Bytes the string arena may hold: every offset and length fits uint32_t. */+#define NN_SYMBOL_ARENA_LIMIT ((uint64_t)UINT32_MAX + 1)+ /* --- Lifecycle --- */ -/* Initialize the global symbol table.  Must be called once before- * any nn_symbol_intern() calls.  initial_capacity is the expected- * number of unique symbols (hint for pre-allocation; 0 uses default). */+/* Initialize the global symbol table, destroying a live one first.+ * Must be called before any nn_symbol_intern() calls; outside the+ * init .. destroy window nn_symbol_intern() returns NN_SYMBOL_INVALID.+ * initial_capacity is the expected number of unique symbols (hint for+ * pre-allocation; 0 uses default). */ void nn_symbol_init(uint32_t initial_capacity); +/* Nonzero between nn_symbol_init and nn_symbol_destroy. */+int nn_symbol_live(void);+ /* Destroy the global symbol table, freeing all memory.  * All nn_symbol_t values become invalid after this call. */ void nn_symbol_destroy(void);@@ -46,7 +60,10 @@  * interned, returns the existing symbol (O(1) amortized).  * The input string is copied - the caller may free it after this call.  * len is the byte length (not null-terminated).  (NULL, 0) denotes the- * empty string; str must not be NULL when len > 0. */+ * empty string; str must not be NULL when len > 0.  Returns+ * NN_SYMBOL_INVALID outside the init .. destroy window and when the+ * table refuses the string (see above); a length past the arena limit+ * is refused before any byte of str is read. */ nn_symbol_t nn_symbol_intern(const char *str, size_t len);  /* Return the string data for a symbol.  The pointer is valid until

@@ -60,6 +60,12 @@ static nn_thunk_t * arena_alloc(struct nn_thunk_arena *arena) {+    /* No arena before nn_thunk_init or after nn_thunk_destroy.  Report+     * it through the NULL the callers already check for rather than+     * dereferencing it; nn_arena_live is how the Haskell boundary tells+     * this apart from exhaustion. */+    if (!arena) return NULL;+     /* Current block full - allocate a new one */     if (arena->current->count >= arena->current->capacity) {         struct nn_thunk_block *block = alloc_block(arena->block_capacity);@@ -107,6 +113,12 @@     g_arena->block_capacity = cap; } +int+nn_thunk_live(void)+{+    return g_arena != NULL;+}+ void nn_thunk_destroy(void) {@@ -144,10 +156,12 @@     return thunk->bc_idx; } -void+int nn_thunk_set_payload(nn_thunk_t *thunk, void *payload) {+    if (thunk->state != NN_THUNK_PENDING) return 0;     thunk->payload = payload;+    return 1; }  nn_thunk_t *@@ -190,32 +204,6 @@ }  nn_thunk_t *-nn_thunk_new_computed_bool(uint8_t value)-{-    nn_thunk_t *t = arena_alloc(g_arena);-    if (!t) return NULL;-    t->state = NN_THUNK_COMPUTED;-    t->val_tag = NN_VALUE_BOOL;-    t->_pad = 0;-    t->bc_idx = 0;-    t->payload = (void *)(intptr_t)value;-    return t;-}--nn_thunk_t *-nn_thunk_new_computed_null(void)-{-    nn_thunk_t *t = arena_alloc(g_arena);-    if (!t) return NULL;-    t->state = NN_THUNK_COMPUTED;-    t->val_tag = NN_VALUE_NULL;-    t->_pad = 0;-    t->bc_idx = 0;-    t->payload = NULL;-    return t;-}--nn_thunk_t * nn_thunk_new_computed_str(uint32_t symbol) {     nn_thunk_t *t = arena_alloc(g_arena);@@ -293,6 +281,24 @@     return t; } +/* --- Shared constants --- */++static nn_thunk_t g_null_cell  = { NN_THUNK_COMPUTED, NN_VALUE_NULL, 0, 0, NULL };+static nn_thunk_t g_true_cell  = { NN_THUNK_COMPUTED, NN_VALUE_BOOL, 0, 0, (void *)(intptr_t)1 };+static nn_thunk_t g_false_cell = { NN_THUNK_COMPUTED, NN_VALUE_BOOL, 0, 0, NULL };++nn_thunk_t *+nn_thunk_null(void)+{+    return &g_null_cell;+}++nn_thunk_t *+nn_thunk_bool(uint8_t value)+{+    return value ? &g_true_cell : &g_false_cell;+}+ /* --- State queries --- */  uint8_t@@ -391,125 +397,114 @@     return 1; } -void *+int nn_thunk_set_computed(nn_thunk_t *thunk, void *value) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_PTR;     thunk->payload = value;-    return old;+    return 1; } -void *+int nn_thunk_set_computed_int(nn_thunk_t *thunk, int64_t value) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_INT;     thunk->payload = (void *)(intptr_t)value;-    return old;+    return 1; } -void *+int nn_thunk_set_computed_float(nn_thunk_t *thunk, double value) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_FLOAT;     memcpy(&thunk->payload, &value, sizeof(double));-    return old;+    return 1; } -void *+int nn_thunk_set_computed_bool(nn_thunk_t *thunk, uint8_t value) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_BOOL;     thunk->payload = (void *)(intptr_t)value;-    return old;+    return 1; } -void *+int nn_thunk_set_computed_null(nn_thunk_t *thunk) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_NULL;     thunk->payload = NULL;-    return old;+    return 1; } -void *+int nn_thunk_set_computed_str(nn_thunk_t *thunk, uint32_t symbol) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_STR;     thunk->payload = (void *)(intptr_t)symbol;-    return old;+    return 1; } -void *+int nn_thunk_set_computed_path(nn_thunk_t *thunk, uint32_t symbol) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_PATH;     thunk->payload = (void *)(intptr_t)symbol;-    return old;+    return 1; } -void *+int nn_thunk_set_computed_list(nn_thunk_t *thunk, void *list) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_LIST;     thunk->payload = list;-    return old;+    return 1; } -void *+int nn_thunk_set_computed_attrs(nn_thunk_t *thunk, void *attrset) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_ATTRS;     thunk->payload = attrset;-    return old;+    return 1; } -void *+int nn_thunk_set_computed_ctxstr(nn_thunk_t *thunk, void *ctxstr) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_CTXSTR;     thunk->payload = ctxstr;-    return old;+    return 1; } -void *+int nn_thunk_set_computed_lambda(nn_thunk_t *thunk, void *lambda) {-    if (thunk->state == NN_THUNK_COMPUTED) return NULL;-    void *old = thunk->payload;+    if (thunk->state == NN_THUNK_COMPUTED) return 0;     thunk->state = NN_THUNK_COMPUTED;     thunk->val_tag = NN_VALUE_LAMBDA;     thunk->payload = lambda;-    return old;+    return 1; }  /* --- Arena diagnostics / cleanup iteration --- */

@@ -82,9 +82,13 @@ /* Initialize the global thunk arena.  initial_capacity is the number  * of thunks to pre-allocate per block (0 uses default: 65536 = 1 MB).  * Must be called once before any thunk allocation (nn_thunk_new_bc or- * the computed-value constructors). */+ * the computed-value constructors); outside the init .. destroy window+ * every allocator returns NULL. */ void nn_thunk_init(uint32_t initial_capacity); +/* Nonzero between nn_thunk_init and nn_thunk_destroy. */+int nn_thunk_live(void);+ /* Destroy the global thunk arena, freeing all block memory.  * Does NOT free payload StablePtrs - caller must iterate and free  * them first (via nn_thunk_count/nn_thunk_get).@@ -103,11 +107,12 @@ /* Read the bytecode index from a PENDING thunk. */ uint32_t nn_thunk_get_bc_idx(const nn_thunk_t *thunk); -/* Set the payload of a thunk.  Used for deferred env fixup in+/* Set the payload of a PENDING thunk.  Used for deferred env fixup in  * knot-tying (rec attrs, let, formal defaults): allocate the thunk  * with NULL payload first, then fill the env pointer once the- * knot-tied env is constructed. */-void nn_thunk_set_payload(nn_thunk_t *thunk, void *payload);+ * knot-tied env is constructed.  Returns 1, or 0 with the thunk+ * unchanged if it is not PENDING. */+int nn_thunk_set_payload(nn_thunk_t *thunk, void *payload);  /* Allocate a new pre-COMPUTED thunk from the arena (StablePtr payload).  * value is an opaque pointer (StablePtr to Haskell NixValue).@@ -117,8 +122,6 @@ /* Allocate pre-COMPUTED thunks with inline scalar values (no StablePtr). */ nn_thunk_t *nn_thunk_new_computed_int(int64_t value); nn_thunk_t *nn_thunk_new_computed_float(double value);-nn_thunk_t *nn_thunk_new_computed_bool(uint8_t value);-nn_thunk_t *nn_thunk_new_computed_null(void);  /* Allocate pre-COMPUTED thunks with C-native complex values (no StablePtr). */ nn_thunk_t *nn_thunk_new_computed_str(uint32_t symbol);@@ -128,6 +131,18 @@ nn_thunk_t *nn_thunk_new_computed_ctxstr(void *ctxstr); nn_thunk_t *nn_thunk_new_computed_lambda(void *lambda); +/* --- Shared constants --- */++/* The COMPUTED null, true and false cells, as upstream shares one vNull,+ * vTrue and vFalse per EvalState.  They are file-scope statics, not+ * arena memory, so each has one address in every init .. destroy window+ * and outside all of them: a constant built from one before+ * nn_thunk_init, or kept across nn_thunk_destroy, still reads correctly.+ * Every state transition refuses a COMPUTED thunk, so nothing writes+ * them.  nn_thunk_bool answers the true cell for any nonzero value. */+nn_thunk_t *nn_thunk_null(void);+nn_thunk_t *nn_thunk_bool(uint8_t value);+ /* --- State queries --- */  /* Read the current state (NN_THUNK_PENDING/COMPUTED/BLACKHOLE). */@@ -165,29 +180,25 @@  * Returns 1 on success, 0 if thunk is not BLACKHOLE. */ int nn_thunk_mark_pending(nn_thunk_t *thunk); -/* Set a non-COMPUTED thunk to COMPUTED with a StablePtr value (NN_VALUE_PTR).- * Accepts PENDING or BLACKHOLE state (skips blackhole for direct memoization).- * Returns the old payload (pending StablePtr for caller to free).- * Returns NULL if thunk is already COMPUTED. */-void *nn_thunk_set_computed(nn_thunk_t *thunk, void *value);--/* Set a non-COMPUTED thunk to COMPUTED with inline scalar values.- * Returns the old payload (pending StablePtr for caller to free).- * Returns NULL if thunk is already COMPUTED. */-void *nn_thunk_set_computed_int(nn_thunk_t *thunk, int64_t value);-void *nn_thunk_set_computed_float(nn_thunk_t *thunk, double value);-void *nn_thunk_set_computed_bool(nn_thunk_t *thunk, uint8_t value);-void *nn_thunk_set_computed_null(nn_thunk_t *thunk);--/* Set a non-COMPUTED thunk to COMPUTED with C-native complex values.- * Returns the old payload (pending StablePtr for caller to free).- * Returns NULL if thunk is already COMPUTED. */-void *nn_thunk_set_computed_str(nn_thunk_t *thunk, uint32_t symbol);-void *nn_thunk_set_computed_path(nn_thunk_t *thunk, uint32_t symbol);-void *nn_thunk_set_computed_list(nn_thunk_t *thunk, void *list);-void *nn_thunk_set_computed_attrs(nn_thunk_t *thunk, void *attrset);-void *nn_thunk_set_computed_ctxstr(nn_thunk_t *thunk, void *ctxstr);-void *nn_thunk_set_computed_lambda(nn_thunk_t *thunk, void *lambda);+/* Set a non-COMPUTED thunk to COMPUTED, the setter naming the value+ * kind: a StablePtr NixValue (NN_VALUE_PTR), an inline scalar, or a+ * C-native complex value.  Accepts PENDING or BLACKHOLE state (skips+ * blackhole for direct memoization).  The pending payload is overwritten,+ * not handed back: a NULL return could not tell a refusal from a NULL+ * payload, and the caller already read the payload to evaluate the+ * thunk, so it frees the StablePtr itself.  Returns 1, or 0 with the+ * thunk unchanged if it is already COMPUTED. */+int nn_thunk_set_computed(nn_thunk_t *thunk, void *value);+int nn_thunk_set_computed_int(nn_thunk_t *thunk, int64_t value);+int nn_thunk_set_computed_float(nn_thunk_t *thunk, double value);+int nn_thunk_set_computed_bool(nn_thunk_t *thunk, uint8_t value);+int nn_thunk_set_computed_null(nn_thunk_t *thunk);+int nn_thunk_set_computed_str(nn_thunk_t *thunk, uint32_t symbol);+int nn_thunk_set_computed_path(nn_thunk_t *thunk, uint32_t symbol);+int nn_thunk_set_computed_list(nn_thunk_t *thunk, void *list);+int nn_thunk_set_computed_attrs(nn_thunk_t *thunk, void *attrset);+int nn_thunk_set_computed_ctxstr(nn_thunk_t *thunk, void *ctxstr);+int nn_thunk_set_computed_lambda(nn_thunk_t *thunk, void *lambda);  /* --- Arena diagnostics / cleanup iteration --- */ 

@@ -1,6 +1,8 @@ /* Platform filesystem capabilities the store layer probes at runtime.- * Windows-only functionality; other platforms compile the constant-failure- * stubs so callers fall back without conditional compilation. */+ * Windows-only functionality.  Every other platform compiles the constant+ * 0 stub because the cabal c-sources entry is unconditional and the C99+ * strict job lints every C file under cbits on Linux; the Haskell side+ * picks the platform's answer at compile time and never calls the stub. */ #ifndef NN_WINFS_H #define NN_WINFS_H 

@@ -1,19 +1,20 @@ cabal-version:      3.0 name:               nova-nix-version:            0.8.0.0+version:            0.9.0.0 synopsis:           Windows-native Nix implementation in Haskell and C99 description:   An implementation of Nix for Windows, written in Haskell with a C99   data layer that keeps evaluation data off the GHC heap.  It also runs-  on macOS and Linux.  It has its own parser, lazy evaluator,-  content-addressed store, derivation builder and binary-cache-  substituter, and does not need an existing Nix installation.+  on macOS and Linux.  It has its own parser, lazy evaluator, store,+  derivation builder and binary-cache substituter, and does not need an+  existing Nix installation. -  On the pinned nixpkgs revision its CI checks, the derivation paths it-  computes match upstream Nix 2.24.9.  On Windows it builds packages from-  source through a stage-1 stdenv over a store-pinned MinGW-w64-  toolchain.  The project is experimental; see the README for what is-  not implemented yet.+  On the 22 derivations its CI checks, over pinned pairs of Nix and+  nixpkgs from 2.24.9 with nixpkgs 24.11 to 2.35.4 with nixpkgs unstable,+  the derivation paths it computes match upstream.  On Windows it builds+  packages from source through a stage-1 stdenv over a store-pinned+  MinGW-w64 toolchain.  The project is experimental; see the README for+  what is not implemented yet.    Evaluation needs the C data layer, so library code must run it between   @Nix.Eval.Arena.arenaInit@ and @Nix.Eval.Arena.arenaDestroy@.@@ -61,11 +62,15 @@     Nix.Parser.Lexer     Nix.Parser.ParseError     Nix.Eval+    Nix.Eval.CallDepth     Nix.Eval.CanonPath     Nix.Eval.Context     Nix.Eval.Types     Nix.Eval.IO+    Nix.Eval.Policy     Nix.Eval.Operator+    Nix.Eval.Print+    Nix.Eval.SourceError     Nix.Eval.StringInterp     Nix.Eval.Symbol     Nix.Eval.CAttrSet@@ -79,32 +84,47 @@     Nix.Eval.EvalFormals     Nix.Eval.Arena     Nix.Eval.AttrPath+    Nix.Eval.CStatus     Nix.Store     Nix.Store.Path     Nix.Store.Path.Internal     Nix.Store.DB+    Nix.Store.GC+    Nix.Store.Handle     Nix.Store.Lock+    Nix.Store.Symlink     Nix.Store.CaseSensitive+    Nix.Store.EntryName     Nix.Store.ExecBit     Nix.DependencyGraph     Nix.Derivation+    Nix.Derivation.StructuredAttrs     Nix.Builder     Nix.Builder.Unpack     Nix.Compression     Nix.Config+    Nix.Environment+    Nix.HostPath     Nix.Push     Nix.Substituter     Nix.Builtins     Nix.Hash+    Nix.Http+    Nix.Json +  autogen-modules:  Paths_nova_nix+  other-modules:+    Nix.Store.Exclusive+    Paths_nova_nix+   build-depends:       base                >= 4.22 && < 5     , array               >= 0.5 && < 0.6     , bytestring          >= 0.11 && < 0.13     , containers          >= 0.6 && < 0.9     , crypton             >= 1.1 && < 2-    , directory           >= 1.3 && < 1.4-    , filepath            >= 1.4 && < 1.6+    , directory           >= 1.3.8 && < 1.4+    , filepath            >= 1.4.100 && < 1.6     , http-client         >= 0.7 && < 0.8     , http-client-tls     >= 0.3 && < 0.5     , http-types          >= 0.12 && < 0.13@@ -113,6 +133,7 @@     , mtl                 >= 2.2 && < 2.4     , nova-cache:{nova-cache, xz, zstandard, bzip2} >= 0.11.1.1 && < 0.12     , process             >= 1.6 && < 1.7+    , random              >= 1.2 && < 1.4     , regex-tdfa          >= 1.3 && < 1.4     , sqlite-simple       >= 0.4 && < 0.5     , tar                 >= 0.7.1 && < 0.8@@ -120,6 +141,19 @@     , time                >= 1.9 && < 1.17     , zstd                >= 0.1 && < 0.2 +  -- Platform calls base cannot express: the exclusive create behind NAR+  -- unpacking (Nix.Store.Exclusive), and reading the environment as+  -- bytes on POSIX (Nix.Environment; getenv, as upstream reads it), where+  -- Windows reads it through base's UTF-16 API.  Win32 2.9 is the first+  -- whose hANDLEToHandle serves the native Windows I/O manager; unix 2.8+  -- is the first whose openFd takes creat and cloexec in its flags.+  if os(windows)+    build-depends:+        Win32             >= 2.9 && < 2.15+  else+    build-depends:+        unix              >= 2.8 && < 2.9+   c-sources:     cbits/nn_symbol.c     cbits/nn_attrset.c@@ -131,6 +165,7 @@     cbits/nn_bytecode.c     cbits/nn_lambda.c     cbits/nn_winfs.c+    cbits/nn_darwinfs.c   include-dirs:     cbits   -- -Werror deliberately NOT baked in: a future gcc/clang adding a new   -- -Wall diagnostic must not retroactively break installing published@@ -165,12 +200,16 @@     OverloadedStrings   ghc-options:      -Wall -Wcompat -threaded -rtsopts +  -- file-io reads a config file by the bytes of its path.  0.1.1 is the+  -- first whose read does not create a missing file on Windows, which+  -- would turn a missing include into an empty one.   build-depends:       base                >= 4.22 && < 5     , bytestring          >= 0.11 && < 0.13     , containers          >= 0.6 && < 0.9-    , directory           >= 1.3 && < 1.4-    , filepath            >= 1.4 && < 1.6+    , directory           >= 1.3.8 && < 1.4+    , file-io             >= 0.1.1 && < 0.2+    , filepath            >= 1.4.100 && < 1.6     , nova-nix     , text                >= 2.0 && < 2.2 @@ -181,7 +220,7 @@   type:             exitcode-stdio-1.0   main-is:          Main.hs   hs-source-dirs:   test-  other-modules:    FetchurlFixture+  other-modules:    HttpFixture   default-language: Haskell2010   default-extensions:     OverloadedStrings@@ -196,12 +235,14 @@     , bytestring          >= 0.11 && < 0.13     , containers          >= 0.6 && < 0.9     , directory           >= 1.3 && < 1.4-    , filepath            >= 1.4 && < 1.6+    , filepath            >= 1.4.100 && < 1.6     , http-client         >= 0.7 && < 0.8+    , http-types          >= 0.12 && < 0.13     , network             >= 3.2 && < 3.3     , nova-cache:{nova-cache, zstandard} >= 0.11.1.1 && < 0.12     , nova-nix-    , process             >= 1.6 && < 1.7+    , process             >= 1.6.12 && < 1.7+    , QuickCheck          >= 2.12.5 && < 2.19     , sqlite-simple       >= 0.4 && < 0.5     , tar                 >= 0.7.1 && < 0.8     , text                >= 2.0 && < 2.2

@@ -48,6 +48,7 @@     buildPath,     execWrapperConfig,     execWrapperFor,+    spawnFor,     rewriteEnv,     rewritePlaceholders,     scrubAmbient,@@ -58,8 +59,9 @@   ) where -import Control.Exception (IOException, SomeException, displayException, finally, onException, try)+import Control.Exception (IOException, catch, catches, displayException, finally, onException, try) import Control.Monad (filterM, unless, when)+import Control.Monad.Except (ExceptT (..), liftEither, runExceptT) import Data.Bifunctor (first) import qualified Data.ByteString as BS import Data.Char (isAscii, isSpace, toLower, toUpper)@@ -71,7 +73,7 @@ import qualified Data.List.NonEmpty as NE import Data.Map.Strict (Map) import qualified Data.Map.Strict as Map-import Data.Maybe (catMaybes, isJust)+import Data.Maybe (catMaybes, fromMaybe, isJust) import Data.Text (Text) import qualified Data.Text as T import qualified Data.Text.Encoding as TE@@ -83,19 +85,20 @@ import Nix.Builder.Unpack (UnpackLimits, builtinUnpackBuilder, defaultUnpackLimits, runBuiltinUnpack) import Nix.DependencyGraph (DepGraph, TopoResult (..), buildDepGraph, topoSort) import qualified Nix.DependencyGraph-import Nix.Derivation (Derivation (..), DerivationOutput (..), currentPlatform, fromATerm, platformToText)+import Nix.Derivation (Derivation (..), DerivationOutput (..), Platform, currentPlatform, extraPlatforms, fromATerm, platformToText)+import Nix.Derivation.StructuredAttrs (decodeStructuredAttrs, renderAttrsJson, renderAttrsShell, stringsAttr, structuredAttrsKey, withOutputPlaceholders) import Nix.Hash (IncrementalHash, bytesToHexText, hashFinalizeBytes, hashInitWithAlgo, hashPlaceholder, hashUpdateChunk, hexToBytes, makeStorePath, rawHashWithAlgo)-import Nix.Store (PathLock, PathRegistration, Store (..), acquirePathLock, isValid, placeInStore, registerPaths, releasePathLock, scanReferences, scanTempReferences)+import Nix.Http (AttemptFailure (..), FetchRetryPolicy, attemptFailureMessage, catchSync, defaultFetchRetryPolicy, fetchStatusFailure, ioRetryEffects, retryTransient, transferFailureHandlers, withTransfer, withUserAgent)+import Nix.Store (PathLock, PathRegistration, Store (..), acquirePathLock, isValid, placeInStore, registerPaths, releasePathLock, scanReferences, scanTempReferences, volumeCaseHack) import qualified Nix.Store.ExecBit as ExecBit import Nix.Store.Path (StoreDir (..), StorePath (spHash, spName), StorePathNameError, defaultStoreDir, defaultStoreDirText, storePathToFilePath, unStoreDir)-import Nix.Substituter (CacheConfig, SubstResult (..), catchSync, trySubstitute)+import Nix.Substituter (CacheConfig, SubstResult (..), trySubstituteWith) import qualified NovaCache.NAR as NAR import System.Directory (createDirectoryIfMissing, doesDirectoryExist, doesPathExist, removeDirectoryRecursive, removePathForcibly) import qualified System.Environment import System.Exit (ExitCode (..)) import System.FilePath (takeDirectory, takeFileName, (</>)) import qualified System.IO-import qualified System.IO.Unsafe import qualified System.Info import qualified System.Process as Proc @@ -171,12 +174,6 @@ httpStatusOk :: Int httpStatusOk = 200 --- | User-Agent sent by @builtin:fetchurl@.  Some upstream servers (e.g.--- ftp.gnu.org) reject requests with no User-Agent as bot traffic with a 403,--- so the fetcher identifies itself like any other download client.-fetchUserAgent :: BS.ByteString-fetchUserAgent = "nova-nix (+https://github.com/Novavero-AI/nova-nix)"- -- | Environment variable for the reproducible-builds.org build timestamp. envSourceDateEpoch :: Text envSourceDateEpoch = "SOURCE_DATE_EPOCH"@@ -186,6 +183,17 @@ envImpureEnvVars :: Text envImpureEnvVars = "impureEnvVars" +-- | The variables naming a structured derivation's two attribute files.+envNixAttrsJsonFile, envNixAttrsShFile :: Text+envNixAttrsJsonFile = "NIX_ATTRS_JSON_FILE"+envNixAttrsShFile = "NIX_ATTRS_SH_FILE"++-- | Where in the build directory a structured derivation's attributes+-- land, under upstream's names.+attrsJsonFileName, attrsShellFileName :: FilePath+attrsJsonFileName = ".attrs.json"+attrsShellFileName = ".attrs.sh"+ -- | The fixed build timestamp handed to every builder: 1980-01-01 UTC. -- Determinism-aware tools (binutils @ld@ writes it into the PE header -- instead of the wall clock; gcc uses it for @__DATE__@\/@__TIME__@)@@ -209,6 +217,11 @@     bcCaches :: ![CacheConfig],     -- | Extraction budget for @builtin:unpack@ builds.     bcUnpackLimits :: !UnpackLimits,+    -- | How a download is retried: each URL of a @builtin:fetchurl@+    -- before the next is tried, and each narinfo and NAR the substituter+    -- requests, as upstream's one @download-attempts@ setting governs+    -- every transfer.+    bcFetchRetry :: !FetchRetryPolicy,     -- | Launchers for derivations whose @system@ this machine cannot execute     -- directly, keyed by that system string exactly as     -- 'Nix.Derivation.platformToText' spells it (@x86_64-windows@ -> a wine@@ -231,7 +244,8 @@           else "/tmp/nova-nix-build",       bcCaches = [],       bcExecWrappers = Map.empty,-      bcUnpackLimits = defaultUnpackLimits+      bcUnpackLimits = defaultUnpackLimits,+      bcFetchRetry = defaultFetchRetryPolicy     }  -- | Result of a build attempt.@@ -435,13 +449,22 @@ -- closure has already been realized. A system this machine cannot execute -- and has not been told how to is refused instead. execWrapperFor :: BuildConfig -> Derivation -> BuilderSpawn-execWrapperFor config drv-  | drvPlatform drv == currentPlatform = SpawnNative+execWrapperFor = spawnFor currentPlatform++-- | 'execWrapperFor' with the host named, so the rule can be checked for+-- every host on whichever one runs the suite.  A derivation for the host's+-- own system, or for one the host executes through its compatibility layer+-- ('extraPlatforms'), spawns directly whatever launchers are configured:+-- upstream runs its extra platforms natively and has no launcher notion.+spawnFor :: Platform -> BuildConfig -> Derivation -> BuilderSpawn+spawnFor host config drv+  | platform == host || platform `elem` extraPlatforms host = SpawnNative   | otherwise = case Map.lookup system (bcExecWrappers config) of       Just launcher -> SpawnThrough launcher       Nothing -> SpawnUnsupported system   where-    system = platformToText (drvPlatform drv)+    platform = drvPlatform drv+    system = platformToText platform  -- | The build, once every output knows where it is written and where it -- belongs.@@ -472,7 +495,7 @@       --    this - they read the byte fields directly.       exitResult <- case drvBuilder drv of         b-          | b == builtinFetchurlBuilder -> runBuiltinFetchurl drv outputDirs+          | b == builtinFetchurlBuilder -> runBuiltinFetchurl (bcFetchRetry config) drv outputDirs           | b == builtinUnpackBuilder -> runBuiltinUnpack (bcStoreDir config) (bcUnpackLimits config) drv outputDirs         _ -> case (execWrapperFor config drv, decodeBuilderStrings drv) of           (SpawnUnsupported system, _) ->@@ -492,7 +515,6 @@                 -- rewritten a second time.                 rewrite = rewritePlaceholders outputDirs . onStore config                 builderPath = T.unpack (onStore config builderText)-                environ = buildEnvironment config (rewriteEnv rewrite decodedEnv) builderPath buildDir outputDirs                 builderArgs = map (T.unpack . rewrite) argTexts                 -- Env still names the real builder - a launcher only                 -- changes what's spawned, not what the derivation says.@@ -504,12 +526,17 @@                 -- derivation type being non-sandboxed, which for us is                 -- exactly the fixed-output case.                 carriesHash out = not (T.null (doHashAlgo out))-                impureVars-                  | any carriesHash (drvOutputs drv) =-                      T.words (Map.findWithDefault "" envImpureEnvVars decodedEnv)-                  | otherwise = []-             in -- 5. Run the builder-                runBuilder spawnPath spawnArgs environ impureVars buildDir+                impureVars delivery+                  | any carriesHash (drvOutputs drv) = adImpureEnvVars delivery+                  | otherwise = Right []+             in case attrsDelivery rewrite buildDir outputDirs decodedEnv of+                  Left err -> pure (Left (1, "cannot process " <> structuredAttrsKey <> " attribute of '" <> formatDrvName drv <> "': " <> err))+                  Right delivery -> case impureVars delivery of+                    Left err -> pure (Left (1, err))+                    Right passed -> do+                      for_ (adFiles delivery) (uncurry BS.writeFile)+                      -- 5. Run the builder+                      runBuilder spawnPath spawnArgs (buildEnvironment config (adEnv delivery) builderPath buildDir) passed buildDir       case exitResult of         Left (exitCode, stderrText) -> do           -- Whatever the builder wrote is in the store now, so failure has@@ -591,26 +618,28 @@   let missingSrcs = [sp | (sp, valid) <- zip (drvInputSrcs drv) srcResults, not valid]   if not (null missingSrcs)     then pure (Left ("missing input sources: " <> T.intercalate ", " (map formatSP missingSrcs)))-    else case resolveInputOutputs config drv of-      Left err -> pure (Left err)-      Right requiredOutputs -> do-        outResults <- mapM (isValid store) requiredOutputs-        let missingOutputs = [sp | (sp, valid) <- zip requiredOutputs outResults, not valid]-        if not (null missingOutputs)-          then pure (Left ("missing input derivation outputs: " <> T.intercalate ", " (map formatSP missingOutputs)))-          else pure (Right ())+    else do+      resolved <- resolveInputOutputs config drv+      case resolved of+        Left err -> pure (Left err)+        Right requiredOutputs -> do+          outResults <- mapM (isValid store) requiredOutputs+          let missingOutputs = [sp | (sp, valid) <- zip requiredOutputs outResults, not valid]+          if not (null missingOutputs)+            then pure (Left ("missing input derivation outputs: " <> T.intercalate ", " (map formatSP missingOutputs)))+            else pure (Right ())  -- | Resolve each input derivation's requested output names to their store -- paths by reading the input @.drv@ from the store.  @Left@ if an input @.drv@ -- cannot be read or names an output the derivation does not define.-resolveInputOutputs :: BuildConfig -> Derivation -> Either Text [StorePath]+resolveInputOutputs :: BuildConfig -> Derivation -> IO (Either Text [StorePath]) resolveInputOutputs config drv =-  concat <$> traverse resolveOne (Map.toList (drvInputDrvs drv))+  runExceptT (concat <$> traverse resolveOne (Map.toList (drvInputDrvs drv)))   where     resolveOne (inputDrvPath, wantedOutputs) = do-      inputDrv <- readDrvFromStore config inputDrvPath+      inputDrv <- ExceptT (readDrvFromStore config inputDrvPath)       let outputMap = Map.fromList [(doName o, doPath o) | o <- drvOutputs inputDrv]-      traverse (lookupOutput inputDrvPath outputMap) wantedOutputs+      liftEither (traverse (lookupOutput inputDrvPath outputMap) wantedOutputs)     lookupOutput inputDrvPath outputMap name =       case Map.lookup name outputMap of         Just sp -> Right sp@@ -633,15 +662,14 @@         [] -> "no-output"    in bcTmpDir config </> uniqueSuffix --- | Remove the build directory, ignoring errors.+-- | Remove the build directory, ignoring a filesystem failure to remove+-- it.  It runs as the build's 'finally', where a directory that will not+-- go away must not replace the build's own outcome. cleanupBuildDir :: FilePath -> IO () cleanupBuildDir dir = do   exists <- doesDirectoryExist dir-  when exists $ do-    result <- try (removeDirectoryRecursive dir)-    case (result :: Either SomeException ()) of-      Right () -> pure ()-      Left _ -> pure () -- Best effort cleanup+  when exists $+    removeDirectoryRecursive dir `catch` \(_ :: IOException) -> pure ()  -- --------------------------------------------------------------------------- -- Environment@@ -668,7 +696,57 @@   where     rewritePair (name, value) = (rewrite name, rewrite value) --- | Build the process environment from the derivation env + standard vars.+-- | What a builder receives of its derivation beyond the builder path and+-- arguments.+data AttrsDelivery = AttrsDelivery+  { -- | Variables the derivation contributes to the environment.+    adEnv :: !(Map Text Text),+    -- | Files written into the build directory before the builder starts.+    adFiles :: ![(FilePath, BS.ByteString)],+    -- | The @impureEnvVars@ attribute, which matters only to a fixed-output+    -- derivation, so a malformed one fails only such a build, as upstream.+    adImpureEnvVars :: !(Either Text [Text])+  }++-- | How the derivation's attributes reach the builder: as environment+-- variables, outputs included, or for a derivation carrying structured+-- attributes, as @.attrs.json@ and @.attrs.sh@ in the build directory+-- named by two variables, with no attribute and no output in the+-- environment (upstream's @initTmpDir@ and @writeStructuredAttrs@,+-- local-derivation-goal.cc at 2.24.9).+--+-- @rewrite@ is the build's rewrite of store paths and placeholders.  It+-- applies to the shell file's text as upstream applies it, after+-- rendering; the JSON file's strings take it before they are escaped, so+-- a store directory holding backslashes still yields JSON.+attrsDelivery :: (Text -> Text) -> FilePath -> [(Text, FilePath)] -> Map Text Text -> Either Text AttrsDelivery+attrsDelivery rewrite buildDir outputDirs decodedEnv = case Map.lookup structuredAttrsKey decodedEnv of+  Nothing ->+    Right+      AttrsDelivery+        { adEnv = unionEnvs [outputEnv, rewriteEnv rewrite decodedEnv],+          adFiles = [],+          adImpureEnvVars = Right (T.words (Map.findWithDefault "" envImpureEnvVars decodedEnv))+        }+  Just encoded -> do+    attrs <- decodeStructuredAttrs encoded+    let prepared = withOutputPlaceholders (map fst outputDirs) attrs+        jsonFile = buildDir </> attrsJsonFileName+        shellFile = buildDir </> attrsShellFileName+    Right+      AttrsDelivery+        { adEnv = Map.fromList [(envNixAttrsJsonFile, T.pack jsonFile), (envNixAttrsShFile, T.pack shellFile)],+          adFiles =+            [ (jsonFile, renderAttrsJson rewrite prepared),+              (shellFile, TE.encodeUtf8 (rewrite (renderAttrsShell prepared)))+            ],+          adImpureEnvVars = fromMaybe [] <$> stringsAttr envImpureEnvVars attrs+        }+  where+    outputEnv = Map.fromList [(name, T.pack path) | (name, path) <- outputDirs]++-- | Build the process environment from the derivation's contribution+-- ('adEnv') + standard vars. -- The builder path is used to derive PATH entries - the builder's own -- directory and its sibling @usr\/bin@ are included so that coreutils -- shipped alongside the builder (e.g. Git for Windows' MSYS2 tools)@@ -679,15 +757,9 @@   Map Text Text ->   FilePath ->   FilePath ->-  [(Text, FilePath)] ->   Map Text Text-buildEnvironment config decodedEnv builderPath buildDir outputDirs =-  let -- Start with the derivation environment (values decoded at the-      -- spawn boundary by 'decodeBuilderStrings')-      baseEnv = decodedEnv-      -- Add output paths: $out, $dev, etc.-      outputEnv = Map.fromList [(name, T.pack path) | (name, path) <- outputDirs]-      -- Standard build variables+buildEnvironment config derivationEnv builderPath buildDir =+  let -- Standard build variables       standardEnv =         Map.fromList           [ (envNixBuildTop, T.pack buildDir),@@ -700,8 +772,8 @@             (envPath, buildPath builderPath),             (envSourceDateEpoch, sourceDateEpochValue)           ]-   in -- Priority: output paths > derivation env > standard env-      unionEnvs [outputEnv, baseEnv, standardEnv]+   in -- Priority: derivation env (output paths first) > standard env+      unionEnvs [derivationEnv, standardEnv]  -- | Union environment maps left to right (an earlier map's variable wins). -- On Windows environment names are one case-insensitive namespace, so@@ -884,13 +956,14 @@ -- Built-in fetcher (builtin:fetchurl) -- --------------------------------------------------------------------------- --- | Run a @builtin:fetchurl@ derivation: try URLs in order and verify the--- written bytes against the derivation's @outputHash@. Nix's bootstrap--- fetcher is baked into the binary because nothing can be fetched before a--- fetcher exists.  Returns the same @Either (exit, msg) ()@ shape as--- 'runBuilder', so the shared output-registration path is reused unchanged.-runBuiltinFetchurl :: Derivation -> [(Text, FilePath)] -> IO (Either (Int, Text) ())-runBuiltinFetchurl drv outputDirs =+-- | Run a @builtin:fetchurl@ derivation: try URLs in order, each under the+-- retry policy, and verify the written bytes against the derivation's+-- @outputHash@. Nix's bootstrap fetcher is baked into the binary because+-- nothing can be fetched before a fetcher exists.  Returns the same+-- @Either (exit, msg) ()@ shape as 'runBuilder', so the shared+-- output-registration path is reused unchanged.+runBuiltinFetchurl :: FetchRetryPolicy -> Derivation -> [(Text, FilePath)] -> IO (Either (Int, Text) ())+runBuiltinFetchurl policy drv outputDirs =   case (fetchUrlsFromEnv (drvEnv drv), lookup envOut outputDirs, fixedOutput) of     (Left err, _, _) -> pure (Left (1, "builtin:fetchurl: " <> err))     (_, Nothing, _) -> pure (Left (1, "builtin:fetchurl: derivation defines no 'out' output"))@@ -904,7 +977,7 @@           Nothing ->             pure (Left (1, "builtin:fetchurl: unsupported hash algorithm '" <> algo <> "'"))           Just ctx -> do-            result <- tryFetchUrlsWith (fetchAndVerify outPath out ctx) urls+            result <- tryFetchUrlsWith (fetchWithRetry outPath out ctx) urls             pure $ case result of               Left err -> Left (1, err)               Right value -> Right value@@ -916,11 +989,19 @@     fixedOutput = case drvOutputs drv of       (out : _) | not (T.null (doHashAlgo out)) -> Just out       _ -> Nothing+    fetchWithRetry outPath out ctx url =+      first attemptFailureMessage <$> retryTransient policy ioRetryEffects (fetchAndVerify outPath out ctx url)+    -- A download that completed and verifies wrong is the server's bytes,+    -- not a hiccup: upstream checks the hash after the transfer layer has+    -- given up retrying, so a mismatch is never retried.     fetchAndVerify outPath out ctx url = do       downloaded <- downloadUrlTo url outPath ctx       pure $ case downloaded of-        Left err -> Left ("builtin:fetchurl: " <> err)-        Right digest -> first snd (verifyFetchedDigest url out digest)+        Left failure -> Left (prefixFailure failure)+        Right digest -> first (FatalFailure . snd) (verifyFetchedDigest url out digest)+    prefixFailure failure = case failure of+      TransientFailure msg -> TransientFailure ("builtin:fetchurl: " <> msg)+      FatalFailure msg -> FatalFailure ("builtin:fetchurl: " <> msg)  -- | Nova's mirror extension uses the ASCII-whitespace-separated @urls@ field. -- An absent field preserves the legacy single @url@ interface. An explicit@@ -955,27 +1036,34 @@           Nothing -> pure (Left (T.intercalate "\n" (reverse (err : failures))))           Just urls -> go (err : failures) urls +-- ---------------------------------------------------------------------------+-- Download+-- ---------------------------------------------------------------------------+ -- | Download a URL to a file using nova-nix's own linked HTTP client -- (the same 'Network.HTTP.Client' the substituter uses) - no external -- @curl@, which is what makes this a genuine builtin.  The body streams -- to disk through the incremental hash chunk by chunk, so memory stays -- at chunk size no matter the download's size, and the returned digest--- is of exactly the written bytes. Synchronous exceptions become a 'Left';--- cancellation propagates through the shared build cleanup. Every attempt--- opens the output in WriteMode and starts from the original hash context.-downloadUrlTo :: Text -> FilePath -> IncrementalHash -> IO (Either Text BS.ByteString)+-- is of exactly the written bytes. A failure of the transfer or of the+-- write becomes a 'Left' carrying its retry class+-- ('transferFailureHandlers'); cancellation propagates through the shared+-- build cleanup. Every attempt opens the output in WriteMode and starts+-- from the original hash context, so a retry never resumes a torn+-- transfer: upstream resumes from the written offset when the server+-- accepts ranges and otherwise gives up, which this restart subsumes.+downloadUrlTo :: Text -> FilePath -> IncrementalHash -> IO (Either AttemptFailure BS.ByteString) downloadUrlTo url outPath ctx0 =-  fetch `catchSync` \err -> pure (Left ("download error: " <> T.pack (show err)))+  fetch `catches` transferFailureHandlers url   where-    fetch :: IO (Either Text BS.ByteString)+    fetch :: IO (Either AttemptFailure BS.ByteString)     fetch = do       manager <- HTTPS.getGlobalManager-      request0 <- HTTP.parseRequest (T.unpack url)-      let request = request0 {HTTP.requestHeaders = ("User-Agent", fetchUserAgent) : HTTP.requestHeaders request0}-      HTTP.withResponse request manager $ \response -> do-        let code = HTTP.statusCode (HTTP.responseStatus response)-        if code /= httpStatusOk-          then pure (Left ("HTTP " <> T.pack (show code) <> " fetching " <> url))+      request <- withUserAgent <$> HTTP.parseRequest (T.unpack url)+      withTransfer request manager $ \response -> do+        let status = HTTP.responseStatus response+        if HTTP.statusCode status /= httpStatusOk+          then pure (Left (fetchStatusFailure url status))           else System.IO.withBinaryFile outPath System.IO.WriteMode $ \handle ->             let consume !ctx = do                   chunk <- HTTP.brRead (HTTP.responseBody response)@@ -1057,10 +1145,10 @@   [OutputPlan] ->   IO BuildResult registerOutputs config store drv _buildDir plans = do-  let -- Candidates for reference scanning: input sources, the input-      -- derivations' realized OUTPUT paths, and this derivation's own outputs.-      inputOutputs = fromRight [] (resolveInputOutputs config drv)-      allCandidates = collectAllCandidates drv ++ inputOutputs+  -- Candidates for reference scanning: input sources, the input+  -- derivations' realized OUTPUT paths, and this derivation's own outputs.+  inputOutputs <- fromRight [] <$> resolveInputOutputs config drv+  let allCandidates = collectAllCandidates drv ++ inputOutputs       -- Deriver path is not available from the Derivation type alone;       -- the caller (buildWithDeps) would need to pass it through.       -- Register with no deriver for now - queryDeriver will return Nothing.@@ -1146,7 +1234,7 @@             [] -> do               refs <- dedupStorePaths <$> scanReferences candidates outDir               reg <- placeInStore store outDir targetSP drvPathText refs-              fixedCheck <- verifyFixedOutput output targetPath+              fixedCheck <- verifyFixedOutput (volumeCaseHack (stCaseSensitivity store)) output targetPath               case fixedCheck of                 Left err -> do                   -- Wrong bytes for a declared content address: remove the@@ -1163,14 +1251,15 @@ -- register as valid (upstream: the fixed-output check in its -- registerOutputs).  Flat mode hashes the output file's bytes; -- recursive (@r:@) mode hashes the canonical NAR of the placed tree.--- Non-fixed outputs (empty @doHashAlgo@) pass unchecked.-verifyFixedOutput :: DerivationOutput -> FilePath -> IO (Either Text ())-verifyFixedOutput out placedPath+-- Non-fixed outputs (empty @doHashAlgo@) pass unchecked.  The tree is+-- read back under the store volume's case-hack mode.+verifyFixedOutput :: NAR.CaseHack -> DerivationOutput -> FilePath -> IO (Either Text ())+verifyFixedOutput caseHack out placedPath   | T.null (doHashAlgo out) = pure (Right ())   | recursive = do       -- Re-serialises the placed tree: the registration's NAR hash is       -- always sha256, while the declared algorithm may be any.-      entry <- ExecBit.serialiseFromPath placedPath+      entry <- ExecBit.serialiseFromPath caseHack placedPath       pure (finish (rawHashWithAlgo algo (NAR.serialise entry)))   | otherwise = do       isDir <- doesDirectoryExist placedPath@@ -1247,8 +1336,9 @@ -- Returns 'BuildSuccess' with the root output path on success, or -- 'BuildFailure' if any dependency fails to build or substitute. buildWithDeps :: BuildConfig -> Store -> Derivation -> StorePath -> IO BuildResult-buildWithDeps config store rootDrv rootDrvPath =-  case buildDepGraph (readDrvFromStore config) rootDrv rootDrvPath of+buildWithDeps config store rootDrv rootDrvPath = do+  graph <- buildDepGraph (readDrvFromStore config) rootDrv rootDrvPath+  case graph of     Left err -> pure (BuildFailure ("dependency graph error: " <> err) 1)     Right depGraph ->       case topoSort depGraph of@@ -1269,27 +1359,15 @@ lookupDrv (Nix.DependencyGraph.DepGraph g) sp =   Nix.DependencyGraph.dnDerivation <$> Map.lookup sp g --- | Read and parse a .drv file from the store.------ Since 'buildDepGraph' is pure but needs to read immutable .drv files,--- we use 'System.IO.Unsafe.unsafePerformIO'.  This is safe because .drv--- files are write-once: their content is determined by their hash, so--- repeated reads always yield the same result.-readDrvFromStore :: BuildConfig -> StorePath -> Either Text Derivation-readDrvFromStore config sp =+-- | Read and parse a .drv file from the store, as bytes (no locale+-- decode, no newline translation).+readDrvFromStore :: BuildConfig -> StorePath -> IO (Either Text Derivation)+readDrvFromStore config sp = do   let drvFilePath = storePathToFilePath (bcStoreDir config) sp-   in case unsafeReadFile drvFilePath of-        Nothing -> Left ("cannot read .drv file: " <> T.pack drvFilePath)-        Just content -> fromATerm content---- | Read a file's raw bytes, returning Nothing on any error.  Used only--- for reading immutable .drv files from the store - byte IO, never--- text-mode (no locale decode, no newline translation).-unsafeReadFile :: FilePath -> Maybe BS.ByteString-unsafeReadFile path =-  case System.IO.Unsafe.unsafePerformIO (try (BS.readFile path)) of-    Left (_ :: SomeException) -> Nothing-    Right content -> Just content+  content <- try (BS.readFile drvFilePath)+  pure $ case content of+    Left (_ :: IOException) -> Left ("cannot read .drv file: " <> T.pack drvFilePath)+    Right bytes -> fromATerm bytes  -- --------------------------------------------------------------------------- -- Build in topological order@@ -1396,7 +1474,7 @@     -- finally owns it even when a later output's attempt fails or     -- throws.     substituteOne heldLocks sp = do-      result <- trySubstitute store (bcCaches config) sp+      result <- trySubstituteWith (bcFetchRetry config) ioRetryEffects store (bcCaches config) sp       case result of         SubstSuccess _ lock -> atomicModifyIORef' heldLocks (\locks -> (lock : locks, ()))         _ -> pure ()

@@ -55,7 +55,7 @@ import qualified Codec.Archive.Tar as Tar import qualified Codec.Archive.Tar.Entry as TarEntry import qualified Codec.Compression.Zstd.Lazy as Zstd-import Control.Exception (SomeException, try)+import Control.Exception (ErrorCall, Handler (..), IOException, catches) import Control.Monad (when) import Data.Bits ((.&.)) import qualified Data.ByteString as BS@@ -214,16 +214,20 @@ -- | Unpack one archive into @outDir@, returning the budget left for the -- archives after it.  The decompressor is chosen by file extension; the -- tar stream is decoded (GNU + pax long names) and extracted entry by--- entry.  Decompression errors surface lazily mid-stream, so the whole--- extraction is exception-wrapped into a clean failure.+-- entry.  The archive is read lazily and decoded as the entries are+-- forced, so a failure surfaces mid-extraction as one of two exceptions,+-- and the whole extraction is wrapped to turn either into a clean+-- failure: an 'IOException' reading the archive or writing the tree, or+-- the 'ErrorCall' the zstd decoder raises for a corrupt frame (its lazy+-- API reports every decoding error with 'error'). unpackArchive :: FilePath -> UnpackLimits -> FilePath -> IO (Either Text UnpackLimits)-unpackArchive outDir budget archivePath = do-  attempt <- try run-  pure $ case attempt of-    Left (e :: SomeException) ->-      Left (T.pack archivePath <> ": " <> T.pack (show e))-    Right result -> result+unpackArchive outDir budget archivePath =+  run+    `catches` [ Handler (\(e :: IOException) -> failed e),+                Handler (\(e :: ErrorCall) -> failed e)+              ]   where+    failed e = pure (Left (T.pack archivePath <> ": " <> T.pack (show e)))     run = case decoderFor archivePath of       Nothing -> pure (Left ("unsupported archive format: " <> T.pack archivePath))       Just decoder -> do

@@ -4,84 +4,87 @@ -- ~100 functions.  This module assembles the initial 'Env' from the -- central registry in "Nix.Eval" and adds standard constants -- (@true@, @false@, @null@, @storeDir@, @currentTime@,--- @currentSystem@, etc.).+-- @currentSystem@, etc.), among them @derivation@: upstream's wrapper+-- lambda around the @derivationStrict@ primop, evaluated from its source.+-- The impure constants follow the evaluation policy: under @pure-eval@+-- upstream installs neither @currentTime@ nor @currentSystem@+-- (@addConstant@ skips an @impureOnly@ constant), so neither exists here+-- then.+--+-- The environment is allocated in the C data layer, so 'builtinEnv' must+-- be forced between 'Nix.Eval.Arena.arenaInit' and+-- 'Nix.Eval.Arena.arenaDestroy'; outside that window forcing it raises+-- 'Nix.Eval.CStatus.ArenaNotInitialized'. module Nix.Builtins   ( -- * Builtin registration     builtinEnv,     builtinEnvWithScope,+    rootScopeNames,      -- * NIX_PATH parsing     parseNixPath,     splitNixPath,+    searchPathRoots,+    isNixPathPseudoUrl,   ) where +import Data.ByteString (ByteString)+import qualified Data.ByteString as BS+import qualified Data.ByteString.Char8 as BC import Data.Char (isAsciiLower, isAsciiUpper) import Data.Int (Int64)+import Data.Map.Strict (Map) import qualified Data.Map.Strict as Map+import Data.Maybe (fromMaybe, mapMaybe)+import Data.Set (Set)+import qualified Data.Set as Set import Data.Text (Text) import qualified Data.Text as T+import qualified Data.Text.Encoding as TE import Foreign.Ptr (nullPtr)-import Nix.Eval (Env (..), NixValue (..), Thunk (..), attrSetFromMap, builtinNames, currentSystemStr, evaluated)-import Nix.Eval.Types (clistFromThunks, mkStr, newCEnv, thunkToCPtr)+import Nix.Eval (Env (..), NixValue (..), Thunk (..), attrSetFromMap, attrSetLookup, builtinNames, currentSystemStr, deferApply, evaluated, readThunkValue)+import Nix.Eval.Types (AttrSet, EvalPolicy (..), cheapThunk, clistFromThunks, mkStr, mkStrBytes, newCEnv, thunkToCPtr)+import Nix.Expr.Resolve (impureOnlyGlobalNames, staticGlobalNames)+import Nix.Parser (parseNixWithScope) import Nix.Store.Path (defaultStoreDirText) --- | The initial environment containing all builtins.+-- | The initial environment: every name upstream's base environment binds+-- under the policy ('rootScopeNames'), each holding the value @builtins@+-- holds under that name less a @__@ prefix, as upstream's @addPrimOp@ and+-- @addConstant@ install one value under both (eval.cc at 2.24.9).  So+-- @__typeOf@ is @builtins.typeOf@, and @map@ is @builtins.map@. ----- Real Nix exposes a subset of builtins at the top level without--- the @builtins.@ prefix.  These are the functions most commonly--- used unqualified in nixpkgs and user code.+-- @fetchMercurial@ is the one name upstream binds by default that nova-nix+-- does not implement: it is bound as a builtin of that name, so binding+-- accepts it and a call fails with the evaluator's unknown-builtin error.+-- @builtins@ does not list it, so feature tests still see it is missing. -- -- @currentTime@ is an integer constant (seconds since epoch), -- passed in at startup.  In tests, pass @0@. -- -- @searchPaths@ populates @builtins.nixPath@.  Parsed from @NIX_PATH@ -- by 'parseNixPath'.  In tests, pass @[]@.-builtinEnv :: Int64 -> [Thunk] -> Env-builtinEnv timestamp searchPaths =-  let scope =-        attrSetFromMap-          $ Map.fromList-          $-          -- Values-          [ ("true", evaluated (VBool True)),-            ("false", evaluated (VBool False)),-            ("null", evaluated VNull),-            ("builtins", evaluated (builtinsAttrSet timestamp searchPaths)),-            -- Search path support: <name> desugars to __findFile __nixPath "name"-            -- (matching C++ Nix's parser desugaring).-            ("__findFile", evaluated (VBuiltin "findFile" [])),-            ("__nixPath", evaluated (VList (clistFromThunks (map thunkToCPtr searchPaths))))-          ]-            -- Top-level builtin functions (available without builtins. prefix)-            ++ map topLevelBuiltin topLevelBuiltinNames+--+-- The policy decides which constants exist: see 'standardEntries'.+builtinEnv :: EvalPolicy -> Int64 -> [Thunk] -> Env+builtinEnv policy timestamp searchPaths =+  let builtinsSet = builtinsAttrSet policy timestamp searchPaths+      bind name+        | name == "builtins" = evaluated (VAttrs builtinsSet)+        | otherwise =+            let unprefixed = fromMaybe name (T.stripPrefix "__" name)+             in fromMaybe (evaluated (VBuiltin unprefixed [])) (attrSetLookup unprefixed builtinsSet)+      scope = attrSetFromMap (Map.fromSet bind (rootScopeNames policy))    in newCEnv nullPtr 0 (Just scope) Nothing nullPtr 0 --- | Builtins exposed at the top level (without @builtins.@ prefix).--- This matches real Nix - nixpkgs uses these unqualified everywhere.--- Exactly upstream's unprefixed surface: fetchurl and toFile are--- deliberately NOT here (upstream exposes them only under @builtins.@,--- and nixpkgs relies on @with pkgs; fetchurl@ binding pkgs.fetchurl).-topLevelBuiltinNames :: [Text]-topLevelBuiltinNames =-  [ "abort",-    "baseNameOf",-    "break",-    "derivation",-    "derivationStrict",-    "dirOf",-    "fetchGit",-    "fetchTarball",-    "fromTOML",-    "import",-    "isNull",-    "map",-    "placeholder",-    "removeAttrs",-    "scopedImport",-    "throw",-    "toString"-  ]+-- | The names the root environment binds under a policy: upstream's base+-- environment, which leaves out its @impureOnly@ constants under+-- @pure-eval@.  Source evaluated in 'builtinEnv' is bound against these.+rootScopeNames :: EvalPolicy -> Set Text+rootScopeNames policy+  | epPureEval policy = staticGlobalNames `Set.difference` impureOnlyGlobalNames+  | otherwise = staticGlobalNames  -- | Create a top-level binding for a builtin function. topLevelBuiltin :: Text -> (Text, Thunk)@@ -89,23 +92,29 @@  -- | Like 'builtinEnv' but with additional scope bindings overlaid on -- the top-level environment.  Used by @scopedImport@.-builtinEnvWithScope :: Int64 -> [Thunk] -> [(Text, Thunk)] -> Env-builtinEnvWithScope timestamp searchPaths scope =-  let base = builtinEnv timestamp searchPaths+builtinEnvWithScope :: EvalPolicy -> Int64 -> [Thunk] -> [(Text, Thunk)] -> Env+builtinEnvWithScope policy timestamp searchPaths scope =+  let base = builtinEnv policy timestamp searchPaths       scopeMap = Map.fromList scope    in newCEnv nullPtr 0 (Just (attrSetFromMap scopeMap)) (Just base) nullPtr 0  -- | The @builtins@ attribute set, derived from the central registry.-builtinsAttrSet :: Int64 -> [Thunk] -> NixValue-builtinsAttrSet timestamp searchPaths =-  VAttrs $ attrSetFromMap $ Map.union builtinEntries (standardEntries timestamp searchPaths)+builtinsAttrSet :: EvalPolicy -> Int64 -> [Thunk] -> AttrSet+builtinsAttrSet policy timestamp searchPaths =+  attrSetFromMap $ Map.union builtinEntries (standardEntries policy timestamp searchPaths)   where     builtinEntries =       Map.fromList [(name, evaluated (VBuiltin name [])) | name <- builtinNames] -standardEntries :: Int64 -> [Thunk] -> Map.Map Text Thunk-standardEntries timestamp searchPaths =-  Map.fromList+-- | The constants beside the registry.  @currentTime@ and @currentSystem@+-- are upstream's @impureOnly@ constants and are absent under @pure-eval@+-- (@builtins ? currentTime@ is @false@ there, observed from+-- nix-instantiate 2.33.2); @nixPath@ stays, holding whatever search path+-- the caller passed, which under @pure-eval@ is what upstream leaves of+-- it.+standardEntries :: EvalPolicy -> Int64 -> [Thunk] -> Map.Map Text Thunk+standardEntries policy timestamp searchPaths =+  Map.fromList $     [ ("true", evaluated (VBool True)),       ("false", evaluated (VBool False)),       ("null", evaluated VNull),@@ -116,84 +125,228 @@       ("nixVersion", evaluated (mkStr "2.24.0")),       ("langVersion", evaluated (VInt 6)),       ("nixPath", evaluated (VList (clistFromThunks (map thunkToCPtr searchPaths)))),-      ("currentTime", evaluated (VInt timestamp)),-      ("currentSystem", evaluated (mkStr currentSystemStr))+      ("derivation", derivationWrapper)     ]+      ++ [("currentTime", evaluated (VInt timestamp)) | not (epPureEval policy)]+      ++ [("currentSystem", evaluated (mkStr currentSystemStr)) | not (epPureEval policy)]  -- ---------------------------------------------------------------------------+-- The derivation constant+-- ---------------------------------------------------------------------------++-- | Upstream's @src\/libexpr\/primops\/derivation.nix@ at 2.24.9, without its+-- documentation comment.  @derivation@ is this lambda, not a primop, so the+-- result set has upstream's shape by construction: every output attribute+-- is the complete derivation set for that output, @all@ lists them,+-- @drvAttrs@ is the argument set, and @derivationStrict@ is reached only+-- through @outPath@ and @drvPath@, which is what keeps forcing a derivation+-- to WHNF from forcing any of its inputs.+derivationWrapperSource :: Text+derivationWrapperSource =+  T.unlines+    [ "drvAttrs @ { outputs ? [ \"out\" ], ... }:",+      "",+      "let",+      "",+      "  strict = derivationStrict drvAttrs;",+      "",+      "  commonAttrs = drvAttrs // (builtins.listToAttrs outputsList) //",+      "    { all = map (x: x.value) outputsList;",+      "      inherit drvAttrs;",+      "    };",+      "",+      "  outputToAttrListElement = outputName:",+      "    { name = outputName;",+      "      value = commonAttrs // {",+      "        outPath = builtins.getAttr outputName strict;",+      "        drvPath = strict.drvPath;",+      "        type = \"derivation\";",+      "        inherit outputName;",+      "      };",+      "    };",+      "",+      "  outputsList = map outputToAttrListElement outputs;",+      "",+      "in (builtins.head outputsList).value"+    ]++-- | The name upstream gives the wrapper's source in error positions.+derivationWrapperName :: Text+derivationWrapperName = "derivation-internal.nix"++-- | The bindings the wrapper's free variables resolve to.  Upstream evaluates+-- the file in its base environment; this is the slice of that environment+-- the wrapper reads, so the constant needs no knot through 'builtinEnv'.+-- The wrapper is bound against these names too, so it cannot read one the+-- slice lacks.+derivationWrapperScope :: Map Text Thunk+derivationWrapperScope =+  let builtinsUsed = ["getAttr", "head", "listToAttrs"]+   in Map.fromList+        [ ("derivationStrict", evaluated (VBuiltin "derivationStrict" [])),+          ("map", evaluated (VBuiltin "map" [])),+          ("builtins", evaluated (VAttrs (attrSetFromMap (Map.fromList (map topLevelBuiltin builtinsUsed)))))+        ]+{-# NOINLINE derivationWrapperScope #-}++-- | 'derivationWrapperScope' as the wrapper's environment.+derivationWrapperEnv :: Env+derivationWrapperEnv =+  newCEnv nullPtr 0 (Just (attrSetFromMap derivationWrapperScope)) Nothing nullPtr 0+{-# NOINLINE derivationWrapperEnv #-}++-- | The @derivation@ constant: the wrapper lambda closed over+-- 'derivationWrapperEnv'.  One value bound in both the root scope and+-- @builtins@, as upstream's @addConstant@ binds it.  It is compiled once+-- for the process rather than once per environment: 'builtinEnv' runs for+-- every imported file, and the arena the lambda lives in is the process's+-- ("Nix.Eval.Arena").  The source is a constant, so a parse failure is a+-- defect in this module; it surfaces as an abort at the first use of+-- @derivation@ rather than as a crash while the environment is assembled.+derivationWrapper :: Thunk+derivationWrapper =+  case parseNixWithScope (Map.keysSet derivationWrapperScope) "/" derivationWrapperName derivationWrapperSource of+    Right expr -> cheapThunk derivationWrapperEnv expr+    Left err -> abortingThunk ("the derivation wrapper does not parse: " <> T.pack (show err))+{-# NOINLINE derivationWrapper #-}++-- | A thunk that aborts evaluation with the message when forced: @abort@+-- applied to it, deferred the way "Nix.Eval" defers any application.+abortingThunk :: Text -> Thunk+abortingThunk message = deferApply (VBuiltin "abort" []) (evaluated (mkStr message))++-- --------------------------------------------------------------------------- -- NIX_PATH parsing -- ---------------------------------------------------------------------------  -- | Parse a @NIX_PATH@-formatted string into a list of search path entry -- thunks.  Each entry becomes a @{ prefix, path }@ attrset. ----- Format: colon-separated entries, each either @name=path@ or plain @path@.--- A plain path gets an empty prefix (matching real Nix behaviour).+-- Format: colon-separated entries, each either @name=path@ or plain @path@,+-- split at the first @=@.  A plain path gets an empty prefix (matching+-- real Nix behaviour).  The prefix and path keep the entry's bytes, as+-- upstream's @LookupPath::Elem::parse@ keeps them+-- (src/libexpr/search-path.cc at Nix 2.24.9). -- -- >>> parseNixPath "nixpkgs=/home/user/nixpkgs:custom=/opt/custom" -- [Evaluated (VAttrs {"prefix": "nixpkgs", "path": "/home/user/nixpkgs"}), ...]-parseNixPath :: Text -> [Thunk]+parseNixPath :: ByteString -> [Thunk] parseNixPath raw-  | T.null raw = []+  | BS.null raw = []   | otherwise = map parseEntry (splitNixPath raw)   where     parseEntry entry =-      let (prefix, path) = case T.breakOn "=" entry of+      let (prefix, path) = case BC.break (== '=') entry of             (before, after)-              | T.null after -> ("", before)-              | otherwise -> (before, T.drop 1 after)+              | BS.null after -> ("", before)+              | otherwise -> (before, BS.drop 1 after)        in evaluated             ( VAttrs                 ( attrSetFromMap $                     Map.fromList-                      [ ("prefix", evaluated (mkStr prefix)),-                        ("path", evaluated (mkStr path))+                      [ ("prefix", evaluated (mkStrBytes prefix)),+                        ("path", evaluated (mkStrBytes path))                       ]                 )             ) --- | Split a NIX_PATH string on colon separators.  A colon stays part of--- its entry, rather than separating, in exactly two shapes:+-- | The @path@ of every search path entry 'parseNixPath' produced, for the+-- restricted-mode allow list: upstream allows every lookup path root+-- (@resolveLookupPathPath@ with @initAccessControl@), so the roots are+-- read back from the very list the evaluator will search.  A root is the+-- bytes the entry holds.  An entry that is not an attribute set with a+-- string or path @path@ contributes nothing.+searchPathRoots :: [Thunk] -> [ByteString]+searchPathRoots = mapMaybe entryRoot+  where+    entryRoot thunk = do+      VAttrs attrs <- readThunkValue thunk+      pathThunk <- attrSetLookup "path" attrs+      pathVal <- readThunkValue pathThunk+      case pathVal of+        VStr bytes _ -> Just bytes+        VPath p -> Just (TE.encodeUtf8 p)+        _ -> Nothing++-- | URL schemes that keep a @NIX_PATH@ entry whole when @://@ follows+-- them: the allowlist in @EvalSettings::isPseudoUrl@,+-- src/libexpr/eval-settings.cc at Nix 2.24.9.+nixPathUrlSchemes :: [ByteString]+nixPathUrlSchemes = ["http", "https", "file", "channel", "git", "s3", "ssh"]++-- | Schemes that keep a @NIX_PATH@ entry whole whatever follows their+-- colon: @isPseudoUrl@'s @channel:@ test and @parseNixPath@'s @flake:@+-- test, both in src/libexpr/eval-settings.cc at Nix 2.24.9.+nixPathBareSchemes :: [ByteString]+nixPathBareSchemes = ["channel", "flake"]++-- | Whether a search path entry's path names something fetched rather+-- than a place on this filesystem: upstream's @EvalSettings::isPseudoUrl@+-- (a @channel:@ prefix, or one of 'nixPathUrlSchemes' before @://@),+-- plus the @flake:@ entries a lookup path hook resolves+-- (@resolveLookupPathPath@ in src/libexpr/eval.cc at Nix 2.24.9).+isNixPathPseudoUrl :: ByteString -> Bool+isNixPathPseudoUrl path =+  any (\bare -> (bare <> ":") `BS.isPrefixOf` path) nixPathBareSchemes+    || (not (BS.null afterScheme) && scheme `elem` nixPathUrlSchemes)+  where+    (scheme, afterScheme) = BS.breakSubstring "://" path++-- | Split a @NIX_PATH@ string into entries the way upstream's+-- @EvalSettings::parseNixPath@ does (src/libexpr/eval-settings.cc at+-- Nix 2.24.9).  An entry runs to the first colon.  That colon stays in+-- the entry, which then extends through exactly one more colon-free+-- run, when the text between the last @=@ before the colon (or the+-- entry's start) and the colon is: ----- * a URL colon - followed by @//@ - so an entry like---   @nixpkgs=https://example.com/nixpkgs.tar.gz@ stays whole (upstream's---   NIX_PATH parser keeps pseudo-URL entries whole);--- * a Windows drive colon - preceded by a single ASCII letter that opens---   the entry or follows @=@, and followed by @\\@ or @/@ - so @C:\\x@,---   @C:/x@, and @nixpkgs=C:\\x@ stay whole.+-- * one of 'nixPathBareSchemes', whatever follows the colon, so+--   @channel:nixos-24.11@ and @nixpkgs=channel:nixos-24.11@ stay whole;+-- * one of 'nixPathUrlSchemes' with @//@ after the colon, so+--   @nixpkgs=https://example.com/nixpkgs.tar.gz@ stays whole while an+--   unlisted @foo://x@ splits into @foo@ and @//x@, as it does upstream;+-- * a single ASCII letter with @/@ or @\\@ after the colon: a Windows+--   drive colon, so @C:\\x@, @C:/x@ and @nixpkgs=C:\\x@ stay whole.+--   Upstream has no such rule and splits every drive path at its letter+--   (nix-instantiate 2.33.2 reports @C:\\a@ as the entries @C@ and @\\a@).+--   The rule also keeps a one-letter scheme such as @C://x@ whole, which+--   upstream splits into @C@ and @//x@. ----- Every other colon separates, so a Unix-style list of absolute paths--- (@/foo:/bar@) splits at each colon: @/foo@ does not end in a drive--- letter, and a lone @/@ after the colon is not a URL.-splitNixPath :: Text -> [Text]-splitNixPath = go []+-- Only one further run is absorbed, so @https://example.com:8080/x@+-- splits after the host exactly as it does upstream.  Every other colon+-- separates: @/foo:/bar@ is two entries.  An empty entry is dropped:+-- @a::b@ is @a@ and @b@, @::x@ is @x@, @a:@ is @a@.  Upstream's parser+-- emits a leading or interior empty entry (never a trailing one), but+-- the entries are then round-tripped through a whitespace-separated+-- setting (initGC in src/libexpr/eval-gc.cc) that drops it, so+-- @builtins.nixPath@ never shows one.  That round trip also splits an+-- entry at a space, which is not reproduced here: a Windows path may+-- contain one, the same reason the drive rule above diverges.+--+-- The split works on bytes, as upstream's does.  Every delimiter is+-- ASCII, and no byte of a multibyte UTF-8 sequence is, so a UTF-8 entry+-- splits exactly where its text would and any other byte passes through+-- unchanged.+splitNixPath :: ByteString -> [ByteString]+splitNixPath = filter (not . BS.null) . go   where-    -- Accumulates reversed chunks and concatenates once per entry, so a-    -- long entry costs O(n) instead of the O(n^2) of per-character snoc.-    go !chunks remaining =-      let (chunk, rest) = T.break (== ':') remaining-       in case T.uncons rest of-            Nothing ->-              let entry = T.concat (reverse (chunk : chunks))-               in [entry | not (T.null entry)]-            Just (_, afterColon)-              | keepsColon (null chunks) chunk afterColon ->-                  go (T.take 1 afterColon : ":" : chunk : chunks) (T.drop 1 afterColon)-              | otherwise ->-                  T.concat (reverse (chunk : chunks)) : go [] afterColon-    -- Whether the colon between chunk and afterColon is a URL or drive-    -- colon (the two shapes above).  atEntryStart says chunk opens its-    -- entry (nothing absorbed before it), so a lone letter can only be a-    -- drive letter there.-    keepsColon atEntryStart chunk afterColon-      | T.isPrefixOf "//" afterColon = True-      | startsWithPathSep afterColon = endsInDriveLetter atEntryStart chunk-      | otherwise = False-    startsWithPathSep t = case T.uncons t of-      Just (c, _) -> c == '/' || c == '\\'+    go remaining+      | BS.null remaining = []+      | otherwise =+          let (segment, rest) = BC.break (== ':') remaining+           in case BC.uncons rest of+                Nothing -> [segment]+                Just (_, afterColon)+                  | keepsColon (BC.takeWhileEnd (/= '=') segment) afterColon ->+                      let (absorbed, afterEntry) = BC.break (== ':') afterColon+                       in BS.concat [segment, ":", absorbed] : go (BS.drop 1 afterEntry)+                  | otherwise -> segment : go afterColon+    keepsColon scheme afterColon+      | scheme `elem` nixPathBareSchemes = True+      | scheme `elem` nixPathUrlSchemes = BS.isPrefixOf "//" afterColon+      | otherwise = isDriveLetter scheme && startsWithPathSep afterColon+    isDriveLetter scheme = case BC.uncons scheme of+      Just (letter, afterLetter) -> BS.null afterLetter && (isAsciiUpper letter || isAsciiLower letter)       Nothing -> False-    endsInDriveLetter atEntryStart chunk = case T.unsnoc chunk of-      Just (beforeLetter, letter) ->-        (isAsciiUpper letter || isAsciiLower letter)-          && (T.isSuffixOf "=" beforeLetter || (atEntryStart && T.null beforeLetter))+    startsWithPathSep t = case BC.uncons t of+      Just (c, _) -> c == '/' || c == '\\'       Nothing -> False

@@ -1,20 +1,65 @@ -- | Nix configuration: the @nix.conf@ / @NIX_CONFIG@ settings that decide--- which binary caches a machine substitutes from and which public keys it--- trusts.+-- which binary caches a machine substitutes from, which public keys it+-- trusts, how deep function calls may nest, and how far an evaluation+-- may reach (@restrict-eval@, @pure-eval@, @allowed-uris@). -- -- == The format -- -- One @name = value@ assignment per line.  A @#@ truncates the rest of the--- line (a comment).  A list value is whitespace separated.  These are the--- rules upstream's @parseConfigFiles@ applies (comment truncation, no line--- continuation, whitespace tokenizing), matched here.+-- line (a comment).  A list value is whitespace separated.  An @include@+-- or @!include@ line splices another file in at that position: the path+-- is resolved against the directory of the file being parsed, and the two+-- forms differ only in that @!include@ goes on without a file that cannot+-- be read.  These are the rules upstream's @parseConfigFiles@ applies+-- (@config.cc@ at 2.24.9: comment truncation, no line continuation,+-- whitespace tokenizing, inline include expansion), matched here.  A+-- Boolean value is one of @true@, @yes@, @1@, @false@, @no@, @0@+-- (upstream's @BaseSetting\<bool\>::parse@), and any other spelling is+-- an error.  An integer value is upstream's too ('parseUnsignedSetting'):+-- decimal digits, an optional leading @+@, and an optional binary unit+-- suffix (@K@, @M@, @G@, @T@). --+-- == Bytes+--+-- A source is bytes until a setting takes a value from it, as upstream's+-- @std::string@ is.  A line splits into tokens on upstream's separators+-- alone (space, tab, CR, LF), not on every Unicode space; a comment, and+-- the value of a setting this layer does not model, are never decoded;+-- and an include target reaches the open as the bytes the line holds+-- ("Nix.HostPath"), so a target with no UTF-8 reading names the file it+-- names on disk.  A Boolean or integer setting compares the value's bytes+-- with what it accepts, so a byte with no UTF-8 reading there is+-- upstream's own invalid-value error.  A list setting's tokens are+-- decoded strictly where upstream keeps them as bytes, because everything+-- downstream holds them as text (a substituter's URL, a key matched+-- against a narinfo's signatures, a URI prefix matched against the+-- evaluator's URIs).  A token that is not UTF-8 is refused rather than+-- spelled with U+FFFD, which would name a different cache, key or URI.+--+-- == Where the files are+--+-- Upstream's @loadConfFile@ (@globals.cc@) reads, weakest first: the system+-- file @$NIX_CONF_DIR\/nix.conf@, by default under the platform's+-- machine-wide config directory (@\/etc\/nix@ where upstream runs), the+-- directory having to be absolute and being collapsed lexically as the+-- @Settings@ constructor runs it through @canonPath@; the user files,+-- which are @$NIX_USER_CONF_FILES@ when that is set and otherwise+-- @nix\/nix.conf@ under the XDG config home and then under each+-- @XDG_CONFIG_DIRS@ entry, applied back to front so the first listed wins;+-- then @NIX_CONFIG@.  'configFilePaths' computes that order from the+-- environment and the platform's directories, which the caller looks up+-- (this module holds no platform literal), and 'loadConfig' reads and+-- folds it.+-- -- == Precedence -- -- Sources are folded weakest first, so a later source overrides an earlier -- one.  A plain assignment REPLACES the accumulated value; an @extra-@--- prefixed assignment APPENDS to it.  The caller supplies the sources in--- order (built-in default, then files, then @NIX_CONFIG@, then the command+-- prefixed assignment APPENDS to a list.  An @extra-@ on a Boolean or a+-- scalar names no setting (upstream appends only to an appendable+-- setting, so @extra-max-call-depth@ is an unknown name) and is ignored+-- like any unknown name.  The caller supplies the sources in order+-- (built-in default, then files, then @NIX_CONFIG@, then the command -- line), so the command line wins, exactly as upstream orders them. -- -- == Security@@ -23,83 +68,465 @@ -- accepted under.  The precedence is therefore load bearing: a source that -- REPLACES the trusted set where it should APPEND, or an @extra-@ that is -- mishandled, silently widens what the machine trusts.  The fold here is--- pure and total so the whole rule set can be tested directly.+-- pure and total so the whole rule set can be tested directly, and the+-- include expander is written over a file-reading effect+-- ('ReadConfigFile') for the same reason. ----- Not yet modelled (tracked separately): @include@ \/ @!include@--- directives, the @\/etc\/nix@ system file and the @XDG_CONFIG_DIRS@--- cascade.  A line opening with @include@ is refused loudly rather than--- silently skipped, so a config that depends on one fails visibly.+-- One deliberate divergence: upstream silently drops an @include@ whose+-- file exists but cannot be read (its own TODO questions that).  Here a+-- required include that cannot be read is an error, because the only+-- thing @include@ promises over @!include@ is to fail when the file is+-- unusable, and an include is where a site narrows the substituter or+-- trusted-key set; dropping it leaves the wider set in force.  The reader+-- therefore reports which of the two happened ('ConfigReadFailure'), so a+-- missing include is reported in upstream's words and an unreadable one+-- in its own. module Nix.Config   ( -- * Resolved settings     NixConfig (..),     defaultNixConfig, +    -- * Where the files are+    ConfigLocations (..),+    configFilePaths,+    nixConfFileName,+    nixConfDirName,++    -- * Sources and includes+    ConfigSource (..),+    nixConfigSourceName,+    ConfigReadFailure (..),+    ReadConfigFile,+    loadConfig,+    expandConfigSource,+     -- * Parsing and folding+    ConfigLine (..),+    IncludeMode (..),     ConfigAssignment (..),-    parseConfigText,+    parseConfigLines,+    parseUnsignedSetting,     applyAssignment,-    applyConfigText,     resolveConfig,   ) where +import Control.Applicative ((<|>))+import Control.Monad (foldM, mfilter, when)+import Control.Monad.Except (ExceptT (..), liftEither, runExceptT, throwError)+import Control.Monad.Trans (lift)+import Data.ByteString (ByteString)+import qualified Data.ByteString as BS+import qualified Data.ByteString.Char8 as BS8+import Data.Char (isDigit, ord, toUpper)+import Data.Either (rights)+import Data.List (dropWhileEnd, intercalate)+import Data.List.NonEmpty (NonEmpty (..))+import qualified Data.List.NonEmpty as NE+import Data.Maybe (catMaybes, fromMaybe, maybeToList) import Data.Text (Text)-import qualified Data.Text as T+import qualified Data.Text.Encoding as TE+import Data.Word (Word32)+import Nix.Eval.CallDepth (defaultMaxCallDepth)+import Nix.HostPath (hostPathFromBytes, hostPathText)+import System.OsPath (OsChar, OsPath, OsString, (</>))+import qualified System.OsPath as OP  -- --------------------------------------------------------------------------- -- Settings -- --------------------------------------------------------------------------- --- | The subset of Nix settings that this layer resolves: the binary caches--- to try and the public keys their signatures are trusted under.  Both are--- ordered lists (upstream's @substituters@ is a @Strings@, and--- @trusted-public-keys@ is too); order is preserved on write, though it--- does not affect key acceptance (any trusted key is enough).+-- | The subset of Nix settings that this layer resolves.  The lists are+-- ordered (upstream's @substituters@, @trusted-public-keys@ and+-- @allowed-uris@ are each a @Strings@); order is preserved on write, though+-- it does not affect key acceptance (any trusted key is enough) or URI+-- admission (any prefix is enough). data NixConfig = NixConfig   { ncSubstituters :: ![Text],-    ncTrustedPublicKeys :: ![Text]+    ncTrustedPublicKeys :: ![Text],+    -- | Upstream's @max-call-depth@: how many function calls may be+    -- active around a new one before evaluation refuses it.+    ncMaxCallDepth :: !Word32,+    -- | URI prefixes a fetch may reach under @restrict-eval@.+    ncAllowedUris :: ![Text],+    -- | Upstream @restrict-eval@.+    ncRestrictEval :: !Bool,+    -- | Upstream @pure-eval@.+    ncPureEval :: !Bool   }   deriving (Eq, Show) --- | The baseline the fold starts from: no substituters and no trusted--- keys.  This is nova-nix's existing default (nothing is substituted--- unless configured), a deliberate divergence from upstream's--- cache.nixos.org default: turning a cache on for every machine is the--- operator's decision to make in a config file, not a built-in.+-- | The baseline the fold starts from: no substituters, no trusted keys,+-- upstream's call-depth ceiling, no allowed URIs, and both evaluation+-- modes off.  The empty substituter list is nova-nix's existing default+-- (nothing is substituted unless configured), a deliberate divergence+-- from upstream's cache.nixos.org default: turning a cache on for every+-- machine is the operator's decision to make in a config file, not a+-- built-in.  The other defaults are upstream's own. defaultNixConfig :: NixConfig-defaultNixConfig = NixConfig {ncSubstituters = [], ncTrustedPublicKeys = []}+defaultNixConfig =+  NixConfig+    { ncSubstituters = [],+      ncTrustedPublicKeys = [],+      ncMaxCallDepth = defaultMaxCallDepth,+      ncAllowedUris = [],+      ncRestrictEval = False,+      ncPureEval = False+    }  -- ---------------------------------------------------------------------------+-- Where the files are+-- ---------------------------------------------------------------------------++-- | The environment that decides which files are read.  The two variables+-- are carried raw, as the bytes 'Nix.Environment.lookupEnvBytes' returns,+-- because upstream reads them differently: an empty @NIX_CONF_DIR@ is+-- unset (@getEnvNonEmpty@), while an empty @NIX_USER_CONF_FILES@ is set+-- and names no files at all.  The directories arrive resolved, since the+-- platform defaults behind them (where the machine-wide config directory+-- is, what the XDG config home and dirs fall back to) are the caller's to+-- look up.+data ConfigLocations = ConfigLocations+  { -- | @NIX_CONF_DIR@.+    clConfDir :: !(Maybe ByteString),+    -- | The platform's machine-wide config directory, where the system+    -- file is unless @NIX_CONF_DIR@ moves it; 'Nothing' on a platform+    -- that names none, and then there is no system file to read.+    clSystemConfDir :: !(Maybe OsPath),+    -- | @NIX_USER_CONF_FILES@.+    clUserConfFiles :: !(Maybe ByteString),+    -- | The XDG config home.+    clConfigHome :: !OsPath,+    -- | The XDG config dirs, first entry strongest.+    clConfigDirs :: ![OsPath]+  }+  deriving (Eq, Show)++-- | The config files to read, weakest first: the system file, under+-- @NIX_CONF_DIR@ when that is set and non-empty and otherwise under the+-- platform's machine-wide directory (no file at all when the platform has+-- none); then the user files in reverse of the order upstream lists them,+-- since @loadConfFile@ walks @nixUserConfFiles@ back to front+-- (globals.cc:139) so that the first listed, the config home, wins.+-- The system directory goes through 'canonicalAbsolutePath', as upstream's+-- @Settings@ constructor runs it through @canonPath@ (globals.cc:65): a+-- relative one is refused, and @.@ and @..@ in it collapse, so the file+-- is named canonically wherever it is reported and its includes resolve+-- against the collapsed directory.  The user files are read as named;+-- upstream canonicalizes none of them.+-- @NIX_USER_CONF_FILES@ replaces the XDG list outright, in its own order.+-- It is split on the platform's list separator with empty entries dropped+-- as upstream's tokenizer drops them; upstream splits on @:@ on every+-- platform, which cannot carry a Windows drive letter, so @;@ is honoured+-- there as it is for @PATH@ and @XDG_CONFIG_DIRS@.+configFilePaths :: ConfigLocations -> Either Text [OsPath]+configFilePaths locations = do+  confDir <- traverse variablePath (mfilter (not . BS.null) (clConfDir locations))+  systemDir <- traverse canonicalAbsolutePath (confDir <|> clSystemConfDir locations)+  userFiles <- case clUserConfFiles locations of+    Just listed -> splitListVar <$> variablePath listed+    Nothing -> pure (map underXdgDir (clConfigHome locations : clConfigDirs locations))+  pure (maybeToList ((</> nixConfFileName) <$> systemDir) ++ reverse userFiles)+  where+    underXdgDir dir = dir </> nixConfDirName </> nixConfFileName+    variablePath bytes = maybe (Left (noHostSpelling bytes)) Right (hostPathFromBytes bytes)++-- | Split a path-list variable on the platform's list separator, dropping+-- empty entries.+splitListVar :: OsString -> [OsPath]+splitListVar = map OP.pack . filter (not . null) . splitOn . OP.unpack+  where+    splitOn units = case break (== OP.searchPathSeparator) units of+      (item, []) -> [item]+      (item, _ : rest) -> item : splitOn rest++-- | The file name every source directory is read under.+nixConfFileName :: OsPath+nixConfFileName = asciiPath "nix.conf"++-- | The directory @nix.conf@ sits in beneath a config directory: @nix@+-- under each XDG directory (@getUserConfigFiles@) and under @sysconfdir@+-- for the system file (libstore's meson.build at 2.24.9).+nixConfDirName :: OsPath+nixConfDirName = asciiPath "nix"++-- | A path this module spells itself.  'OP.unsafeFromChar' narrows a+-- character to the platform's path unit (a byte, or a UTF-16 unit), which+-- is exact for ASCII on both.+asciiPath :: String -> OsPath+asciiPath = OP.pack . map OP.unsafeFromChar++-- ---------------------------------------------------------------------------+-- Sources and includes+-- ---------------------------------------------------------------------------++-- | One source of config text and the name it is reported under: a file's+-- path, or 'nixConfigSourceName' for the environment variable.  The name+-- also anchors relative includes, so a source that is not a file cannot+-- include relatively; upstream passes the literal @NIX_CONFIG@ as the+-- path and its @canonPath@ refuses the @.\/x@ that results.+data ConfigSource = ConfigSource+  { csName :: !OsPath,+    csText :: !ByteString+  }+  deriving (Eq, Show)++-- | The name upstream applies the @NIX_CONFIG@ text under.+nixConfigSourceName :: OsPath+nixConfigSourceName = asciiPath "NIX_CONFIG"++-- | Why a file could not be read: there is nothing at the path, or there+-- is and it cannot be read (a directory, a permission refusal).  Upstream+-- tells the two apart with @pathExists@ before @readFile@; here the+-- distinction decides only how a failed @include@ is reported.+data ConfigReadFailure = ConfigFileMissing | ConfigFileUnreadable+  deriving (Eq, Show)++-- | How the expander reads a file: its bytes, or why it could not be+-- read.  A function so the expander runs over an in-memory map in tests+-- and over the filesystem in the CLI.+type ReadConfigFile m = OsPath -> m (Either ConfigReadFailure ByteString)++-- | Read, expand and fold the whole configuration: the files at the given+-- paths, weakest first (one that cannot be read is simply absent, as+-- upstream's @applyConfigFile@ treats a @SystemError@), then the+-- @NIX_CONFIG@ bytes when the variable is set.  A file that is read and+-- does not expand is an error, never treated as absent.+loadConfig :: (Monad m) => ReadConfigFile m -> [OsPath] -> Maybe ByteString -> m (Either Text NixConfig)+loadConfig readConfigFile paths nixConfigText = runExceptT $ do+  fileSources <- lift (rights <$> traverse readSource paths)+  let sources = fileSources ++ maybeToList (ConfigSource nixConfigSourceName <$> nixConfigText)+  assignments <- traverse (ExceptT . expandConfigSource readConfigFile) sources+  liftEither (resolveConfig (concat assignments))+  where+    readSource path = fmap (ConfigSource path) <$> readConfigFile path++-- | Expand one source into its assignments, every include spliced in at+-- its line, as upstream's @parseConfigFiles@ pushes an included file's+-- pairs into the same list.  An include whose resolved path is already+-- being expanded is refused: upstream recurses until the stack overflows,+-- and no cycle can mean anything.+expandConfigSource :: (Monad m) => ReadConfigFile m -> ConfigSource -> m (Either Text [ConfigAssignment])+expandConfigSource readConfigFile = runExceptT . expandWithin readConfigFile []++-- | Expand one source beneath the names of the files including it.+expandWithin :: (Monad m) => ReadConfigFile m -> [OsPath] -> ConfigSource -> ExceptT Text m [ConfigAssignment]+expandWithin readConfigFile ancestors (ConfigSource name text) = do+  parsed <- liftEither (parseConfigLines name text)+  concat <$> traverse (expandLine readConfigFile (name :| ancestors)) parsed++-- | Expand one line of the file at the chain's head: an assignment is+-- itself; an include is the included file, expanded beneath the chain.+-- A target with no host spelling (bytes that are not UTF-8, on Windows)+-- names no file that can exist, so @!include@ goes on without it as it+-- does without a missing file.+expandLine :: (Monad m) => ReadConfigFile m -> NonEmpty OsPath -> ConfigLine -> ExceptT Text m [ConfigAssignment]+expandLine _ _ (LineAssignment assignment) = pure [assignment]+expandLine readConfigFile chain@(from :| _) (LineInclude mode target) =+  case (hostPathFromBytes target, mode) of+    (Nothing, IncludeOptional) -> pure []+    (Nothing, IncludeRequired) -> throwError (includeUnspellable target from)+    (Just targetPath, _) -> do+      path <- liftEither (resolveIncludePath from targetPath)+      when (path `elem` chain) (throwError (includeCycle path from))+      contents <- lift (readConfigFile path)+      case (contents, mode) of+        (Right text, _) -> expandWithin readConfigFile (NE.toList chain) (ConfigSource path text)+        (Left _, IncludeOptional) -> pure []+        (Left failure, IncludeRequired) -> throwError (includeFailed failure path from)++-- | Where an include points: the target joined under the including+-- file's directory (an absolute target stands alone), then collapsed+-- through 'canonicalAbsolutePath', as upstream's @absPath@ then+-- @canonPath@ do.  A result that is still relative is refused: the+-- including source has no directory, which is the case for @NIX_CONFIG@+-- and for a user file named relatively.+resolveIncludePath :: OsPath -> OsPath -> Either Text OsPath+resolveIncludePath from target = canonicalAbsolutePath (OP.takeDirectory from </> target)++-- | An absolute native path collapsed lexically, or upstream's own+-- complaint (@canonPath@, file-system.cc at 2.24.9) for a relative one.+-- The drive 'OP.splitDrive' finds (the POSIX root, a Windows drive letter+-- or UNC server) is kept as spelled, and the path beneath it collapses as+-- upstream's @canonPath@ collapses ('collapseUnits'), from the drive's+-- last separator on, so a UNC root survives rather than folding to the+-- current drive.+canonicalAbsolutePath :: OsPath -> Either Text OsPath+canonicalAbsolutePath path+  | OP.isAbsolute path = Right (OP.pack (root ++ collapseUnits (lastSeparator ++ OP.unpack below)))+  | otherwise = Left (configErrorPrefix <> "not an absolute path: '" <> hostPathText path <> "'")+  where+    (drive, below) = OP.splitDrive path+    driveUnits = OP.unpack drive+    root = dropWhileEnd OP.isPathSeparator driveUnits+    lastSeparator = take 1 (takeWhile OP.isPathSeparator (reverse driveUnits))++-- | Upstream's lexical collapse, over a native path's units: @.@ drops,+-- @..@ pops a real predecessor (at a root it drops, in a relative path it+-- stays), repeated separators fold to one, and an empty result is @.@.+-- The same rule 'Nix.Eval.CanonPath.canonPath' applies to path values,+-- which are text; a native path here is bytes, which text cannot hold.+-- The separator is the platform's when the path spells one with it and+-- @/@ otherwise, as there.+collapseUnits :: [OsChar] -> [OsChar]+collapseUnits units+  | rooted = separator : joined+  | null resolved = [dotUnit]+  | otherwise = joined+  where+    rooted = any OP.isPathSeparator (take 1 units)+    segments = filter (not . null) (splitOnSeparators units)+    resolved = reverse (foldl' (collapseStep rooted) [] segments)+    separator = if OP.pathSeparator `elem` units then OP.pathSeparator else slashUnit+    joined = intercalate [separator] resolved++-- | One segment of the collapse fold; the accumulator holds resolved+-- segments in reverse.+collapseStep :: Bool -> [[OsChar]] -> [OsChar] -> [[OsChar]]+collapseStep rooted acc segment+  | segment == [dotUnit] = acc+  | segment == parent = case acc of+      [] -> [parent | not rooted]+      (top : rest)+        | top == parent -> parent : acc+        | otherwise -> rest+  | otherwise = segment : acc+  where+    parent = [dotUnit, dotUnit]++splitOnSeparators :: [OsChar] -> [[OsChar]]+splitOnSeparators units = case break OP.isPathSeparator units of+  (segment, []) -> [segment]+  (segment, _ : rest) -> segment : splitOnSeparators rest++dotUnit, slashUnit :: OsChar+dotUnit = OP.unsafeFromChar '.'+slashUnit = OP.unsafeFromChar '/'++includeFailed :: ConfigReadFailure -> OsPath -> OsPath -> Text+includeFailed failure path from =+  configErrorPrefix <> "file '" <> hostPathText path <> "' included from '" <> hostPathText from <> "' " <> reason+  where+    reason = case failure of+      ConfigFileMissing -> "not found"+      ConfigFileUnreadable -> "cannot be read"++includeCycle :: OsPath -> OsPath -> Text+includeCycle path from =+  configErrorPrefix <> "file '" <> hostPathText path <> "' included from '" <> hostPathText from <> "' is already being included (include cycle)"++includeUnspellable :: ByteString -> OsPath -> Text+includeUnspellable target from =+  configErrorPrefix <> "file '" <> shownBytes target <> "' included from '" <> hostPathText from <> "' " <> noWindowsSpelling++-- | The refusal of a path variable with no host spelling.  Unreachable+-- while the environment reaches this module as "Nix.Environment" reads+-- it, which spells a Windows value as UTF-8.+noHostSpelling :: ByteString -> Text+noHostSpelling bytes = configErrorPrefix <> "path '" <> shownBytes bytes <> "' " <> noWindowsSpelling++noWindowsSpelling :: Text+noWindowsSpelling = "is not valid UTF-8, so it names no Windows file"++-- --------------------------------------------------------------------------- -- Parsing -- --------------------------------------------------------------------------- +-- | One line of a config source after comment truncation: an assignment,+-- or an include directive and the bytes of the path it names.+data ConfigLine+  = LineAssignment !ConfigAssignment+  | LineInclude !IncludeMode !ByteString+  deriving (Eq, Show)++-- | @include@ fails when its file cannot be read; @!include@ goes on+-- without it.  That is the only difference between the two directives.+data IncludeMode = IncludeRequired | IncludeOptional+  deriving (Eq, Show)+ -- | One parsed @name = value@ assignment, before its name is resolved--- against the known settings and aliases.+-- against the known settings and aliases.  The value is its tokens+-- joined by single spaces, as upstream joins them. data ConfigAssignment = ConfigAssignment-  { caName :: !Text,-    caValue :: !Text+  { caName :: !ByteString,+    caValue :: !ByteString   }   deriving (Eq, Show) --- | Parse config text into ordered assignments.  Comments and blank lines--- drop out; a malformed line (fewer than @name = value@, or a missing--- @=@) is a loud error rather than a silent skip, matching upstream's--- @UsageError@ - a typo in a security-relevant file must not pass for an--- empty setting.  An @include@ \/ @!include@ line is refused as not yet--- supported.-parseConfigText :: Text -> Either Text [ConfigAssignment]-parseConfigText = traverse parseLine . filter (not . isBlank) . map stripComment . T.lines+-- | Parse one source's bytes into its lines.  Comments and blank lines+-- drop out; a malformed line (fewer than @name = value@, a missing @=@,+-- or an include with other than exactly one path) is a loud error rather+-- than a silent skip, matching upstream's @UsageError@ - a typo in a+-- security-relevant file must not pass for an empty setting.  The error+-- quotes the line as upstream does, comment-truncated and otherwise+-- verbatim, leading whitespace included.+parseConfigLines :: OsPath -> ByteString -> Either Text [ConfigLine]+parseConfigLines name = fmap catMaybes . traverse (parseLine . BS8.takeWhile (/= commentChar)) . BS8.lines   where-    isBlank line = null (T.words line)-    stripComment = T.takeWhile (/= '#')-    parseLine line = case T.words line of+    parseLine line = case configTokens line of+      [] -> Right Nothing+      [directive, target]+        | directive == includeDirective -> Right (Just (LineInclude IncludeRequired target))+        | directive == bangIncludeDirective -> Right (Just (LineInclude IncludeOptional target))       (directive : _)-        | directive == includeDirective || directive == bangIncludeDirective ->-            Left ("nix.conf: '" <> directive <> "' is not supported yet")-      (name : eq : valueTokens)-        | eq == assignEq -> Right (ConfigAssignment name (T.unwords valueTokens))-      _ -> Left ("nix.conf: syntax error in line '" <> T.strip line <> "'")+        | directive == includeDirective || directive == bangIncludeDirective -> syntaxError line+      (key : eq : valueTokens)+        | eq == assignEq -> Right (Just (LineAssignment (ConfigAssignment key (BS.intercalate valueSeparator valueTokens))))+      _ -> syntaxError line+    syntaxError line =+      Left (configErrorPrefix <> "syntax error in configuration line '" <> shownBytes line <> "' in '" <> hostPathText name <> "'") +-- | Upstream's @tokenizeString@ under its default separators (util.hh at+-- 2.24.9): the maximal runs of bytes other than space, tab, CR and LF.+configTokens :: ByteString -> [ByteString]+configTokens = filter (not . BS.null) . BS8.splitWith (`BS8.elem` tokenSeparators)++-- | Parse an unsigned integer setting the way upstream's+-- @BaseSetting\<unsigned int\>@ does (@string2IntWithUnitPrefix@ over+-- @boost::lexical_cast@, config-impl.hh and util.hh at 2.24.9): decimal+-- digits with an optional leading @+@, then an optional binary unit+-- letter, @K@, @M@, @G@ or @T@ in either case, multiplying by 1024 to+-- that power.  Anything else (a minus sign, a fraction, hex, a number+-- past @unsigned int@) is upstream's @UsageError@, worded as it words it,+-- with no source label: upstream names the setting alone, and the value+-- may have come from @NIX_CONFIG@ rather than a file.+-- One divergence: upstream computes the unit product in 64 bits and+-- narrows it silently, so @5G@ is accepted there as 1073741824; here it+-- is refused like any other value outside the range, since a ceiling+-- that cannot mean what it says must not quietly become another number.+parseUnsignedSetting :: ByteString -> ByteString -> Either Text Word32+parseUnsignedSetting name value = maybe (Left invalid) Right (unitValue >>= inRange)+  where+    invalid = "setting '" <> shownBytes name <> "' has invalid value '" <> shownBytes value <> "'"+    unsigned = fromMaybe value (BS.stripPrefix plusSign value)+    unitValue = case BS8.unsnoc unsigned of+      Just (digits, unit) | Just multiplier <- unitMultiplier unit -> (* multiplier) <$> decimalInteger digits+      _ -> decimalInteger unsigned+    inRange n+      | n <= toInteger (maxBound :: Word32) = Just (fromInteger n)+      | otherwise = Nothing++-- | A whole run of decimal digits as an 'Integer'; anything else, the+-- empty run included, is 'Nothing'.+decimalInteger :: ByteString -> Maybe Integer+decimalInteger digits+  | not (BS.null digits) && BS8.all isDigit digits = Just (BS8.foldl' step 0 digits)+  | otherwise = Nothing+  where+    step acc digit = acc * 10 + toInteger (ord digit - ord '0')++-- | Upstream's binary unit letters.+unitMultiplier :: Char -> Maybe Integer+unitMultiplier unit = case toUpper unit of+  'K' -> Just (unitBase ^ (1 :: Int))+  'M' -> Just (unitBase ^ (2 :: Int))+  'G' -> Just (unitBase ^ (3 :: Int))+  'T' -> Just (unitBase ^ (4 :: Int))+  _ -> Nothing++unitBase :: Integer+unitBase = 1024+ -- --------------------------------------------------------------------------- -- Applying -- ---------------------------------------------------------------------------@@ -107,84 +534,173 @@ -- | Apply one assignment to the accumulated config.  The name is resolved -- through the aliases (@binary-caches@ -> @substituters@, -- @binary-cache-public-keys@ -> @trusted-public-keys@) and the @extra-@--- prefix (append rather than replace).  A name outside the known set is--- ignored, not an error: upstream warns and continues, and refusing every--- unknown key would reject a config that also carries settings this layer--- does not model yet.-applyAssignment :: NixConfig -> ConfigAssignment -> NixConfig+-- prefix (append rather than replace, list settings only).  A name+-- outside the known set is ignored, not an error: upstream warns and+-- continues, and refusing every unknown key would reject a config that+-- also carries settings this layer does not model yet.  A value that does+-- not parse for its setting is an error, as upstream's @UsageError@ is:+-- @pure-eval = ture@ must not pass for off.+applyAssignment :: NixConfig -> ConfigAssignment -> Either Text NixConfig applyAssignment config (ConfigAssignment name value) =   case resolveName name of-    Nothing -> config-    Just (field, mode) ->-      let parsed = T.words value-       in setField field (combine mode (getField field config) parsed) config+    Nothing -> Right config+    Just (ListSetting field, mode) ->+      (\items -> setList field (combine mode (getList field config) items) config) <$> listItems field value+    Just (BoolSetting field, _) ->+      (\flag -> setBool field flag config) <$> parseBool name value+    Just (ScalarSetting MaxCallDepthField, _) ->+      (\limit -> config {ncMaxCallDepth = limit}) <$> parseUnsignedSetting name value   where     combine ReplaceMode _ new = new     combine AppendMode old new = old ++ new --- | Which list a setting name targets, once the @extra-@ prefix and the--- aliases are resolved, and whether it replaces or appends.-resolveName :: Text -> Maybe (ConfigField, ApplyMode)-resolveName name =-  case T.stripPrefix extraPrefix name of-    Just base -> tag AppendMode (baseField base)-    Nothing -> tag ReplaceMode (baseField name)+-- | A list value's tokens as text, split as upstream's @Strings@ setting+-- splits it, or the refusal of a token that is not UTF-8 (see the module+-- header's Bytes section).  The refusal names the setting as upstream's+-- value errors do, by its own name rather than an alias or an @extra-@+-- spelling.+listItems :: ListField -> ByteString -> Either Text [Text]+listItems field value = maybe (Left refusal) Right (traverse decoded (configTokens value))   where-    tag mode mField = case mField of-      Just field -> Just (field, mode)+    decoded = either (const Nothing) Just . TE.decodeUtf8'+    refusal = "setting '" <> shownBytes (listFieldKey field) <> "' has invalid value '" <> shownBytes value <> "': not valid UTF-8"++-- | Which setting a name targets, once the @extra-@ prefix and the aliases+-- are resolved, and whether it replaces or appends.  @extra-@ composes+-- with a list only: upstream looks the base name up and appends when the+-- setting is appendable, and a Boolean or a scalar is not.+resolveName :: ByteString -> Maybe (Setting, ApplyMode)+resolveName name =+  case BS.stripPrefix extraPrefix name of+    Just base -> case baseSetting base of+      Just setting@(ListSetting _) -> Just (setting, AppendMode)+      _ -> Nothing+    Nothing -> case baseSetting name of+      Just setting -> Just (setting, ReplaceMode)       Nothing -> Nothing-    baseField n-      | n == substitutersKey || n == substitutersAlias = Just SubstitutersField-      | n == trustedKeysKey || n == trustedKeysAlias = Just TrustedKeysField+  where+    baseSetting n+      | n == substitutersKey || n == substitutersAlias = Just (ListSetting SubstitutersField)+      | n == trustedKeysKey || n == trustedKeysAlias = Just (ListSetting TrustedKeysField)+      | n == allowedUrisKey = Just (ListSetting AllowedUrisField)+      | n == restrictEvalKey = Just (BoolSetting RestrictEvalField)+      | n == pureEvalKey = Just (BoolSetting PureEvalField)+      | n == maxCallDepthKey = Just (ScalarSetting MaxCallDepthField)       | otherwise = Nothing --- | The two list settings this layer resolves.-data ConfigField = SubstitutersField | TrustedKeysField+-- | A setting this layer resolves, by the shape of its value.+data Setting = ListSetting !ListField | BoolSetting !BoolField | ScalarSetting !ScalarField   deriving (Eq, Show) +-- | The list settings.+data ListField = SubstitutersField | TrustedKeysField | AllowedUrisField+  deriving (Eq, Show)++-- | The Boolean settings.+data BoolField = RestrictEvalField | PureEvalField+  deriving (Eq, Show)++-- | The scalar settings, which only ever replace.+data ScalarField = MaxCallDepthField+  deriving (Eq, Show)+ -- | Whether an assignment replaces the accumulated value or appends to it. data ApplyMode = ReplaceMode | AppendMode   deriving (Eq, Show) -getField :: ConfigField -> NixConfig -> [Text]-getField SubstitutersField = ncSubstituters-getField TrustedKeysField = ncTrustedPublicKeys+getList :: ListField -> NixConfig -> [Text]+getList SubstitutersField = ncSubstituters+getList TrustedKeysField = ncTrustedPublicKeys+getList AllowedUrisField = ncAllowedUris -setField :: ConfigField -> [Text] -> NixConfig -> NixConfig-setField SubstitutersField v config = config {ncSubstituters = v}-setField TrustedKeysField v config = config {ncTrustedPublicKeys = v}+setList :: ListField -> [Text] -> NixConfig -> NixConfig+setList SubstitutersField v config = config {ncSubstituters = v}+setList TrustedKeysField v config = config {ncTrustedPublicKeys = v}+setList AllowedUrisField v config = config {ncAllowedUris = v} --- | Parse and apply one source's text onto the accumulated config.-applyConfigText :: NixConfig -> Text -> Either Text NixConfig-applyConfigText config text = foldl applyAssignment config <$> parseConfigText text+listFieldKey :: ListField -> ByteString+listFieldKey SubstitutersField = substitutersKey+listFieldKey TrustedKeysField = trustedKeysKey+listFieldKey AllowedUrisField = allowedUrisKey --- | Fold a list of sources onto the default config, weakest first.  The--- caller orders the list so the command line is last (and so wins); a--- parse error in any source aborts, since a security-relevant file that--- does not parse must not be treated as absent.-resolveConfig :: [Text] -> Either Text NixConfig-resolveConfig = foldl step (Right defaultNixConfig)-  where-    step acc source = acc >>= \config -> applyConfigText config source+setBool :: BoolField -> Bool -> NixConfig -> NixConfig+setBool RestrictEvalField v config = config {ncRestrictEval = v}+setBool PureEvalField v config = config {ncPureEval = v} +-- | Upstream's Boolean spellings (@BaseSetting\<bool\>::parse@): anything+-- else is an error with upstream's wording, which names the setting alone,+-- as 'parseUnsignedSetting' does.+parseBool :: ByteString -> ByteString -> Either Text Bool+parseBool name value+  | value `elem` trueSpellings = Right True+  | value `elem` falseSpellings = Right False+  | otherwise = Left ("Boolean setting '" <> shownBytes name <> "' has invalid value '" <> shownBytes value <> "'")++trueSpellings, falseSpellings :: [ByteString]+trueSpellings = ["true", "yes", "1"]+falseSpellings = ["false", "no", "0"]++-- | Fold expanded assignments onto the default config, weakest first.+-- The caller orders them so the strongest source's assignments are last+-- (and so win).  A value a setting cannot take aborts the fold, as+-- upstream's @UsageError@ does.+resolveConfig :: [ConfigAssignment] -> Either Text NixConfig+resolveConfig = foldM applyAssignment defaultNixConfig+ -- ------------------------------------------------------------------------------ Setting names+-- Messages -- --------------------------------------------------------------------------- -substitutersKey, substitutersAlias :: Text+-- | Bytes from a source as a message quotes them, for display only: their+-- UTF-8 reading, with U+FFFD where it fails.  Upstream writes the bytes+-- themselves; a message here is text.+shownBytes :: ByteString -> Text+shownBytes = TE.decodeUtf8Lenient++-- | What every error about the files themselves opens with (a syntax+-- error, a failed include, a path that is not absolute): the format's+-- name.  A setting's value error carries none, as upstream's does not.+configErrorPrefix :: Text+configErrorPrefix = "nix.conf: "++-- ---------------------------------------------------------------------------+-- Setting names and syntax+-- ---------------------------------------------------------------------------++substitutersKey, substitutersAlias :: ByteString substitutersKey = "substituters" substitutersAlias = "binary-caches" -trustedKeysKey, trustedKeysAlias :: Text+trustedKeysKey, trustedKeysAlias :: ByteString trustedKeysKey = "trusted-public-keys" trustedKeysAlias = "binary-cache-public-keys" -extraPrefix :: Text+allowedUrisKey, maxCallDepthKey, pureEvalKey, restrictEvalKey :: ByteString+allowedUrisKey = "allowed-uris"+maxCallDepthKey = "max-call-depth"+pureEvalKey = "pure-eval"+restrictEvalKey = "restrict-eval"++extraPrefix :: ByteString extraPrefix = "extra-" -assignEq :: Text+assignEq :: ByteString assignEq = "=" -includeDirective, bangIncludeDirective :: Text+plusSign :: ByteString+plusSign = "+"++includeDirective, bangIncludeDirective :: ByteString includeDirective = "include" bangIncludeDirective = "!include"++commentChar :: Char+commentChar = '#'++tokenSeparators :: ByteString+tokenSeparators = " \t\n\r"++-- | What a value's tokens are joined with, as upstream's+-- @concatStringsSep(" ", ...)@ joins them.+valueSeparator :: ByteString+valueSeparator = " "

@@ -22,6 +22,7 @@   ) where +import Control.Monad.Except (ExceptT (..), runExceptT) import Data.Map.Strict (Map) import qualified Data.Map.Strict as Map import Data.Maybe (fromMaybe)@@ -62,23 +63,26 @@  -- | Build the full dependency graph starting from a root derivation. ----- The @readDrv@ function reads a .drv file from the store and parses it.--- Returns @Left@ if any .drv file cannot be read.+-- The @readDrv@ function reads a .drv file from the store and parses it,+-- in the caller's monad: 'IO' for the build driver,+-- 'Data.Functor.Identity.Identity' over a pure lookup.  Returns @Left@+-- for the first .drv file that cannot be read. -- -- Uses a 'Seq' work-queue for O(1) enqueue\/dequeue instead of list append. buildDepGraph ::-  (StorePath -> Either Text Derivation) ->+  (Monad m) =>+  (StorePath -> m (Either Text Derivation)) ->   Derivation ->   StorePath ->-  Either Text DepGraph+  m (Either Text DepGraph) buildDepGraph readDrv rootDrv rootPath =-  go Map.empty (Seq.singleton (rootPath, rootDrv))+  runExceptT (go Map.empty (Seq.singleton (rootPath, rootDrv)))   where     go visited queue = case Seq.viewl queue of-      Seq.EmptyL -> Right (DepGraph visited)+      Seq.EmptyL -> pure (DepGraph visited)       (sp, drv) Seq.:< rest         | Map.member sp visited -> go visited rest-        | otherwise ->+        | otherwise -> do             let deps = Map.keys (drvInputDrvs drv)                 node =                   DepNode@@ -87,22 +91,20 @@                       dnDeps = deps                     }                 visitedWithNode = Map.insert sp node visited-             in case resolveNewDeps readDrv visitedWithNode deps of-                  Left err -> Left err-                  Right newItems -> go visitedWithNode (foldl' (|>) rest newItems)+            newItems <- resolveNewDeps readDrv visitedWithNode deps+            go visitedWithNode (foldl' (|>) rest newItems)  -- | Resolve unvisited dependencies by reading their .drv files. resolveNewDeps ::-  (StorePath -> Either Text Derivation) ->+  (Monad m) =>+  (StorePath -> m (Either Text Derivation)) ->   Map StorePath DepNode ->   [StorePath] ->-  Either Text [(StorePath, Derivation)]+  ExceptT Text m [(StorePath, Derivation)] resolveNewDeps readDrv visited = traverse resolve . filter unvisited   where     unvisited dep = not (Map.member dep visited)-    resolve dep = case readDrv dep of-      Left err -> Left err-      Right drv -> Right (dep, drv)+    resolve dep = (,) dep <$> ExceptT (readDrv dep)  -- --------------------------------------------------------------------------- -- Topological sort (Kahn's algorithm)

@@ -61,6 +61,7 @@     -- * Platform     Platform (..),     currentPlatform,+    extraPlatforms,     platformToText,     textToPlatform,   )@@ -91,6 +92,8 @@   | Aarch64_Darwin   | X86_64_Windows   | Aarch64_Linux+  | I686_Linux+  | I686_Windows   | OtherPlatform !Text   deriving (Eq, Ord, Show) @@ -104,8 +107,23 @@   ("aarch64", "darwin") -> Aarch64_Darwin   ("aarch64", "linux") -> Aarch64_Linux   ("x86_64", "linux") -> X86_64_Linux+  ("i386", "linux") -> I686_Linux+  ("i386", "mingw32") -> I686_Windows   (arch, os) -> OtherPlatform (packPlatform arch os) +-- | The systems a host executes besides its own, as upstream's default+-- @extra-platforms@ lists them: an x86_64 Linux kernel runs i686 binaries,+-- so upstream adds @i686-linux@ on @x86_64-linux@ (outside WSL1, which+-- cannot), and 64-bit Windows runs i686 binaries through WoW64, the same+-- rule for the platform upstream has no entry for yet.  Upstream also adds+-- @x86_64-darwin@ on @aarch64-darwin@ when Rosetta is installed; that is a+-- filesystem probe, not a property of the platform, and is not modelled+-- here, so such a build needs a launcher named on the command line.+extraPlatforms :: Platform -> [Platform]+extraPlatforms X86_64_Linux = [I686_Linux]+extraPlatforms X86_64_Windows = [I686_Windows]+extraPlatforms _ = []+ -- | Format an arch-os pair as a Nix platform string. packPlatform :: String -> String -> Text packPlatform arch os =@@ -127,6 +145,8 @@ platformToText Aarch64_Darwin = "aarch64-darwin" platformToText X86_64_Windows = "x86_64-windows" platformToText Aarch64_Linux = "aarch64-linux"+platformToText I686_Linux = "i686-linux"+platformToText I686_Windows = "i686-windows" platformToText (OtherPlatform t) = t  -- | Parse a Nix platform string into a 'Platform'.@@ -137,6 +157,8 @@   "aarch64-darwin" -> Aarch64_Darwin   "x86_64-windows" -> X86_64_Windows   "aarch64-linux" -> Aarch64_Linux+  "i686-linux" -> I686_Linux+  "i686-windows" -> I686_Windows   other -> OtherPlatform other  -- | A single output of a derivation.

@@ -0,0 +1,177 @@+-- | Structured attributes: a derivation that passes its attributes to the+-- builder as one JSON object rather than one environment variable each.+--+-- == The two halves+--+-- Evaluation (@__structuredAttrs = true@) renders the attributes into a+-- single object and stores it in the derivation's environment under+-- 'structuredAttrsKey', so attributes may be nested sets and lists where+-- the environment would need strings.  The @.drv@ hashes that entry, so+-- its bytes are upstream's ('Nix.Json.renderJson').+--+-- Building reads the entry back, replaces @outputs@ with an object naming+-- each output's path, and hands the builder two files instead of the+-- attributes themselves: @.attrs.json@, the object as JSON, and+-- @.attrs.sh@, the part of it bash can hold as @declare@ statements+-- ('renderAttrsShell').  A derivation is built this way when its+-- environment holds the entry, the test upstream's @ParsedDerivation@+-- makes (@src\/libstore\/parsed-derivations.cc@ at 2.24.9).+module Nix.Derivation.StructuredAttrs+  ( -- * The environment entry+    structuredAttrsKey,+    StructuredAttrs (..),+    encodeStructuredAttrs,+    decodeStructuredAttrs,++    -- * What the builder reads+    withOutputPlaceholders,+    renderAttrsJson,+    renderAttrsShell,+    stringsAttr,+  )+where++import Data.ByteString (ByteString)+import Data.Char (isAsciiLower, isAsciiUpper, isDigit)+import Data.Int (Int32)+import Data.Map.Strict (Map)+import qualified Data.Map.Strict as Map+import Data.Maybe (mapMaybe)+import Data.Text (Text)+import qualified Data.Text as T+import GHC.Float (double2Float)+import Nix.Hash (hashPlaceholder)+import Nix.Json (Json (..), parseJson, renderJson, renderJsonWith)++-- | The environment entry holding a structured-attributes derivation's+-- attributes.+structuredAttrsKey :: Text+structuredAttrsKey = "__json"++-- | The member upstream fills with the output paths before the builder+-- runs, replacing whatever the attributes held there (the list of output+-- names, when the derivation declared one).+outputsMember :: Text+outputsMember = "outputs"++-- | A derivation's attributes, by name.+newtype StructuredAttrs = StructuredAttrs (Map Text Json)+  deriving (Eq, Show)++-- | The bytes of the 'structuredAttrsKey' entry.+encodeStructuredAttrs :: StructuredAttrs -> ByteString+encodeStructuredAttrs (StructuredAttrs members) = renderJson (JsonObject members)++-- | Read the 'structuredAttrsKey' entry back.  It must hold an object, or+-- @null@, which nlohmann turns into an empty object the moment upstream+-- assigns @outputs@ into it; any other value has no member to assign.+decodeStructuredAttrs :: Text -> Either Text StructuredAttrs+decodeStructuredAttrs encoded = do+  value <- parseJson encoded+  case value of+    JsonObject members -> Right (StructuredAttrs members)+    JsonNull -> Right (StructuredAttrs Map.empty)+    _ -> Left "the attributes are not a JSON object"++-- | Set @outputs@ to an object naming each output's placeholder, as+-- upstream's @prepareStructuredAttrs@ does; the build rewrites each+-- placeholder to the path the output is written to, along with every+-- other placeholder the attributes hold.+withOutputPlaceholders :: [Text] -> StructuredAttrs -> StructuredAttrs+withOutputPlaceholders outputNames (StructuredAttrs members) =+  StructuredAttrs (Map.insert outputsMember outputs members)+  where+    outputs = JsonObject (Map.fromList [(name, JsonString (hashPlaceholder name)) | name <- outputNames])++-- | The @.attrs.json@ a builder reads: the attributes as JSON, every+-- string passed through the build's rewrite (see 'Nix.Json.renderJsonWith'+-- for why before escaping rather than after rendering).+renderAttrsJson :: (Text -> Text) -> StructuredAttrs -> ByteString+renderAttrsJson rewrite (StructuredAttrs members) = renderJsonWith rewrite (JsonObject members)++-- | Upstream's @writeStructuredAttrsShell@: one @declare@ per attribute+-- whose name is a shell variable name and whose value bash can hold.  A+-- scalar becomes a variable, an array of scalars an indexed array, an+-- object of scalars an associative array; anything else, an array or+-- object holding a nested one or a non-integral number included, is+-- left out.  Arrays and objects keep the space upstream writes after+-- each element.+renderAttrsShell :: StructuredAttrs -> Text+renderAttrsShell (StructuredAttrs members) = T.concat (mapMaybe declaration (Map.toAscList members))+  where+    declaration (name, value)+      | not (isShellVarName name) = Nothing+      | Just scalar <- shellScalar value = Just ("declare " <> name <> "=" <> scalar <> "\n")+      | JsonArray items <- value,+        Just scalars <- traverse shellScalar items =+          Just ("declare -a " <> name <> "=(" <> T.concat (map (<> " ") scalars) <> ")\n")+      | JsonObject entries <- value,+        Just pairs <- traverse shellEntry (Map.toAscList entries) =+          Just ("declare -A " <> name <> "=(" <> T.concat pairs <> ")\n")+      | otherwise = Nothing+    shellEntry (key, value) = (\scalar -> "[" <> shellQuote key <> "]=" <> scalar <> " ") <$> shellScalar value++-- | upstream's @std::regex@ @[A-Za-z_][A-Za-z0-9_]*@, matched against the+-- whole name.+isShellVarName :: Text -> Bool+isShellVarName name = case T.uncons name of+  Just (first, rest) -> (isAsciiLetter first || first == '_') && T.all (\c -> isAsciiLetter c || isDigit c || c == '_') rest+  Nothing -> False+  where+    isAsciiLetter c = isAsciiUpper c || isAsciiLower c++-- | upstream's @handleSimpleType@: a string single-quoted, an integral+-- number in decimal, @null@ as an empty quoted string, a boolean as @1@ or+-- nothing.+--+-- Upstream tests a number for integrality as a C @float@ and prints it+-- after @static_cast<int>@, so an integer keeps its low 32 bits and a float+-- that is integral at single precision truncates toward zero.  A float+-- past @int@'s range is undefined behaviour in C++; the value here is what+-- an aarch64 build of upstream writes for it (saturation, observed with+-- Nix 2.33.2 on aarch64-darwin), where x86-64 writes @INT_MIN@ for every+-- such value.+shellScalar :: Json -> Maybe Text+shellScalar (JsonString s) = Just (shellQuote s)+shellScalar (JsonInt n) = Just (T.pack (show (fromInteger n :: Int32)))+shellScalar (JsonFloat d)+  | isIntegralAsFloat (double2Float d) = Just (T.pack (show (truncateToInt32 d)))+  | otherwise = Nothing+shellScalar JsonNull = Just "''"+shellScalar (JsonBool True) = Just "1"+shellScalar (JsonBool False) = Just ""+shellScalar (JsonArray _) = Nothing+shellScalar (JsonObject _) = Nothing++-- | C's @ceil(f) == f@: true of an infinity, false of NaN.+isIntegralAsFloat :: Float -> Bool+isIntegralAsFloat f+  | isNaN f = False+  | isInfinite f = True+  | otherwise = fromInteger (ceiling f) == f++-- | @static_cast<int>@ of a double as aarch64 performs it: toward zero,+-- saturating at the ends of the range, NaN to zero.+truncateToInt32 :: Double -> Int32+truncateToInt32 d+  | isNaN d = 0+  | d >= fromIntegral (maxBound :: Int32) = maxBound+  | d <= fromIntegral (minBound :: Int32) = minBound+  | otherwise = fromInteger (truncate d)++-- | Upstream's @shellEscape@: single quotes around the whole, each single+-- quote inside closed, escaped and reopened.+shellQuote :: Text -> Text+shellQuote s = "'" <> T.replace "'" "'\\''" s <> "'"++-- | A list-of-strings attribute (upstream's @getStringsAttr@ in structured+-- mode): absent is 'Nothing', and anything but a list of strings is an+-- error rather than a guess.+stringsAttr :: Text -> StructuredAttrs -> Either Text (Maybe [Text])+stringsAttr name (StructuredAttrs members) = case Map.lookup name members of+  Nothing -> Right Nothing+  Just (JsonArray items) | Just strings <- traverse asString items -> Right (Just strings)+  Just _ -> Left ("attribute '" <> name <> "' must be a list of strings")+  where+    asString (JsonString s) = Just s+    asString _ = Nothing

@@ -0,0 +1,67 @@+{-# LANGUAGE CPP #-}++-- | The process environment, read the way a Nix string holds it: as bytes.+--+-- Upstream reads a variable with @getenv@ and keeps the bytes it returns+-- (@getEnv@ in src\/libutil\/environment-variables.cc at Nix 2.24.9), so+-- a value reaches @builtins.getEnv@ and @builtins.nixPath@ unchanged+-- whatever its encoding.  On POSIX this module makes the same call.+-- 'System.Environment.lookupEnv' does not: it decodes the value with the+-- file-system encoding, which carries an undecodable byte as a lone+-- surrogate that 'Data.Text.pack' then replaces with U+FFFD, and it+-- encodes the name with the foreign encoding, which drops a character+-- the locale cannot spell instead of failing.+--+-- A Windows environment is UTF-16.  A value becomes the UTF-8 bytes a+-- Nix string carries, and a name is read as UTF-8.  An unpaired+-- surrogate has no UTF-8 form, so a value holding one is refused rather+-- than approximated, the rule the NAR serialiser applies to such a file+-- name.+module Nix.Environment+  ( EnvLookup (..),+    lookupEnvBytes,+  )+where++import Data.ByteString (ByteString)+#if defined(mingw32_HOST_OS)+import Data.Char (GeneralCategory (Surrogate), generalCategory)+import qualified Data.Text as T+import qualified Data.Text.Encoding as TE+import System.Environment (lookupEnv)+#else+import qualified System.Posix.Env.ByteString as PosixEnv+#endif++-- | What the environment holds under one name.+data EnvLookup+  = -- | No variable has the name.+    EnvUnset+  | -- | The value, as the bytes a Nix string carries.+    EnvValue !ByteString+  | -- | A Windows value holding an unpaired UTF-16 surrogate, which has no+    -- UTF-8 form.  Never the answer on POSIX, where a value is bytes.+    EnvUnpairedSurrogate+  deriving (Eq, Show)++-- | Look up a variable by the bytes of its name.  Nothing is caught: the+-- read cannot fail other than by finding nothing, since @getenv@ answers+-- NULL for a missing name and base's 'System.Environment.lookupEnv'+-- answers 'Nothing' whenever @GetEnvironmentVariableW@ finds no value.+lookupEnvBytes :: ByteString -> IO EnvLookup+#if defined(mingw32_HOST_OS)+lookupEnvBytes name = case TE.decodeUtf8' name of+  -- A Windows name is UTF-16, so bytes with no UTF-8 reading name no+  -- variable.+  Left _ -> pure EnvUnset+  Right decoded -> maybe EnvUnset utf8Value <$> lookupEnv (T.unpack decoded)+  where+    -- base decodes a surrogate pair into one character and keeps an+    -- unpaired surrogate as its own code point, which 'T.pack' would+    -- replace with U+FFFD.+    utf8Value value+      | any ((== Surrogate) . generalCategory) value = EnvUnpairedSurrogate+      | otherwise = EnvValue (TE.encodeUtf8 (T.pack value))+#else+lookupEnvBytes name = maybe EnvUnset EnvValue <$> PosixEnv.getEnv name+#endif

@@ -12,5413 +12,5698 @@ -- The evaluator maintains an environment ('Env') that maps variable -- names to thunks.  @let@, @with@, function application, and -- recursive attribute sets all extend the environment.-module Nix.Eval-  ( -- * Values (re-exported from Types)-    NixValue (..),-    CompiledRegex (..),-    Thunk (..),--    -- * Attribute sets (re-exported from Types)-    AttrSet (..),-    CAttrSet,-    attrSetFromMap,-    attrSetLookup,-    attrSetKeys,-    attrSetToMap,-    attrSetToAscList,-    attrSetMember,-    attrSetElems,-    attrSetNull,-    attrSetRemoveKeys,-    attrSetSize,--    -- * String context (re-exported from Types)-    StringContextElement (..),-    StringContext (..),-    emptyContext,-    mkStr,--    -- * Environment (re-exported from Types)-    Env (..),-    emptyEnv,--    -- * Evaluation monad (re-exported from Types)-    MonadEval (..),-    PureEval,-    runPureEval,--    -- * Evaluation-    eval,-    evalBytecode,-    force,--    -- * Helpers (for Builtins)-    typeName,-    evaluated,-    readThunkValue,--    -- * Fetcher transport validation (pure, exported for tests)-    checkGitUrl,-    checkGitRef,-    checkGitRev,--    -- * Remembered fetches (pure, exported for tests)-    FetchCache (..),-    fetchCacheKey,-    encodeFetchCache,-    decodeFetchCache,--    -- * Builtin registry-    BuiltinDef (..),-    builtinRegistry,-    builtinNames,--    -- * Platform-    currentSystemStr,-  )-where--import Control.Monad (foldM, forM_, unless, void, when, (>=>))-import qualified Crypto.Hash as CH-import qualified Data.Array as Array-import Data.Bits (complement, xor, (.&.), (.|.))-import qualified Data.ByteArray as BA-import qualified Data.ByteString as BS-import qualified Data.ByteString.Char8 as BC-import Data.Char (chr, digitToInt, isAsciiLower, isAsciiUpper, isDigit, isHexDigit, isOctDigit, ord)-import Data.IORef (IORef, atomicModifyIORef', newIORef)-import Data.Int (Int64)-import Data.List (find, partition, sort)-import Data.Map.Strict (Map)-import qualified Data.Map.Strict as Map-import Data.Maybe (catMaybes, fromMaybe, isJust, isNothing, listToMaybe)-import Data.Sequence (Seq (..))-import qualified Data.Sequence as Seq-import qualified Data.Set as Set-import Data.Text (Text)-import qualified Data.Text as T-import qualified Data.Text.Encoding as TE-import qualified Data.Text.Read as TR-import Data.Time.Clock.POSIX (posixSecondsToUTCTime)-import Data.Time.Format (defaultTimeLocale, formatTime)-import Data.Word (Word32, Word64, Word8)-import Foreign.Ptr (Ptr, castPtr, nullPtr, ptrToWordPtr, wordPtrToPtr)-import Foreign.Storable (peekElemOff, pokeElemOff)-import Nix.Derivation (Derivation (..), DerivationOutput (..), textToPlatform, toATerm, toATermForHash)-import Nix.Eval.CBytecode (cbcArg1, cbcArg2, cbcArg3, cbcCountedPayload, cbcData, cbcFlags, cbcOpcode, cbcShortArg, pattern OpApp, pattern OpAssert, pattern OpAttrs, pattern OpBinary, pattern OpHasAttr, pattern OpIf, pattern OpIndStr, pattern OpLambda, pattern OpLet, pattern OpList, pattern OpLitBool, pattern OpLitFloat, pattern OpLitInt, pattern OpLitNull, pattern OpLitPath, pattern OpLitUri, pattern OpPathStr, pattern OpResolvedVar, pattern OpSearchPath, pattern OpSelect, pattern OpStr, pattern OpUnary, pattern OpVar, pattern OpWith, pattern OpWithVar)-import Nix.Eval.CEnv (cenvPushWith)-import Nix.Eval.CList (CList (..), clistGet)-import Nix.Eval.CThunk (CThunkPtr)-import Nix.Eval.CanonPath (canonBaseName, canonDirName, canonPathValue)-import Nix.Eval.Compile (BcAttrKey (..), BcBinding (..), compileExpr, decodeBcBindings, decodeBcCaptureInfo, decodeBcFormals, reassembleDouble, reassembleInt64)-import Nix.Eval.Context (extractAllOutputRefs, extractInputDrvs, extractInputSrcs, plainContext)-import Nix.Eval.Operator (checkedAdd, checkedMul, checkedSub, evalBinary, evalUnary, nixCompare, nixEqual)-import Nix.Eval.StringInterp (coerceToString, formatJsonFloat, formatNixFloat, formatXmlFloat, stripIndentedChunks)-import Nix.Eval.Symbol (Symbol (..), symbolBytes, symbolText)-import Nix.Eval.Types-  ( AttrSet (..),-    CAttrSet,-    CompiledRegex (..),-    Env (..),-    EvalFormal (..),-    EvalFormals (..),-    MonadEval (..),-    NixValue (..),-    PureEval,-    StringContext (..),-    StringContextElement (..),-    Thunk (..),-    allocCSlots,-    attrSetElems,-    attrSetFromMap,-    attrSetKeys,-    attrSetLookup,-    attrSetMapWithKey,-    attrSetMember,-    attrSetNull,-    attrSetRemoveKeys,-    attrSetSize,-    attrSetToAscList,-    attrSetToMap,-    buildCAttrSetKeys,-    buildCSlots,-    bytesToTextLossy,-    cheapThunkBc,-    checkedCPtr,-    clistFromThunks,-    clistLen,-    clistThunks,-    emptyContext,-    emptyEnv,-    envFromSlots,-    envLookup,-    envLookupResolved,-    envWithScopesRaw,-    evaluated,-    fillCAttrSetValues,-    fillCSlots,-    mkStr,-    mkStrBytes,-    mkSyntheticThunk,-    mkThunk,-    mkThunkBc,-    newCEnv,-    newMinimalEnv,-    readThunkValue,-    runPureEval,-    storePathOrThrow,-    thunkToCPtr,-    typeName,-    withScopesForCapture,-  )-import Nix.Expr.Types-  ( AttrKey (..),-    BinaryOp (..),-    CaptureInfo (..),-    Expr (..),-    NixAtom (..),-    UnaryOp (..),-  )-import Nix.Hash (base64HashLen, bytesToHexText, hashAlgoBytes, hashPlaceholder, hexHashLen, hexToBytes, makeFixedOutputPath, makeOutputPath, makeTextPath, nix32HashLen, sha256Digest, sha256Hex)-import Nix.Store.Path (StorePath (spName), StorePathNameError (..), checkStorePathName, defaultStoreDir, defaultStoreDirText, parseStorePath, parseStorePathBaseName, storePathNameErrorText, storePathNameReasonText, storePathToText)-import Nix.Store.Path.Internal (maskedOutputPath)-import qualified NovaCache.Base32 as Nix32-import qualified NovaCache.Base64 as B64-import qualified NovaCache.NAR as NAR-import System.IO.Unsafe (unsafePerformIO)-import qualified System.Info-import Text.Regex.TDFA (matchAllText)-import qualified Text.Regex.TDFA as RE-import Text.Regex.TDFA.ByteString ()---- | Evaluate a Nix expression in an environment.--- Compiles the expression to bytecode and dispatches to 'evalBytecode'.-eval :: (MonadEval m) => Env -> Expr -> m NixValue-eval env expr =-  let bcIdx = unsafePerformIO (compileExpr expr)-   in evalBytecode env bcIdx---- | Force a thunk to a value.------ Delegates to 'forceThunk' which is a 'MonadEval' method - this--- allows IO evaluators to implement memoization (caching the result--- after the first force) while pure evaluators simply re-evaluate.-force :: (MonadEval m) => Thunk -> m NixValue-force = forceThunk evalBytecode---- | Strict UTF-8 decode at a Text-typed boundary (attr names, filesystem--- paths, algorithm names, ...).  A Nix string is a byte string; where the--- implementation needs 'Text', invalid UTF-8 is a clean eval error - never--- a lossy replacement, which would smuggle a DIFFERENT string through an--- identity-bearing boundary.-decodedText :: (MonadEval m) => Text -> BS.ByteString -> m Text-decodedText what bytes = case TE.decodeUtf8' bytes of-  Right t -> pure t-  Left _ -> throwEvalError (what <> ": invalid UTF-8 in string")---- | Evaluate a bytecode instruction by index.--- This is the primary evaluator - reads opcodes from the C bytecode--- store and dispatches.  All recursive evaluation goes through this--- function, never through 'eval' directly.-evalBytecode :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBytecode env bcIdx =-  let opcode = unsafePerformIO (cbcOpcode bcIdx)-   in case opcode of-        OpLitInt ->-          let lo = unsafePerformIO (cbcArg1 bcIdx)-              hi = unsafePerformIO (cbcArg2 bcIdx)-           in pure (VInt (reassembleInt64 lo hi))-        OpLitFloat ->-          let lo = unsafePerformIO (cbcArg1 bcIdx)-              hi = unsafePerformIO (cbcArg2 bcIdx)-           in pure (VFloat (reassembleDouble lo hi))-        OpLitBool ->-          let flag = unsafePerformIO (cbcShortArg bcIdx)-           in pure (VBool (flag /= 0))-        OpLitNull -> pure VNull-        OpLitUri ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-           in pure (mkStrBytes (symbolBytes (Symbol sym)))-        OpLitPath ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-           in VPath <$> resolvePathLiteral (symbolText (Symbol sym))-        OpStr -> evalBcStr env bcIdx-        OpIndStr -> evalBcIndStr env bcIdx-        OpPathStr -> evalBcPathStr env bcIdx-        OpVar ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-           in evalVar env (symbolText (Symbol sym))-        OpWithVar ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-              name = symbolText (Symbol sym)-           in evalWithVar env name-        OpResolvedVar ->-          let level = fromIntegral (unsafePerformIO (cbcArg1 bcIdx))-              idx = fromIntegral (unsafePerformIO (cbcArg2 bcIdx))-           in force (envLookupResolved level idx env)-        OpAttrs -> evalBcAttrs env bcIdx-        OpList -> evalBcList env bcIdx-        OpSelect -> evalBcSelect env bcIdx-        OpHasAttr -> evalBcHasAttr env bcIdx-        OpApp -> evalBcApp env bcIdx-        OpLambda -> evalBcLambda env bcIdx-        OpLet -> evalBcLet env bcIdx-        OpIf ->-          let condIdx = unsafePerformIO (cbcArg1 bcIdx)-              thenIdx = unsafePerformIO (cbcArg2 bcIdx)-              elseIdx = unsafePerformIO (cbcArg3 bcIdx)-           in do-                condVal <- evalBytecode env condIdx-                case condVal of-                  VBool True -> evalBytecode env thenIdx-                  VBool False -> evalBytecode env elseIdx-                  _ -> throwEvalError ("'if' condition must be a Boolean, got " <> typeName condVal)-        OpWith ->-          let scopeIdx = unsafePerformIO (cbcArg1 bcIdx)-              bodyIdx = unsafePerformIO (cbcArg2 bcIdx)-              -- Lazy with: defer forcing the scope until a WITH_VAR lookup-              -- actually needs it.  This is critical for nixpkgs where-              -- all-packages.nix uses `with pkgs;` inside a fixpoint --              -- eagerly forcing the scope would blackhole.-              scopeThunk = cheapThunkBc env scopeIdx-           in evalBytecode (pushLazyWithScope scopeThunk env) bodyIdx-        OpAssert ->-          let condIdx = unsafePerformIO (cbcArg1 bcIdx)-              bodyIdx = unsafePerformIO (cbcArg2 bcIdx)-           in do-                condVal <- evalBytecode env condIdx-                case condVal of-                  VBool True -> evalBytecode env bodyIdx-                  -- A failed assert is catchable by tryEval (upstream-                  -- AssertionError); a non-bool condition is a type error.-                  VBool False -> throwCatchableError "assertion failed"-                  _ -> throwEvalError ("assertion condition must be a Boolean, got " <> typeName condVal)-        OpUnary ->-          let flags_ = unsafePerformIO (cbcFlags bcIdx)-              operandIdx = unsafePerformIO (cbcArg1 bcIdx)-           in do-                val <- evalBytecode env operandIdx-                evalUnary (decodeUnaryOp flags_) val-        OpBinary -> evalBcBinary env bcIdx-        OpSearchPath ->-          let sym = unsafePerformIO (cbcArg1 bcIdx)-           in evalSearchPath env (symbolText (Symbol sym))-        _ -> throwEvalError "evalBytecode: unknown opcode"---- ------------------------------------------------------------------------------ Bytecode helpers--- ------------------------------------------------------------------------------- | Decode a UnaryOp from bytecode flags.-decodeUnaryOp :: Word8 -> UnaryOp-decodeUnaryOp 0 = OpNot-decodeUnaryOp 1 = OpNegate--- Unreachable: the tag is written by Nix.Eval.Compile's encodeUnaryOp, which--- only emits 0 or 1.-decodeUnaryOp n = error ("decodeUnaryOp: unknown tag " <> show n)---- | Decode a BinaryOp from bytecode flags.-decodeBinaryOp :: Word8 -> BinaryOp-decodeBinaryOp 0 = OpAdd-decodeBinaryOp 1 = OpSub-decodeBinaryOp 2 = OpMul-decodeBinaryOp 3 = OpDiv-decodeBinaryOp 4 = OpAnd-decodeBinaryOp 5 = OpOr-decodeBinaryOp 6 = OpImpl-decodeBinaryOp 7 = OpEq-decodeBinaryOp 8 = OpNeq-decodeBinaryOp 9 = OpLt-decodeBinaryOp 10 = OpLte-decodeBinaryOp 11 = OpGt-decodeBinaryOp 12 = OpGte-decodeBinaryOp 13 = OpConcat-decodeBinaryOp 14 = OpUpdate--- Unreachable: the tag is written by Nix.Eval.Compile's encodeBinaryOp, which--- only emits 0..14.-decodeBinaryOp n = error ("decodeBinaryOp: unknown tag " <> show n)---- | Evaluate a binary operation from bytecode, with short-circuit--- support for &&, ||, ->.-evalBcBinary :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcBinary env bcIdx0 =-  let flags_ = unsafePerformIO (cbcFlags bcIdx0)-      leftIdx = unsafePerformIO (cbcArg1 bcIdx0)-      rightIdx = unsafePerformIO (cbcArg2 bcIdx0)-      op = decodeBinaryOp flags_-   in case op of-        OpAnd -> evalShortCircuitAnd env leftIdx rightIdx-        OpOr -> evalShortCircuitOr env leftIdx rightIdx-        OpImpl -> evalShortCircuitImpl env leftIdx rightIdx-        OpAdd -> do-          leftVal <- evalBytecode env leftIdx-          rightVal <- evalBytecode env rightIdx-          evalAddWithCoercion leftVal rightVal-        _ -> do-          leftVal <- evalBytecode env leftIdx-          rightVal <- evalBytecode env rightIdx-          evalBinary force op leftVal rightVal---- | Addition with string coercion fallback, matching C++ Nix behavior.--- C++ Nix's ExprOpAdd falls through to concatStrings when operands--- are not both numeric and neither is a path.  concatStrings calls--- coerceToString on each part, which handles attrsets via outPath.-evalAddWithCoercion :: (MonadEval m) => NixValue -> NixValue -> m NixValue-evalAddWithCoercion left right = case (left, right) of-  -- Numeric: direct arithmetic (matches C++ Nix priority)-  (VFloat _, _) -> evalBinary force OpAdd left right-  (_, VFloat _) -> evalBinary force OpAdd left right-  (VInt _, VInt _) -> evalBinary force OpAdd left right-  -- Path + path: text concatenation, canonicalized - the joined spelling-  -- (dot segments, doubled separators) never survives into the value, as-  -- upstream (CanonPath on the concatenated text).-  (VPath a, VPath b) -> pure (VPath (canonPathValue (a <> b)))-  -- Path + coercible: the result stays a path, the right side coerces-  -- WITHOUT a store copy, and a right side carrying string context is an-  -- error, as upstream (a store-path reference cannot survive inside a-  -- path value).  Paths are Text in nova, so the appended bytes must-  -- decode; invalid UTF-8 cannot form a filesystem path here.-  (VPath a, _) -> do-    (rightStr, rightCtx) <- coerceAddOperand right-    if rightCtx == emptyContext-      then do-        appended <- decodedText "path concatenation" rightStr-        pure (VPath (canonPathValue (a <> appended)))-      else throwEvalError "cannot append a string with context (a store-path reference) to a path"-  -- Strings: direct concat.-  (VStr {}, VStr {}) -> evalBinary force OpAdd left right-  -- Otherwise: string concatenation with STRICT coercion (Nix coerceMore=false)-  -- - only strings, sets with __toString/outPath, and paths coerce; numbers,-  -- bools, null, lists, and functions are type errors, matching C++ Nix's `+`.-  -- A path on the right of a string is COPIED to the store (upstream-  -- copyToStore=true), so "x" + ./src concatenates the source's store path-  -- and carries it in the result's context.-  _ -> do-    (leftStr, leftCtx) <- coerceAddOperand left-    (rightStr, rightCtx) <- coerceAddOperand right-    pure (VStr (leftStr <> rightStr) (leftCtx <> rightCtx))---- | Strict string coercion for the @+@ operator (Nix @coerceMore = false@):--- strings, sets with @__toString@\/@outPath@, and paths (copied to the--- store, carrying context) coerce; numbers, booleans, null, lists, and--- functions are type errors.-coerceAddOperand :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)-coerceAddOperand v@(VStr {}) = coerceToString False force applyValue coercePathToStore v-coerceAddOperand v@(VAttrs {}) = coerceToString False force applyValue coercePathToStore v-coerceAddOperand v@(VPath _) = coerceToStoreString v-coerceAddOperand v =-  throwEvalError ("cannot coerce " <> typeName v <> " to a string with the + operator")---- | Bytecode short-circuit &&-evalShortCircuitAnd :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue-evalShortCircuitAnd env leftIdx rightIdx = do-  leftVal <- evalBytecode env leftIdx-  case leftVal of-    VBool False -> pure (VBool False)-    VBool True -> do-      rightVal <- evalBytecode env rightIdx-      case rightVal of-        VBool _ -> pure rightVal-        _ -> throwEvalError ("second operand of && must be a Boolean, got " <> typeName rightVal)-    _ -> throwEvalError ("first operand of && must be a Boolean, got " <> typeName leftVal)---- | Bytecode short-circuit ||-evalShortCircuitOr :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue-evalShortCircuitOr env leftIdx rightIdx = do-  leftVal <- evalBytecode env leftIdx-  case leftVal of-    VBool True -> pure (VBool True)-    VBool False -> do-      rightVal <- evalBytecode env rightIdx-      case rightVal of-        VBool _ -> pure rightVal-        _ -> throwEvalError ("second operand of || must be a Boolean, got " <> typeName rightVal)-    _ -> throwEvalError ("first operand of || must be a Boolean, got " <> typeName leftVal)---- | Bytecode short-circuit ->-evalShortCircuitImpl :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue-evalShortCircuitImpl env leftIdx rightIdx = do-  leftVal <- evalBytecode env leftIdx-  case leftVal of-    VBool False -> pure (VBool True)-    VBool True -> do-      rightVal <- evalBytecode env rightIdx-      case rightVal of-        VBool _ -> pure rightVal-        _ -> throwEvalError ("second operand of -> must be a Boolean, got " <> typeName rightVal)-    _ -> throwEvalError ("first operand of -> must be a Boolean, got " <> typeName leftVal)---- | Evaluate a string literal from bytecode data buffer.-evalBcStr :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcStr env bcIdx0 = do-  let (count, dataOff) =-        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)-  chunks <- evalBcStringParts env count dataOff-  pure (VStr (BS.concat [t | (_, t, _) <- chunks]) (mconcat [c | (_, _, c) <- chunks]))---- | Evaluate an indented string literal from bytecode data buffer.  The common--- indentation is stripped from the LITERAL chunks before concatenation, so an--- interpolated multi-line value cannot drag the computed indent down - matching--- C++ Nix.-evalBcIndStr :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcIndStr env bcIdx0 = do-  let (count, dataOff) =-        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)-  chunks <- evalBcStringParts env count dataOff-  let (text, ctx) = stripIndentedChunks chunks-  pure (VStr text ctx)---- | Evaluate an interpolated path literal from the bytecode data--- buffer.  The pieces concatenate with no separator, each interpolated--- value coerced as a path segment, and the whole resolves like a plain--- path literal - absolutized if still relative, @~\/@ expanded, and--- canonicalized, so a @..@ or a slash arriving at runtime collapses--- textually, matching upstream (verified against nix-instantiate--- 2.33.2: @let v = "a\/.."; in .\/${v}@ is the base directory itself).-evalBcPathStr :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcPathStr env bcIdx0 = do-  let (count, dataOff) =-        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)-  chunks <- evalBcPathParts env count dataOff-  text <- decodedText "path literal" (BS.concat chunks)-  VPath <$> resolvePathLiteral text---- | The path-segment walk under 'evalBcPathStr': literal pieces pass--- through; an interpolated value coerces with upstream's path-segment--- rules - a context-free string passes, a path contributes its text--- WITHOUT a store copy (unlike string interpolation, which copies),--- and a string carrying store-path context is refused, since a path--- value has nowhere to keep the context that holds a store reference--- alive.  All three observed from nix-instantiate 2.33.2.-evalBcPathParts :: (MonadEval m) => Env -> Int -> Word32 -> m [BS.ByteString]-evalBcPathParts _ 0 _ = pure []-evalBcPathParts env n off = do-  let tag = unsafePerformIO (cbcData off)-      val = unsafePerformIO (cbcData (off + 1))-  chunk <- case tag of-    0 -> pure (symbolBytes (Symbol val))-    _ -> do-      v <- evalBytecode env val-      (txt, ctx) <- coerceToString False force applyValue coercePathVerbatim v-      unless (ctx == emptyContext) $-        throwEvalError "a string that refers to a store path cannot be appended to a path"-      pure txt-  rest <- evalBcPathParts env (n - 1) (off + 2)-  pure (chunk : rest)---- | Evaluate string parts from the bytecode data buffer.  Each part is two--- words: (tag, value).  tag=0 means literal (value = symbol), tag=1 means--- interpolation (value = bc_idx).  The 'Bool' marks literal (@True@) vs--- interpolated (@False@) so indented strings strip only the literals.-evalBcStringParts :: (MonadEval m) => Env -> Int -> Word32 -> m [(Bool, BS.ByteString, StringContext)]-evalBcStringParts _ 0 _ = pure []-evalBcStringParts env n off = do-  let tag = unsafePerformIO (cbcData off)-      val = unsafePerformIO (cbcData (off + 1))-  chunk <- case tag of-    0 -> pure (True, symbolBytes (Symbol val), emptyContext)-    _ -> do-      v <- evalBytecode env val-      (txt, ctx) <- coerceToStringInterp v-      pure (False, txt, ctx)-  rest <- evalBcStringParts env (n - 1) (off + 2)-  pure (chunk : rest)---- | Evaluate a list from bytecode data buffer.-evalBcList :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcList env bcIdx0 =-  let (count, dataOff) =-        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)-      readChildren 0 _ = []-      readChildren n off =-        let childIdx = unsafePerformIO (cbcData off)-         in cheapThunkBc env childIdx : readChildren (n - 1) (off + 1)-   in pure (VList (clistFromThunks (map thunkToCPtr (readChildren count dataOff))))---- | Evaluate a function application from bytecode.-evalBcApp :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcApp env bcIdx0 = do-  let funcIdx = unsafePerformIO (cbcArg1 bcIdx0)-      argIdx = unsafePerformIO (cbcArg2 bcIdx0)-  funcVal <- evalBytecode env funcIdx-  case funcVal of-    VLambda closureEnv formals bodyBcIdx -> do-      let argThunk = cheapThunkBc env argIdx-      extEnv <- matchFormals closureEnv formals argThunk-      evalBytecode extEnv bodyBcIdx-    VBuiltin "tryEval" [] -> tryEvalAction (evalBytecode env argIdx)-    VBuiltin name accArgs -> do-      argVal <- evalBytecode env argIdx-      applyBuiltin name accArgs argVal-    VAttrs attrs-      | Just functorThunk <- attrSetLookup "__functor" attrs -> do-          functor <- force functorThunk-          partiallyApplied <- applyValue functor funcVal-          -- Maintain laziness: thunk the argument for lambdas, like-          -- the normal VLambda path above.  Builtins force anyway.-          case partiallyApplied of-            VLambda closureEnv formals bodyBcIdx -> do-              let argThunk = cheapThunkBc env argIdx-              extEnv <- matchFormals closureEnv formals argThunk-              evalBytecode extEnv bodyBcIdx-            -- A functor returning tryEval keeps the catch around the-            -- argument's evaluation, like the direct arm above.-            VBuiltin "tryEval" [] -> tryEvalAction (evalBytecode env argIdx)-            _ -> do-              argVal <- evalBytecode env argIdx-              applyValue partiallyApplied argVal-    _ -> throwEvalError ("attempt to call " <> typeName funcVal <> ", which is not a function")---- | @builtins.tryEval@ over an argument's evaluation: @{ success, value }@--- with catchable errors (throw, failed assert - the only kinds--- 'catchEvalError' recovers) mapped to @success = false@.  The catch must--- wrap the ARGUMENT'S EVALUATION: an application path that forces the--- argument before dispatching here has already let the throw escape.--- Callers holding an already-forced value pass @pure val@ - nothing left--- to catch, so it success-wraps, exactly as upstream treats a value in--- WHNF.-tryEvalAction :: (MonadEval m) => m NixValue -> m NixValue-tryEvalAction act = do-  result <- catchEvalError act-  pure $ case result of-    Right val ->-      VAttrs-        ( attrSetFromMap $-            Map.fromList-              [ ("success", evaluated (VBool True)),-                ("value", evaluated val)-              ]-        )-    Left _ ->-      VAttrs-        ( attrSetFromMap $-            Map.fromList-              [ ("success", evaluated (VBool False)),-                ("value", evaluated (VBool False))-              ]-        )---- | Evaluate a lambda literal from bytecode - returns VLambda.-evalBcLambda :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcLambda env bcIdx0 =-  let flags_ = unsafePerformIO (cbcFlags bcIdx0)-      formalsOff = unsafePerformIO (cbcArg1 bcIdx0)-      bodyBcIdx = unsafePerformIO (cbcArg2 bcIdx0)-      captureOff = unsafePerformIO (cbcArg3 bcIdx0)-      formals = unsafePerformIO (decodeBcFormals flags_ formalsOff)-      captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)-   in pure (VLambda (buildCaptureEnv env captureInfo) formals bodyBcIdx)---- | Evaluate a select expression from bytecode.-evalBcSelect :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcSelect env bcIdx0 = do-  let hasDef = unsafePerformIO (cbcFlags bcIdx0) /= 0-      targetIdx = unsafePerformIO (cbcArg1 bcIdx0)-      (pathLen, pathOff) =-        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg2 bcIdx0)-      defIdx = unsafePerformIO (cbcArg3 bcIdx0)-  targetVal <- evalBytecode env targetIdx-  result <- walkBcAttrPath env pathLen pathOff targetVal-  case result of-    Just val -> pure val-    Nothing-      | hasDef -> evalBytecode env defIdx-      | otherwise -> do-          let pathName = collectBcAttrPathNames pathLen pathOff-              targetKeys = case targetVal of-                VAttrs attrs -> T.intercalate ", " (take 20 (attrSetKeys attrs))-                _ -> ""-          throwEvalError ("attribute '" <> pathName <> "' not found in " <> typeName targetVal <> " {" <> targetKeys <> "}")---- | Evaluate a hasAttr expression from bytecode.-evalBcHasAttr :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcHasAttr env bcIdx0 = do-  let targetIdx = unsafePerformIO (cbcArg1 bcIdx0)-      (pathLen, pathOff) =-        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg2 bcIdx0)-  targetVal <- evalBytecode env targetIdx-  VBool <$> hasBcAttrPath env pathLen pathOff targetVal---- | Collect static attribute path names for error reporting.-collectBcAttrPathNames :: Int -> Word32 -> Text-collectBcAttrPathNames pathLen pathOff = T.intercalate "." (go pathLen pathOff)-  where-    go 0 _ = []-    go n off =-      let isExpr = unsafePerformIO (cbcData off)-          keyVal = unsafePerformIO (cbcData (off + 1))-          name = if isExpr /= 0 then "<expr>" else symbolText (Symbol keyVal)-       in name : go (n - 1) (off + 2)---- | Resolve one attr-path element (two words at @off@) to its key text.--- A dynamic key must produce a string - null included, as upstream's--- select and has-attr key coercion rejects null with a type error.-resolveBcAttrKey :: (MonadEval m) => Env -> Word32 -> m Text-resolveBcAttrKey env off = do-  let isExpr = unsafePerformIO (cbcData off)-      keyVal = unsafePerformIO (cbcData (off + 1))-  if isExpr /= 0-    then do-      keyResult <- evalBytecode env keyVal-      case keyResult of-        VStr s _ -> decodedText "dynamic attribute key" s-        _ -> throwEvalError ("dynamic attribute key must be a string, got " <> typeName keyResult)-    else pure (symbolText (Symbol keyVal))---- | Walk an attribute path stored in the bytecode data buffer.--- Each element is two words: (is_expr, key_or_bc_idx).  Every matched--- element is forced - select needs the terminal value, and the walk--- needs each intermediate to be a set.-walkBcAttrPath :: (MonadEval m) => Env -> Int -> Word32 -> NixValue -> m (Maybe NixValue)-walkBcAttrPath _ 0 _ val = pure (Just val)-walkBcAttrPath env n off val = case val of-  VAttrs attrs -> do-    key <- resolveBcAttrKey env off-    case attrSetLookup key attrs of-      Just thunk -> do-        inner <- force thunk-        walkBcAttrPath env (n - 1) (off + 2) inner-      Nothing -> pure Nothing-  -- Non-attrset: attribute path cannot continue.  Return Nothing so-  -- that callers with a default (``a.b or def'') can handle it-  -- gracefully, matching C++ Nix behaviour.-  _ -> pure Nothing---- | Presence walk for has-attr: intermediates force (the walk must reach--- a set), but the terminal element is a membership check only - upstream--- ``a ? b.c`` never evaluates the final attribute's value.-hasBcAttrPath :: (MonadEval m) => Env -> Int -> Word32 -> NixValue -> m Bool-hasBcAttrPath _ 0 _ _ = pure True-hasBcAttrPath env n off val = case val of-  VAttrs attrs -> do-    key <- resolveBcAttrKey env off-    case attrSetLookup key attrs of-      Just thunk-        | n == 1 -> pure True-        | otherwise -> do-            inner <- force thunk-            hasBcAttrPath env (n - 1) (off + 2) inner-      Nothing -> pure False-  _ -> pure False---- | Evaluate attribute set from bytecode.-evalBcAttrs :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcAttrs env bcIdx0 = do-  let isRec = unsafePerformIO (cbcFlags bcIdx0) /= 0-      (bindCount, dataOff) =-        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)-      captureOff = unsafePerformIO (cbcArg2 bcIdx0)-      bindings = unsafePerformIO (decodeBcBindings bindCount dataOff)-  if isRec-    then do-      let captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)-      evalBcRecAttrs env bindings captureInfo-    else evalBcNonRecAttrs env bindings---- | Evaluate a non-recursive attr set from bytecode bindings.------ Values go through 'cheapThunkBc', so a constant or a variable already in--- scope becomes the value rather than a thunk over it, which is what--- upstream's non-recursive @ExprAttrs::eval@ does through @maybeThunk@.  The--- env here is the enclosing one and is fully built, so reading a variable--- out of it now is safe; the recursive and @let@ paths knot-tie their own--- frame and cannot make the same shortcut.-evalBcNonRecAttrs :: (MonadEval m) => Env -> [BcBinding] -> m NixValue-evalBcNonRecAttrs env bindings = do-  thunkMap <- buildBcThunkMap cheapThunkBc env bindings-  pure (VAttrs (attrSetFromMap thunkMap))---- | Build a let\/rec frame env, sharing the parent-chain and with-scope--- plumbing otherwise repeated across the positional and dynamic paths.  The--- frame's own bindings are positional slots (@slots@\/@slotCount@) or a lazy--- name-table @scope@; the parent and with-scopes come from the enclosing @env@--- and @captureInfo@.-newFrameEnv :: Env -> CaptureInfo -> Ptr CThunkPtr -> Int -> Maybe AttrSet -> Env-newFrameEnv env captureInfo slots slotCount scope =-  newCEnv slots slotCount scope (Just (buildCaptureEnv env captureInfo)) withArr withCount-  where-    (withArr, withCount) = case captureInfo of-      NoCaptureInfo -> envWithScopesRaw env-      Captures _ -> (nullPtr, 0)-      CapturesWithScopes _ -> withScopesForCapture env---- | Evaluate a recursive attr set from bytecode bindings.-evalBcRecAttrs :: (MonadEval m) => Env -> [BcBinding] -> CaptureInfo -> m NixValue-evalBcRecAttrs env bindings captureInfo-  | allBcPositional bindings =-      -- Positional path: slots for variable lookup, CAttrSet for return.-      let slotCount = bcBindingSlotCount bindings-          slotsPtr = allocCSlots slotCount-          recEnv = newFrameEnv env captureInfo slotsPtr slotCount Nothing-          thunkList = buildBcSlotThunks recEnv env bindings-          filled = fillCSlots slotsPtr thunkList-          attrMap = buildBcAttrMapFromSlots bindings thunkList-       in filled `seq` pure (VAttrs (attrSetFromMap attrMap))-  | otherwise = do-      -- Dynamic-key path: the set has a ${dynamic} key or a nested a.b path, so-      -- names are not all known at compile time.  Not a corner-cutting fallback:-      -- it follows C++ Nix's env2 semantics.  The rec env holds the-      -- statically-named bindings as thunks, and the dynamic keys AND values are-      -- evaluated against it - so they can see static siblings and enclosing-      -- vars, but not another dynamic key.  The result is the static bindings-      -- plus the dynamic (name -> value) pairs.-      let scopeCset = buildCAttrSetKeys (bcBindingStaticKeys bindings)-          recEnv = newFrameEnv env captureInfo nullPtr 0 (Just (AttrSet scopeCset))-          (staticBs, dynBs) = partition bcBindingIsStatic bindings-      staticThunks <- buildBcThunkMap mkThunkBc recEnv staticBs-      let scopeFilled = fillCAttrSetValues scopeCset staticThunks-      dynThunks <- scopeFilled `seq` buildBcThunkMap mkThunkBc recEnv dynBs-      -- A dynamic key colliding with a static sibling is an eval error-      -- upstream ("dynamic attribute already defined"), never a merge.-      case Map.keys (Map.intersection dynThunks staticThunks) of-        (dupKey : _) -> throwEvalError ("dynamic attribute '" <> dupKey <> "' already defined")-        [] ->-          let allThunks = Map.union dynThunks staticThunks-              resultCset = buildCAttrSetKeys (Map.keys allThunks)-              filled = fillCAttrSetValues resultCset allThunks-           in filled `seq` pure (VAttrs (AttrSet resultCset))---- | Evaluate a let expression from bytecode.-evalBcLet :: (MonadEval m) => Env -> Word32 -> m NixValue-evalBcLet env bcIdx0 = do-  let (bindCount, dataOff) =-        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)-      bodyIdx = unsafePerformIO (cbcArg2 bcIdx0)-      captureOff = unsafePerformIO (cbcArg3 bcIdx0)-      bindings = unsafePerformIO (decodeBcBindings bindCount dataOff)-      captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)-  if allBcPositional bindings-    then do-      -- Positional path: slots for O(1) lookup.-      let slotCount = bcBindingSlotCount bindings-          slotsPtr = allocCSlots slotCount-          letEnv = newFrameEnv env captureInfo slotsPtr slotCount Nothing-          filled = fillCSlots slotsPtr (buildBcSlotThunks letEnv env bindings)-       in filled `seq` evalBytecode letEnv bodyIdx-    else do-      -- Dynamic path: a nested a.b binding (a dynamic top-level key is not valid-      -- in a let).  Every top-level key is therefore static; sub-keys and values-      -- resolve in the let env, which the body also sees.-      let cset = buildCAttrSetKeys (bcBindingStaticKeys bindings)-          letEnv = newFrameEnv env captureInfo nullPtr 0 (Just (AttrSet cset))-      thunkMap <- buildBcThunkMap mkThunkBc letEnv bindings-      let filled = fillCAttrSetValues cset thunkMap-       in filled `seq` evalBytecode letEnv bodyIdx---- | Check if all bytecode bindings are single static keys (eligible for positional).--- Must stay in sync with 'allStaticSingleKey' in 'Nix.Expr.Resolve'.-allBcPositional :: [BcBinding] -> Bool-allBcPositional = all isEligible-  where-    isEligible (BcNamed [BcStaticKey _] _) = True-    isEligible (BcInherit _) = True-    isEligible (BcInheritFrom _ _) = True-    isEligible _ = False---- | Count positional slots for bytecode bindings.--- Must stay in sync with 'lexicalScopeFromBindings' in 'Nix.Expr.Resolve'.-bcBindingSlotCount :: [BcBinding] -> Int-bcBindingSlotCount = foldl' countOne 0-  where-    countOne !acc (BcNamed [BcStaticKey _] _) = acc + 1-    countOne !acc (BcInherit syms) = acc + length syms-    countOne !acc (BcInheritFrom _ syms) = acc + length syms-    countOne !acc _ = acc---- | Build thunks for positional bytecode bindings in declaration order.-buildBcSlotThunks :: Env -> Env -> [BcBinding] -> [Thunk]-buildBcSlotThunks recEnv outerEnv = concatMap slotThunk-  where-    slotThunk (BcNamed [BcStaticKey _] valBcIdx) =-      [mkThunkBc recEnv valBcIdx]-    slotThunk (BcInherit syms) =-      map (inheritLookup outerEnv . symbolText . Symbol) syms-    slotThunk (BcInheritFrom fromBcIdx syms) =-      -- inherit (from) x y z; becomes one thunk per name that selects from the from-expr.-      -- Each thunk gets a minimal env with the from-value at slot 0.-      let fromThunk = mkThunkBc recEnv fromBcIdx-          mkInheritThunk sym =-            let name = symbolText (Symbol sym)-                selectExpr = ESelect (EResolvedVar 0 0) [StaticKey name] Nothing-                (sp, sc) = buildCSlots [fromThunk]-                fromEnv = newMinimalEnv sp sc-             in mkSyntheticThunk fromEnv selectExpr-       in map mkInheritThunk syms-    -- Unreachable: allBcPositional guards this path.-    slotThunk _ = []---- | Build attr map from slots for positional bytecode bindings.-buildBcAttrMapFromSlots :: [BcBinding] -> [Thunk] -> Map Text Thunk-buildBcAttrMapFromSlots bindings thunks = go bindings thunks Map.empty-  where-    go [] _ !acc = acc-    go (BcNamed [BcStaticKey sym] _ : bs) (t : ts) !acc =-      go bs ts (Map.insert (symbolText (Symbol sym)) t acc)-    go (BcInherit syms : bs) ts !acc =-      let (used, rest) = splitAt (length syms) ts-          accMerged = foldl' (\a (sym, t0) -> Map.insert (symbolText (Symbol sym)) t0 a) acc (zip syms used)-       in go bs rest accMerged-    go (BcInheritFrom _ syms : bs) ts !acc =-      let (used, rest) = splitAt (length syms) ts-          accMerged = foldl' (\a (sym, t0) -> Map.insert (symbolText (Symbol sym)) t0 a) acc (zip syms used)-       in go bs rest accMerged-    -- Unreachable: allBcPositional guards this path.-    go (_ : bs) ts !acc = go bs ts acc---- | Build thunk map for bytecode attrs (non-rec or fallback rec path).--- | Build the name-to-thunk map for a set of bindings.------ How a value becomes a thunk is the caller's decision: a non-recursive--- attr set can resolve constants and in-scope variables immediately, while a--- frame that is still being tied has to defer everything, since the slots--- the variables point at are not filled yet.-buildBcThunkMap :: (MonadEval m) => (Env -> Word32 -> Thunk) -> Env -> [BcBinding] -> m (Map Text Thunk)-buildBcThunkMap mkValueThunk thunkEnv = foldM addBinding Map.empty-  where-    addBinding acc (BcNamed keys valBcIdx) = do-      resolvedKeys <- mapM (resolveBcKey thunkEnv) keys-      case sequence resolvedKeys of-        Nothing -> pure acc -- null key -> skip-        Just [key] ->-          insertChecked acc key (mkValueThunk thunkEnv valBcIdx)-        Just path ->-          let nested = buildBcNestedAttr thunkEnv path valBcIdx-           in foldM (\a (k, t0) -> insertChecked a k t0) acc (Map.toList nested)-    addBinding acc (BcInherit syms) =-      foldM (\a sym -> let name = symbolText (Symbol sym) in insertChecked a name (inheritLookup thunkEnv name)) acc syms-    addBinding acc (BcInheritFrom fromBcIdx syms) =-      -- inherit (from) name selects name from the from-expr.-      -- Create a small env with the from value at slot 0, then a-      -- synthetic expression that selects name from slot 0.-      let addInheritFrom a sym =-            let name = symbolText (Symbol sym)-                selectExpr = ESelect (EResolvedVar 0 0) [StaticKey name] Nothing-                (sp, sc) = buildCSlots [mkThunkBc thunkEnv fromBcIdx]-                fromEnv = newMinimalEnv sp sc-             in insertChecked a name (mkSyntheticThunk fromEnv selectExpr)-       in foldM addInheritFrom acc syms--    -- The parser normalizes static keys to appear exactly once, so a-    -- collision here means an evaluated DYNAMIC key hit an existing-    -- attr - an eval error upstream, never a silent merge.-    insertChecked acc key thunk =-      case Map.lookup key acc of-        Nothing -> pure (Map.insert key thunk acc)-        Just _ -> throwEvalError ("dynamic attribute '" <> key <> "' already defined")---- | Resolve a bytecode attr key to text.-resolveBcKey :: (MonadEval m) => Env -> BcAttrKey -> m (Maybe Text)-resolveBcKey _env (BcStaticKey sym) = pure (Just (symbolText (Symbol sym)))-resolveBcKey env (BcDynamicKey bcIdx0) = do-  val <- evalBytecode env bcIdx0-  case val of-    VStr s _ -> Just <$> decodedText "dynamic attribute key" s-    VNull -> pure Nothing-    _ -> throwEvalError ("dynamic attribute key must be a string, got " <> typeName val)---- | Build a nested attribute structure from a resolved dotted path (bytecode).-buildBcNestedAttr :: Env -> [Text] -> Word32 -> Map Text Thunk-buildBcNestedAttr _thunkEnv [] _valBcIdx = Map.empty-buildBcNestedAttr thunkEnv [key] valBcIdx =-  Map.singleton key (mkThunkBc thunkEnv valBcIdx)-buildBcNestedAttr thunkEnv (key : rest) valBcIdx =-  Map.singleton key (evaluated (VAttrs (attrSetFromMap (buildBcNestedAttr thunkEnv rest valBcIdx))))---- | Top-level keys knowable without evaluating any dynamic key: static keys--- and inherited names.  These populate the rec env's name table while the--- dynamic keys are evaluated, so a dynamic key can reference a static sibling--- or an enclosing variable (matching C++ Nix's env2), but not another dynamic--- key.-bcBindingStaticKeys :: [BcBinding] -> [Text]-bcBindingStaticKeys = concatMap oneBinding-  where-    oneBinding (BcNamed (BcStaticKey sym : _) _) = [symbolText (Symbol sym)]-    oneBinding (BcNamed _ _) = []-    oneBinding (BcInherit syms) = map (symbolText . Symbol) syms-    oneBinding (BcInheritFrom _ syms) = map (symbolText . Symbol) syms---- | True when a binding's top-level key is known statically (a static key or an--- inherit).  These bindings populate the rec env's name table (C++ Nix's env2);--- a binding with a dynamic top-level key does not - it is added to the value.-bcBindingIsStatic :: BcBinding -> Bool-bcBindingIsStatic (BcNamed (BcStaticKey _ : _) _) = True-bcBindingIsStatic (BcNamed _ _) = False-bcBindingIsStatic (BcInherit _) = True-bcBindingIsStatic (BcInheritFrom _ _) = True---- ------------------------------------------------------------------------------ Search paths (<nixpkgs>, <nixpkgs/lib>)--- ------------------------------------------------------------------------------- | Evaluate a search path expression.--- Desugars to @builtins.findFile builtins.nixPath "name"@ - exactly how--- real Nix handles @\<name\>@ expressions.-evalSearchPath :: (MonadEval m) => Env -> Text -> m NixValue-evalSearchPath env name = do-  builtinsVal <- evalVar env "builtins"-  case builtinsVal of-    VAttrs builtinsAttrs ->-      case attrSetLookup "nixPath" builtinsAttrs of-        Just nixPathThunk -> do-          nixPathVal <- force nixPathThunk-          builtinFindFile nixPathVal (mkStr name)-        Nothing ->-          throwCatchableError ("file '" <> name <> "' was not found in the Nix search path")-    _ ->-      throwCatchableError ("file '" <> name <> "' was not found in the Nix search path")---- ------------------------------------------------------------------------------ Variables--- -----------------------------------------------------------------------------evalVar :: (MonadEval m) => Env -> Text -> m NixValue-evalVar env name =-  case envLookup name env of-    Just thunk -> force thunk-    Nothing -> throwEvalError ("undefined variable '" <> name <> "'")---- | Evaluate a with-scoped variable: check with-scopes first (innermost--- to outermost), then fall back to the standard name-based lookup--- (parent chain to builtins).  For trimmed envs ('CapturesWithScopes'),--- the root scope is already appended to 'envWithScopes' so the--- with-scope lookup finds builtins without needing a parent chain.--- Supports both resolved (CAttrSet*) and lazy (CThunk*, tagged with bit 0)--- with-scope entries.  Lazy entries are forced on first lookup and the--- pointer is updated in place so subsequent lookups hit the resolved--- attrset directly.-evalWithVar :: (MonadEval m) => Env -> Text -> m NixValue-evalWithVar env name =-  let (withArr, withCount) = envWithScopesRaw env-   in evalWithVarScopes env name withArr (fromIntegral withCount) 0--evalWithVarScopes :: (MonadEval m) => Env -> Text -> Ptr (Ptr ()) -> Int -> Int -> m NixValue-evalWithVarScopes env name withArr count idx-  | idx >= count = evalVar env name-  | otherwise = do-      let scopePtr = unsafePerformIO (peekElemOff withArr idx)-      if isLazyWithScope scopePtr-        then do-          -- Lazy with-scope: force the thunk to get the attrset-          let thunkPtr = untagWithScope scopePtr-          scopeVal <- force (Thunk thunkPtr)-          case scopeVal of-            VAttrs (AttrSet cset) -> do-              -- Cache: replace the tagged thunk pointer with the resolved-              -- attrset pointer so future lookups are fast.-              let resolvedPtr = castPtr cset-              seq (unsafePerformIO (pokeElemOff withArr idx resolvedPtr)) (pure ())-              case attrSetLookup name (AttrSet cset) of-                Just thunk -> force thunk-                Nothing -> evalWithVarScopes env name withArr count (idx + 1)-            _ -> throwEvalError ("'with' requires a set, got " <> typeName scopeVal)-        else-          -- Resolved attrset scope (normal path)-          case attrSetLookup name (AttrSet (castPtr scopePtr)) of-            Just thunk -> force thunk-            Nothing -> evalWithVarScopes env name withArr count (idx + 1)---- | Check if a with-scope pointer is tagged as lazy (bit 0 set).-isLazyWithScope :: Ptr () -> Bool-isLazyWithScope ptr = ptrToWordPtr ptr .&. 1 /= 0---- | Remove the lazy tag from a with-scope pointer, returning a CThunkPtr.-untagWithScope :: Ptr () -> CThunkPtr-untagWithScope ptr =-  let tagged = ptrToWordPtr ptr-   in wordPtrToPtr (tagged .&. complement 1)---- | Tag a CThunkPtr as a lazy with-scope (set bit 0).-tagLazyWithScope :: CThunkPtr -> Ptr ()-tagLazyWithScope ptr =-  let raw = ptrToWordPtr (castPtr ptr)-   in wordPtrToPtr (raw .|. 1)---- | Push a lazy (thunk-based) with-scope onto the environment.--- The scope is NOT forced until a WITH_VAR lookup actually needs it.-{-# NOINLINE pushLazyWithScope #-}-pushLazyWithScope :: Thunk -> Env -> Env-pushLazyWithScope (Thunk thunkPtr) =-  pushWithScopeRaw (tagLazyWithScope thunkPtr)---- | Push a raw pointer as a with-scope.-{-# NOINLINE pushWithScopeRaw #-}-pushWithScopeRaw :: Ptr () -> Env -> Env-pushWithScopeRaw ptr (Env envPtr) =-  Env (checkedCPtr "pushWithScopeRaw" (unsafePerformIO (cenvPushWith envPtr ptr)))---- ------------------------------------------------------------------------------ Formals matching + env helpers (used by evalBcApp, applyValue, etc.)--- ------------------------------------------------------------------------------- | Match a lambda's formals against an argument thunk.-matchFormals :: (MonadEval m) => Env -> EvalFormals -> Thunk -> m Env-matchFormals closureEnv (EFName _) argThunk =-  let (sp, sc) = buildCSlots [argThunk]-   in pure (envFromSlots sp sc closureEnv)-matchFormals closureEnv (EFSet formals allowExtra) argThunk = do-  argVal <- force argThunk-  matchFormalSet closureEnv formals allowExtra argVal Nothing-matchFormals closureEnv (EFNamedSet _ formals allowExtra) argThunk = do-  argVal <- force argThunk-  matchFormalSet closureEnv formals allowExtra argVal (Just argThunk)---- | Match destructuring set pattern formals against an attrset value.-matchFormalSet :: (MonadEval m) => Env -> [EvalFormal] -> Bool -> NixValue -> Maybe Thunk -> m Env-matchFormalSet closureEnv formals allowExtra argVal atThunk =-  case argVal of-    VAttrs attrs -> do-      checkExtraKeys formals allowExtra attrs-      checkMissingFormals attrs formals-      let formalEnv = envFromSlots formalSlotsPtr formalSlotCount closureEnv-          (formalSlotsPtr, formalSlotCount) = buildCSlots formalThunks-          formalThunks = case atThunk of-            Nothing -> map resolveOneFormal formals-            Just at -> at : map resolveOneFormal formals-          resolveOneFormal (EvalFormal name defBcIdx) =-            case attrSetLookup name attrs of-              Just thunk -> thunk-              Nothing -> case defBcIdx of-                Just bcIdx -> mkThunkBc formalEnv bcIdx-                Nothing -> error "matchFormalSet: missing required formal (unreachable)"-      pure formalEnv-    _ -> throwEvalError ("function expects a set argument, got " <> typeName argVal)--checkExtraKeys :: (MonadEval m) => [EvalFormal] -> Bool -> AttrSet -> m ()-checkExtraKeys _ True _ = pure ()-checkExtraKeys formals False attrs =-  let expected = map efName formals-      actual = attrSetKeys attrs-      extra = filter (`notElem` expected) actual-   in case extra of-        [] -> pure ()-        (k : _) -> throwEvalError ("unexpected attribute '" <> k <> "' in function argument")--checkMissingFormals :: (MonadEval m) => AttrSet -> [EvalFormal] -> m ()-checkMissingFormals attrs formals =-  let allMissing = [efName f | f <- formals, isNothing (efDefault f), not (attrSetMember (efName f) attrs)]-   in case allMissing of-        [] -> pure ()-        (name : _) ->-          let provided = attrSetKeys attrs-              provSnippet = T.intercalate ", " (take 20 provided)-              missSnippet = T.intercalate ", " allMissing-           in throwEvalError ("missing required attribute '" <> name <> "'; all missing: [" <> missSnippet <> "]; provided keys (" <> T.pack (show (length provided)) <> "): [" <> provSnippet <> "]")---- | Build capture environment from capture info.--- NoCaptureInfo: no trimming, use env as-is.--- Captures: build minimal env from captured slots.--- CapturesWithScopes: build minimal env + copy with-scopes.-buildCaptureEnv :: Env -> CaptureInfo -> Env-buildCaptureEnv env NoCaptureInfo = env-buildCaptureEnv env (Captures captureList) =-  let (slotsPtr, slotCount) = buildCSlots [envLookupResolved lvl idx env | (lvl, idx) <- captureList]-   in newMinimalEnv slotsPtr slotCount-buildCaptureEnv env (CapturesWithScopes captureList) =-  let (slotsPtr, slotCount) = buildCSlots [envLookupResolved lvl idx env | (lvl, idx) <- captureList]-      (withArr, withCount) = withScopesForCapture env-   in newCEnv slotsPtr slotCount Nothing Nothing withArr withCount---- | Look up a name in the environment and return its thunk.--- Used by @inherit@ bindings (both bytecode and Expr paths).-inheritLookup :: Env -> Text -> Thunk-inheritLookup env name =-  case envLookup name env of-    Just thunk -> thunk-    Nothing -> error ("inheritLookup: undefined variable '" <> T.unpack name <> "' (unreachable)")---- ------------------------------------------------------------------------------ Builtin registry (single-definition-site for all builtins)--- ------------------------------------------------------------------------------- | A builtin function definition: its arity and implementation.-data BuiltinDef m = BuiltinDef-  { bdArity :: !Int,-    bdApply :: [NixValue] -> m NixValue-  }---- | Define an arity-1 builtin.-builtin1 :: (MonadEval m) => Text -> (NixValue -> m NixValue) -> (Text, BuiltinDef m)-builtin1 name f =-  ( name,-    BuiltinDef 1 $ \case-      [a] -> f a-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-  )---- | Define an arity-2 builtin.-builtin2 ::-  (MonadEval m) =>-  Text ->-  (NixValue -> NixValue -> m NixValue) ->-  (Text, BuiltinDef m)-builtin2 name f =-  ( name,-    BuiltinDef 2 $ \case-      [a, b] -> f a b-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-  )---- | Define an arity-3 builtin.-builtin3 ::-  (MonadEval m) =>-  Text ->-  (NixValue -> NixValue -> NixValue -> m NixValue) ->-  (Text, BuiltinDef m)-builtin3 name f =-  ( name,-    BuiltinDef 3 $ \case-      [a, b, c] -> f a b c-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-  )---- | Central registry of all builtins.  Adding a new builtin is a single--- entry here plus its implementation function - no other files need changes.-builtinRegistry :: (MonadEval m) => Map Text (BuiltinDef m)-builtinRegistry =-  Map.fromList-    [ -- Type checking (arity 1)-      builtin1 "typeOf" (pure . mkStr . typeOfValue),-      builtin1 "isNull" (pure . VBool . isNullVal),-      builtin1 "isInt" (pure . VBool . isIntVal),-      builtin1 "isFloat" (pure . VBool . isFloatVal),-      builtin1 "isBool" (pure . VBool . isBoolVal),-      builtin1 "isString" (pure . VBool . isStringVal),-      builtin1 "isList" (pure . VBool . isListVal),-      builtin1 "isAttrs" (pure . VBool . isAttrsVal),-      builtin1 "isFunction" (pure . VBool . isFunctionVal),-      -- List operations (arity 1)-      builtin1 "length" builtinLength,-      builtin1 "head" builtinHead,-      builtin1 "tail" builtinTail,-      -- String operations (arity 1)-      builtin1 "toString" (fmap (uncurry VStr) . coerceToStringPermissive),-      builtin1 "stringLength" builtinStringLength,-      -- Control (arity 1)-      builtin1 "throw" builtinThrow,-      builtin1 "abort" builtinAbort,-      -- Attr set operations (arity 1)-      builtin1 "attrNames" builtinAttrNames,-      builtin1 "attrValues" builtinAttrValues,-      builtin1 "listToAttrs" builtinListToAttrs,-      -- Attr set operations (arity 2)-      builtin2 "hasAttr" builtinHasAttr,-      builtin2 "getAttr" builtinGetAttr,-      builtin2 "removeAttrs" builtinRemoveAttrs,-      builtin2 "intersectAttrs" builtinIntersectAttrs,-      builtin2 "catAttrs" builtinCatAttrs,-      -- List higher-order (arity 2)-      builtin2 "map" builtinMap,-      builtin2 "filter" builtinFilter,-      builtin2 "genList" builtinGenList,-      builtin2 "sort" builtinSort,-      builtin2 "concatMap" builtinConcatMap,-      builtin2 "any" builtinAny,-      builtin2 "all" builtinAll,-      builtin2 "elem" builtinElem,-      builtin2 "elemAt" builtinElemAt,-      builtin2 "partition" builtinPartition,-      builtin2 "groupBy" builtinGroupBy,-      -- String operations (arity 2)-      builtin2 "concatStringsSep" builtinConcatStringsSep,-      -- Arity 3-      builtin3 "foldl'" builtinFoldl,-      builtin3 "substring" builtinSubstring,-      -- Numeric-      builtin1 "isPath" (pure . VBool . isPathVal),-      builtin1 "ceil" builtinCeil,-      builtin1 "floor" builtinFloor,-      builtin2 "seq" builtinSeq,-      builtin2 "trace" builtinTrace,-      builtin2 "warn" builtinWarn,-      builtin1 "unsafeDiscardStringContext" builtinDiscardContext,-      builtin1 "unsafeDiscardOutputDependency" builtinDiscardOutputDep,-      builtin1 "addDrvOutputDependencies" builtinAddDrvOutputDeps,-      -- String context introspection-      builtin1 "hasContext" builtinHasContext,-      builtin1 "getContext" builtinGetContext,-      builtin2 "appendContext" builtinAppendContext,-      builtin1 "baseNameOf" builtinBaseNameOf,-      builtin1 "dirOf" builtinDirOf,-      builtin1 "concatLists" builtinConcatLists,-      builtin2 "lessThan" builtinLessThan,-      -- Arithmetic + bitwise-      builtin2 "add" builtinAdd,-      builtin2 "sub" builtinSub,-      builtin2 "mul" builtinMul,-      builtin2 "div" builtinDiv,-      builtin2 "bitAnd" builtinBitAnd,-      builtin2 "bitOr" builtinBitOr,-      builtin2 "bitXor" builtinBitXor,-      -- Attr set higher-order-      builtin2 "mapAttrs" builtinMapAttrs,-      builtin1 "functionArgs" builtinFunctionArgs,-      builtin2 "zipAttrsWith" builtinZipAttrsWith,-      -- String manipulation-      builtin2 "match" builtinMatch,-      builtin2 "split" builtinSplit,-      builtin3 "replaceStrings" builtinReplaceStrings,-      builtin2 "compareVersions" builtinCompareVersions,-      builtin1 "splitVersion" builtinSplitVersion,-      builtin1 "parseDrvName" builtinParseDrvName,-      -- Serialization + hashing-      builtin1 "toJSON" builtinToJSON,-      builtin1 "fromJSON" builtinFromJSON,-      builtin2 "hashString" builtinHashString,-      -- Error handling + sequencing-      -- An argument reaching here is already forced (any throw happened-      -- before tryEval saw it), so it success-wraps; the catching paths-      -- are evalBcApp and applyValueLazy.-      builtin1 "tryEval" (tryEvalAction . pure),-      builtin2 "deepSeq" builtinDeepSeq,-      -- Graph traversal-      builtin1 "genericClosure" builtinGenericClosure,-      -- IO builtins (delegate to MonadEval methods)-      builtin1 "import" builtinImport,-      builtin1 "readFile" builtinReadFile,-      builtin1 "pathExists" builtinPathExists,-      builtin1 "readDir" builtinReadDir,-      builtin1 "getEnv" builtinGetEnv,-      builtin1 "toPath" builtinToPath,-      -- Store path operations-      builtin1 "placeholder" builtinPlaceholder,-      builtin1 "storePath" builtinStorePath,-      builtin2 "findFile" builtinFindFile,-      builtin2 "toFile" builtinToFile,-      builtin2 "scopedImport" builtinScopedImport,-      -- Network fetchers-      builtin1 "fetchurl" builtinFetchurl,-      builtin1 "fetchTarball" builtinFetchTarball,-      builtin1 "fetchGit" builtinFetchGit,-      -- Derivation construction: lazy 'derivation' wrapper over the eager-      -- 'derivationStrict' primop, as upstream's-      -- src/libexpr/primops/derivation.nix does.-      builtin1 "derivation" builtinDerivationLazy,-      builtin1 "derivationStrict" builtinDerivationStrict,-      -- Error context (pass-through - context only matters on error)-      builtin2 "addErrorContext" (\_ val -> pure val),-      -- Attr position (return null - nixpkgs handles this gracefully)-      builtin2 "unsafeGetAttrPos" (\_ _ -> pure VNull),-      -- Debugging (traceVerbose: same as trace for now, --trace-verbose not yet gated)-      builtin2 "traceVerbose" builtinTrace,-      builtin1 "break" pure,-      -- IO: file hashing + type detection-      builtin2 "hashFile" builtinHashFile,-      builtin1 "readFileType" builtinReadFileType,-      -- Serialization-      builtin1 "fromTOML" builtinFromTOML,-      -- Hash conversion-      builtin1 "convertHash" builtinConvertHash,-      -- XML serialization-      builtin1 "toXML" builtinToXML,-      -- Source filtering + path import-      builtin1 "path" builtinPath,-      builtin2 "filterSource" builtinFilterSource,-      -- Experimental feature stubs-      builtin2 "outputOf" builtinOutputOf,-      builtin1 "fetchTree" builtinFetchTree,-      builtin1 "fetchClosure" builtinFetchClosure-    ]---- | Names of all registered builtins.-builtinNames :: [Text]-builtinNames = Map.keys (builtinRegistry :: Map Text (BuiltinDef PureEval))---- ------------------------------------------------------------------------------ Builtin dispatch (partial application via accumulated args)--- ------------------------------------------------------------------------------- | Arity of a builtin (how many arguments before execution).-builtinArity :: Text -> Int-builtinArity name = maybe 1 bdArity (Map.lookup name (builtinRegistry :: Map Text (BuiltinDef PureEval)))---- | Apply a builtin with accumulated args.  If we have enough args,--- execute; otherwise return a partially applied builtin.-applyBuiltin :: (MonadEval m) => Text -> [NixValue] -> NixValue -> m NixValue-applyBuiltin name accArgs arg =-  let allArgs = accArgs ++ [arg]-      arity = builtinArity name-   in if length allArgs < arity-        then pure (VBuiltin name (precompileArgs name allArgs))-        else executeBuiltin name allArgs---- | Pre-compile regex patterns at partial application time.--- When builtins.match or builtins.split receives its first argument--- (the pattern string), compile it immediately and store the compiled--- RE.Regex in a VCompiledRegex, replacing the raw VStr.  The compiled--- form is carried in VBuiltin's accumulated args and reused on every--- subsequent application - zero recompilation.  Both builtins compile--- the RAW pattern: match's whole-string requirement is a span check at--- match time, not textual @^...$@ anchoring, which would misparse a--- top-level alternation (@^a|b$@ is @(^a)|(b$)@).-precompileArgs :: Text -> [NixValue] -> [NixValue]-precompileArgs "match" [VStr pat _] = compiledRegexArg pat-precompileArgs "split" [VStr pat _] = compiledRegexArg pat-precompileArgs _ args = args---- | The single-element arg list for a regex builtin: the compiled pattern--- if valid, the raw string otherwise (the error surfaces at execute time).-compiledRegexArg :: BS.ByteString -> [NixValue]-compiledRegexArg pat = case cachedCompileRegex pat of-  Just compiled -> [VCompiledRegex (CompiledRegex pat compiled)]-  Nothing -> [VStr pat emptyContext]---- | Apply a function value (lambda or builtin) to one argument.--- Used by higher-order builtins to invoke user-supplied functions.-applyValue :: (MonadEval m) => NixValue -> NixValue -> m NixValue-applyValue (VLambda closureEnv formals bodyBcIdx) arg = do-  extEnv <- matchFormals closureEnv formals (evaluated arg)-  evalBytecode extEnv bodyBcIdx-applyValue (VBuiltin name accArgs) arg =-  applyBuiltin name accArgs arg-applyValue other _ =-  throwEvalError ("attempt to call " <> typeName other <> ", which is not a function")---- | Apply a function value to an UNFORCED thunk argument.  Upstream's--- higher-order list builtins (filter, any, all, partition, groupBy,--- foldl') pass elements as unforced values, so an element the function--- never inspects may contain a throw without failing the call.  A--- builtin callee still receives a forced value (builtins force their--- arguments regardless), and set-pattern formals force on destructuring--- exactly as upstream does.-applyValueLazy :: (MonadEval m) => NixValue -> Thunk -> m NixValue-applyValueLazy (VLambda closureEnv formals bodyBcIdx) argThunk = do-  extEnv <- matchFormals closureEnv formals argThunk-  evalBytecode extEnv bodyBcIdx--- tryEval's catch must wrap the argument's forcing (see 'tryEvalAction'):--- map/filter passing a throwing element to tryEval yields success = false,--- not an escaped error.-applyValueLazy (VBuiltin "tryEval" []) argThunk = tryEvalAction (force argThunk)-applyValueLazy other argThunk = do-  val <- force argThunk-  applyValue other val---- | Execute a builtin once all arguments are collected.------ Direct case dispatch avoids rebuilding the polymorphic 'builtinRegistry'--- Map on every call.  'builtinRegistry' is polymorphic in @m@ so GHC--- cannot cache it as a CAF - it gets reconstructed on every use.--- Pattern matching on the name is zero-allocation.-executeBuiltin :: (MonadEval m) => Text -> [NixValue] -> m NixValue-executeBuiltin name args = case name of-  -- Type checking (arity 1)-  "typeOf" -> apply1 (pure . mkStr . typeOfValue)-  "isNull" -> apply1 (pure . VBool . isNullVal)-  "isInt" -> apply1 (pure . VBool . isIntVal)-  "isFloat" -> apply1 (pure . VBool . isFloatVal)-  "isBool" -> apply1 (pure . VBool . isBoolVal)-  "isString" -> apply1 (pure . VBool . isStringVal)-  "isList" -> apply1 (pure . VBool . isListVal)-  "isAttrs" -> apply1 (pure . VBool . isAttrsVal)-  "isFunction" -> apply1 (pure . VBool . isFunctionVal)-  -- List operations (arity 1)-  "length" -> apply1 builtinLength-  "head" -> apply1 builtinHead-  "tail" -> apply1 builtinTail-  -- String operations (arity 1)-  "toString" -> apply1 (fmap (uncurry VStr) . coerceToStringPermissive)-  "stringLength" -> apply1 builtinStringLength-  -- Control (arity 1)-  "throw" -> apply1 builtinThrow-  "abort" -> apply1 builtinAbort-  -- Attr set operations (arity 1)-  "attrNames" -> apply1 builtinAttrNames-  "attrValues" -> apply1 builtinAttrValues-  "listToAttrs" -> apply1 builtinListToAttrs-  -- Attr set operations (arity 2)-  "hasAttr" -> apply2 builtinHasAttr-  "getAttr" -> apply2 builtinGetAttr-  "removeAttrs" -> apply2 builtinRemoveAttrs-  "intersectAttrs" -> apply2 builtinIntersectAttrs-  "catAttrs" -> apply2 builtinCatAttrs-  -- List higher-order (arity 2)-  "map" -> apply2 builtinMap-  "filter" -> apply2 builtinFilter-  "genList" -> apply2 builtinGenList-  "sort" -> apply2 builtinSort-  "concatMap" -> apply2 builtinConcatMap-  "any" -> apply2 builtinAny-  "all" -> apply2 builtinAll-  "elem" -> apply2 builtinElem-  "elemAt" -> apply2 builtinElemAt-  "partition" -> apply2 builtinPartition-  "groupBy" -> apply2 builtinGroupBy-  -- String operations (arity 2)-  "concatStringsSep" -> apply2 builtinConcatStringsSep-  -- Arity 3-  "foldl'" -> apply3 builtinFoldl-  "substring" -> apply3 builtinSubstring-  -- Numeric-  "isPath" -> apply1 (pure . VBool . isPathVal)-  "ceil" -> apply1 builtinCeil-  "floor" -> apply1 builtinFloor-  "seq" -> apply2 builtinSeq-  "trace" -> apply2 builtinTrace-  "warn" -> apply2 builtinWarn-  "unsafeDiscardStringContext" -> apply1 builtinDiscardContext-  "unsafeDiscardOutputDependency" -> apply1 builtinDiscardOutputDep-  "addDrvOutputDependencies" -> apply1 builtinAddDrvOutputDeps-  -- String context introspection-  "hasContext" -> apply1 builtinHasContext-  "getContext" -> apply1 builtinGetContext-  "appendContext" -> apply2 builtinAppendContext-  "baseNameOf" -> apply1 builtinBaseNameOf-  "dirOf" -> apply1 builtinDirOf-  "concatLists" -> apply1 builtinConcatLists-  "lessThan" -> apply2 builtinLessThan-  -- Arithmetic + bitwise-  "add" -> apply2 builtinAdd-  "sub" -> apply2 builtinSub-  "mul" -> apply2 builtinMul-  "div" -> apply2 builtinDiv-  "bitAnd" -> apply2 builtinBitAnd-  "bitOr" -> apply2 builtinBitOr-  "bitXor" -> apply2 builtinBitXor-  -- Attr set higher-order-  "mapAttrs" -> apply2 builtinMapAttrs-  "functionArgs" -> apply1 builtinFunctionArgs-  "zipAttrsWith" -> apply2 builtinZipAttrsWith-  -- String manipulation-  "match" -> apply2 builtinMatch-  "split" -> apply2 builtinSplit-  "replaceStrings" -> apply3 builtinReplaceStrings-  "compareVersions" -> apply2 builtinCompareVersions-  "splitVersion" -> apply1 builtinSplitVersion-  "parseDrvName" -> apply1 builtinParseDrvName-  -- Serialization + hashing-  "toJSON" -> apply1 builtinToJSON-  "fromJSON" -> apply1 builtinFromJSON-  "hashString" -> apply2 builtinHashString-  -- Error handling + sequencing-  -- Already-forced argument: success-wrap (see the registry entry).-  "tryEval" -> apply1 (tryEvalAction . pure)-  "deepSeq" -> apply2 builtinDeepSeq-  -- Graph traversal-  "genericClosure" -> apply1 builtinGenericClosure-  -- IO builtins (delegate to MonadEval methods)-  "import" -> apply1 builtinImport-  "readFile" -> apply1 builtinReadFile-  "pathExists" -> apply1 builtinPathExists-  "readDir" -> apply1 builtinReadDir-  "getEnv" -> apply1 builtinGetEnv-  "toPath" -> apply1 builtinToPath-  -- Store path operations-  "placeholder" -> apply1 builtinPlaceholder-  "storePath" -> apply1 builtinStorePath-  "findFile" -> apply2 builtinFindFile-  "toFile" -> apply2 builtinToFile-  "scopedImport" -> apply2 builtinScopedImport-  -- Network fetchers-  "fetchurl" -> apply1 builtinFetchurl-  "fetchTarball" -> apply1 builtinFetchTarball-  "fetchGit" -> apply1 builtinFetchGit-  -- Derivation construction: lazy 'derivation' over eager 'derivationStrict'-  "derivation" -> apply1 builtinDerivationLazy-  "derivationStrict" -> apply1 builtinDerivationStrict-  -- Error context (pass-through - context only matters on error)-  "addErrorContext" -> apply2 (\_ val -> pure val)-  -- Attr position (return null - nixpkgs handles this gracefully)-  "unsafeGetAttrPos" -> apply2 (\_ _ -> pure VNull)-  -- Debugging (traceVerbose: same as trace for now)-  "traceVerbose" -> apply2 builtinTrace-  "break" -> apply1 pure-  -- IO: file hashing + type detection-  "hashFile" -> apply2 builtinHashFile-  "readFileType" -> apply1 builtinReadFileType-  -- Serialization-  "fromTOML" -> apply1 builtinFromTOML-  -- Hash conversion-  "convertHash" -> apply1 builtinConvertHash-  -- XML serialization-  "toXML" -> apply1 builtinToXML-  -- Source filtering + path import-  "path" -> apply1 builtinPath-  "filterSource" -> apply2 builtinFilterSource-  -- Experimental feature stubs-  "outputOf" -> apply2 builtinOutputOf-  "fetchTree" -> apply1 builtinFetchTree-  "fetchClosure" -> apply1 builtinFetchClosure-  _ -> throwEvalError ("unknown builtin '" <> name <> "'")-  where-    apply1 f = case args of-      [a] -> f a-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-    apply2 f = case args of-      [a, b] -> f a b-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")-    apply3 f = case args of-      [a, b, c] -> f a b c-      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")---- ------------------------------------------------------------------------------ Builtin implementations - type checking--- -----------------------------------------------------------------------------typeOfValue :: NixValue -> Text-typeOfValue val = case val of-  VInt _ -> "int"-  VFloat _ -> "float"-  VBool _ -> "bool"-  VNull -> "null"-  VStr _ _ -> "string"-  VPath _ -> "path"-  VList _ -> "list"-  VAttrs _ -> "set"-  VLambda {} -> "lambda"-  VBuiltin _ _ -> "lambda"-  VDerivation _ -> "set"-  VCompiledRegex _ -> "lambda"--isNullVal :: NixValue -> Bool-isNullVal VNull = True-isNullVal _ = False--isIntVal :: NixValue -> Bool-isIntVal (VInt _) = True-isIntVal _ = False--isFloatVal :: NixValue -> Bool-isFloatVal (VFloat _) = True-isFloatVal _ = False--isBoolVal :: NixValue -> Bool-isBoolVal (VBool _) = True-isBoolVal _ = False--isStringVal :: NixValue -> Bool-isStringVal (VStr _ _) = True-isStringVal _ = False--isListVal :: NixValue -> Bool-isListVal (VList _) = True-isListVal _ = False--isAttrsVal :: NixValue -> Bool-isAttrsVal (VAttrs _) = True-isAttrsVal _ = False--isFunctionVal :: NixValue -> Bool-isFunctionVal (VLambda {}) = True-isFunctionVal (VBuiltin _ _) = True-isFunctionVal _ = False---- ------------------------------------------------------------------------------ Builtin implementations - list (arity 1)--- -----------------------------------------------------------------------------builtinLength :: (MonadEval m) => NixValue -> m NixValue-builtinLength (VList cl) = pure (VInt (fromIntegral (clistLen cl)))-builtinLength other = throwEvalError ("builtins.length: expected a list, got " <> typeName other)--builtinHead :: (MonadEval m) => NixValue -> m NixValue-builtinHead (VList cl)-  | clistLen cl == 0 = throwEvalError "builtins.head: empty list"-  | otherwise = case clistThunks cl of-      (p : _) -> force (Thunk p)-      [] -> throwEvalError "builtins.head: empty list" -- unreachable: clistLen > 0-builtinHead other = throwEvalError ("builtins.head: expected a list, got " <> typeName other)--builtinTail :: (MonadEval m) => NixValue -> m NixValue-builtinTail (VList cl)-  | clistLen cl == 0 = throwEvalError "builtins.tail: empty list"-  | otherwise = pure (VList (clistFromThunks (drop 1 (clistThunks cl))))-builtinTail other = throwEvalError ("builtins.tail: expected a list, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - string (arity 1)--- ------------------------------------------------------------------------------- | Byte length, as upstream: stringLength of a 2-byte character is 2, not 1.-builtinStringLength :: (MonadEval m) => NixValue -> m NixValue-builtinStringLength (VStr s _) = pure (VInt (fromIntegral (BS.length s)))-builtinStringLength other =-  throwEvalError ("builtins.stringLength: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - control--- ------------------------------------------------------------------------------- | The error channel is Text and display-only (tryEval discards the--- message), so throw/abort messages decode lossily.-builtinThrow :: (MonadEval m) => NixValue -> m NixValue-builtinThrow (VStr msg _) = throwCatchableError (bytesToTextLossy msg)-builtinThrow other = throwEvalError ("builtins.throw: expected a string, got " <> typeName other)--builtinAbort :: (MonadEval m) => NixValue -> m NixValue-builtinAbort (VStr msg _) = abortEvaluation (bytesToTextLossy msg)-builtinAbort other = abortEvaluation ("builtins.abort: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - attr set (arity 1)--- -----------------------------------------------------------------------------builtinAttrNames :: (MonadEval m) => NixValue -> m NixValue-builtinAttrNames (VAttrs attrs) =-  -- Nix returns attribute names lexicographically sorted; the C array is in-  -- interned-symbol order, so sort here (consistent with builtins.attrValues,-  -- which sorts via attrSetElems).-  let thunks = map (evaluated . mkStr) (sort (attrSetKeys attrs))-   in pure (VList (clistFromThunks (map thunkToCPtr thunks)))-builtinAttrNames other =-  throwEvalError ("builtins.attrNames: expected a set, got " <> typeName other)--builtinAttrValues :: (MonadEval m) => NixValue -> m NixValue-builtinAttrValues (VAttrs attrs) =-  pure (VList (clistFromThunks (map thunkToCPtr (attrSetElems attrs))))-builtinAttrValues other =-  throwEvalError ("builtins.attrValues: expected a set, got " <> typeName other)--builtinListToAttrs :: (MonadEval m) => NixValue -> m NixValue-builtinListToAttrs (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  pairs <- mapM listToAttrsPair thunks-  -- Nix listToAttrs uses first-wins: if duplicate name, first element wins.-  let firstWins = Map.fromListWith (\_ kept -> kept) pairs-  pure (VAttrs (attrSetFromMap firstWins))-builtinListToAttrs other =-  throwEvalError ("builtins.listToAttrs: expected a list, got " <> typeName other)---- | Extract { name, value } from a thunk for listToAttrs.-listToAttrsPair :: (MonadEval m) => Thunk -> m (Text, Thunk)-listToAttrsPair thunk = do-  val <- force thunk-  case val of-    VAttrs attrs -> do-      nameThunk <--        maybe (throwEvalError "builtins.listToAttrs: element missing 'name'") pure $-          attrSetLookup "name" attrs-      nameVal <- force nameThunk-      case nameVal of-        VStr keyName _ ->-          case attrSetLookup "value" attrs of-            Just valueThunk -> do-              key <- decodedText "builtins.listToAttrs: attribute name" keyName-              pure (key, valueThunk)-            Nothing -> throwEvalError "builtins.listToAttrs: element missing 'value'"-        _ -> throwEvalError "builtins.listToAttrs: 'name' must be a string"-    _ -> throwEvalError "builtins.listToAttrs: element must be a set"---- ------------------------------------------------------------------------------ Builtin implementations - attr set (arity 2)--- -----------------------------------------------------------------------------builtinHasAttr :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinHasAttr (VStr key _) (VAttrs attrs) = do-  name <- decodedText "builtins.hasAttr" key-  pure (VBool (attrSetMember name attrs))-builtinHasAttr (VStr _ _) other =-  throwEvalError ("builtins.hasAttr: expected a set, got " <> typeName other)-builtinHasAttr other _ =-  throwEvalError ("builtins.hasAttr: expected a string, got " <> typeName other)--builtinGetAttr :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinGetAttr (VStr key _) (VAttrs attrs) = do-  name <- decodedText "builtins.getAttr" key-  case attrSetLookup name attrs of-    Just thunk -> force thunk-    Nothing -> throwEvalError ("builtins.getAttr: attribute '" <> name <> "' not found")-builtinGetAttr (VStr _ _) other =-  throwEvalError ("builtins.getAttr: expected a set, got " <> typeName other)-builtinGetAttr other _ =-  throwEvalError ("builtins.getAttr: expected a string, got " <> typeName other)--builtinRemoveAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinRemoveAttrs (VAttrs attrs) (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  keys <- mapM forceToString thunks-  pure (VAttrs (attrSetRemoveKeys keys attrs))-  where-    forceToString thunk = do-      val <- force thunk-      case val of-        VStr s _ -> decodedText "builtins.removeAttrs" s-        _ -> throwEvalError "builtins.removeAttrs: key list must contain strings"-builtinRemoveAttrs (VAttrs _) other =-  throwEvalError ("builtins.removeAttrs: expected a list, got " <> typeName other)-builtinRemoveAttrs other _ =-  throwEvalError ("builtins.removeAttrs: expected a set, got " <> typeName other)--builtinIntersectAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinIntersectAttrs (VAttrs a) (VAttrs b) =-  -- Iterate keys of 'a' (typically the smaller set, e.g. functionArgs)-  -- and point-lookup each in 'b' (typically the large set, e.g. nixpkgs).-  -- This avoids materializing all thunks in 'b'.-  let keysA = attrSetKeys a-      result = Map.fromList [(k, thunk) | k <- keysA, Just thunk <- [attrSetLookup k b]]-   in pure (VAttrs (attrSetFromMap result))-builtinIntersectAttrs (VAttrs _) other =-  throwEvalError ("builtins.intersectAttrs: expected a set, got " <> typeName other)-builtinIntersectAttrs other _ =-  throwEvalError ("builtins.intersectAttrs: expected a set, got " <> typeName other)--builtinCatAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinCatAttrs (VStr key _) (VList cl) = do-  name <- decodedText "builtins.catAttrs" key-  let thunks = map Thunk (clistThunks cl)-  vals <- catAttrsCollect name thunks-  pure (VList (clistFromThunks (map thunkToCPtr vals)))-builtinCatAttrs (VStr _ _) other =-  throwEvalError ("builtins.catAttrs: expected a list, got " <> typeName other)-builtinCatAttrs other _ =-  throwEvalError ("builtins.catAttrs: expected a string, got " <> typeName other)---- | Collect values for a given key from a list of attrsets.--- Tail-recursive with accumulator to avoid stack overflow on large lists.-catAttrsCollect :: (MonadEval m) => Text -> [Thunk] -> m [Thunk]-catAttrsCollect key = go []-  where-    go !acc [] = pure (reverse acc)-    go !acc (thunk : rest) = do-      val <- force thunk-      case val of-        VAttrs attrs ->-          case attrSetLookup key attrs of-            Just found -> go (found : acc) rest-            Nothing -> go acc rest-        _ -> throwEvalError "builtins.catAttrs: list element must be a set"---- ------------------------------------------------------------------------------ Builtin implementations - list higher-order (arity 2)--- -----------------------------------------------------------------------------builtinMap :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinMap func (VList cl) =-  -- Lazy: each element is a deferred application, forced only on demand.-  let thunks = map Thunk (clistThunks cl)-   in pure (VList (clistFromThunks (map (thunkToCPtr . deferApply func) thunks)))-builtinMap _ other =-  throwEvalError ("builtins.map: expected a list, got " <> typeName other)--builtinFilter :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinFilter predFn (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  filtered <- filterThunks predFn thunks-  pure (VList (clistFromThunks (map thunkToCPtr filtered)))-builtinFilter _ other =-  throwEvalError ("builtins.filter: expected a list, got " <> typeName other)--filterThunks :: (MonadEval m) => NixValue -> [Thunk] -> m [Thunk]-filterThunks _ [] = pure []-filterThunks predFn (thunk : rest) = do-  result <- applyValueLazy predFn thunk-  case result of-    VBool True -> (thunk :) <$> filterThunks predFn rest-    VBool False -> filterThunks predFn rest-    _ -> throwEvalError "builtins.filter: predicate must return a bool"--builtinGenList :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinGenList func (VInt n)-  | n < 0 = throwEvalError "builtins.genList: length must be non-negative"-  | otherwise =-      -- Lazy: each element is a deferred @f i@, forced only on demand.-      -- Slot 0 = function.-      let fnThunk = evaluated func-          (sp, sc) = buildCSlots [fnThunk]-          env = newMinimalEnv sp sc-          mkIndexThunk i = mkThunk env (EApp (EResolvedVar 0 0) (ELit (NixInt i)))-       in pure (VList (clistFromThunks (map (thunkToCPtr . mkIndexThunk) [0 .. n - 1])))-builtinGenList _ other =-  throwEvalError ("builtins.genList: expected an integer, got " <> typeName other)--builtinSort :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinSort comparator (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  vals <- mapM force thunks-  sorted <- mergeSort comparator vals-  pure (VList (clistFromThunks (map (thunkToCPtr . evaluated) sorted)))-builtinSort _ other =-  throwEvalError ("builtins.sort: expected a list, got " <> typeName other)---- | Stable O(n log n) merge sort using a user-supplied comparator.--- The comparator takes two args (curried) and returns bool.-mergeSort :: (MonadEval m) => NixValue -> [NixValue] -> m [NixValue]-mergeSort _ [] = pure []-mergeSort _ [x] = pure [x]-mergeSort cmp xs = do-  let half = length xs `div` 2-      (left, right) = splitAt half xs-  sortedLeft <- mergeSort cmp left-  sortedRight <- mergeSort cmp right-  mergeSorted cmp sortedLeft sortedRight--mergeSorted :: (MonadEval m) => NixValue -> [NixValue] -> [NixValue] -> m [NixValue]-mergeSorted _ [] ys = pure ys-mergeSorted _ xs [] = pure xs-mergeSorted cmp (x : xs) (y : ys) = do-  -- Stable merge: take the right element only when it is STRICTLY less than the-  -- left (@cmp y x@).  On a tie - neither strictly less - take the left element,-  -- so comparator-equal elements keep their input order, matching C++ Nix's-  -- std::stable_sort.  (Comparing @cmp x y@ instead would emit @y@ on a tie and-  -- reverse equal runs.)-  partial <- applyValue cmp y-  result <- applyValue partial x-  case result of-    VBool True -> (y :) <$> mergeSorted cmp (x : xs) ys-    VBool False -> (x :) <$> mergeSorted cmp xs (y : ys)-    _ -> throwEvalError "builtins.sort: comparator must return a bool"--builtinConcatMap :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinConcatMap func (VList cl) = do-  -- Semi-eager: must force each application to discover list structure for-  -- concatenation, but element thunks within those sub-lists stay lazy.-  let thunks = map Thunk (clistThunks cl)-      deferredApps = map (deferApply func) thunks-  results <- mapM force deferredApps-  concatted <- mapM extractList results-  pure (VList (clistFromThunks (map thunkToCPtr (concat concatted))))-builtinConcatMap _ other =-  throwEvalError ("builtins.concatMap: expected a list, got " <> typeName other)--extractList :: (MonadEval m) => NixValue -> m [Thunk]-extractList (VList cl) = pure (map Thunk (clistThunks cl))-extractList other =-  throwEvalError ("builtins.concatMap: function must return a list, got " <> typeName other)--builtinAny :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinAny predFn (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  result <- anyThunk predFn thunks-  pure (VBool result)-builtinAny _ other =-  throwEvalError ("builtins.any: expected a list, got " <> typeName other)--anyThunk :: (MonadEval m) => NixValue -> [Thunk] -> m Bool-anyThunk _ [] = pure False-anyThunk predFn (thunk : rest) = do-  result <- applyValueLazy predFn thunk-  case result of-    VBool True -> pure True-    VBool False -> anyThunk predFn rest-    _ -> throwEvalError "builtins.any: predicate must return a bool"--builtinAll :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinAll predFn (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  result <- allThunk predFn thunks-  pure (VBool result)-builtinAll _ other =-  throwEvalError ("builtins.all: expected a list, got " <> typeName other)--allThunk :: (MonadEval m) => NixValue -> [Thunk] -> m Bool-allThunk _ [] = pure True-allThunk predFn (thunk : rest) = do-  result <- applyValueLazy predFn thunk-  case result of-    VBool True -> allThunk predFn rest-    VBool False -> pure False-    _ -> throwEvalError "builtins.all: predicate must return a bool"--builtinElem :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinElem needle (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  found <- elemCheck needle thunks-  pure (VBool found)-builtinElem _ other =-  throwEvalError ("builtins.elem: expected a list, got " <> typeName other)--elemCheck :: (MonadEval m) => NixValue -> [Thunk] -> m Bool-elemCheck _ [] = pure False-elemCheck needle (thunk : rest) = do-  val <- force thunk-  eq <- nixEqual force needle val-  if eq then pure True else elemCheck needle rest--builtinElemAt :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinElemAt (VList cl) (VInt idx)-  | idx < 0 || fromIntegral idx >= clistLen cl = elemAtOOB idx cl-  | otherwise =-      -- O(1) direct C array access instead of materializing the whole list-      let ptr = unsafePerformIO (clistGet (unCList cl) (fromIntegral idx))-       in force (Thunk ptr)-  where-    elemAtOOB i c =-      throwEvalError-        ( "builtins.elemAt: index "-            <> T.pack (show i)-            <> " out of bounds for list of length "-            <> T.pack (show (clistLen c))-        )-builtinElemAt (VList _) other =-  throwEvalError ("builtins.elemAt: expected an integer, got " <> typeName other)-builtinElemAt other _ =-  throwEvalError ("builtins.elemAt: expected a list, got " <> typeName other)--builtinPartition :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinPartition predFn (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  (rightThunks, wrongThunks) <- partitionThunks predFn thunks-  pure-    ( VAttrs-        ( attrSetFromMap $-            Map.fromList-              [ ("right", evaluated (VList (clistFromThunks (map thunkToCPtr rightThunks)))),-                ("wrong", evaluated (VList (clistFromThunks (map thunkToCPtr wrongThunks))))-              ]-        )-    )-builtinPartition _ other =-  throwEvalError ("builtins.partition: expected a list, got " <> typeName other)---- | Tail-recursive partition with accumulator to avoid stack overflow.-partitionThunks :: (MonadEval m) => NixValue -> [Thunk] -> m ([Thunk], [Thunk])-partitionThunks predFn = go [] []-  where-    go !rs !ws [] = pure (reverse rs, reverse ws)-    go !rs !ws (thunk : rest) = do-      result <- applyValueLazy predFn thunk-      case result of-        VBool True -> go (thunk : rs) ws rest-        VBool False -> go rs (thunk : ws) rest-        _ -> throwEvalError "builtins.partition: predicate must return a bool"--builtinGroupBy :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinGroupBy func (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  groups <- groupByCollect func thunks Map.empty-  pure (VAttrs (attrSetFromMap (Map.map (evaluated . VList . clistFromThunks . map thunkToCPtr . reverse) groups)))-builtinGroupBy _ other =-  throwEvalError ("builtins.groupBy: expected a list, got " <> typeName other)--groupByCollect ::-  (MonadEval m) =>-  NixValue ->-  [Thunk] ->-  Map Text [Thunk] ->-  m (Map Text [Thunk])-groupByCollect _ [] acc = pure acc-groupByCollect func (thunk : rest) acc = do-  result <- applyValueLazy func thunk-  case result of-    VStr key _ -> do-      name <- decodedText "builtins.groupBy" key-      groupByCollect func rest (Map.insertWith (++) name [thunk] acc)-    _ -> throwEvalError "builtins.groupBy: function must return a string"---- ------------------------------------------------------------------------------ Builtin implementations - string (arity 2)--- -----------------------------------------------------------------------------builtinConcatStringsSep :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinConcatStringsSep (VStr sep sepCtx) (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  pairs <- mapM forceToStrCtx thunks-  let texts = map fst pairs-      mergedCtx = sepCtx <> mconcat (map snd pairs)-  pure (VStr (BS.intercalate sep texts) mergedCtx)-  where-    forceToStrCtx thunk = do-      val <- force thunk-      -- Nix 2.24's coerceToString defaults copyToStore=true and-      -- concatStringsSep passes no override, so a path element is copied into-      -- the store and the result carries its SCPlain context.  Non-string-      -- scalars still error (coerceMore=False), matching interpolation.-      coerceToStringInterp val-builtinConcatStringsSep (VStr _ _) other =-  throwEvalError ("builtins.concatStringsSep: expected a list, got " <> typeName other)-builtinConcatStringsSep other _ =-  throwEvalError ("builtins.concatStringsSep: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - arity 3--- -----------------------------------------------------------------------------builtinFoldl :: (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue-builtinFoldl op initial (VList cl) =-  foldlStrict op initial (map Thunk (clistThunks cl))-builtinFoldl _ _ other =-  throwEvalError ("builtins.foldl': expected a list, got " <> typeName other)---- | Strict left fold: apply @op acc elem@ for each element.  The--- accumulator is forced each step (upstream foldl' strictness); the--- element is passed as an unforced thunk, as upstream does.-foldlStrict :: (MonadEval m) => NixValue -> NixValue -> [Thunk] -> m NixValue-foldlStrict _ acc [] = pure acc-foldlStrict op acc (thunk : rest) = do-  partial <- applyValue op acc-  stepped <- applyValueLazy partial thunk-  foldlStrict op stepped rest---- | Byte-indexed slicing, as upstream: offsets and lengths count bytes,--- and a slice may fall mid-codepoint (the resulting bytes are the value).-builtinSubstring :: (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue-builtinSubstring (VInt start) (VInt len) (VStr s ctx)-  | start < 0 = throwEvalError "builtins.substring: negative start position"-  | otherwise =-      let startPos = fromIntegral start-          -- Nix clamps len to available length (negative len means rest of string)-          available = BS.length s - startPos-          clampedLen =-            if len < 0-              then available-              else min (fromIntegral len) available-       in -- Context is preserved through substring (matching real Nix).-          pure (VStr (BS.take clampedLen (BS.drop startPos s)) ctx)-builtinSubstring _ _ (VStr _ _) =-  throwEvalError "builtins.substring: start and length must be integers"-builtinSubstring _ _ other =-  throwEvalError ("builtins.substring: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin helpers--- ------------------------------------------------------------------------------- | Build a thunk that defers @f arg@ - the application only happens when--- the thunk is forced.  Reuses the existing eval machinery via a synthetic--- @EApp (EResolvedVar 0 0) (EResolvedVar 0 1)@ in a self-contained env.--- Slot 0 = function, slot 1 = argument.-deferApply :: NixValue -> Thunk -> Thunk-deferApply func argThunk =-  let (sp, sc) = buildCSlots [evaluated func, argThunk]-      env = newMinimalEnv sp sc-   in mkSyntheticThunk env deferApplyExpr---- | Shared expression for 'deferApply'.  Allocated once as a CAF.-deferApplyExpr :: Expr-deferApplyExpr = EApp (EResolvedVar 0 0) (EResolvedVar 0 1)-{-# NOINLINE deferApplyExpr #-}---- | Permissive coercion used by @builtins.toString@.------ Like 'coerceToString' but additionally handles lists: elements are--- recursively coerced and joined with spaces, matching real Nix semantics.--- @toString [1 2 3]@ gives @"1 2 3"@.--- | The non-copying path coercion: the path text verbatim, no context ---- upstream's @coerceToString@ with @copyToStore = false@.-coercePathVerbatim :: (MonadEval m) => Text -> m (BS.ByteString, StringContext)-coercePathVerbatim p = pure (TE.encodeUtf8 p, emptyContext)---- | The copy-to-store path coercion: the path becomes its source store--- path, carried in the context - upstream's @copyToStore = true@.  Passed--- into 'coerceToString' so a path reached through an attrset's @outPath@--- (or a @__toString@ result) coerces exactly as the same path written--- directly would; a fixed path case in the engine dropped both the copy--- and the context for every such value.-coercePathToStore :: (MonadEval m) => Text -> m (BS.ByteString, StringContext)-coercePathToStore p = do-  (spText, ctx) <- sourcePathWithContext p-  pure (TE.encodeUtf8 spText, ctx)--coerceToStringPermissive :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)-coerceToStringPermissive (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  parts <- mapM coerceThunk thunks-  let texts = map fst parts-      ctx = mconcat (map snd parts)-  pure (BS.intercalate " " texts, ctx)-  where-    coerceThunk thunk = do-      val <- force thunk-      coerceToStringPermissive val-coerceToStringPermissive other = coerceToString True force applyValue coercePathVerbatim other---- | Coerce a value to a string for a DERIVATION field (an env value or an--- arg).  Like 'coerceToStringPermissive', but a path literal is copied into--- the store: it becomes its source store path, with that path added to the--- string context so it lands in the derivation's @inputSrcs@ - matching C++--- Nix's copy-to-store coercion of paths in derivation arguments/environment.-coerceToStoreString :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)-coerceToStoreString (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  parts <- mapM (force >=> coerceToStoreString) thunks-  pure (BS.intercalate " " (map fst parts), mconcat (map snd parts))-coerceToStoreString other = coerceToString True force applyValue coercePathToStore other---- | Coerce a value for string interpolation (@"${...}"@).  Like--- 'coerceToString', but a path literal is copied into the store and replaced by--- its source store path (with context) - matching C++ Nix, where interpolation--- uses @copyToStore = true@, unlike 'builtins.toString', which does not copy.-coerceToStringInterp :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)-coerceToStringInterp = coerceToString False force applyValue coercePathToStore---- | The store path a source path literal coerces to, carrying its--- SCPlain context - the copy-to-store coercion shared by interpolation,--- derivation arguments/env values, and @builtins.toJSON@.-sourcePathWithContext :: (MonadEval m) => Text -> m (Text, StringContext)-sourcePathWithContext p-  -- An already-in-store path coerces to itself with an SCPlain (Opaque)-  -- reference - never re-copied.  This is the shared choke point for-  -- interpolation, derivation args, concatStringsSep, and toJSON, so all of-  -- them inherit the in-store short-circuit (and the Windows re-NAR fix).-  | Just sp <- enclosingStorePath p = pure (p, plainContext sp)-  | otherwise = do-      spText <- storeSourcePath p-      case parseStorePath defaultStoreDir spText of-        Just sp -> pure (spText, plainContext sp)-        Nothing -> pure (spText, mempty)---- | The current system platform string.-currentSystemStr :: Text-currentSystemStr = case (System.Info.arch, System.Info.os) of-  ("x86_64", "mingw32") -> "x86_64-windows"-  ("x86_64", "darwin") -> "x86_64-darwin"-  ("aarch64", "darwin") -> "aarch64-darwin"-  ("aarch64", "linux") -> "aarch64-linux"-  ("x86_64", "linux") -> "x86_64-linux"-  (arch, os) -> T.pack arch <> "-" <> T.pack os---- | Store dir with trailing slash, for building store paths.-storeDirPrefix :: Text-storeDirPrefix = defaultStoreDirText <> "/"---- ------------------------------------------------------------------------------ Builtin implementations - numeric + context--- -----------------------------------------------------------------------------isPathVal :: NixValue -> Bool-isPathVal (VPath _) = True-isPathVal _ = False--builtinCeil :: (MonadEval m) => NixValue -> m NixValue-builtinCeil (VFloat f) = intFromDouble "builtins.ceil" ceiling f-builtinCeil (VInt n) = pure (VInt n)-builtinCeil other = throwEvalError ("builtins.ceil: expected a number, got " <> typeName other)--builtinFloor :: (MonadEval m) => NixValue -> m NixValue-builtinFloor (VFloat f) = intFromDouble "builtins.floor" floor f-builtinFloor (VInt n) = pure (VInt n)-builtinFloor other = throwEvalError ("builtins.floor: expected a number, got " <> typeName other)---- | Round a float to Int64 with the checks Nix 2.24 performs: NaN,--- infinity, and out-of-range values are eval errors, never a garbage--- Int64 out of Haskell's unchecked conversion.-intFromDouble :: (MonadEval m) => Text -> (Double -> Integer) -> Double -> m NixValue-intFromDouble ctx rounder f-  | isNaN f = throwEvalError (ctx <> ": NaN cannot be converted to an integer")-  | isInfinite f = throwEvalError (ctx <> ": infinity cannot be converted to an integer")-  | rounded < toInteger (minBound :: Int64) || rounded > toInteger (maxBound :: Int64) =-      throwEvalError (ctx <> ": " <> formatNixFloat f <> " is out of integer range")-  | otherwise = pure (VInt (fromInteger rounded))-  where-    rounded = rounder f--builtinDiscardContext :: (MonadEval m) => NixValue -> m NixValue-builtinDiscardContext (VStr s _) = pure (mkStrBytes s)-builtinDiscardContext other =-  throwEvalError ("builtins.unsafeDiscardStringContext: expected a string, got " <> typeName other)---- | @builtins.unsafeDiscardOutputDependency@ - downgrade all-outputs (DrvDeep)--- references to a plain (Opaque) reference on the same @.drv@ path, and KEEP--- derivation-output (Built) references unchanged, matching upstream.  It--- formerly dropped both kinds and kept only plain references, losing the--- @.drv@ reference the downgrade must preserve.  'Set.map' also folds a--- downgraded element into an existing plain reference on the same path.-builtinDiscardOutputDep :: (MonadEval m) => NixValue -> m NixValue-builtinDiscardOutputDep (VStr s (StringContext ctx)) =-  pure (VStr s (StringContext (Set.map downgrade ctx)))-  where-    downgrade (SCAllOutputs sp) = SCPlain sp-    downgrade other = other-builtinDiscardOutputDep other =-  throwEvalError ("builtins.unsafeDiscardOutputDependency: expected a string, got " <> typeName other)---- | @builtins.addDrvOutputDependencies@ - the inverse of the--- 'builtinDiscardOutputDep' downgrade for a single element: upgrade a plain--- (Opaque) reference to a @.drv@ path into an all-outputs (DrvDeep) reference.--- Upstream requires the string's context to have exactly one element and--- errors on a derivation-output (Built) element or a non-@.drv@ plain path.-builtinAddDrvOutputDeps :: (MonadEval m) => NixValue -> m NixValue-builtinAddDrvOutputDeps (VStr s (StringContext ctx)) =-  case Set.toList ctx of-    [only] -> VStr s . StringContext . Set.singleton <$> upgrade only-    _ ->-      throwEvalError-        ( "builtins.addDrvOutputDependencies: the string must have exactly one "-            <> "context element, but has "-            <> T.pack (show (Set.size ctx))-        )-  where-    upgrade (SCPlain sp)-      | ".drv" `T.isSuffixOf` spName sp = pure (SCAllOutputs sp)-      | otherwise =-          throwEvalError-            ( "builtins.addDrvOutputDependencies: path "-                <> storePathToText defaultStoreDir sp-                <> " is not a derivation"-            )-    upgrade (SCAllOutputs sp) = pure (SCAllOutputs sp)-    upgrade (SCDrvOutput _ outName) =-      throwEvalError-        ( "builtins.addDrvOutputDependencies: can only act on derivations, not "-            <> "on a derivation output such as "-            <> outName-        )-builtinAddDrvOutputDeps other =-  throwEvalError ("builtins.addDrvOutputDependencies: expected a string, got " <> typeName other)---- | Check whether a string has any context elements.-builtinHasContext :: (MonadEval m) => NixValue -> m NixValue-builtinHasContext (VStr _ ctx) = pure (VBool (ctx /= emptyContext))-builtinHasContext other =-  throwEvalError ("builtins.hasContext: expected a string, got " <> typeName other)---- | Return the context of a string as an attrset.------ Each key is a store path string.  Each value is an attrset with:---   - @path@: true if there's a SCPlain reference---   - @allOutputs@: true if there's a SCAllOutputs reference---   - @outputs@: list of output names from SCDrvOutput references-builtinGetContext :: (MonadEval m) => NixValue -> m NixValue-builtinGetContext (VStr _ (StringContext ctx)) = do-  let grouped = groupContextByPath (Set.toList ctx)-      attrMap = Map.map contextEntryToAttrs grouped-  pure (VAttrs (attrSetFromMap attrMap))-builtinGetContext other =-  throwEvalError ("builtins.getContext: expected a string, got " <> typeName other)---- | Intermediate representation for grouping context elements by store path.-data ContextEntry = ContextEntry-  { cePath :: !Bool,-    ceAllOutputs :: !Bool,-    ceOutputs :: ![Text]-  }---- | Group context elements by their store path.-groupContextByPath :: [StringContextElement] -> Map Text ContextEntry-groupContextByPath = foldl' addElement Map.empty-  where-    addElement acc (SCPlain sp) =-      Map.insertWith mergeEntry (spToText sp) (ContextEntry True False []) acc-    addElement acc (SCDrvOutput sp outName) =-      Map.insertWith mergeEntry (spToText sp) (ContextEntry False False [outName]) acc-    addElement acc (SCAllOutputs sp) =-      Map.insertWith mergeEntry (spToText sp) (ContextEntry False True []) acc-    -- 'Set.toList' feeds elements in ascending order and 'old' holds the-    -- earlier (smaller) output names, so 'old ++ new' keeps the rendered-    -- outputs list ascending, as upstream getContext produces it.-    mergeEntry new old =-      ContextEntry-        (cePath new || cePath old)-        (ceAllOutputs new || ceAllOutputs old)-        (ceOutputs old ++ ceOutputs new)-    -- Context keys are identity, not IO: always the canonical /nix/store-    -- spelling, never the platform file-path mapping.-    spToText = storePathToText defaultStoreDir---- | Convert a ContextEntry to an attrset thunk.-contextEntryToAttrs :: ContextEntry -> Thunk-contextEntryToAttrs entry =-  let fields =-        [("path", evaluated (VBool True)) | cePath entry]-          ++ [("allOutputs", evaluated (VBool True)) | ceAllOutputs entry]-          ++ [("outputs", evaluated (VList (clistFromThunks [thunkToCPtr (evaluated (mkStr o)) | o <- ceOutputs entry]))) | not (null (ceOutputs entry))]-   in evaluated (VAttrs (attrSetFromMap (Map.fromList fields)))---- | Append context entries to a string from an attrset.------ @builtins.appendContext string contextAttrset@ adds the specified--- context elements to the string.-builtinAppendContext :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinAppendContext (VStr s ctx) (VAttrs contextAttrs) = do-  newCtx <- parseContextAttrs (attrSetToMap contextAttrs)-  pure (VStr s (ctx <> newCtx))-builtinAppendContext (VStr _ _) other =-  throwEvalError ("builtins.appendContext: second argument must be a set, got " <> typeName other)-builtinAppendContext other _ =-  throwEvalError ("builtins.appendContext: first argument must be a string, got " <> typeName other)---- | Parse a context attrset into a StringContext.--- Each key is a store path; each value is an attrset with optional--- @path@, @allOutputs@, and @outputs@ fields.-parseContextAttrs :: (MonadEval m) => Map Text Thunk -> m StringContext-parseContextAttrs attrs = do-  elements <- mapM parseOneCtx (Map.toList attrs)-  pure (StringContext (Set.fromList (concat elements)))-  where-    parseOneCtx (pathText, thunk) = do-      val <- force thunk-      case val of-        VAttrs inner -> do-          -- The key must parse as a store path, as upstream requires; a-          -- fabricated identity here would flow into derivation inputs.-          sp <- case parseStorePath defaultStoreDir pathText of-            Just parsed -> pure parsed-            Nothing ->-              throwEvalError-                ("builtins.appendContext: context key is not a store path: " <> pathText)-          hasPath <- getBoolAttr "path" inner-          hasAllOuts <- getBoolAttr "allOutputs" inner-          outNames <- getOutputsList inner-          let pathElems = [SCPlain sp | hasPath]-              allOutElems = [SCAllOutputs sp | hasAllOuts]-              outElems = [SCDrvOutput sp o | o <- outNames]-          pure (pathElems ++ allOutElems ++ outElems)-        _ -> throwEvalError "builtins.appendContext: context entry must be a set"--    getBoolAttr key attrs' = case attrSetLookup key attrs' of-      Nothing -> pure False-      Just thunk -> do-        val <- force thunk-        case val of-          VBool b -> pure b-          _ -> pure False--    getOutputsList attrs' = case attrSetLookup "outputs" attrs' of-      Nothing -> pure []-      Just thunk -> do-        val <- force thunk-        case val of-          VList cl -> mapM (forceToOutputName . Thunk) (clistThunks cl)-          _ -> pure []--    forceToOutputName thunk = do-      val <- force thunk-      case val of-        VStr s _ -> decodedText "builtins.appendContext" s-        _ -> throwEvalError "builtins.appendContext: output name must be a string"---- | For a STRING operand, upstream's rule is textual: everything after--- the final @/@.  For a PATH operand the value may be native-spelled--- (eval's base dir can be a native Windows path), so the split is--- separator-aware via 'canonBaseName'.-builtinBaseNameOf :: (MonadEval m) => NixValue -> m NixValue-builtinBaseNameOf (VStr s ctx) = pure (VStr (lastComponentBytes s) ctx)-builtinBaseNameOf (VPath p) = pure (mkStr (canonBaseName p))-builtinBaseNameOf other =-  throwEvalError ("builtins.baseNameOf: expected a string or path, got " <> typeName other)---- | Byte-level last component for string operands ('/' is a single byte--- in UTF-8 and never occurs inside a multi-byte sequence).-lastComponentBytes :: BS.ByteString -> BS.ByteString-lastComponentBytes t = case reverse (filter (not . BS.null) (BC.split '/' t)) of-  [] -> ""-  (final : _) -> final---- | String operands keep upstream's textual '/'-only rule--- ('dirComponentBytes'); path operands may be native-spelled and split--- separator-aware via 'canonDirName'.-builtinDirOf :: (MonadEval m) => NixValue -> m NixValue-builtinDirOf (VStr s ctx) = pure (VStr (dirComponentBytes s) ctx)-builtinDirOf (VPath p) = pure (VPath (canonDirName p))-builtinDirOf other =-  throwEvalError ("builtins.dirOf: expected a string or path, got " <> typeName other)---- | Byte-level dir component for string operands: everything before the--- last '/' byte, with upstream's "." / "/" edge results.-dirComponentBytes :: BS.ByteString -> BS.ByteString-dirComponentBytes t =-  case BC.elemIndexEnd '/' t of-    Nothing -> "."-    Just idx ->-      let dir = BS.take idx t-       in if BS.null dir then "/" else dir--builtinConcatLists :: (MonadEval m) => NixValue -> m NixValue-builtinConcatLists (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  sublists <- mapM forceThenExtractList thunks-  pure (VList (clistFromThunks (concat sublists)))-  where-    forceThenExtractList thunk = do-      val <- force thunk-      case val of-        VList innerCl -> pure (clistThunks innerCl)-        _ -> throwEvalError "builtins.concatLists: element must be a list"-builtinConcatLists other =-  throwEvalError ("builtins.concatLists: expected a list, got " <> typeName other)--builtinLessThan :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinLessThan a b = VBool <$> nixCompare force a b---- ------------------------------------------------------------------------------ Builtin implementations - arithmetic + bitwise--- -----------------------------------------------------------------------------builtinAdd :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinAdd (VInt a) (VInt b) = either throwEvalError (pure . VInt) (checkedAdd a b)-builtinAdd (VInt a) (VFloat b) = pure (VFloat (fromIntegral a + b))-builtinAdd (VFloat a) (VInt b) = pure (VFloat (a + fromIntegral b))-builtinAdd (VFloat a) (VFloat b) = pure (VFloat (a + b))-builtinAdd l r = throwEvalError ("builtins.add: expected numbers, got " <> typeName l <> " and " <> typeName r)--builtinSub :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinSub (VInt a) (VInt b) = either throwEvalError (pure . VInt) (checkedSub a b)-builtinSub (VInt a) (VFloat b) = pure (VFloat (fromIntegral a - b))-builtinSub (VFloat a) (VInt b) = pure (VFloat (a - fromIntegral b))-builtinSub (VFloat a) (VFloat b) = pure (VFloat (a - b))-builtinSub l r = throwEvalError ("builtins.sub: expected numbers, got " <> typeName l <> " and " <> typeName r)--builtinMul :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinMul (VInt a) (VInt b) = either throwEvalError (pure . VInt) (checkedMul a b)-builtinMul (VInt a) (VFloat b) = pure (VFloat (fromIntegral a * b))-builtinMul (VFloat a) (VInt b) = pure (VFloat (a * fromIntegral b))-builtinMul (VFloat a) (VFloat b) = pure (VFloat (a * b))-builtinMul l r = throwEvalError ("builtins.mul: expected numbers, got " <> typeName l <> " and " <> typeName r)--builtinDiv :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinDiv _ (VInt 0) = throwEvalError "builtins.div: division by zero"-builtinDiv (VInt a) (VInt b)-  -- The one overflowing division: |minBound| has no representation.-  | a == minBound && b == -1 =-      throwEvalError-        ("integer overflow in dividing " <> T.pack (show a) <> " and " <> T.pack (show b))-  | otherwise = pure (VInt (quot a b))-builtinDiv _ (VFloat 0) = throwEvalError "builtins.div: division by zero"-builtinDiv (VInt a) (VFloat b) = pure (VFloat (fromIntegral a / b))-builtinDiv (VFloat a) (VInt b) = pure (VFloat (a / fromIntegral b))-builtinDiv (VFloat a) (VFloat b) = pure (VFloat (a / b))-builtinDiv l r = throwEvalError ("builtins.div: expected numbers, got " <> typeName l <> " and " <> typeName r)--builtinBitAnd :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinBitAnd (VInt a) (VInt b) = pure (VInt (a .&. b))-builtinBitAnd _ _ = throwEvalError "builtins.bitAnd: expected two integers"--builtinBitOr :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinBitOr (VInt a) (VInt b) = pure (VInt (a .|. b))-builtinBitOr _ _ = throwEvalError "builtins.bitOr: expected two integers"--builtinBitXor :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinBitXor (VInt a) (VInt b) = pure (VInt (xor a b))-builtinBitXor _ _ = throwEvalError "builtins.bitXor: expected two integers"---- ------------------------------------------------------------------------------ Builtin implementations - attr set higher-order--- -----------------------------------------------------------------------------builtinMapAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinMapAttrs func (VAttrs attrs) =-  -- Each attr value is a deferred @f key val@, forced only on demand.-  -- Eagerly builds all thunks via attrSetMapWithKey - with C arena thunks-  -- (~16 bytes each), this is cheaper than the former MappedAttrs overhead-  -- and keeps all data off the GHC heap.-  -- Slot 0 = function, slot 1 = key, slot 2 = value.-  pure (VAttrs (attrSetMapWithKey deferAttr attrs))-  where-    deferAttr key valThunk =-      let (sp, sc) = buildCSlots [evaluated func, evaluated (mkStr key), valThunk]-          env = newMinimalEnv sp sc-       in mkSyntheticThunk env mapAttrsExpr-builtinMapAttrs _ other =-  throwEvalError ("builtins.mapAttrs: expected a set, got " <> typeName other)---- | Shared expression for 'builtinMapAttrs'.  Allocated once as a CAF.-mapAttrsExpr :: Expr-mapAttrsExpr = EApp (EApp (EResolvedVar 0 0) (EResolvedVar 0 1)) (EResolvedVar 0 2)-{-# NOINLINE mapAttrsExpr #-}---- | Formals for lambdas, an empty set for builtins, an error otherwise ---- including functor sets: upstream's primop never consults--- @__functionArgs@ (nixpkgs lib.functionArgs handles that in Nix).-builtinFunctionArgs :: (MonadEval m) => NixValue -> m NixValue-builtinFunctionArgs (VLambda _ formals _) = pure (formalsToAttrs formals)-builtinFunctionArgs (VBuiltin _ _) = pure (VAttrs (attrSetFromMap Map.empty))-builtinFunctionArgs other =-  throwEvalError ("builtins.functionArgs: expected a function, got " <> typeName other)--formalsToAttrs :: EvalFormals -> NixValue-formalsToAttrs (EFName _) = VAttrs (attrSetFromMap Map.empty)-formalsToAttrs (EFSet formals _) = formalsListToAttrs formals-formalsToAttrs (EFNamedSet _ formals _) = formalsListToAttrs formals--formalsListToAttrs :: [EvalFormal] -> NixValue-formalsListToAttrs formals =-  VAttrs-    $ attrSetFromMap-    $ Map.fromList-      [(efName f, evaluated (VBool (isJust (efDefault f)))) | f <- formals]--builtinZipAttrsWith :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinZipAttrsWith func (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  attrSets <- mapM forceToAttrSet thunks-  let merged = mergeAllAttrs attrSets-      -- Lazy: each result is a deferred f(name)(values) thunk, not eagerly-      -- evaluated.  Critical for nixpkgs evalModules fixpoint - config is a-      -- self-referencing lazy attrset that must be COMPUTED (holding the lazy-      -- result) before any individual attribute thunks are forced.-      resultPairs = map (deferZip func) (Map.toList merged)-  pure (VAttrs (attrSetFromMap (Map.fromList resultPairs)))-  where-    forceToAttrSet thunk = do-      val <- force thunk-      case val of-        VAttrs attrs -> pure (attrSetToMap attrs)-        _ -> throwEvalError "builtins.zipAttrsWith: list element must be a set"-    mergeAllAttrs = foldl' (\acc m -> Map.unionWith (++) acc (Map.map (: []) m)) Map.empty-    -- Slot 0 = function, slot 1 = name, slot 2 = values list.-    deferZip fn (key, thunkList) =-      let valueList = VList (clistFromThunks (map thunkToCPtr thunkList))-          (slots, slotCount) = buildCSlots [evaluated fn, evaluated (mkStr key), evaluated valueList]-          env = newMinimalEnv slots slotCount-       in (key, mkSyntheticThunk env mapAttrsExpr)-builtinZipAttrsWith _ other =-  throwEvalError ("builtins.zipAttrsWith: expected a list, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - string manipulation--- -----------------------------------------------------------------------------builtinReplaceStrings ::-  (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue-builtinReplaceStrings (VList fromCl) (VList toCl) (VStr input inputCtx) = do-  let fromThunks = map Thunk (clistThunks fromCl)-      toThunks = map Thunk (clistThunks toCl)-  when (length fromThunks /= length toThunks) $-    throwEvalError "builtins.replaceStrings: 'from' and 'to' must have the same length"-  froms <- mapM forceStr fromThunks-  -- Match-gated replacement forcing, as upstream: a 'to' element is-  -- forced - and its context joins the result - only the first time its-  -- pattern matches, memoized per index.  An unmatched replacement is-  -- never evaluated, so it may throw or diverge harmlessly.-  ---  -- Matching and stepping are byte-level, as upstream: an empty @from@-  -- element inserts between BYTES, so a 2-byte character gets a-  -- replacement inside it.  Chunks accumulate reversed, one BS.concat-  -- at the end.-  let rules = zip3 [0 :: Int ..] (map fst froms) toThunks-      findRule txt =-        listToMaybe [r | r@(_, from, _) <- rules, BS.null from || from `BS.isPrefixOf` txt]-      forcedTo memo (i, _, toThunk) = case Map.lookup i memo of-        Just hit -> pure (hit, memo)-        Nothing -> do-          forced <- forceStr toThunk-          pure (forced, Map.insert i forced memo)-      step remaining acc memo-        | BS.null remaining = case findRule remaining of-            -- At end of string, still check for an empty-from match.-            Just rule -> do-              ((to, _), advanced) <- forcedTo memo rule-              pure (to : acc, advanced)-            Nothing -> pure (acc, memo)-        | otherwise = case findRule remaining of-            Just rule@(_, from, _) -> do-              ((to, _), advanced) <- forcedTo memo rule-              if BS.null from-                then case BS.uncons remaining of-                  -- empty-from: insert replacement then advance ONE BYTE-                  Just (byte, after) -> step after (BS.singleton byte : to : acc) advanced-                  -- Unreachable: the null string is handled by the guard above.-                  Nothing -> pure (to : acc, advanced)-                else step (BS.drop (BS.length from) remaining) (to : acc) advanced-            Nothing -> case BS.uncons remaining of-              Just (byte, after) -> step after (BS.singleton byte : acc) memo-              Nothing -> pure (acc, memo)-  (revChunks, forcedTos) <- step input [] Map.empty-  let mergedCtx = inputCtx <> mconcat (map snd (Map.elems forcedTos))-  pure (VStr (BS.concat (reverse revChunks)) mergedCtx)-  where-    forceStr thunk = do-      val <- force thunk-      case val of-        VStr s ctx -> pure (s, ctx)-        _ -> throwEvalError "builtins.replaceStrings: elements must be strings"-builtinReplaceStrings _ _ (VStr _ _) =-  throwEvalError "builtins.replaceStrings: first two arguments must be lists"-builtinReplaceStrings _ _ other =-  throwEvalError ("builtins.replaceStrings: expected a string, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - regex (POSIX ERE via regex-tdfa)--- ------------------------------------------------------------------------------- ------------------------------------------------------------------------------ Regex compilation cache--- ------------------------------------------------------------------------------- | Global regex compilation cache.  Keyed by the raw pattern bytes--- (match and split share entries).  Idempotent memoization via--- unsafePerformIO - same rationale as thunk memoization.-{-# NOINLINE regexCacheRef #-}-regexCacheRef :: IORef (Map BS.ByteString RE.Regex)-regexCacheRef = unsafePerformIO (newIORef Map.empty)---- | Compile options matching C++ Nix's POSIX ERE semantics: no multiline--- mode, so @^@\/@$@ anchor only at the string boundaries and @.@ (and a--- negated bracket class) match a newline.  regex-tdfa's default has--- multiline=True, which silently diverges on any subject containing @\n@.-wholeStringCompOpt :: RE.CompOption-wholeStringCompOpt = RE.defaultCompOpt {RE.multiline = False}---- | Compile a regex from its raw pattern bytes, using the global cache to--- avoid recompilation.  Compiling from bytes makes the PATTERN byte-level--- too, matching upstream: a multi-byte character in the pattern is a--- sequence of single-byte atoms, so it lines up with byte-level subjects.--- Returns Nothing for invalid patterns.  NOINLINE prevents GHC from--- inlining and floating the unsafePerformIO reads.-{-# NOINLINE cachedCompileRegex #-}-cachedCompileRegex :: BS.ByteString -> Maybe RE.Regex-cachedCompileRegex pat =-  unsafePerformIO $ do-    cache <- atomicModifyIORef' regexCacheRef (\c -> (c, c))-    case Map.lookup pat cache of-      Just compiled -> pure (Just compiled)-      Nothing -> case RE.makeRegexOptsM wholeStringCompOpt RE.defaultExecOpt pat :: Maybe RE.Regex of-        Nothing -> pure Nothing-        Just compiled -> do-          atomicModifyIORef' regexCacheRef (\c -> (Map.insert pat compiled c, ()))-          pure (Just compiled)---- ------------------------------------------------------------------------------ Regex builtins--- ------------------------------------------------------------------------------- | @builtins.match regex str@: match a POSIX ERE against a string.--- The regex must match the ENTIRE string (like C++ Nix's regex_match).--- Returns @null@ if no match, or a list of capture group strings--- (@null@ for non-participating groups).-builtinMatch :: (MonadEval m) => NixValue -> NixValue -> m NixValue--- Pre-compiled path: regex was compiled at partial-application time.-builtinMatch (VCompiledRegex (CompiledRegex _ compiled)) (VStr str _) =-  matchWithCompiled compiled str--- Direct 2-arg call: use global compilation cache.-builtinMatch (VStr regex _) (VStr str _) =-  case cachedCompileRegex regex of-    Nothing -> throwEvalError ("builtins.match: invalid regex: " <> bytesToTextLossy regex)-    Just compiled -> matchWithCompiled compiled str-builtinMatch (VStr _ _) other =-  throwEvalError ("builtins.match: expected a string, got " <> typeName other)-builtinMatch (VCompiledRegex _) other =-  throwEvalError ("builtins.match: expected a string, got " <> typeName other)-builtinMatch other _ =-  throwEvalError ("builtins.match: expected a string (regex), got " <> typeName other)---- | Shared match logic for pre-compiled and freshly-compiled regex paths.------ Whole-string semantics via a span check on the leftmost-longest match:--- if any whole-string match exists it starts at 0, and POSIX picks the--- longest match at the leftmost start, so the reported match spans the--- whole subject exactly when a whole-string match exists.  This is what--- regex_match gives C++ Nix; textual @^...$@ anchoring is NOT equivalent--- (it misparses top-level alternation).-matchWithCompiled :: (MonadEval m) => RE.Regex -> BS.ByteString -> m NixValue-matchWithCompiled compiled str =-  case RE.matchOnceText compiled str of-    Just (beforeMatch, match, afterMatch)-      | BS.null beforeMatch,-        BS.null afterMatch ->-          -- match is an Array of (bytes, (offset, len)) pairs.-          -- Index 0 is the full match; indices 1.. are capture groups.-          let captureGroups = drop 1 (Array.elems match)-              -- A non-participating capture group has offset (-1); C++ Nix-              -- yields null for it, not the empty string.-              toThunk (s, (off, _)) =-                if off < 0 then evaluated VNull else evaluated (mkStrBytes s)-           in pure (VList (clistFromThunks (map (thunkToCPtr . toThunk) captureGroups)))-    _ -> pure VNull---- | @builtins.split regex str@: split a string by a POSIX ERE.--- Returns an alternating list of non-matched strings and match-group lists.--- Example: @split "(x)" "axbxc"@ yields @["a" ["x"] "b" ["x"] "c"]@-builtinSplit :: (MonadEval m) => NixValue -> NixValue -> m NixValue--- Pre-compiled path: regex was compiled at partial-application time.-builtinSplit (VCompiledRegex (CompiledRegex _ compiled)) (VStr str _) =-  splitWithCompiled compiled str--- Direct 2-arg call: use global compilation cache.-builtinSplit (VStr regex _) (VStr str _) =-  case cachedCompileRegex regex of-    Nothing -> throwEvalError ("builtins.split: invalid regex: " <> bytesToTextLossy regex)-    Just compiled -> splitWithCompiled compiled str-builtinSplit (VStr _ _) other =-  throwEvalError ("builtins.split: expected a string, got " <> typeName other)-builtinSplit (VCompiledRegex _) other =-  throwEvalError ("builtins.split: expected a string, got " <> typeName other)-builtinSplit other _ =-  throwEvalError ("builtins.split: expected a string (regex), got " <> typeName other)---- | Shared split logic for pre-compiled and freshly-compiled regex paths.-splitWithCompiled :: (MonadEval m) => RE.Regex -> BS.ByteString -> m NixValue-splitWithCompiled compiled str =-  let allMatches = matchAllText compiled str-      result = buildSplitResult str 0 allMatches-   in pure (VList (clistFromThunks (map thunkToCPtr result)))---- | Build the alternating list for builtins.split.  Offsets from the--- ByteString regex instance are byte offsets, so slicing is O(1)--- 'BS.take'/'BS.drop'.-buildSplitResult :: BS.ByteString -> Int -> [Array.Array Int (BS.ByteString, (Int, Int))] -> [Thunk]-buildSplitResult remaining pos [] =-  -- No more matches - emit the rest of the string.-  [evaluated (mkStrBytes (BS.drop pos remaining))]-buildSplitResult remaining pos (match : rest) =-  let elems = Array.elems match-      (_, (matchStart, matchLen)) = case elems of-        (full : _) -> full-        [] -> ("", (pos, 0)) -- defensive: should not happen from matchAllText-        -- Bytes before this match-      before = BS.take (matchStart - pos) (BS.drop pos remaining)-      -- Capture groups (indices 1..)-      groups = drop 1 elems-      -- A non-participating capture group has offset (-1) becomes null (as 'match').-      groupThunks =-        map (\(s, (off, _)) -> if off < 0 then evaluated VNull else evaluated (mkStrBytes s)) groups-      -- Continue after this match-      afterPos = matchStart + matchLen-   in evaluated (mkStrBytes before)-        : evaluated (VList (clistFromThunks (map thunkToCPtr groupThunks)))-        : buildSplitResult remaining afterPos rest--builtinCompareVersions :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinCompareVersions (VStr a _) (VStr b _) =-  pure (VInt (compareVersionParts (splitVersionStr a) (splitVersionStr b)))-builtinCompareVersions _ _ = throwEvalError "builtins.compareVersions: expected two strings"---- | Convert 'Ordering' to the Nix compareVersions convention: -1, 0, 1.-ordToNix :: Ordering -> Int64-ordToNix LT = -1-ordToNix EQ = 0-ordToNix GT = 1--compareVersionParts :: [BS.ByteString] -> [BS.ByteString] -> Int64-compareVersionParts [] [] = 0--- When one version runs out, Nix pads the shorter side with an empty--- component and keeps comparing - so "1.0" > "1.0pre" (empty sorts AFTER--- "pre"), not "<" as a naive length comparison would give.-compareVersionParts [] (b : bs) =-  case compareComponent "" b of-    EQ -> compareVersionParts [] bs-    cmp -> ordToNix cmp-compareVersionParts (a : as) [] =-  case compareComponent a "" of-    EQ -> compareVersionParts as []-    cmp -> ordToNix cmp-compareVersionParts (a : as) (b : bs) =-  case compareComponent a b of-    EQ -> compareVersionParts as bs-    cmp -> ordToNix cmp---- | Byte-level alpha classification, as upstream (C @isalpha@ over--- bytes): a non-ASCII letter is a separator, never an alphabetic--- component.  Digits need no counterpart - 'isDigit' is @0-9@ only.-isVersionAlpha :: Char -> Bool-isVersionAlpha c = isAsciiLower c || isAsciiUpper c--compareComponent :: BS.ByteString -> BS.ByteString -> Ordering-compareComponent a b-  | a == b = EQ-  | allDigits a && allDigits b = compare (readInt a) (readInt b)-  -- "pre" sorts before everything else (Nix pre-release convention)-  | a == "pre" = LT-  | b == "pre" = GT-  | a == "" = LT-  | b == "" = GT-  -- Alphabetic components sort before numeric in Nix-  | isAlphaComp a && allDigits b = LT-  | allDigits a && isAlphaComp b = GT-  | otherwise = compare a b-  where-    allDigits t = not (BS.null t) && BC.all isDigit t-    isAlphaComp t = case BC.uncons t of-      Just (c, _) -> isVersionAlpha c-      Nothing -> False-    readInt :: BS.ByteString -> Int64-    readInt = BC.foldl' (\acc c -> acc * 10 + fromIntegral (digitToInt c)) (0 :: Int64)--splitVersionStr :: BS.ByteString -> [BS.ByteString]-splitVersionStr t-  | BS.null t = []-  | otherwise =-      let (component, rest) = spanComponent t-       in component : splitVersionAfterComponent rest--splitVersionAfterComponent :: BS.ByteString -> [BS.ByteString]-splitVersionAfterComponent t = case BC.uncons t of-  Nothing -> []-  -- '.' and '-' are both component separators in Nix's version grammar, so a-  -- '-' is skipped, not emitted as a one-character component.-  Just (sep, rest) | sep == '.' || sep == '-' -> splitVersionStr rest-  Just _ -> splitVersionStr t--spanComponent :: BS.ByteString -> (BS.ByteString, BS.ByteString)-spanComponent t = case BC.uncons t of-  Nothing -> ("", "")-  Just (c, rest)-    | isDigit c -> BC.span isDigit t-    | isVersionAlpha c -> BC.span isVersionAlpha t-    | otherwise -> (BS.take 1 t, rest)--builtinSplitVersion :: (MonadEval m) => NixValue -> m NixValue-builtinSplitVersion (VStr s _) =-  pure (VList (clistFromThunks (map (thunkToCPtr . evaluated . mkStrBytes) (splitVersionComponents s))))-builtinSplitVersion other =-  throwEvalError ("builtins.splitVersion: expected a string, got " <> typeName other)--splitVersionComponents :: BS.ByteString -> [BS.ByteString]-splitVersionComponents t = case BC.uncons t of-  Nothing -> []-  Just ('.', rest) -> splitVersionComponents rest-  Just (c, _)-    | isDigit c ->-        let (digits, rest) = BC.span isDigit t-         in digits : splitVersionComponents rest-    | isVersionAlpha c ->-        let (alpha, rest) = BC.span isVersionAlpha t-         in alpha : splitVersionComponents rest-    | otherwise ->-        -- Non-alphanumeric separator byte (e.g. '-', '_'): consume it-        splitVersionComponents (BS.drop 1 t)--builtinParseDrvName :: (MonadEval m) => NixValue -> m NixValue-builtinParseDrvName (VStr s _) =-  let (name, version) = parseName s-   in pure-        ( VAttrs-            ( attrSetFromMap $-                Map.fromList-                  [ ("name", evaluated (mkStrBytes name)),-                    ("version", evaluated (mkStrBytes version))-                  ]-            )-        )-builtinParseDrvName other =-  throwEvalError ("builtins.parseDrvName: expected a string, got " <> typeName other)--parseName :: BS.ByteString -> (BS.ByteString, BS.ByteString)-parseName t =-  case findVersionDash t 0 of-    Nothing -> (t, "")-    Just idx -> (BS.take idx t, BS.drop (idx + 1) t)--findVersionDash :: BS.ByteString -> Int -> Maybe Int-findVersionDash t idx = case BC.uncons (BS.drop idx t) of-  Nothing -> Nothing-  Just ('-', after)-    | Just (d, _) <- BC.uncons after,-      isDigit d ->-        Just idx-  Just _ -> findVersionDash t (idx + 1)---- ------------------------------------------------------------------------------ Builtin implementations - serialization + hashing--- -----------------------------------------------------------------------------builtinToJSON :: (MonadEval m) => NixValue -> m NixValue-builtinToJSON val = do-  (json, ctx) <- valueToJSON val-  pure (VStr (TE.encodeUtf8 json) ctx)---- | JSON is built as 'Text' and encoded once at the top: upstream's--- serializer (nlohmann) REJECTS invalid UTF-8, so string payloads decode--- strictly here and invalid bytes are an eval error, matching upstream.-valueToJSON :: (MonadEval m) => NixValue -> m (Text, StringContext)-valueToJSON VNull = pure ("null", emptyContext)-valueToJSON (VBool True) = pure ("true", emptyContext)-valueToJSON (VBool False) = pure ("false", emptyContext)-valueToJSON (VInt n) = pure (T.pack (show n), emptyContext)-valueToJSON (VFloat f)-  -- upstream's serializer (nlohmann dump) writes a non-finite float as null-  | isNaN f || isInfinite f = pure ("null", emptyContext)-  | otherwise = pure (formatJsonFloat f, emptyContext)-valueToJSON (VStr s ctx) = do-  decoded <- decodedText "builtins.toJSON" s-  pure (jsonEscapeString decoded, ctx)-valueToJSON (VList cl) = do-  let thunks = map Thunk (clistThunks cl)-  vals <- mapM force thunks-  results <- mapM valueToJSON vals-  let jsonVals = map fst results-      ctx = mconcat (map snd results)-  pure ("[" <> T.intercalate "," jsonVals <> "]", ctx)-valueToJSON (VAttrs attrs) =-  -- C++ Nix serializes an attrset via __toString first, then outPath, and only-  -- falls back to an object when neither is present.-  case (attrSetLookup "__toString" attrs, attrSetLookup "outPath" attrs) of-    (Nothing, Nothing) -> do-      let m = attrSetToMap attrs-          sortedKeys = Map.keys m-      results <- mapM (jsonPair m) sortedKeys-      let pairs = map fst results-          ctx = mconcat (map snd results)-      pure ("{" <> T.intercalate "," pairs <> "}", ctx)-    _ -> do-      (s, ctx) <- coerceToString True force applyValue coercePathToStore (VAttrs attrs)-      decoded <- decodedText "builtins.toJSON" s-      pure (jsonEscapeString decoded, ctx)-  where-    jsonPair attrMap key = case Map.lookup key attrMap of-      Nothing -> pure ("", emptyContext)-      Just thunk -> do-        val <- force thunk-        (jsonVal, ctx) <- valueToJSON val-        pure (jsonEscapeString key <> ":" <> jsonVal, ctx)--- A path serializes as its source store path, with context - the same--- copy-to-store coercion as interpolation (upstream value-to-json.cc--- serializes paths with copyToStore = true).-valueToJSON (VPath p) = do-  (spText, ctx) <- sourcePathWithContext p-  pure (jsonEscapeString spText, ctx)-valueToJSON (VLambda {}) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"-valueToJSON (VBuiltin _ _) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"-valueToJSON (VDerivation _) = throwEvalError "builtins.toJSON: cannot convert a derivation to JSON"-valueToJSON (VCompiledRegex _) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"--jsonEscapeString :: Text -> Text-jsonEscapeString s = "\"" <> T.concatMap escapeChar s <> "\""-  where-    escapeChar '"' = "\\\""-    escapeChar '\\' = "\\\\"-    escapeChar '\n' = "\\n"-    escapeChar '\r' = "\\r"-    escapeChar '\t' = "\\t"-    escapeChar c-      | ord c < 0x20 = "\\u" <> T.pack (padHex 4 (showHex' (ord c)))-      | otherwise = T.singleton c-    padHex n str = replicate (n - length str) '0' ++ str-    showHex' 0 = "0"-    showHex' num = go num ""-      where-        go 0 acc = acc-        go v acc =-          let (q, r) = quotRem v 16-           in go q (hexDigit r : acc)---- | Safe hex digit lookup (total for 0-15).-hexDigit :: Int -> Char-hexDigit n-  | n >= 0 && n <= 9 = chr (ord '0' + n)-  | n >= 10 && n <= 15 = chr (ord 'a' + n - 10)-  | otherwise = '?' -- unreachable for valid hex--builtinFromJSON :: (MonadEval m) => NixValue -> m NixValue-builtinFromJSON (VStr s _) = do-  -- JSON input must be valid UTF-8 (upstream's parser rejects it too).-  decoded <- decodedText "builtins.fromJSON" s-  case parseJSON (T.strip decoded) of-    Just (val, rest)-      | T.null (T.strip rest) -> pure val-      | otherwise -> throwEvalError "builtins.fromJSON: trailing content after JSON value"-    Nothing -> throwEvalError "builtins.fromJSON: invalid JSON"-builtinFromJSON other =-  throwEvalError ("builtins.fromJSON: expected a string, got " <> typeName other)--parseJSON :: Text -> Maybe (NixValue, Text)-parseJSON t = case T.uncons (T.stripStart t) of-  Nothing -> Nothing-  Just ('n', rest)-    | Just suffix <- T.stripPrefix "ull" rest -> Just (VNull, suffix)-  Just ('t', rest)-    | Just suffix <- T.stripPrefix "rue" rest -> Just (VBool True, suffix)-  Just ('f', rest)-    | Just suffix <- T.stripPrefix "alse" rest -> Just (VBool False, suffix)-  Just ('"', _) -> parseJSONString (T.stripStart t)-  Just ('[', rest) -> parseJSONArray rest-  Just ('{', rest) -> parseJSONObject rest-  Just (c, _)-    | c == '-' || isDigit c -> parseJSONNumber (T.stripStart t)-  _ -> Nothing--parseJSONString :: Text -> Maybe (NixValue, Text)-parseJSONString t = case T.uncons t of-  Just ('"', rest) ->-    let (strVal, remaining) = parseJSONStringContent rest-     in Just (mkStr strVal, remaining)-  _ -> Nothing---- | Parse JSON string content, O(n) via chunk list + T.concat.-parseJSONStringContent :: Text -> (Text, Text)-parseJSONStringContent = go []-  where-    go !chunks t = case T.uncons t of-      Nothing -> (T.concat (reverse chunks), "")-      Just ('"', rest) -> (T.concat (reverse chunks), rest)-      Just ('\\', rest) -> case T.uncons rest of-        Just ('"', r) -> go ("\"" : chunks) r-        Just ('\\', r) -> go ("\\" : chunks) r-        Just ('/', r) -> go ("/" : chunks) r-        Just ('n', r) -> go ("\n" : chunks) r-        Just ('r', r) -> go ("\r" : chunks) r-        Just ('t', r) -> go ("\t" : chunks) r-        Just ('u', r) -> case parseHex4 r of-          Just (hi, r2)-            -- UTF-16 surrogate pair: high surrogate followed by \uXXXX low-            | hi >= 0xD800 && hi <= 0xDBFF ->-                case T.stripPrefix "\\u" r2 of-                  Just r3 -> case parseHex4 r3 of-                    Just (lo, r4)-                      | lo >= 0xDC00 && lo <= 0xDFFF ->-                          let combined = 0x10000 + (hi - 0xD800) * 0x400 + (lo - 0xDC00)-                           in go (T.singleton (chr combined) : chunks) r4-                    _ -> go (T.singleton (chr hi) : chunks) r2-                  Nothing -> go (T.singleton (chr hi) : chunks) r2-          Just (codepoint, r2) ->-            go (T.singleton (chr codepoint) : chunks) r2-          Nothing -> go ("u" : chunks) r-        _ -> (T.concat (reverse chunks), rest)-      Just (c, rest) -> go (T.singleton c : chunks) rest--parseHex4 :: Text -> Maybe (Int, Text)-parseHex4 t-  | T.length t >= 4 =-      let hex = T.take 4 t-       in if T.all isHexDigit hex-            then Just (readHex4 hex, T.drop 4 t)-            else Nothing-  | otherwise = Nothing--readHex4 :: Text -> Int-readHex4 = T.foldl' (\acc c -> acc * 16 + digitToInt c) 0--parseJSONNumber :: Text -> Maybe (NixValue, Text)-parseJSONNumber t =-  let (numStr, rest) = T.span (\c -> isDigit c || c == '.' || c == '-' || c == 'e' || c == 'E' || c == '+') t-   in if T.null numStr-        then Nothing-        else-          if T.any (\c -> c == '.' || c == 'e' || c == 'E') numStr-            then case reads (T.unpack numStr) :: [(Double, String)] of-              [(d, "")] -> Just (VFloat d, rest)-              _ -> Nothing-            else case reads (T.unpack numStr) :: [(Integer, String)] of-              [(n, "")] -> Just (jsonInteger n, rest)-              _ -> Nothing---- | Nix value for a JSON integer literal, as upstream's nlohmann-based--- parser produces it: a value in int64 range is an int; a positive value--- that fits only uint64 still arrives as an int (nlohmann hands it over--- unsigned, upstream stores it into the signed NixInt, two's-complement);--- anything wider than 64 bits falls back to a float.-jsonInteger :: Integer -> NixValue-jsonInteger n-  | n >= toInteger (minBound :: Int64) && n <= toInteger (maxBound :: Word64) = VInt (fromInteger n)-  | otherwise = VFloat (fromInteger n)--parseJSONArray :: Text -> Maybe (NixValue, Text)-parseJSONArray t = parseJSONArrayElements (T.stripStart t) []--parseJSONArrayElements :: Text -> [Thunk] -> Maybe (NixValue, Text)-parseJSONArrayElements t acc = case T.uncons (T.stripStart t) of-  Just (']', rest) -> Just (VList (clistFromThunks (map thunkToCPtr (reverse acc))), rest)-  _ -> case parseJSON t of-    Just (val, rest) ->-      let stripped = T.stripStart rest-       in case T.uncons stripped of-            Just (',', rest2) -> parseJSONArrayElements rest2 (evaluated val : acc)-            Just (']', rest2) -> Just (VList (clistFromThunks (map thunkToCPtr (reverse (evaluated val : acc)))), rest2)-            _ -> Nothing-    Nothing -> Nothing--parseJSONObject :: Text -> Maybe (NixValue, Text)-parseJSONObject t = parseJSONObjectEntries (T.stripStart t) Map.empty--parseJSONObjectEntries :: Text -> Map Text Thunk -> Maybe (NixValue, Text)-parseJSONObjectEntries t acc = case T.uncons (T.stripStart t) of-  Just ('}', rest) -> Just (VAttrs (attrSetFromMap acc), rest)-  -- Keys read via 'parseJSONStringContent' directly: they become attr-  -- names (Text), not string values.-  Just ('"', afterQuote) ->-    let (key, rest) = parseJSONStringContent afterQuote-     in case T.uncons (T.stripStart rest) of-          Just (':', rest2) -> case parseJSON rest2 of-            Just (val, rest3) ->-              let stripped = T.stripStart rest3-                  updated = Map.insert key (evaluated val) acc-               in case T.uncons stripped of-                    Just (',', rest4) -> parseJSONObjectEntries rest4 updated-                    Just ('}', rest4) -> Just (VAttrs (attrSetFromMap updated), rest4)-                    _ -> Nothing-            Nothing -> Nothing-          _ -> Nothing-  _ -> Nothing--builtinHashString :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinHashString (VStr algo _) (VStr input _) = do-  -- The payload IS the hashed bytes - no encode step, so a mid-codepoint-  -- substring hashes to the sha256 of exactly those bytes, as upstream.-  algoName <- decodedText "builtins.hashString" algo-  hashBytesWithAlgo "hashString" algoName input-builtinHashString (VStr _ _) other =-  throwEvalError ("builtins.hashString: expected a string, got " <> typeName other)-builtinHashString other _ =-  throwEvalError ("builtins.hashString: expected a string, got " <> typeName other)--digestToHex :: (BA.ByteArrayAccess a) => a -> Text-digestToHex = bytesToHexText . BA.convert---- ------------------------------------------------------------------------------ Builtin implementations - deep evaluation--- -----------------------------------------------------------------------------builtinDeepSeq :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinDeepSeq first second = do-  deepForce first-  pure second--deepForce :: (MonadEval m) => NixValue -> m ()-deepForce (VList cl) = mapM_ ((force >=> deepForce) . Thunk) (clistThunks cl)-deepForce (VAttrs attrs) = mapM_ (force >=> deepForce) (attrSetElems attrs)-deepForce _ = pure ()---- | @builtins.seq a b@ - evaluate @a@ to WHNF, then return @b@.-builtinSeq :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinSeq !_first = pure---- | @builtins.trace msg val@ - print @msg@ to stderr, return @val@.-builtinTrace :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinTrace msgVal result = do-  msg <- case msgVal of-    VStr s _ -> pure (bytesToTextLossy s)-    other -> pure (showValueForTrace other)-  traceMessage ("trace: " <> msg)-  pure result---- | @builtins.warn msg val@ - print warning to stderr, return @val@.-builtinWarn :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinWarn msgVal result = do-  msg <- case msgVal of-    VStr s _ -> pure (bytesToTextLossy s)-    other -> pure (showValueForTrace other)-  traceMessage ("warning: " <> msg)-  pure result---- | Pretty-print a value for trace/warn, matching C++ Nix's printValue.-showValueForTrace :: NixValue -> Text-showValueForTrace (VInt n) = T.pack (show n)-showValueForTrace (VFloat f) = formatNixFloat f-showValueForTrace (VBool True) = "true"-showValueForTrace (VBool False) = "false"-showValueForTrace VNull = "null"-showValueForTrace (VPath p) = p-showValueForTrace other = "<<" <> typeName other <> ">>"---- ------------------------------------------------------------------------------ Builtin implementations - graph traversal--- -----------------------------------------------------------------------------builtinGenericClosure :: (MonadEval m) => NixValue -> m NixValue-builtinGenericClosure (VAttrs attrs) = do-  startSetThunk <--    maybe (throwEvalError "builtins.genericClosure: missing 'startSet'") pure $-      attrSetLookup "startSet" attrs-  operatorThunk <--    maybe (throwEvalError "builtins.genericClosure: missing 'operator'") pure $-      attrSetLookup "operator" attrs-  startSetVal <- force startSetThunk-  operatorVal <- force operatorThunk-  case startSetVal of-    VList cl -> do-      let items = map Thunk (clistThunks cl)-      result <- closureLoop operatorVal (Seq.fromList items) [] []-      pure (VList (clistFromThunks (map (thunkToCPtr . evaluated) result)))-    _ -> throwEvalError "builtins.genericClosure: 'startSet' must be a list"-builtinGenericClosure other =-  throwEvalError ("builtins.genericClosure: expected a set, got " <> typeName other)---- | BFS loop for genericClosure.  Uses Data.Sequence for O(1) queue--- append (the old list-based version was O(n) per operator call).--- seenKeys is still a linear scan - Nix value equality is monadic so--- Set/HashMap is not directly applicable without specialising on key type.-closureLoop ::-  (MonadEval m) =>-  NixValue ->-  Seq Thunk ->-  [NixValue] ->-  [NixValue] ->-  m [NixValue]-closureLoop _ Empty _ acc = pure (reverse acc)-closureLoop operator (thunk :<| rest) seenKeys acc = do-  item <- force thunk-  key <- extractKey item-  alreadySeen <- keyInList key seenKeys-  if alreadySeen-    then closureLoop operator rest seenKeys acc-    else do-      newItems <- applyValue operator item-      case newItems of-        VList newCl ->-          closureLoop operator (rest <> Seq.fromList (map Thunk (clistThunks newCl))) (key : seenKeys) (item : acc)-        _ -> throwEvalError "builtins.genericClosure: operator must return a list"--extractKey :: (MonadEval m) => NixValue -> m NixValue-extractKey (VAttrs attrs) =-  case attrSetLookup "key" attrs of-    Just thunk -> force thunk-    Nothing -> throwEvalError "builtins.genericClosure: item missing 'key' attribute"-extractKey _ = throwEvalError "builtins.genericClosure: item must be a set with 'key'"--keyInList :: (MonadEval m) => NixValue -> [NixValue] -> m Bool-keyInList _ [] = pure False-keyInList key (seen : rest) = do-  eq <- nixEqual force key seen-  if eq then pure True else keyInList key rest---- ------------------------------------------------------------------------------ IO builtins (delegate to MonadEval methods)--- ------------------------------------------------------------------------------- | Coerce a value to a path 'Text'.  Accepts 'VPath' and 'VStr';--- throws a type error for anything else.  A string operand is a byte--- string naming a filesystem path, so it decodes strictly.-coerceToPath :: (MonadEval m) => Text -> NixValue -> m Text-coerceToPath _ (VPath p) = pure p-coerceToPath name (VStr s _) = decodedText ("builtins." <> name) s-coerceToPath name other =-  throwEvalError ("builtins." <> name <> ": expected a path or string, got " <> typeName other)--builtinImport :: (MonadEval m) => NixValue -> m NixValue-builtinImport (VPath p) = importFile p-builtinImport (VStr s _) = importFile =<< decodedText "import" s-builtinImport other =-  throwEvalError ("import: expected a path or string, got " <> typeName other)--builtinReadFile :: (MonadEval m) => NixValue -> m NixValue-builtinReadFile val = do-  p <- coerceToPath "readFile" val-  bytes <- readFileBytes p-  -- The value is the file's RAW BYTES, as upstream: no BOM stripping, no-  -- UTF-16 transcoding, no replacement characters (the auto-decode stays-  -- on the parser/import path only).  The only rejection is NUL, which a-  -- Nix string cannot represent upstream.-  when (BS.elem 0 bytes) $-    throwEvalError-      ("builtins.readFile: the contents of the file '" <> p <> "' cannot be represented as a Nix string")-  pure (mkStrBytes bytes)--builtinPathExists :: (MonadEval m) => NixValue -> m NixValue-builtinPathExists val = do-  p <- coerceToPath "pathExists" val-  VBool <$> doesPathExist p--builtinReadDir :: (MonadEval m) => NixValue -> m NixValue-builtinReadDir val = do-  p <- coerceToPath "readDir" val-  entries <- listDirectory p-  pure (VAttrs (attrSetFromMap (Map.fromList [(name, evaluated (mkStr fileType)) | (name, fileType) <- entries])))---- ------------------------------------------------------------------------------ Builtin implementations - environment + paths--- -----------------------------------------------------------------------------builtinGetEnv :: (MonadEval m) => NixValue -> m NixValue-builtinGetEnv (VStr name _) = do-  varName <- decodedText "builtins.getEnv" name-  mkStr <$> getEnvVar varName-builtinGetEnv other =-  throwEvalError ("builtins.getEnv: expected a string, got " <> typeName other)--builtinToPath :: (MonadEval m) => NixValue -> m NixValue-builtinToPath (VPath p) = pure (VPath p)-builtinToPath (VStr rawBytes _) = do-  s <- decodedText "builtins.toPath" rawBytes-  case T.uncons s of-    Nothing -> throwEvalError "builtins.toPath: empty path"-    -- Canonicalized like every other path production site, as upstream.-    Just ('/', _) -> pure (VPath (canonPathValue s))-    Just _ -> throwEvalError ("builtins.toPath: path must be absolute, got " <> s)-builtinToPath other =-  throwEvalError ("builtins.toPath: expected a string or path, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - store path operations--- -----------------------------------------------------------------------------builtinPlaceholder :: (MonadEval m) => NixValue -> m NixValue-builtinPlaceholder (VStr outputName _) = do-  name <- decodedText "builtins.placeholder" outputName-  pure (mkStr (hashPlaceholder name))-builtinPlaceholder other =-  throwEvalError ("builtins.placeholder: expected a string, got " <> typeName other)--builtinStorePath :: (MonadEval m) => NixValue -> m NixValue-builtinStorePath (VPath p) = validateStorePath p-builtinStorePath (VStr s _) = validateStorePath =<< decodedText "builtins.storePath" s-builtinStorePath other =-  throwEvalError ("builtins.storePath: expected a path or string, got " <> typeName other)---- | @builtins.storePath@ - mark an already-in-store path as such.  Upstream--- returns a STRING carrying an Opaque (SCPlain) context entry for the enclosing--- store path, NOT a bare path: the Opaque marker is what stops a later coercion--- from re-serialising (re-NARing) the already-present path into a new store--- path.  Returning a context-free path (the old behavior) re-copied the path on--- coercion - a wrong store path on Unix, and a file-not-found on Windows, where--- the canonical @/nix/store@ text is not the on-disk location.-validateStorePath :: (MonadEval m) => Text -> m NixValue-validateStorePath p = case enclosingStorePath p of-  Just sp -> pure (VStr (TE.encodeUtf8 p) (plainContext sp))-  Nothing -> throwEvalError ("builtins.storePath: not a valid store path: " <> p)---- | The store path enclosing an absolute path under the store dir, or--- 'Nothing' if the path is not in the store.  Accepts a bare store path and a--- subpath (@\/nix\/store\/\<hash\>-\<name\>\/sub@ resolves to its--- @\<hash\>-\<name\>@ component), the way upstream marks the enclosing store--- path Opaque for either.  The component passes the same charset--- validation as every other store-path parse boundary.-enclosingStorePath :: Text -> Maybe StorePath-enclosingStorePath p = do-  rest <- T.stripPrefix storeDirPrefix p-  parseStorePathBaseName (T.takeWhile (/= '/') rest)---- ------------------------------------------------------------------------------ Builtin implementations - Nix search path--- -----------------------------------------------------------------------------builtinFindFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinFindFile (VList cl) (VStr name _) = do-  fileName <- decodedText "builtins.findFile" name-  let searchPath = map Thunk (clistThunks cl)-  entries <- mapM forceSearchEntry searchPath-  findFirst entries fileName-builtinFindFile (VList _) other =-  throwEvalError ("builtins.findFile: expected a string, got " <> typeName other)-builtinFindFile other _ =-  throwEvalError ("builtins.findFile: expected a list, got " <> typeName other)---- | Extract {prefix, path} from a search path entry thunk.-forceSearchEntry :: (MonadEval m) => Thunk -> m (Text, Text)-forceSearchEntry thunk = do-  val <- force thunk-  case val of-    VAttrs attrs -> do-      prefixThunk <--        maybe (throwEvalError "builtins.findFile: entry missing 'prefix'") pure $-          attrSetLookup "prefix" attrs-      pathThunk <--        maybe (throwEvalError "builtins.findFile: entry missing 'path'") pure $-          attrSetLookup "path" attrs-      prefixVal <- force prefixThunk-      pathVal <- force pathThunk-      prefix <- case prefixVal of-        VStr s _ -> decodedText "builtins.findFile" s-        _ -> throwEvalError "builtins.findFile: 'prefix' must be a string"-      path <- case pathVal of-        VStr s _ -> decodedText "builtins.findFile" s-        VPath s -> pure s-        _ -> throwEvalError "builtins.findFile: 'path' must be a string or path"-      pure (prefix, path)-    _ -> throwEvalError "builtins.findFile: search path entry must be a set"---- | Iterate search path entries, checking for a match.--- A miss is a CATCHABLE error (upstream raises ThrownError here):--- nixpkgs' impure.nix wraps @<nixpkgs-overlays>@ in @tryEval@ and--- relies on catching the miss.-findFirst :: (MonadEval m) => [(Text, Text)] -> Text -> m NixValue-findFirst [] name =-  throwCatchableError ("file '" <> name <> "' was not found in the Nix search path")-findFirst ((prefix, path) : rest) name-  | prefix == name || (not (T.null prefix) && (prefix <> "/") `T.isPrefixOf` name) =-      let suffix = if prefix == name then "" else T.drop (T.length prefix + 1) name-          candidate = canonPathValue (if T.null suffix then path else path <> "/" <> suffix)-       in do-            exists <- doesPathExist candidate-            if exists-              then pure (VPath candidate)-              else findFirst rest name-  | T.null prefix =-      let candidate = canonPathValue (path <> "/" <> name)-       in do-            exists <- doesPathExist candidate-            if exists-              then pure (VPath candidate)-              else findFirst rest name-  | otherwise = findFirst rest name---- ------------------------------------------------------------------------------ Builtin implementations - store file creation--- -----------------------------------------------------------------------------builtinToFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinToFile (VStr name _) (VStr contents ctx) = do-  fileName <- decodedText "builtins.toFile" name-  refs <- toFileRefs ctx-  -- The contents are stored (and hashed) as their raw bytes.-  storePath <- writeToStore fileName contents refs-  -- Upstream returns a STRING whose context is the new path itself; the-  -- refs travel through the store path computation, not the eval context.-  let selfContext = maybe emptyContext plainContext (parseStorePath defaultStoreDir storePath)-  pure (VStr (TE.encodeUtf8 storePath) selfContext)-builtinToFile (VStr _ _) other =-  throwEvalError ("builtins.toFile: expected a string, got " <> typeName other)-builtinToFile other _ =-  throwEvalError ("builtins.toFile: expected a string, got " <> typeName other)---- | The store-path references a toFile output may carry: the contents'--- plain-path context, in sorted order.  A derivation-output reference is--- an error, exactly as upstream ("files created by builtins.toFile may--- not reference derivations").-toFileRefs :: (MonadEval m) => StringContext -> m [StorePath]-toFileRefs (StringContext elems) = mapM refOf (Set.toAscList elems)-  where-    refOf (SCPlain sp) = pure sp-    refOf (SCDrvOutput _ _) =-      throwEvalError "builtins.toFile: files created by toFile may not reference derivations"-    refOf (SCAllOutputs _) =-      throwEvalError "builtins.toFile: files created by toFile may not reference derivations"---- ------------------------------------------------------------------------------ Builtin implementations - scoped import--- -----------------------------------------------------------------------------builtinScopedImport :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinScopedImport (VAttrs attrs) pathVal = do-  p <- coerceToPath "scopedImport" pathVal-  let scope = Map.toList (attrSetToMap attrs)-  scopedImportFile scope p-builtinScopedImport other _ =-  throwEvalError ("builtins.scopedImport: expected a set, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - network fetchers--- -----------------------------------------------------------------------------builtinFetchurl :: (MonadEval m) => NixValue -> m NixValue-builtinFetchurl (VStr url _) = do-  urlText <- decodedText "builtins.fetchurl" url-  fetchUrlSimple urlText Nothing-builtinFetchurl (VAttrs attrs) = do-  url <- forceAttrStr "builtins.fetchurl" "url" attrs-  sha256 <- forceOptionalAttrStr attrs "sha256"-  fetchUrlSimple url sha256-builtinFetchurl other =-  throwEvalError ("builtins.fetchurl: expected a string or set, got " <> typeName other)--builtinFetchTarball :: (MonadEval m) => NixValue -> m NixValue-builtinFetchTarball (VStr url _) = do-  urlText <- decodedText "builtins.fetchTarball" url-  fetchAndExtractTarball urlText Nothing tarballSourceName-builtinFetchTarball (VAttrs attrs) = do-  url <- forceAttrStr "builtins.fetchTarball" "url" attrs-  sha256 <- forceOptionalAttrStr attrs "sha256"-  nameOverride <- forceOptionalAttrStr attrs "name"-  fetchAndExtractTarball url sha256 (fromMaybe tarballSourceName nameOverride)-builtinFetchTarball other =-  throwEvalError ("builtins.fetchTarball: expected a string or set, got " <> typeName other)---- | Upstream's default store name for fetched source trees.-tarballSourceName :: Text-tarballSourceName = "source"---- | Download a tarball, extract it, verify the optional sha256 pin, and--- copy the tree to its content-addressed store path.  The pin is the--- recursive NAR hash of the EXTRACTED tree, as upstream.  Download and--- extraction share one shell pipeline to avoid binary-as-text encoding--- issues.  The scratch dir is exclusively created with an unpredictable--- name ('createScratchDir') and removed once the tree reaches the store.-fetchAndExtractTarball :: (MonadEval m) => Text -> Maybe Text -> Text -> m NixValue-fetchAndExtractTarball url mSha256 name = do-  extractDir <- createScratchDir "nova-nix-tarball-"-  -- The -- separator prevents argument injection from the URL.-  (code, _, errOut) <--    runProcess-      "sh"-      [ "-c",-        "curl -sSfL -- \"$1\" | tar -xz -C \"$2\" --strip-components=1",-        "--",-        url,-        extractDir-      ]-      ""-  case code of-    0 -> do-      pin <- traverse (decodeSha256Pin "builtins.fetchTarball") mSha256-      storePath <--        copyPathToStore-          extractDir-          name-          (fmap ("builtins.fetchTarball: " <> url,) pin)-      removeScratchDir extractDir-      pure (VPath storePath)-    _ -> do-      removeScratchDir extractDir-      throwEvalError ("builtins.fetchTarball: " <> errOut)---- | Transports 'builtinFetchGit' accepts.  Also spelled into the--- clone's @protocol.*.allow@ config, so git enforces the same set--- internally.-allowedGitSchemes :: [Text]-allowedGitSchemes = ["http", "https", "ssh", "git", "file"]---- | Validate a fetchGit URL's transport before anything spawns.  git's--- transport-helper syntax (@\<helper\>::\<address\>@) makes the helper--- name a command to run as the transport (@ext::@ runs a shell command,--- @fd::@ reads a descriptor), so evaluating an expression carrying such--- a URL would execute it.  Accepted: an allowlisted explicit scheme, an--- scp-like remote, or a local path.  Left carries the eval-error text.-checkGitUrl :: Text -> Either Text Text-checkGitUrl url-  | T.null url = Left "builtins.fetchGit: empty url"-  | not (T.null schemeRest),-    schemeShaped scheme,-    T.toLower scheme `elem` allowedGitSchemes =-      Right url-  | not (T.null schemeRest) = Left (disallowed scheme)-  | Just helper <- helperPrefix = Left (disallowed helper)-  | otherwise = Right url-  where-    (scheme, schemeRest) = T.breakOn "://" url-    -- RFC 3986 scheme shape; anything else before :// is not a scheme.-    schemeShaped s = case T.uncons s of-      Just (leading, rest) -> asciiAlpha leading && T.all schemeChar rest-      Nothing -> False-    schemeChar c = asciiAlpha c || isDigit c || c == '+' || c == '-' || c == '.'-    asciiAlpha c = isAsciiLower c || isAsciiUpper c-    -- <helper>:: counts only when the prefix is shaped like a helper-    -- name; "[::1]"-style scp hosts contain :: but are not helpers.-    helperPrefix = case T.breakOn "::" url of-      (prefix, rest)-        | not (T.null rest),-          T.null prefix || T.all helperChar prefix ->-            Just prefix-      _ -> Nothing-    helperChar c = asciiAlpha c || isDigit c || c == '-' || c == '_'-    disallowed t =-      "builtins.fetchGit: transport '" <> t <> "' is not allowed in url: " <> url---- | What @git fetch@ asks for when the caller pinned no @ref@: the--- remote's default branch.-defaultFetchRef :: Text-defaultFetchRef = "HEAD"---- | What @git checkout@ resolves when the caller pinned no @rev@: the--- tip of whatever the fetch just brought down.-fetchHeadRef :: Text-fetchHeadRef = "FETCH_HEAD"---- | Characters upstream's @refRegexS@ allows after the first one.-gitRefTrailingPunctuation :: [Char]-gitRefTrailingPunctuation = "_./@+-"---- | Validate a @ref@ against upstream's @refRegexS@--- (@[a-zA-Z0-9\@][a-zA-Z0-9_.\/\@+-]*@).  The leading class excludes--- @-@, and that is the load-bearing part: git parses options after the--- remote name, so a @ref@ of @--upload-pack=\<cmd\>@ names the command--- git runs as the transport.  Left carries the eval-error text.-checkGitRef :: Text -> Either Text Text-checkGitRef ref = case T.uncons ref of-  Just (leading, rest)-    | refLeadChar leading,-      T.all refChar rest ->-        Right ref-  _ -> Left ("builtins.fetchGit: ref is not a valid git ref name: " <> ref)-  where-    refLeadChar c = asciiAlphaNum c || c == '@'-    refChar c = asciiAlphaNum c || c `elem` gitRefTrailingPunctuation-    asciiAlphaNum c = isAsciiLower c || isAsciiUpper c || isDigit c---- | Hex characters in a full SHA-1.-gitRevHexLength :: Int-gitRevHexLength = 40---- | Validate a @rev@ against upstream's @revRegexS@ (@[0-9a-fA-F]{40}@).--- Upstream parses it as a SHA-1 @Hash@ before it reaches git, which--- rejects a tag or an abbreviated prefix as well as a leading @-@: a--- \"pinned\" fetch that still resolves through git's DWIM rules is not--- pinned.  Left carries the eval-error text.-checkGitRev :: Text -> Either Text Text-checkGitRev rev-  | T.length rev == gitRevHexLength,-    T.all isHexDigit rev =-      Right rev-  | otherwise = Left ("builtins.fetchGit: rev is not a full SHA-1: " <> rev)---- | @-c@ config pinning the clone to 'allowedGitSchemes': every--- transport defaults to never, each allowed scheme is re-enabled.  This--- enforces what URL validation cannot see up front - a helper reached--- indirectly, or a @remote-\<helper\>@ binary on PATH.-gitTransportConfig :: [Text]-gitTransportConfig =-  [ "-c",-    "protocol.allow=never",-    -- Keep checkout bytes platform-independent: no CRLF rewriting.-    "-c",-    "core.autocrlf=false",-    "-c",-    "core.eol=lf",-    -- Fail loudly rather than hash a symlink as a plain file (Git for-    -- Windows' fallback when it can't create real symlinks).-    "-c",-    "core.symlinks=true"-  ]-    ++ concat [["-c", "protocol." <> scheme <> ".allow=always"] | scheme <- allowedGitSchemes]---- | The parsed arguments of a @builtins.fetchGit@ call.  A record--- rather than positional threading: eight independent knobs invite--- transposition, and the names keep every site readable.-data FetchGitArgs = FetchGitArgs-  { fgaUrl :: !Text,-    fgaName :: !Text,-    fgaRef :: !(Maybe Text),-    fgaRev :: !(Maybe Text),-    fgaSubmodules :: !Bool,-    fgaShallow :: !Bool,-    fgaAllRefs :: !Bool,-    fgaNarHash :: !(Maybe Text)-  }---- | The attributes @builtins.fetchGit@ accepts.  Anything outside the--- set is an error rather than a silent drop - an ignored attribute is--- exactly how an unhonored pin stays invisible.  Upstream refuses the--- same way ("input attribute '...' not supported by scheme 'git'",--- observed from nix-instantiate 2.33.2).-fetchGitSupportedAttrs :: [Text]-fetchGitSupportedAttrs = ["url", "name", "ref", "rev", "submodules", "shallow", "allRefs", "narHash"]--builtinFetchGit :: (MonadEval m) => NixValue -> m NixValue-builtinFetchGit (VStr rawUrl _) = do-  url <- decodedText "builtins.fetchGit" rawUrl-  fetchGit-    FetchGitArgs-      { fgaUrl = url,-        fgaName = "source",-        fgaRef = Nothing,-        fgaRev = Nothing,-        fgaSubmodules = False,-        fgaShallow = False,-        fgaAllRefs = False,-        fgaNarHash = Nothing-      }-builtinFetchGit (VAttrs attrs) = do-  case filter (`notElem` fetchGitSupportedAttrs) (Map.keys (attrSetToMap attrs)) of-    (unsupported : _) ->-      throwEvalError ("builtins.fetchGit: attribute '" <> unsupported <> "' not supported")-    [] -> pure ()-  url <- forceAttrStr "builtins.fetchGit" "url" attrs-  name <- fromMaybe "source" <$> forceOptionalAttrStr attrs "name"-  ref <- forceOptionalAttrStr attrs "ref"-  rev <- forceOptionalAttrStr attrs "rev"-  submodules <- forceOptionalAttrBool "builtins.fetchGit" attrs "submodules" False-  shallow <- forceOptionalAttrBool "builtins.fetchGit" attrs "shallow" False-  allRefs <- forceOptionalAttrBool "builtins.fetchGit" attrs "allRefs" False-  narHash <- forceOptionalAttrStr attrs "narHash"-  fetchGit-    FetchGitArgs-      { fgaUrl = url,-        fgaName = name,-        fgaRef = ref,-        fgaRev = rev,-        fgaSubmodules = submodules,-        fgaShallow = shallow,-        fgaAllRefs = allRefs,-        fgaNarHash = narHash-      }-builtinFetchGit other =-  throwEvalError ("builtins.fetchGit: expected a string or set, got " <> typeName other)---- | Fetch one revision into the store; returns upstream's @fetchGit@--- attrset (@outPath@, @rev@, @shortRev@, @revCount@, @submodules@,--- @lastModified@, @lastModifiedDate@, @narHash@).  @ref@ and @rev@ are--- validated to upstream's shapes before they reach git (see--- 'checkGitRef' and 'checkGitRev'); neither may lead with @-@.-fetchGit :: (MonadEval m) => FetchGitArgs -> m NixValue-fetchGit args =-  case (,,) <$> checkGitUrl (fgaUrl args) <*> traverse checkGitRef (fgaRef args) <*> traverse checkGitRev (fgaRev args) of-    Left err -> throwEvalError err-    Right (url, checkedRef, checkedRev) -> do-      let name = fgaName args-          submodules = fgaSubmodules args-          shallow = fgaShallow args-      -- Only a pinned rev is cached: a bare ref means "whatever this branch-      -- points at now", which a note taken earlier cannot answer.-      cached <- case checkedRev of-        Nothing -> pure Nothing-        Just rev -> do-          entry <- lookupFetchCache (fetchCacheKey url name rev submodules shallow)-          case entry >>= decodeFetchCache of-            Nothing -> pure Nothing-            Just fields -> do-              -- The note is only good while the tree it names is still-              -- there, and a hit has to re-record the write the fetch it-              -- stands in for would have recorded: on disk and registered-              -- are different facts, and a derivation naming an-              -- unregistered outPath fails to build.-              adopted <- adoptStorePath (fcStorePath fields)-              pure (if adopted then Just fields else Nothing)-      fields <- case cached of-        Just hit -> pure hit-        Nothing -> fetchGitUncached args {fgaUrl = url} checkedRef checkedRev-      -- A declared narHash pins the tree; a mismatch is an error on the-      -- hit and fresh paths alike, never a silent recompute.  Upstream's-      -- orientation: "expected" is what the fetch produced, "got" is the-      -- declared pin (observed from nix-instantiate 2.33.2).-      case fgaNarHash args of-        Nothing -> pure ()-        Just declared ->-          let computed = "sha256-" <> fcNarHash fields-           in unless (declared == computed) $-                throwEvalError-                  ("builtins.fetchGit: NAR hash mismatch in '" <> url <> "', expected '" <> computed <> "' but got '" <> declared <> "'")-      pure (fetchGitResult submodules fields)---- | The fetch-everything refspec @allRefs@ selects, upstream's exact--- spelling: every remote ref lands under the same local name, so a--- pinned rev reachable from ANY ref becomes fetchable even when the--- remote refuses a direct SHA want.-allRefsFetchSpec :: Text-allRefsFetchSpec = "refs/*:refs/*"---- | The fetch itself, when nothing is remembered about it.  @checkedRef@--- and @checkedRev@ have already passed 'checkGitRef'\/'checkGitRev'.--- The scratch clone is removed on success once the tree is copied out,--- and by 'onEvalError' when any step throws: a failing fetch must not--- leave the clone behind.-fetchGitUncached :: (MonadEval m) => FetchGitArgs -> Maybe Text -> Maybe Text -> m FetchCache-fetchGitUncached args checkedRef checkedRev = do-  cloneDir <- createScratchDir "nova-nix-fetchgit-"-  fetchGitInClone args checkedRef checkedRev cloneDir-    `onEvalError` removeScratchDir cloneDir---- | Every step of an uncached fetch that can throw, run under--- 'fetchGitUncached''s scratch-dir cleanup.-fetchGitInClone :: (MonadEval m) => FetchGitArgs -> Maybe Text -> Maybe Text -> Text -> m FetchCache-fetchGitInClone args checkedRef checkedRev cloneDir = do-  let ctx = "builtins.fetchGit"-      git = gitRun ctx cloneDir-      url = fgaUrl args-      name = fgaName args-      submodules = fgaSubmodules args-      shallow = fgaShallow args-      depthArgs = if shallow then ["--depth", "1"] else []-      -- An allRefs fetch writes every remote ref, including the one the-      -- scratch clone's unborn HEAD names, which git refuses in a repo-      -- with a worktree (upstream fetches into a BARE cache repo and-      -- never hits this).  The refusal protects a checked-out branch-      -- from moving under the worktree; the explicit checkout below-      -- replaces the worktree state anyway, so allowing it is safe.-      updateHeadArgs = ["--update-head-ok" | fgaAllRefs args]-      -- Upstream's refspec ternary, in its order.  @allRefs@ fetches-      -- everything.  Otherwise a pinned rev is itself the refspec: a-      -- depth-1 fetch of a branch tip cannot contain any other revision,-      -- so asking the remote for the SHA is what lets @shallow@ and-      -- @rev@ compose (and what finds a rev not on the fetched ref).  A-      -- server may refuse a SHA it does not advertise; that surfaces as-      -- git's own fetch error, the same surface upstream has, and-      -- @allRefs = true@ is the caller's way around it.-      fetchTarget-        | fgaAllRefs args = allRefsFetchSpec-        | Just pinned <- checkedRev = pinned-        | otherwise = fromMaybe defaultFetchRef checkedRef-      -- The pinned rev when there is one; under an allRefs fetch with-      -- only a ref, that ref (FETCH_HEAD after a refs/* fetch is-      -- whichever ref arrived last, not the named one); otherwise-      -- whatever the fetch brought down.-      checkoutTarget = case (checkedRev, fgaAllRefs args, checkedRef) of-        (Just pinned, _, _) -> pinned-        (Nothing, True, Just ref) -> ref-        _ -> fetchHeadRef-  _ <- git ["init", "--quiet", "."]-  _ <- git ["remote", "add", "origin", "--", url]-  -- @--@ before the remote: git keeps parsing options after it, so-  -- without a separator a refspec is indistinguishable from a flag.-  _ <- git (["fetch", "--quiet"] ++ depthArgs ++ updateHeadArgs ++ ["--", "origin", fetchTarget])-  -- Trailing @--@, not leading: @git checkout -- X@ reads X as a-  -- pathspec, the opposite of what a leading separator means elsewhere.-  _ <- git ["checkout", "--quiet", checkoutTarget, "--"]-  when submodules $-    void (git ["submodule", "update", "--init", "--recursive"])-  markExecutablesFromIndex ctx cloneDir-  rev <- git ["rev-parse", "HEAD"]-  -- Truncated history cannot answer rev-list: the count would be the-  -- fetch depth, not the revision's depth, and @revCount@ can reach a-  -- derivation's environment.  Upstream reports 0 under @shallow@ (its-  -- fetcher skips computing the attribute and eval fills the default;-  -- observed from nix-instantiate 2.33.2), so 0 is recorded here and-  -- cache hits replay it.-  revCount <--    if shallow-      then pure 0-      else decodeDecimal ctx =<< git ["rev-list", "--count", "HEAD"]-  lastModifiedText <- git ["show", "-s", "--format=%ct", "HEAD"]-  removeGitMetadata ctx cloneDir-  storePath <- copyPathToStore cloneDir name Nothing-  narHash <- narHashOfPath cloneDir-  removeScratchDir cloneDir-  lastModified <- decodeDecimal ctx lastModifiedText-  let fields =-        FetchCache-          { fcStorePath = storePath,-            fcRev = rev,-            fcRevCount = revCount,-            fcLastModified = lastModified,-            fcNarHash = bytesToBase64 narHash-          }-  -- Remembered only for a pinned revision; see fetchGit.  @allRefs@ is-  -- deliberately not in the key: it changes only whether a fetch can-  -- succeed, never what a given revision's entry holds.-  case checkedRev of-    Nothing -> pure ()-    Just pinned -> writeFetchCache (fetchCacheKey url name pinned submodules shallow) (encodeFetchCache fields)-  pure fields---- | Mark every file git records as executable (mode 100755) in the--- checked-out tree.  A no-op on Unix; on Windows the mode has nowhere to--- live on disk, so it's read back from the index before @.git@ is stripped.-markExecutablesFromIndex :: (MonadEval m) => Text -> Text -> m ()-markExecutablesFromIndex ctx cloneDir = do-  listing <- gitRun ctx cloneDir ["ls-files", "--recurse-submodules", "--stage", "-z"]-  mapM_ markOne (T.split (== '\0') listing)-  where-    markOne row-      | Just rest <- T.stripPrefix "100755 " row,-        (_, tabbed) <- T.breakOn "\t" rest,-        Just relPath <- T.stripPrefix "\t" tabbed,-        not (T.null relPath) =-          setExecutableFile (cloneDir <> "/" <> relPath)-      | otherwise = pure ()---- | What @builtins.fetchGit@ hands back, from the few facts about a fetch--- that are worth keeping.  Shared by the fetch and by the cache, so the two--- cannot describe the same tree differently.-data FetchCache = FetchCache-  { fcStorePath :: !Text,-    fcRev :: !Text,-    fcRevCount :: !Integer,-    fcLastModified :: !Integer,-    fcNarHash :: !Text-  }-  deriving (Eq, Show)--fetchGitResult :: Bool -> FetchCache -> NixValue-fetchGitResult submodules fields =-  let lastModifiedDate =-        T.pack-          ( formatTime-              defaultTimeLocale-              "%Y%m%d%H%M%S"-              (posixSecondsToUTCTime (fromIntegral (fcLastModified fields)))-          )-   in VAttrs-        ( attrSetFromMap $-            Map.fromList-              [ ("outPath", evaluated (VPath (canonPathValue (fcStorePath fields)))),-                ("rev", evaluated (mkStr (fcRev fields))),-                ("shortRev", evaluated (mkStr (T.take 7 (fcRev fields)))),-                ("revCount", evaluated (VInt (fromIntegral (fcRevCount fields)))),-                ("submodules", evaluated (VBool submodules)),-                ("lastModified", evaluated (VInt (fromIntegral (fcLastModified fields)))),-                ("lastModifiedDate", evaluated (mkStr lastModifiedDate)),-                ("narHash", evaluated (mkStr ("sha256-" <> fcNarHash fields)))-              ]-        )---- | What a remembered fetch is filed under.  Everything that decides what--- comes back is in the key, so a hit cannot describe a different fetch: the--- URL, the store name, the revision, whether submodules were taken, and--- whether the clone was shallow.------ @shallow@ is in the key even though it cannot change the tree, because it--- decides @revCount@: a shallow fetch reports 0 where a full clone of the--- same rev counts the real depth.  Sharing an entry between the two would--- let whichever ran first decide what the other sees, and @revCount@ can--- reach a derivation's environment, so that is a reproducibility problem--- rather than a stale-data one.------ The leading version tag invalidates every entry written before a change--- in what the fields mean.  It last moved for the Windows executable bit,--- which changes the @narHash@ of any tree holding an executable file.-fetchCacheKey :: Text -> Text -> Text -> Bool -> Bool -> Text-fetchCacheKey url name rev submodules shallow =-  T.intercalate-    "\n"-    [ "fetchGit-2",-      url,-      name,-      rev,-      if submodules then "submodules" else "no-submodules",-      if shallow then "shallow" else "full"-    ]---- | One field per line, in a fixed order.  Anything that does not read back--- as exactly five lines is treated as no entry at all.-encodeFetchCache :: FetchCache -> Text-encodeFetchCache fields =-  T.intercalate-    "\n"-    [ fcStorePath fields,-      fcRev fields,-      T.pack (show (fcRevCount fields)),-      T.pack (show (fcLastModified fields)),-      fcNarHash fields-    ]--decodeFetchCache :: Text -> Maybe FetchCache-decodeFetchCache raw = case T.splitOn "\n" raw of-  [storePath, rev, revCount, lastModified, narHash] -> do-    count <- readDecimalMaybe revCount-    modified <- readDecimalMaybe lastModified-    -- Every field is checked, the last one included.  Truncation before-    -- the last field yields fewer than five and is rejected above, but a-    -- write cut inside narHash still yields five and would otherwise-    -- decode as valid with a short hash - and an entry is trusted for as-    -- long as its store path survives.-    validBase64Sha256 narHash-    pure-      FetchCache-        { fcStorePath = storePath,-          fcRev = rev,-          fcRevCount = count,-          fcLastModified = modified,-          fcNarHash = narHash-        }-  _ -> Nothing-  where-    readDecimalMaybe t = case TR.decimal t of-      Right (value, rest) | T.null rest -> Just value-      _ -> Nothing-    -- Base64 of 32 bytes: 44 characters, the last one the single pad.-    validBase64Sha256 t =-      if T.length t == 44 && T.all isBase64Char (T.init t) && T.last t == '='-        then Just ()-        else Nothing-    isBase64Char c = isAsciiUpper c || isAsciiLower c || isDigit c || c == '+' || c == '/'---- | Run one git subcommand under the same transport allowlist as the URL--- check.  Returns trimmed stdout; a nonzero exit throws with git's stderr.-gitRun :: (MonadEval m) => Text -> Text -> [Text] -> m Text-gitRun ctx cloneDir args = do-  (code, out, err) <- runProcess "git" (gitTransportConfig ++ ["-C", cloneDir] ++ args) ""-  if code == 0-    then pure (T.strip out)-    else throwEvalError (ctx <> ": git " <> T.unwords args <> " failed: " <> err)---- | Strip every @.git@ entry (clone's own, and each submodule's) before the--- tree is copied to the store.  Walked directly, not shelled out to--- @find@\/@rm@: no @sh@ on a bare Windows install.-removeGitMetadata :: (MonadEval m) => Text -> Text -> m ()-removeGitMetadata _ctx = go-  where-    go dir = do-      entries <- listDirectory dir-      forM_ entries $ \(name, fileType) ->-        let path = dir <> "/" <> name-         in if name == ".git"-              then removeScratchDir path-              else when (fileType == "directory") $ go path---- | Parse a decimal from trusted git stdout (@rev-list --count@, @show--- --format=%ct@); a failure means git itself misbehaved.-decodeDecimal :: (MonadEval m) => Text -> Text -> m Integer-decodeDecimal ctx t = case TR.decimal t of-  Right (n, rest) | T.null rest -> pure n-  _ -> throwEvalError (ctx <> ": expected a decimal integer from git, got " <> t)---- | Resolve the system temp directory.  Checks @TMPDIR@ (Unix), then--- @TEMP@ (Windows), falls back to @\/tmp@.-getTempDir :: (MonadEval m) => m Text-getTempDir = do-  candidates <- mapM getEnvVar ["TMPDIR", "TEMP"]-  pure (fromMaybe "/tmp" (find (not . T.null) candidates))---- | Fetch a URL and optionally verify its hash.-fetchUrlSimple :: (MonadEval m) => Text -> Maybe Text -> m NixValue-fetchUrlSimple url mSha256 = do-  -- The store name derives from the URL alone, so an unusable name fails-  -- here, before the download side effect.  Upstream rejects the same-  -- names when it adds the fetched file to the store.-  let name = urlBaseName url-  case checkStorePathName name of-    Left err -> throwEvalError ("builtins.fetchurl: " <> storePathNameErrorText err)-    Right () -> pure ()-  -- Download to a file, not through the text-mode stdout pipe (which mangles-  -- binary), read the raw bytes, verify the pin if one was given, then store at-  -- the canonical fixed-output path.-  tmpDir <- getTempDir-  let tmpFile = tmpDir <> "/nova-nix-fetchurl-" <> sha256Hex (TE.encodeUtf8 url)-  (code, _, stderr) <- runProcess "curl" ["-sSfL", "-o", tmpFile, "--", url] ""-  if code /= 0-    then throwEvalError ("builtins.fetchurl: fetch failed: " <> stderr)-    else do-      bytes <- readFileBytes tmpFile-      mapM_ (verifyFetchPin "builtins.fetchurl" url bytes) mSha256-      storePath <- addFixedOutputFile name bytes-      pure (VPath storePath)---- | Store name for a fetched URL: its basename (minus query/fragment), matching--- C++ Nix's @baseNameOf url@ default so the fixed-output path agrees with it.-urlBaseName :: Text -> Text-urlBaseName url =-  let stripped = T.takeWhile (\c -> c /= '?' && c /= '#') url-      base = T.takeWhileEnd (/= '/') stripped-   in if T.null base then "source" else base---- | Verify fetched bytes against a user-supplied sha256 pin, erroring on--- mismatch.  Accepts SRI, @sha256:@-prefixed, and bare digest forms.-verifyFetchPin :: (MonadEval m) => Text -> Text -> BS.ByteString -> Text -> m ()-verifyFetchPin ctx url bytes expectedStr = do-  expected <- decodeSha256Pin ctx expectedStr-  let got = sha256Digest bytes-  when (expected /= got) $-    throwEvalError-      ( ctx-          <> ": hash mismatch for "-          <> url-          <> "\n  expected: "-          <> expectedStr-          <> "\n  got:      sha256:"-          <> bytesToHexText got-      )---- | Decode a sha256 pin to raw bytes, reusing the convertHash decoders (SRI,--- @sha256:@-prefixed, or a bare hex/nix32/base64 digest).-decodeSha256Pin :: (MonadEval m) => Text -> Text -> m BS.ByteString-decodeSha256Pin ctx s-  | Just (algo, b64) <- parseSRI s = do-      requireSha256 algo-      decodeSRI ctx algo b64-  | Just (algo, rest) <- parseAlgoPrefix s = do-      requireSha256 algo-      snd <$> decodeWithAlgo algo rest-  | otherwise = snd <$> decodeWithAlgo "sha256" s-  where-    -- The pin names a sha256 digest specifically, so a spelling carrying-    -- its own algorithm tag must carry sha256 - a sha512 pin here is an-    -- error at decode time, as upstream's typed Hash parse.-    requireSha256 "sha256" = pure ()-    requireSha256 algo =-      throwEvalError (ctx <> ": hash '" <> s <> "' should have type 'sha256', not '" <> algo <> "'")---- | Force a required string attribute from an attrset, using full Nix string--- coercion (VStr, VPath, VInt, VBool, VAttrs via __toString/outPath).--- A coercion failure (or a throwing attr value) propagates with its own--- message, as upstream - swallowing it here once masked user throws.--- The Text result decodes strictly: callers use it as a name, URL, or--- platform string, none of which may carry invalid UTF-8 here.-forceAttrStr :: (MonadEval m) => Text -> Text -> AttrSet -> m Text-forceAttrStr builtin key attrs = do-  bytes <- forceAttrBytes builtin key attrs-  decodedText builtin bytes---- | Like 'forceAttrStr' but returns the coerced RAW BYTES - for--- derivation fields (builder) that flow byte-exact into the ATerm.-forceAttrBytes :: (MonadEval m) => Text -> Text -> AttrSet -> m BS.ByteString-forceAttrBytes builtin key attrs =-  case attrSetLookup key attrs of-    Nothing -> throwEvalError (builtin <> ": missing required attribute '" <> key <> "'")-    Just thunk -> do-      val <- force thunk-      (s, _ctx) <- coerceToString True force applyValue coercePathVerbatim val-      pure s---- | Force an optional string attribute via full Nix coercion.  A present--- but uncoercible (or throwing) value is an error, not 'Nothing'.-forceOptionalAttrStr :: (MonadEval m) => AttrSet -> Text -> m (Maybe Text)-forceOptionalAttrStr attrs key =-  case attrSetLookup key attrs of-    Nothing -> pure Nothing-    Just thunk -> do-      val <- force thunk-      (s, _ctx) <- coerceToString True force applyValue coercePathVerbatim val-      Just <$> decodedText "string attribute" s---- | Force an optional boolean attribute; present but non-boolean is an error,--- not a silent coercion.-forceOptionalAttrBool :: (MonadEval m) => Text -> AttrSet -> Text -> Bool -> m Bool-forceOptionalAttrBool builtin attrs key def =-  case attrSetLookup key attrs of-    Nothing -> pure def-    Just thunk -> do-      val <- force thunk-      case val of-        VBool b -> pure b-        other -> throwEvalError (builtin <> ": attribute '" <> key <> "' should be a bool, but is " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - derivation construction--- ------------------------------------------------------------------------------- | Resolve an input derivation's modulo hash (hex) for the ATerm substitution--- 'toATermForHash' performs.  The drv-hash cache is populated bottom-up as each--- derivation is evaluated, so an in-session input hits directly.  A miss - a--- cross-session reference, or a path fabricated by @builtins.appendContext@ ---- reads the input @.drv@ from the store and recurses, exactly as upstream--- @hashDerivationModulo@ does.  A miss whose @.drv@ cannot be read (pure--- evaluation, or a @.drv@ absent from the store) fails loudly: a divergent--- derivation hash is never emitted from a guessed input hash.  Reading the--- store is an effect, so hashing a dependent derivation is an IO-evaluator--- capability - pure evaluation, which cannot read the store, cannot do it.-resolveInputModulo :: (MonadEval m) => (StorePath, [Text]) -> m (Text, [Text])-resolveInputModulo (sp, outs) = do-  let inputPathText = storePathToText defaultStoreDir sp-  cached <- lookupDrvHash inputPathText-  case cached of-    Just hex -> pure (hex, outs)-    Nothing -> do-      mDrv <- readStoreDerivation sp-      case mDrv of-        Just inputDrv -> do-          hex <- derivationModuloHex inputDrv-          cacheDrvHash inputPathText hex-          pure (hex, outs)-        Nothing ->-          throwEvalError-            ( "derivation: cannot compute the input-derivation modulo hash for "-                <> inputPathText-                <> " - it was not evaluated in this session and its .drv is not "-                <> "readable from the store (dependent-derivation hashing needs the IO evaluator)"-            )---- | The derivation-modulo hash (hex) of a derivation, matching upstream--- @hashDerivationModulo@: a fixed-output derivation hashes the--- @fixed:out:\<algo\>:\<hash\>:\<path\>@ form; an input-addressed derivation--- substitutes each input's modulo hash into its ATerm and hashes that.  These--- are the same two rules 'builtinDerivationStrict' applies when it first--- computes a derivation's hash, so a store-read input yields the value it had--- in-session.-derivationModuloHex :: (MonadEval m) => Derivation -> m Text-derivationModuloHex drv = case drvOutputs drv of-  [DerivationOutput "out" outPath algoField hashHex]-    | not (T.null algoField) && not (T.null hashHex) ->-        let outPathText = storePathToText defaultStoreDir outPath-            fixedForm = "fixed:out:" <> algoField <> ":" <> hashHex <> ":" <> outPathText-         in pure (bytesToHexText (sha256Digest (TE.encodeUtf8 fixedForm)))-  _ -> do-    inputSubst <- mapM resolveInputModulo (Map.toList (drvInputDrvs drv))-    pure (bytesToHexText (sha256Digest (toATermForHash False (Just inputSubst) drv)))---- | The full output-name list of an all-outputs (upstream DrvDeep) reference:--- every output name of the referenced @.drv@, which upstream's derivationStrict--- inserts into the consuming derivation's inputDrvs.  Mirrors the--- 'resolveInputModulo' ladder - an in-session derivation from the recorded--- ATerm ('lookupSessionDrv'), else a cross-session @.drv@ read from the store--- ('readStoreDerivation'), else a loud error rather than a dropped reference--- (which would under-hash the dependent).  Pure evaluation can read neither--- source, so a dependent carrying an all-outputs reference errors there,--- consistent with dependent-derivation hashing being an IO-evaluator capability.-resolveAllOutputNames :: (MonadEval m) => StorePath -> m [Text]-resolveAllOutputNames sp = do-  let drvPathText = storePathToText defaultStoreDir sp-  session <- lookupSessionDrv drvPathText-  case session of-    Just drv -> pure (outputNamesOf drv)-    Nothing -> do-      onDisk <- readStoreDerivation sp-      case onDisk of-        Just drv -> pure (outputNamesOf drv)-        Nothing ->-          throwEvalError-            ( "derivation: cannot resolve the output names of the all-outputs reference "-                <> drvPathText-                <> " - it was not evaluated in this session and its .drv is not "-                <> "readable from the store (all-outputs references need the IO evaluator)"-            )-  where-    outputNamesOf = map doName . drvOutputs---- | Eager derivation computation - @builtins.derivationStrict@.  Forces all--- input attrs into env vars, content-hashes, and returns the full derivation--- attrset (drvPath, outPath, per-output, _derivation).  Called LAZILY by the--- @derivation@ wrapper ('builtinDerivationLazy'), so forcing a derivation to--- WHNF never forces this - matching C++ Nix's derivationStrict/derivation split.-builtinDerivationStrict :: (MonadEval m) => NixValue -> m NixValue-builtinDerivationStrict (VAttrs attrs) = do-  -- Extract required attributes.  The name and system are Text (they feed-  -- store-path and platform machinery); the builder stays raw bytes - it-  -- lands byte-exact in the ATerm's builder field.-  drvName <- forceAttrStr "derivation" "name" attrs-  -- The name becomes the store-path name of the .drv and of every output,-  -- so it must satisfy the store-path name rules.  The path constructors-  -- re-check what they build; this early check reports the offending-  -- FIELD rather than a composed path name.-  case checkStorePathName drvName of-    Left err ->-      throwEvalError-        ("derivation: invalid derivation name '" <> drvName <> "': " <> storePathNameReasonText (spneReason err))-    Right () -> pure ()-  system <- forceAttrStr ("derivation \"" <> drvName <> "\"") "system" attrs-  builder <- forceAttrBytes ("derivation \"" <> drvName <> "\"") "builder" attrs--  -- __ignoreNulls: when true, null-valued attrs are dropped from the-  -- derivation env (stdenv.mkDerivation sets it); when absent or false,-  -- null coerces to "" like any other coerceMore value - C++ Nix semantics.-  ignoreNulls <- case attrSetLookup "__ignoreNulls" attrs of-    Nothing -> pure False-    Just thunk -> do-      val <- force thunk-      case val of-        VBool b -> pure b-        other -> throwEvalError ("derivation: '__ignoreNulls' must be a boolean, got " <> typeName other)--  -- Extract optional outputs (default ["out"])-  outputNames <- case attrSetLookup "outputs" attrs of-    Nothing -> pure ["out"]-    Just thunk -> do-      val <- force thunk-      case val of-        VList cl -> mapM (forceToText . Thunk) (clistThunks cl)-        -- A null outputs attr is dropped by __ignoreNulls, falling back to-        -- the default output set; without it, null is an error as upstream.-        VNull | ignoreNulls -> pure ["out"]-        _ -> throwEvalError "derivation: 'outputs' must be a list of strings"--  -- Each output name composes into a store-path name (drvName-<output>)-  -- and names the on-disk location the builder later clears and moves-  -- onto, so it must satisfy the same store-path name rules (the-  -- composed length is re-checked at construction).-  forM_ outputNames $ \outName ->-    case checkStorePathName outName of-      Left err ->-        throwEvalError-          ( "derivation \""-              <> drvName-              <> "\": invalid derivation output name '"-              <> outName-              <> "': "-              <> storePathNameReasonText (spneReason err)-          )-      Right () -> pure ()--  -- Extract optional args (default []).  Path literals in args (e.g. stdenv's-  -- ./default-builder.sh) are copied into the store; their source paths flow-  -- into inputSrcs via the returned context.-  (builderArgs, argsContext) <- case attrSetLookup "args" attrs of-    Nothing -> pure ([], mempty)-    Just thunk -> do-      val <- force thunk-      case val of-        VList cl -> do-          parts <- mapM (\t -> force (Thunk t) >>= coerceToStoreString) (clistThunks cl)-          pure (map fst parts, mconcat (map snd parts))-        VNull | ignoreNulls -> pure ([], mempty)-        _ -> throwEvalError "derivation: 'args' must be a list of strings"--  -- Materialize once, reuse for both env collection and result merge-  let materialized = attrSetToMap attrs--  -- Collect string-coercible attrs into the build env, EXCLUDING "args"-  -- (C++ Nix puts args in the Derive() args field, never the env).  The-  -- per-output env vars ($out, ...) are added below.  Carries merged context.-  (drvEnvPairs, envContext) <- collectDrvEnvWithContext ignoreNulls (Map.delete "__ignoreNulls" (Map.delete "args" materialized))--  let fullContext = envContext <> argsContext-      builtInputDrvs = extractInputDrvs fullContext-      inputSrcs = extractInputSrcs fullContext-      allOutputRefs = extractAllOutputRefs fullContext-  -- All-outputs (DrvDeep) references - e.g. an embedded @dep.drvPath@ - add the-  -- referenced .drv to inputDrvs with ALL its output names, as upstream's-  -- derivationStrict does.  Merged in BEFORE drvRefs and the modulo-  -- substitution so both the dependent's own .drv hash and its output paths-  -- account for the reference.-  deepInputDrvs <--    Map.fromList <$> mapM (\drvSp -> (,) drvSp <$> resolveAllOutputNames drvSp) allOutputRefs-  let inputDrvs = Map.unionWith (++) builtInputDrvs deepInputDrvs-      platform = textToPlatform system-      baseEnv = Map.fromList drvEnvPairs-      drvRefs = inputSrcs ++ Map.keys inputDrvs-      drvFileName = drvName <> ".drv"-      -- Build a Derivation sharing this call's inputs/platform/builder/args.-      mkDrv outs env =-        Derivation-          { drvOutputs = outs,-            drvInputDrvs = inputDrvs,-            drvInputSrcs = inputSrcs,-            drvPlatform = platform,-            drvBuilder = builder,-            drvArgs = builderArgs,-            drvEnv = env-          }-      -- Output carrying only its name; the path is masked at render time.-      maskedOutput name = DerivationOutput name maskedOutputPath "" ""--  -- Fixed-output derivations (fetchurl etc.) are content-addressed and hash-  -- via the @fixed:out:@ scheme; input-addressed derivations recurse through-  -- the modulo hashes of their inputs.-  mFixed <- detectFixedOutput attrs--  -- Path construction returns Left on a name the store rules reject; the-  -- early field checks above make that unreachable here except through-  -- composition (drvName <> ".drv", drvName-output past the length cap),-  -- which only the constructors see.-  let drvContext = "derivation \"" <> drvName <> "\""-  (drvPathText, drvSP, outPaths, completeDrv) <- case mFixed of-    Just (foAlgo, foMode, foDigest) -> do-      foPath <- storePathOrThrow drvContext (makeFixedOutputPath drvName foAlgo foMode foDigest)-      let foPathText = storePathToText defaultStoreDir foPath-          algoField = (if foMode == "recursive" then "r:" else "") <> foAlgo-          foHashHex = bytesToHexText foDigest-          foModulo =-            sha256Digest-              (TE.encodeUtf8 ("fixed:out:" <> algoField <> ":" <> foHashHex <> ":" <> foPathText))-          contents =-            mkDrv-              [DerivationOutput "out" foPath algoField foHashHex]-              (Map.insert "out" (TE.encodeUtf8 foPathText) baseEnv)-      drvSp <- storePathOrThrow drvContext (makeTextPath drvFileName (sha256Digest (toATerm contents)) drvRefs)-      let drvText = storePathToText defaultStoreDir drvSp-      cacheDrvHash drvText (bytesToHexText foModulo)-      pure (drvText, drvSp, [("out", foPathText)], contents)-    Nothing -> do-      inputSubst <- mapM resolveInputModulo (Map.toList inputDrvs)-      let maskedEnv = foldr (`Map.insert` "") baseEnv outputNames-          maskedDrv = mkDrv (map maskedOutput outputNames) maskedEnv-          -- Masked modulo hash yields this derivation's own output paths.-          moduloMasked = sha256Digest (toATermForHash True (Just inputSubst) maskedDrv)-      outStorePaths <--        mapM-          (\n -> (,) n <$> storePathOrThrow drvContext (makeOutputPath n moduloMasked drvName))-          outputNames-      let outPathTexts = [(n, storePathToText defaultStoreDir sp) | (n, sp) <- outStorePaths]-          realEnv = foldr (\(n, t) e -> Map.insert n (TE.encodeUtf8 t) e) baseEnv outPathTexts-          contents = mkDrv [DerivationOutput n sp "" "" | (n, sp) <- outStorePaths] realEnv-          -- Unmasked modulo hash (real outputs, inputs substituted) cached for-          -- when this derivation is itself an input to another.-          moduloUnmasked = sha256Digest (toATermForHash False (Just inputSubst) contents)-      drvSp <- storePathOrThrow drvContext (makeTextPath drvFileName (sha256Digest (toATerm contents)) drvRefs)-      let drvText = storePathToText defaultStoreDir drvSp-      cacheDrvHash drvText (bytesToHexText moduloUnmasked)-      pure (drvText, drvSp, outPathTexts, contents)--  -- Record this derivation's full .drv ATerm (the exact bytes whose hash is its-  -- store path) so the build driver can materialize the entire input-.drv-  -- closure before building.  Bottom-up eval guarantees every transitive input-  -- is recorded by the time a dependent is.-  recordDrvAterm drvPathText (toATerm completeDrv)--  let mainOutPath = case outPaths of-        ((_, p) : _) -> p-        [] -> ""-      -- The default output is the FIRST in @outputs@ (matching C++ Nix, which-      -- returns @(head outputsList).value@) - not necessarily @out@.-      mainOutName = case outPaths of-        ((n, _) : _) -> n-        [] -> "out"--  -- Context for output paths: each output carries SCDrvOutput context-  -- Context for drvPath: carries SCAllOutputs context-  let drvPathCtx = StringContext (Set.singleton (SCAllOutputs drvSP))-      outPathCtx outName = StringContext (Set.singleton (SCDrvOutput drvSP outName))--  -- Build per-output attrsets matching Nix: drv.out = { outPath, drvPath, type }-  let mkOutputAttrs outName outP =-        let outCtx = outPathCtx outName-            outputAttrMap =-              Map.fromList-                [ ("outPath", evaluated (VStr (TE.encodeUtf8 outP) outCtx)),-                  ("drvPath", evaluated (VStr (TE.encodeUtf8 drvPathText) drvPathCtx)),-                  ("type", evaluated (mkStr "derivation"))-                ]-         in evaluated (VAttrs (attrSetFromMap outputAttrMap))--  -- Build result attrset: original attrs + drvPath, outPath, type, per-output attrs-  let baseAttrs =-        Map.fromList $-          [ ("type", evaluated (mkStr "derivation")),-            ("drvPath", evaluated (VStr (TE.encodeUtf8 drvPathText) drvPathCtx)),-            ("outPath", evaluated (VStr (TE.encodeUtf8 mainOutPath) (outPathCtx mainOutName))),-            ("name", evaluated (mkStr drvName)),-            ("system", evaluated (mkStr system)),-            ("builder", evaluated (mkStrBytes builder)),-            ("_derivation", evaluated (VDerivation completeDrv))-          ]-            ++ [(outName, mkOutputAttrs outName outP) | (outName, outP) <- outPaths]-      -- Merge original attrs underneath so computed attrs take priority-      resultAttrs = Map.union baseAttrs materialized--  pure (VAttrs (attrSetFromMap resultAttrs))-builtinDerivationStrict other =-  throwEvalError ("derivation: expected a set, got " <> typeName other)---- | Detect a fixed-output derivation.  Returns @Just (algo, mode, rawDigest)@--- when @outputHash@ is present and non-empty (fetchurl, fetchgit, ...), else--- 'Nothing' for an ordinary input-addressed derivation.  @mode@ is--- @\"flat\"@ or @\"recursive\"@; @algo@ is e.g. @\"sha256\"@.-detectFixedOutput :: (MonadEval m) => AttrSet -> m (Maybe (Text, Text, BS.ByteString))-detectFixedOutput attrs =-  case attrSetLookup "outputHash" attrs of-    Nothing -> pure Nothing-    Just thunk -> do-      val <- force thunk-      case val of-        VStr rawHash _-          | not (BS.null rawHash) -> do-              ohash <- decodedText "derivation: outputHash" rawHash-              ohAlgo <- optDrvStrAttr "outputHashAlgo" attrs-              ohMode <- optDrvStrAttr "outputHashMode" attrs-              (algo, digest) <- normalizeFixedHash ohash ohAlgo-              let mode = if ohMode == "recursive" then "recursive" else "flat"-              pure (Just (algo, mode, digest))-        _ -> pure Nothing---- | Read an optional string attribute, defaulting to @\"\"@ when absent or--- not a string.-optDrvStrAttr :: (MonadEval m) => Text -> AttrSet -> m Text-optDrvStrAttr key attrs =-  case attrSetLookup key attrs of-    Nothing -> pure ""-    Just thunk -> do-      val <- force thunk-      case val of-        VStr s _ -> decodedText ("derivation: " <> key) s-        _ -> pure ""---- | Decode a fixed-output hash (SRI @algo-base64@, @algo:hash@, or a bare--- hash plus a separate algorithm) to its algorithm name and raw bytes.--- A non-empty @outputHashAlgo@ must name a known algorithm and agree with--- the algorithm an SRI or prefixed spelling carries: the enforced--- algorithm must be the declared one, never a silent substitute.-normalizeFixedHash :: (MonadEval m) => Text -> Text -> m (Text, BS.ByteString)-normalizeFixedHash ohash ohAlgo-  | Just (algo, b64) <- parseSRI ohash = do-      requireDeclaredAlgo algo-      bytes <- decodeSRI "derivation" algo b64-      pure (algo, bytes)-  | Just (algo, rest) <- parseAlgoPrefix ohash = do-      requireDeclaredAlgo algo-      decodeWithAlgo algo rest-  | not (T.null ohAlgo) = decodeWithAlgo ohAlgo ohash-  | otherwise =-      throwEvalError ("derivation: cannot determine outputHash algorithm for " <> ohash)-  where-    -- 'decodeSha256Pin's requireSha256 with the expected type supplied by-    -- @outputHashAlgo@ instead of fixed at sha256 (upstream's typed Hash-    -- parse, hash.cc parseAny with an expected type).  An unknown declared-    -- algorithm is an error even when the spelling carries its own tag.-    requireDeclaredAlgo embedded-      | T.null ohAlgo = pure ()-      | Nothing <- hashAlgoBytes ohAlgo =-          throwEvalError ("unknown hash algorithm '" <> ohAlgo <> "'")-      | embedded == ohAlgo = pure ()-      | otherwise =-          throwEvalError-            ("derivation: hash '" <> ohash <> "' should have type '" <> ohAlgo <> "', not '" <> embedded <> "'")---- | Lazy @derivation@ wrapper, mirroring upstream's--- @src/libexpr/primops/derivation.nix@.--- Returns a WHNF attrset whose @drvPath@/@outPath@/output-path/@_derivation@--- attrs are LAZY thunks that defer to 'builtinDerivationStrict'.  Forcing a--- derivation to WHNF therefore does NOT force its input/env closure - which is--- essential for nixpkgs, where merely referencing a derivation (e.g.--- @drv != null@, @assert (libxcrypt != null)@) must not build its whole closure.------ The lazy thunks are built with the same synthetic-select pattern used by--- @inherit (from)@: a single shared @strict@ thunk (so the eager computation--- runs at most once) selected from via fresh minimal envs.-builtinDerivationLazy :: (MonadEval m) => NixValue -> m NixValue-builtinDerivationLazy (VAttrs attrs) = do-  -- Output names are cheap (matches @drvAttrs @ { outputs ? [ "out" ], ... }@).-  outputNames <- case attrSetLookup "outputs" attrs of-    Nothing -> pure ["out"]-    Just thunk -> do-      val <- force thunk-      case val of-        VList cl -> mapM (forceToText . Thunk) (clistThunks cl)-        _ -> throwEvalError "derivation: 'outputs' must be a list of strings"-  -- One shared thunk computing @derivationStrict attrs@, forced only when an-  -- output path / drvPath is actually read.-  let drvAttrsThunk = evaluated (VAttrs attrs)-      strictBuiltinThunk = evaluated (VBuiltin "derivationStrict" [])-      strictThunk =-        let (sp, sc) = buildCSlots [drvAttrsThunk, strictBuiltinThunk]-            envDS = newMinimalEnv sp sc-         in mkSyntheticThunk envDS (EApp (EResolvedVar 0 1) (EResolvedVar 0 0))-      selectStrict field =-        let (sp, sc) = buildCSlots [strictThunk]-            envF = newMinimalEnv sp sc-         in mkSyntheticThunk envF (ESelect (EResolvedVar 0 0) [StaticKey field] Nothing)-  -- WHNF spine: input attrs (unforced) overlaid with the lazy computed attrs.-  let computedAttrs =-        Map.fromList $-          [ ("type", evaluated (mkStr "derivation")),-            ("drvPath", selectStrict "drvPath"),-            ("outPath", selectStrict "outPath"),-            ("_derivation", selectStrict "_derivation")-          ]-            ++ [(outName, selectStrict outName) | outName <- outputNames]-      resultAttrs = Map.union computedAttrs (attrSetToMap attrs)-  pure (VAttrs (attrSetFromMap resultAttrs))-builtinDerivationLazy other =-  throwEvalError ("derivation: expected a set, got " <> typeName other)---- | Force a thunk to a Text string via full Nix coercion (strict decode:--- used for output names, which are ASCII-shaped identity components).-forceToText :: (MonadEval m) => Thunk -> m Text-forceToText thunk = do-  val <- force thunk-  (s, _ctx) <- coerceToString True force applyValue coercePathVerbatim val-  decodedText "derivation" s---- | Collect all derivation attributes into env pairs via full Nix coercion--- (__toString, outPath, list-to-space-separated-string), along with the--- merged string context from all collected values.  Values are RAW BYTES:--- they flow byte-exact into the ATerm env section (and its hash).------ A coercion failure (a thrown attr value, an uncoercible function, a failed--- import inside the value) fails the WHOLE derivation, as in C++ Nix.--- Swallowing it silently produces a wrong .drv - this exact bug once turned--- a seed derivation with 17 failed src attrs into an empty no-input drv that--- "built" successfully.  Null attrs are dropped only under __ignoreNulls;--- otherwise null coerces to @""@ like any other coerceMore value.-collectDrvEnvWithContext :: (MonadEval m) => Bool -> Map Text Thunk -> m ([(Text, BS.ByteString)], StringContext)-collectDrvEnvWithContext ignoreNulls attrs = do-  let pairs = Map.toList attrs-  results <- mapM coerceEnvAttr pairs-  let envPairs = catMaybes [fmap (\(k, v, _) -> (k, v)) r | r <- results]-      mergedCtx = mconcat [ctx | Just (_, _, ctx) <- results]-  pure (envPairs, mergedCtx)-  where-    coerceEnvAttr (key, thunk) = do-      val <- force thunk-      case val of-        VNull | ignoreNulls -> pure Nothing-        _ -> do-          (s, ctx) <- coerceToStoreString val-          pure (Just (key, s, ctx))---- ------------------------------------------------------------------------------ Builtin implementations - hashFile, readFileType--- ------------------------------------------------------------------------------- | @builtins.hashFile algo path@ - hash raw bytes of a file on disk.--- Returns base-16 hex string, matching @builtins.hashString@ output format.-builtinHashFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinHashFile (VStr algo _) (VPath path) = do-  algoName <- decodedText "builtins.hashFile" algo-  bytes <- readFileBytes path-  hashBytesWithAlgo "hashFile" algoName bytes-builtinHashFile (VStr algo _) (VStr path _) = do-  algoName <- decodedText "builtins.hashFile" algo-  filePath <- decodedText "builtins.hashFile" path-  bytes <- readFileBytes filePath-  hashBytesWithAlgo "hashFile" algoName bytes-builtinHashFile (VStr _ _) other =-  throwEvalError ("builtins.hashFile: expected a path, got " <> typeName other)-builtinHashFile other _ =-  throwEvalError ("builtins.hashFile: expected a string, got " <> typeName other)---- | Shared hash dispatch for raw 'ByteString' input.-hashBytesWithAlgo :: (MonadEval m) => Text -> Text -> BS.ByteString -> m NixValue-hashBytesWithAlgo ctx algo bytes = case algo of-  "sha256" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA256)))-  "sha512" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA512)))-  "sha1" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA1)))-  "md5" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.MD5)))-  _ -> throwEvalError ("builtins." <> ctx <> ": unknown hash algorithm '" <> algo <> "'")---- | @builtins.readFileType path@ - classify a filesystem entry.--- Returns @"regular"@, @"directory"@, @"symlink"@, or @"unknown"@.-builtinReadFileType :: (MonadEval m) => NixValue -> m NixValue-builtinReadFileType (VPath path) = mkStr <$> getFileType path-builtinReadFileType (VStr path _) = do-  filePath <- decodedText "builtins.readFileType" path-  mkStr <$> getFileType filePath-builtinReadFileType other =-  throwEvalError ("builtins.readFileType: expected a path, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - convertHash--- ------------------------------------------------------------------------------- | @builtins.convertHash { hash, hashAlgo?, toHashFormat }@ - convert--- between hash representations.  Supports base16, nix32, base64, and sri.-builtinConvertHash :: (MonadEval m) => NixValue -> m NixValue-builtinConvertHash (VAttrs attrs) = do-  hashVal <- requireStrAttr "convertHash" "hash" attrs-  toFmt <- requireStrAttr "convertHash" "toHashFormat" attrs-  -- Detect input format and decode to raw bytes + algo-  (algo, rawBytes) <- decodeHashInput attrs hashVal-  -- Encode to target format-  case toFmt of-    "base16" -> pure (mkStr (bytesToHexText rawBytes))-    "nix32" -> pure (mkStr (Nix32.encode rawBytes))-    "base32" -> pure (mkStr (Nix32.encode rawBytes)) -- deprecated alias-    "base64" -> pure (mkStr (bytesToBase64 rawBytes))-    "sri" -> pure (mkStr (algo <> "-" <> bytesToBase64 rawBytes))-    _ -> throwEvalError ("builtins.convertHash: unknown toHashFormat '" <> toFmt <> "'")-builtinConvertHash other =-  throwEvalError ("builtins.convertHash: expected a set, got " <> typeName other)---- | Extract algo + raw bytes from the hash input, handling SRI, prefixed, and plain formats.-decodeHashInput :: (MonadEval m) => AttrSet -> Text -> m (Text, BS.ByteString)-decodeHashInput attrs hashStr-  -- SRI format: algo-base64-  | Just (algo, b64) <- parseSRI hashStr = do-      bytes <- decodeSRI "convertHash" algo b64-      pure (algo, bytes)-  -- Prefixed format: algo:hex or algo:nix32-  | Just (algo, rest) <- parseAlgoPrefix hashStr =-      decodeWithAlgo algo rest-  -- Plain hash - need hashAlgo attribute-  | otherwise = do-      algo <- requireStrAttr "convertHash" "hashAlgo" attrs-      decodeWithAlgo algo hashStr---- | Decode a bare hash string for a known algorithm, keyed by length as--- upstream (@hash.cc@ @Hash@ parsing): an algorithm's base16, nix32, and--- base64 spellings have pairwise distinct lengths, so the input length--- selects the decoder and every other length is an error.  Trying decoders--- in sequence instead mis-reads edge inputs - an all-hex-digit string of--- nix32 length is a nix32 hash, and a truncated hash must be rejected, not--- decoded by whichever shorter format happens to accept it.-decodeWithAlgo :: (MonadEval m) => Text -> Text -> m (Text, BS.ByteString)-decodeWithAlgo algo s = case hashAlgoBytes algo of-  Nothing -> throwEvalError ("unknown hash algorithm '" <> algo <> "'")-  Just size-    | T.length s == hexHashLen size -> accept size "base16" (hexToBytes s)-    | T.length s == nix32HashLen size -> accept size "nix32" (rightToMaybe (Nix32.decode s))-    | T.length s == base64HashLen size -> accept size "base64" (rightToMaybe (decodeBase64Pure s))-    | otherwise ->-        throwEvalError ("hash '" <> s <> "' has wrong length for hash algorithm '" <> algo <> "'")-  where-    accept size spelling decoded = case decoded of-      Just bytes | BS.length bytes == size -> pure (algo, bytes)-      _ -> throwEvalError ("hash '" <> s <> "' is not a valid " <> spelling <> " " <> algo <> " hash")-    rightToMaybe = either (const Nothing) Just---- | Decode an SRI digest (@algo-base64@) with the decoded-length check--- every spelling gets upstream (hash.cc checks SRI too): well-formed--- base64 of the wrong byte count is an invalid hash at eval time, not a--- short digest that defers failure to fetch or build time.  Shared by--- convertHash, the fetch pins, and fixed-output outputHash.-decodeSRI :: (MonadEval m) => Text -> Text -> Text -> m BS.ByteString-decodeSRI ctx algo b64 = case hashAlgoBytes algo of-  -- Unreachable via parseSRI (it admits only known algorithm tags), but-  -- this helper must not silently skip the check for an unknown one.-  Nothing -> throwEvalError ("unknown hash algorithm '" <> algo <> "'")-  Just size -> do-    bytes <- decodeBase64E ctx b64-    when (BS.length bytes /= size) $-      throwEvalError-        ("hash '" <> algo <> "-" <> b64 <> "' has wrong length for hash algorithm '" <> algo <> "'")-    pure bytes---- | Parse @sha256-base64...@ SRI format.-parseSRI :: Text -> Maybe (Text, Text)-parseSRI t = case T.breakOn "-" t of-  (algo, rest)-    | not (T.null rest) && algo `elem` ["sha256", "sha512", "sha1", "md5"] ->-        Just (algo, T.drop 1 rest)-  _ -> Nothing---- | Parse @sha256:value@ prefixed format.-parseAlgoPrefix :: Text -> Maybe (Text, Text)-parseAlgoPrefix t = case T.breakOn ":" t of-  (algo, rest)-    | not (T.null rest) && algo `elem` ["sha256", "sha512", "sha1", "md5"] ->-        Just (algo, T.drop 1 rest)-  _ -> Nothing---- | Require a string attribute from an attrset.-requireStrAttr :: (MonadEval m) => Text -> Text -> AttrSet -> m Text-requireStrAttr ctx key attrs = case attrSetLookup key attrs of-  Just thunk -> do-    val <- force thunk-    case val of-      VStr s _ -> decodedText ("builtins." <> ctx) s-      _ -> throwEvalError ("builtins." <> ctx <> ": " <> key <> " must be a string")-  Nothing -> throwEvalError ("builtins." <> ctx <> ": missing required attribute '" <> key <> "'")---- ------------------------------------------------------------------------------ Base64 encode/decode - delegates to nova-cache (base64-bytestring under the hood)--- ------------------------------------------------------------------------------- | Encode bytes to base64.-bytesToBase64 :: BS.ByteString -> Text-bytesToBase64 = B64.encode---- | Decode base64 text to bytes (pure).-decodeBase64Pure :: Text -> Either Text BS.ByteString-decodeBase64Pure t =-  -- Strip whitespace and any existing padding, then re-pad to a multiple of-  -- 4.  base64-bytestring's 'decode' requires correct padding, so SRI hashes-  -- (correctly-padded standard base64, e.g. @sha256-...NQ=@) would otherwise be-  -- rejected once their trailing @=@ was removed.-  let stripped = T.filter (\c -> c /= '\n' && c /= '\r' && c /= '=') t-      padLen = (4 - (T.length stripped `mod` 4)) `mod` 4-      padded = stripped <> T.replicate padLen "="-   in case B64.decode padded of-        Right bytes -> Right bytes-        Left _ -> Left "invalid base64"---- | Decode base64 with error context for builtins.-decodeBase64E :: (MonadEval m) => Text -> Text -> m BS.ByteString-decodeBase64E ctx t = case decodeBase64Pure t of-  Right bytes -> pure bytes-  Left _ -> throwEvalError ("builtins." <> ctx <> ": invalid base64 encoding")---- ------------------------------------------------------------------------------ Builtin implementations - fromTOML--- ------------------------------------------------------------------------------- | @builtins.fromTOML str@ - parse a TOML document to a Nix value.--- Hand-rolled parser covering the TOML v1.0 subset used by nixpkgs:--- bare/quoted keys, dotted keys, basic/literal strings (multiline),--- integers (dec/hex/oct/bin), floats (inc. inf/nan), booleans,--- inline tables, arrays, array-of-tables, and standard tables.--- Datetimes are represented as strings (matching real Nix).-builtinFromTOML :: (MonadEval m) => NixValue -> m NixValue-builtinFromTOML (VStr s _) = do-  -- TOML is UTF-8 by definition; upstream's parser rejects invalid bytes.-  decoded <- decodedText "builtins.fromTOML" s-  case parseTOML decoded of-    Right val -> pure val-    Left err -> throwEvalError ("builtins.fromTOML: " <> err)-builtinFromTOML other =-  throwEvalError ("builtins.fromTOML: expected a string, got " <> typeName other)---- | Intermediate TOML value before conversion to NixValue.-data TOMLValue-  = TOMLStr !Text-  | TOMLInt !Int64-  | TOMLFloat !Double-  | TOMLBool !Bool-  | TOMLArray ![TOMLValue]-  | TOMLTable !(Map Text TOMLValue)-  deriving (Show)---- | Parse a TOML document into a NixValue.-parseTOML :: Text -> Either Text NixValue-parseTOML input = do-  table <- parseTOMLDoc (T.lines input)-  pure (tomlToNix (TOMLTable table))---- | Convert a TOMLValue to NixValue.-tomlToNix :: TOMLValue -> NixValue-tomlToNix val = case val of-  TOMLStr s -> mkStr s-  TOMLInt n -> VInt n-  TOMLFloat d -> VFloat d-  TOMLBool b -> VBool b-  TOMLArray xs -> VList (clistFromThunks (map (thunkToCPtr . evaluated . tomlToNix) xs))-  TOMLTable m -> VAttrs (attrSetFromMap (Map.map (evaluated . tomlToNix) m))---- | Parse all lines of a TOML document into a table.-parseTOMLDoc :: [Text] -> Either Text (Map Text TOMLValue)-parseTOMLDoc lns = go lns [] Map.empty-  where-    go [] _ root = Right root-    go (line : rest) currentPath root-      | T.null stripped || T.isPrefixOf "#" stripped =-          -- Empty line or comment-          go rest currentPath root-      | T.isPrefixOf "[[" stripped && T.isSuffixOf "]]" stripped =-          -- Array of tables: [[key]]-          let keyStr = T.strip (T.drop 2 (T.dropEnd 2 stripped))-              keys = parseDottedKey keyStr-           in go rest keys (insertArrayTable keys root)-      | T.isPrefixOf "[" stripped && T.isSuffixOf "]" stripped =-          -- Standard table: [key]-          let keyStr = T.strip (T.drop 1 (T.dropEnd 1 stripped))-              keys = parseDottedKey keyStr-           in go rest keys (ensureTable keys root)-      | otherwise =-          -- Key = value pair.  The value may span physical lines (arrays-          -- and multi-line strings - the Cargo.lock shapes), so join-          -- until brackets and multi-line string delimiters balance.-          let (logical, remaining) = joinLogicalLine stripped rest-           in case parseKVLine logical of-                Right (keys, val) ->-                  go remaining currentPath (insertNested (currentPath ++ keys) val root)-                Left err -> Left err-      where-        stripped = T.strip line---- | Which TOML string form a scan position is inside.-data TomlStringState = TSNone | TSBasic | TSLiteral | TSMultiBasic | TSMultiLiteral-  deriving (Eq)---- | Scanner state for joining physical lines into one logical--- key = value line: array-bracket depth outside strings, plus the--- string form currently open.-data TomlScan = TomlScan-  { tsBracketDepth :: !Int,-    tsString :: !TomlStringState-  }--emptyTomlScan :: TomlScan-emptyTomlScan = TomlScan 0 TSNone---- | Whether a logical value is still open at end of line: inside a--- multi-line string, or under an unclosed array bracket.  A single-line--- string left open is NOT continuable (TOML basic\/literal strings--- cannot span lines) - the value parser reports that case.-tomlNeedsMoreLines :: TomlScan -> Bool-tomlNeedsMoreLines st =-  tsBracketDepth st > 0-    || tsString st == TSMultiBasic-    || tsString st == TSMultiLiteral---- | Scan one physical line, returning the state at end of line and the--- line's visible text: a comment outside strings is cut here, where the--- string context is still known ('#' inside any string form is content).-scanTomlLine :: TomlScan -> Text -> (TomlScan, Text)-scanTomlLine st0 line = go st0 line 0-  where-    go st t !seen = case T.uncons t of-      Nothing -> (st, line)-      Just (c, rest) ->-        let one newSt = go newSt rest (seen + 1)-            jump n newSt = go newSt (T.drop (n - 1) rest) (seen + n)-         in case tsString st of-              TSBasic-                | c == '\\' -> jump 2 st-                | c == '"' -> one st {tsString = TSNone}-                | otherwise -> one st-              TSLiteral-                | c == '\'' -> one st {tsString = TSNone}-                | otherwise -> one st-              TSMultiBasic-                | c == '\\' -> jump 2 st-                | c == '"', Just _ <- T.stripPrefix "\"\"" rest -> jump 3 st {tsString = TSNone}-                | otherwise -> one st-              TSMultiLiteral-                | c == '\'', Just _ <- T.stripPrefix "''" rest -> jump 3 st {tsString = TSNone}-                | otherwise -> one st-              TSNone-                | c == '#' -> (st, T.take seen line)-                | c == '"', Just _ <- T.stripPrefix "\"\"" rest -> jump 3 st {tsString = TSMultiBasic}-                | c == '"' -> one st {tsString = TSBasic}-                | c == '\'', Just _ <- T.stripPrefix "''" rest -> jump 3 st {tsString = TSMultiLiteral}-                | c == '\'' -> one st {tsString = TSLiteral}-                | c == '[' -> one st {tsBracketDepth = tsBracketDepth st + 1}-                | c == ']' -> one st {tsBracketDepth = max 0 (tsBracketDepth st - 1)}-                | otherwise -> one st---- | Join physical lines into one logical key = value line, returning it--- with the unconsumed lines.  An unterminated construct at end of input--- hands what accumulated to the value parser, which reports the specific--- failure.-joinLogicalLine :: Text -> [Text] -> (Text, [Text])-joinLogicalLine firstLine rest0 =-  let (st0, visible0) = scanTomlLine emptyTomlScan firstLine-   in go st0 [visible0] rest0-  where-    -- Reversed line chunks, joined once - O(n) in the logical line's-    -- length instead of the O(n^2) of appending per physical line.-    go st !chunks remaining-      | not (tomlNeedsMoreLines st) = (T.intercalate "\n" (reverse chunks), remaining)-      | otherwise = case remaining of-          [] -> (T.intercalate "\n" (reverse chunks), [])-          (next : more) ->-            let (advanced, visible) = scanTomlLine st next-             in go advanced (visible : chunks) more---- | Parse a key = value line.-parseKVLine :: Text -> Either Text ([Text], TOMLValue)-parseKVLine line =-  let (keyPart, afterEq) = splitAtEquals line-   in case T.uncons afterEq of-        Nothing -> Left ("expected '=' in: " <> line)-        Just _ -> do-          let val = T.strip afterEq-          parsed <- parseTOMLValue val-          Right (parseDottedKey (T.strip keyPart), parsed)---- | Split a line at the first unquoted '=' sign.--- O(n) via bulk spans into a chunk list instead of O(n^2) T.snoc.-splitAtEquals :: Text -> (Text, Text)-splitAtEquals = go []-  where-    keyPart chunks = T.concat (reverse chunks)-    go !chunks t = case T.uncons t of-      Nothing -> (keyPart chunks, T.empty)-      Just ('=', rest) -> (keyPart chunks, rest)-      Just ('"', rest) ->-        let (quoted, after) = T.break (== '"') rest-         in case T.uncons after of-              Just ('"', r) -> go ("\"" : quoted : "\"" : chunks) r-              _ -> go (quoted : "\"" : chunks) after-      Just ('\'', rest) ->-        let (quoted, after) = T.break (== '\'') rest-         in case T.uncons after of-              Just ('\'', r) -> go ("'" : quoted : "'" : chunks) r-              _ -> go (quoted : "'" : chunks) after-      Just (_, _) ->-        let (plain, after) = T.break (\c -> c == '=' || c == '"' || c == '\'') t-         in go (plain : chunks) after---- | Parse dotted key like @foo.bar."baz qux"@ into @["foo", "bar", "baz qux"]@.-parseDottedKey :: Text -> [Text]-parseDottedKey t-  | T.null t = []-  | otherwise = case T.uncons t of-      Just ('"', rest) ->-        let (key, after) = T.break (== '"') rest-         in key : parseDottedKey (T.drop 1 (T.stripStart (dropDot after)))-      Just ('\'', rest) ->-        let (key, after) = T.break (== '\'') rest-         in key : parseDottedKey (T.drop 1 (T.stripStart (dropDot after)))-      _ ->-        let (key, after) = T.break (\c -> c == '.' || c == '"') t-         in T.strip key : case T.uncons after of-              Nothing -> []-              Just _ -> parseDottedKey (T.drop 1 (T.stripStart after))-  where-    dropDot txt = case T.uncons txt of-      Just ('.', rest) -> rest-      _ -> txt---- | Parse a TOML value (right side of '=').-parseTOMLValue :: Text -> Either Text TOMLValue-parseTOMLValue t =-  let stripped = T.strip t-      -- Strip inline comments (not inside strings)-      cleaned = stripInlineComment stripped-   in case T.uncons cleaned of-        Nothing -> Left "empty value"-        Just ('"', _)-          | T.isPrefixOf "\"\"\"" cleaned -> parseMultilineBasicStr (T.drop 3 cleaned)-          | otherwise -> parseBasicStr (T.drop 1 cleaned)-        Just ('\'', _)-          | T.isPrefixOf "'''" cleaned -> parseMultilineLiteralStr (T.drop 3 cleaned)-          | otherwise -> parseLiteralStr (T.drop 1 cleaned)-        Just ('{', _) -> parseInlineTable cleaned-        Just ('[', _) -> parseInlineArray cleaned-        Just ('t', _)-          | T.isPrefixOf "true" cleaned -> Right (TOMLBool True)-        Just ('f', _)-          | T.isPrefixOf "false" cleaned -> Right (TOMLBool False)-        Just ('i', _)-          | T.isPrefixOf "inf" cleaned -> Right (TOMLFloat (1 / 0))-        Just ('+', rest)-          | T.isPrefixOf "inf" rest -> Right (TOMLFloat (1 / 0))-          | T.isPrefixOf "nan" rest -> Right (TOMLFloat (0 / 0))-        Just ('-', rest)-          | T.isPrefixOf "inf" rest -> Right (TOMLFloat (negate (1 / 0)))-          | T.isPrefixOf "nan" rest -> Right (TOMLFloat (0 / 0))-        Just ('n', _)-          | T.isPrefixOf "nan" cleaned -> Right (TOMLFloat (0 / 0))-        _ -> parseTOMLNumberOrDatetime cleaned---- | Strip inline comment from a value (not inside quotes).--- O(n) via bulk spans into a chunk list instead of O(n^2)--- per-character T.cons (each cons copies the whole tail).-stripInlineComment :: Text -> Text-stripInlineComment = go (0 :: Int) []-  where-    finish chunks = T.concat (reverse chunks)-    go depth !chunks t = case T.uncons t of-      Nothing -> finish chunks-      Just ('#', _) | depth == 0 -> finish chunks-      Just ('"', rest)-        | depth == 0 ->-            let (str, after) = T.break (== '"') rest-             in go depth (T.take 1 after : str : "\"" : chunks) (T.drop 1 after)-      Just ('[', rest) -> go (depth + 1) ("[" : chunks) rest-      Just ('{', rest) -> go (depth + 1) ("{" : chunks) rest-      Just (']', rest) -> go (max 0 (depth - 1)) ("]" : chunks) rest-      Just ('}', rest) -> go (max 0 (depth - 1)) ("}" : chunks) rest-      Just (c, rest) ->-        -- c is plain (or a quote/hash inside brackets, kept as content);-        -- take it plus the whole plain run after it in one span.-        let (plain, after) = T.break scanBreak rest-         in go depth (plain : T.singleton c : chunks) after-    scanBreak c = c == '#' || c == '"' || c == '[' || c == '{' || c == ']' || c == '}'---- | Parse a basic (double-quoted) TOML string.--- O(n) via chunk list + T.concat instead of O(n^2) T.snoc.-parseBasicStr :: Text -> Either Text TOMLValue-parseBasicStr = go []-  where-    go !chunks t = case T.uncons t of-      Nothing -> Left "unterminated basic string"-      Just ('"', _) -> Right (TOMLStr (T.concat (reverse chunks)))-      Just ('\\', rest) -> case T.uncons rest of-        Just ('n', r) -> go ("\n" : chunks) r-        Just ('t', r) -> go ("\t" : chunks) r-        Just ('r', r) -> go ("\r" : chunks) r-        Just ('\\', r) -> go ("\\" : chunks) r-        Just ('"', r) -> go ("\"" : chunks) r-        Just ('b', r) -> go ("\b" : chunks) r-        Just ('f', r) -> go ("\f" : chunks) r-        Just ('u', r) -> case parseHex4 r of-          Just (cp, r2) -> go (T.singleton (chr cp) : chunks) r2-          Nothing -> Left "invalid \\u escape"-        _ -> Left "invalid escape sequence"-      Just (c, rest) -> go (T.singleton c : chunks) rest---- | Parse a literal (single-quoted) TOML string.-parseLiteralStr :: Text -> Either Text TOMLValue-parseLiteralStr t =-  let (content, rest) = T.break (== '\'') t-   in case T.uncons rest of-        Just ('\'', _) -> Right (TOMLStr content)-        _ -> Left "unterminated literal string"---- | Parse a multiline basic string.-parseMultilineBasicStr :: Text -> Either Text TOMLValue-parseMultilineBasicStr t =-  case T.breakOn "\"\"\"" t of-    (content, rest)-      | T.isPrefixOf "\"\"\"" rest ->-          Right (TOMLStr (T.replace "\\\n" "" (stripLeadingNewline content)))-      | otherwise -> Left ("unterminated multiline basic string, remaining: " <> T.take 20 rest)---- | Parse a multiline literal string.-parseMultilineLiteralStr :: Text -> Either Text TOMLValue-parseMultilineLiteralStr t =-  case T.breakOn "'''" t of-    (content, rest)-      | T.isPrefixOf "'''" rest -> Right (TOMLStr (stripLeadingNewline content))-      | otherwise -> Left "unterminated multiline literal string"---- | Strip a leading newline (TOML spec: first newline after opening quotes is trimmed).-stripLeadingNewline :: Text -> Text-stripLeadingNewline t = case T.uncons t of-  Just ('\n', rest) -> rest-  Just ('\r', rest) -> case T.uncons rest of-    Just ('\n', r) -> r-    _ -> rest-  _ -> t---- | Parse a TOML number or datetime.-parseTOMLNumberOrDatetime :: Text -> Either Text TOMLValue-parseTOMLNumberOrDatetime s-  -- Hex, octal, binary integers-  | T.isPrefixOf "0x" s || T.isPrefixOf "0X" s = parseHexInt (T.drop 2 s)-  | T.isPrefixOf "0o" s || T.isPrefixOf "0O" s = parseOctInt (T.drop 2 s)-  | T.isPrefixOf "0b" s || T.isPrefixOf "0B" s = parseBinInt (T.drop 2 s)-  -- Contains date separators, so treat as a datetime string-  | T.any (== 'T') s && T.any (== '-') s = Right (TOMLStr s)-  | T.count "-" s >= 2 && T.any isDigit s = Right (TOMLStr s)-  | T.any (== ':') s && T.any isDigit s = Right (TOMLStr s)-  -- Float (has dot or exponent)-  | T.any (== '.') s || T.any (\c -> c == 'e' || c == 'E') s = parseFloat s-  -- Plain integer-  | otherwise = parseInt s---- | Parse a plain decimal integer, ignoring underscores.-parseInt :: Text -> Either Text TOMLValue-parseInt t =-  let cleaned = T.filter (/= '_') t-      (sign, digits) = case T.uncons cleaned of-        Just ('+', rest) -> (1 :: Integer, rest)-        Just ('-', rest) -> (-1, rest)-        _ -> (1, cleaned)-   in case readDecimal digits of-        Just n -> tomlInt t (sign * n)-        Nothing -> Left ("invalid integer: " <> t)--parseHexInt :: Text -> Either Text TOMLValue-parseHexInt t =-  let cleaned = T.filter (/= '_') t-   in case readHexT cleaned of-        Just n -> tomlInt t n-        Nothing -> Left ("invalid hex integer: " <> t)--parseOctInt :: Text -> Either Text TOMLValue-parseOctInt t =-  let cleaned = T.filter (/= '_') t-   in case readOctT cleaned of-        Just n -> tomlInt t n-        Nothing -> Left ("invalid octal integer: " <> t)--parseBinInt :: Text -> Either Text TOMLValue-parseBinInt t =-  let cleaned = T.filter (/= '_') t-   in case readBinT cleaned of-        Just n -> tomlInt t n-        Nothing -> Left ("invalid binary integer: " <> t)---- | Finish a parsed TOML integer: a value outside the 64-bit signed range--- is a parse error, as upstream's TOML parser reports - silently wrapping--- would hand the evaluator a different number than the document wrote.-tomlInt :: Text -> Integer -> Either Text TOMLValue-tomlInt original n-  | n < toInteger (minBound :: Int64) || n > toInteger (maxBound :: Int64) =-      Left ("integer out of 64-bit range: " <> original)-  | otherwise = Right (TOMLInt (fromInteger n))--parseFloat :: Text -> Either Text TOMLValue-parseFloat t =-  let cleaned = T.filter (/= '_') t-   in case readDouble cleaned of-        Just d -> Right (TOMLFloat d)-        Nothing -> Left ("invalid float: " <> t)---- Digit readers accumulate an unbounded 'Integer'; 'tomlInt' applies the--- 64-bit range gate after any sign, so the minimum int64 (whose magnitude--- alone exceeds the maximum) still parses.---- | Read an unbounded decimal integer from Text.-readDecimal :: Text -> Maybe Integer-readDecimal t-  | T.null t = Nothing-  | T.all isDigit t = Just (T.foldl' (\acc c -> acc * 10 + fromIntegral (digitToInt c)) 0 t)-  | otherwise = Nothing--readHexT :: Text -> Maybe Integer-readHexT t-  | T.null t = Nothing-  | T.all isHexDigit t = Just (T.foldl' (\acc c -> acc * 16 + fromIntegral (digitToInt c)) 0 t)-  | otherwise = Nothing--readOctT :: Text -> Maybe Integer-readOctT t-  | T.null t = Nothing-  | T.all isOctDigit t =-      Just (T.foldl' (\acc c -> acc * 8 + fromIntegral (digitToInt c)) 0 t)-  | otherwise = Nothing--readBinT :: Text -> Maybe Integer-readBinT t-  | T.null t = Nothing-  | T.all (\c -> c == '0' || c == '1') t =-      Just (T.foldl' (\acc c -> acc * 2 + fromIntegral (digitToInt c)) 0 t)-  | otherwise = Nothing--readDouble :: Text -> Maybe Double-readDouble t = case reads (T.unpack t) of-  [(d, "")] -> Just d-  _ -> Nothing---- | Parse an inline table: @{ key = val, ... }@.-parseInlineTable :: Text -> Either Text TOMLValue-parseInlineTable t = case T.uncons t of-  Just ('{', rest) ->-    let inner = T.strip (T.dropWhileEnd (== '}') (T.strip rest))-     in if T.null inner-          then Right (TOMLTable Map.empty)-          else do-            pairs <- mapM parseInlineKV (splitCommas inner)-            Right (TOMLTable (Map.fromList (concatMap flattenPair pairs)))-  _ -> Left "expected '{'"-  where-    flattenPair (keys, val) = case keys of-      [] -> []-      [k] -> [(k, val)]-      (k : ks) -> [(k, nestKeys ks val)]-    nestKeys [] v = v-    nestKeys (k : ks) v = TOMLTable (Map.singleton k (nestKeys ks v))---- | Parse an inline array: @[ val, ... ]@.-parseInlineArray :: Text -> Either Text TOMLValue-parseInlineArray t = case T.uncons t of-  Just ('[', rest) ->-    let inner = T.strip (T.dropWhileEnd (== ']') (T.strip rest))-     in if T.null inner-          then Right (TOMLArray [])-          else do-            vals <- mapM (parseTOMLValue . T.strip) (splitCommas inner)-            Right (TOMLArray vals)-  _ -> Left "expected '['"---- | Parse a single key=value pair in an inline table.-parseInlineKV :: Text -> Either Text ([Text], TOMLValue)-parseInlineKV t =-  let (keyPart, afterEq) = splitAtEquals (T.strip t)-   in do-        val <- parseTOMLValue (T.strip afterEq)-        Right (parseDottedKey (T.strip keyPart), val)---- | Split on commas not inside brackets or braces.--- O(n) via chunk list + T.concat instead of O(n^2) T.snoc.-splitCommas :: Text -> [Text]-splitCommas = go (0 :: Int) []-  where-    finalize chunks =-      let t = T.concat (reverse chunks)-       in [t | not (T.null (T.strip t))]-    go _ !chunks t | T.null t = finalize chunks-    go depth !chunks t = case T.uncons t of-      Nothing -> finalize chunks-      Just (',', rest) | depth == 0 -> T.concat (reverse chunks) : go 0 [] rest-      Just ('[', rest) -> go (depth + 1) ("[" : chunks) rest-      Just ('{', rest) -> go (depth + 1) ("{" : chunks) rest-      Just (']', rest) -> go (max 0 (depth - 1)) ("]" : chunks) rest-      Just ('}', rest) -> go (max 0 (depth - 1)) ("}" : chunks) rest-      Just ('"', rest) ->-        let (str, after) = T.break (== '"') rest-            consumed = "\"" <> str <> T.take 1 after-         in go depth (consumed : chunks) (T.drop 1 after)-      Just (c, rest) -> go depth (T.singleton c : chunks) rest---- | Insert a value at a nested key path into a table.-insertNested :: [Text] -> TOMLValue -> Map Text TOMLValue -> Map Text TOMLValue-insertNested [] _ m = m-insertNested [k] v m = Map.insert k v m-insertNested (k : ks) v m = case Map.lookup k m of-  -- Under a [[table]] header the path crosses an array of tables: keys-  -- belong to its LAST element, not to a table replacing the array.-  Just (TOMLArray xs)-    | (TOMLTable lastInner : prev) <- reverse xs ->-        Map.insert k (TOMLArray (reverse prev ++ [TOMLTable (insertNested ks v lastInner)])) m-  Just (TOMLTable inner) -> Map.insert k (TOMLTable (insertNested ks v inner)) m-  _ -> Map.insert k (TOMLTable (insertNested ks v Map.empty)) m---- | Ensure a table path exists (for @[table]@ headers).-ensureTable :: [Text] -> Map Text TOMLValue -> Map Text TOMLValue-ensureTable [] m = m-ensureTable [k] m = case Map.lookup k m of-  Just (TOMLTable _) -> m-  Nothing -> Map.insert k (TOMLTable Map.empty) m-  _ -> m-ensureTable (k : ks) m =-  let sub = case Map.lookup k m of-        Just (TOMLTable inner) -> inner-        _ -> Map.empty-   in Map.insert k (TOMLTable (ensureTable ks sub)) m---- | Insert an entry into an array-of-tables (@[[table]]@).-insertArrayTable :: [Text] -> Map Text TOMLValue -> Map Text TOMLValue-insertArrayTable [] m = m-insertArrayTable [k] m = case Map.lookup k m of-  Just (TOMLArray xs) -> Map.insert k (TOMLArray (xs ++ [TOMLTable Map.empty])) m-  Nothing -> Map.insert k (TOMLArray [TOMLTable Map.empty]) m-  _ -> Map.insert k (TOMLArray [TOMLTable Map.empty]) m-insertArrayTable (k : ks) m =-  let sub = case Map.lookup k m of-        Just (TOMLTable inner) -> inner-        Just (TOMLArray xs) ->-          -- Descend into the last element of the array-          case reverse xs of-            (TOMLTable inner : _) -> inner-            _ -> Map.empty-        _ -> Map.empty-      updated = insertArrayTable ks sub-   in case Map.lookup k m of-        Just (TOMLArray xs) ->-          case reverse xs of-            (TOMLTable _ : prev) ->-              Map.insert k (TOMLArray (reverse prev ++ [TOMLTable updated])) m-            _ -> Map.insert k (TOMLTable updated) m-        _ -> Map.insert k (TOMLTable updated) m---- ------------------------------------------------------------------------------ Builtin implementations - toXML--- ------------------------------------------------------------------------------- | @builtins.toXML val@ - convert a Nix value to its XML representation.--- Matches the format defined by the Nix manual: strings, ints, floats,--- bools, nulls, lists, and attrsets map to their XML counterparts.--- Built over BYTES: upstream's serializer copies string payloads into the--- output with only the four ASCII escapes, so invalid UTF-8 passes--- through raw rather than erroring (unlike toJSON, whose upstream--- serializer validates).-builtinToXML :: (MonadEval m) => NixValue -> m NixValue-builtinToXML val = do-  xml <- valueToXML 0 val-  pure (mkStrBytes ("<?xml version='1.0' encoding='utf-8'?>\n<expr>\n" <> xml <> "</expr>\n"))--valueToXML :: (MonadEval m) => Int -> NixValue -> m BS.ByteString-valueToXML depth val = case val of-  VStr s _ ->-    pure (indent depth <> "<string value=" <> xmlQuote s <> " />\n")-  VInt n ->-    pure (indent depth <> "<int value=\"" <> BC.pack (show n) <> "\" />\n")-  VFloat d ->-    pure (indent depth <> "<float value=\"" <> TE.encodeUtf8 (formatXmlFloat d) <> "\" />\n")-  VBool True ->-    pure (indent depth <> "<bool value=\"true\" />\n")-  VBool False ->-    pure (indent depth <> "<bool value=\"false\" />\n")-  VNull ->-    pure (indent depth <> "<null />\n")-  VPath p ->-    pure (indent depth <> "<path value=" <> xmlQuote (TE.encodeUtf8 p) <> " />\n")-  VList cl -> do-    let thunks = map Thunk (clistThunks cl)-    items <- mapM (force >=> valueToXML (depth + 1)) thunks-    pure (indent depth <> "<list>\n" <> BS.concat items <> indent depth <> "</list>\n")-  VAttrs attrs -> do-    let pairs = attrSetToAscList attrs-    items <- mapM (attrToXML (depth + 1)) pairs-    pure (indent depth <> "<attrs>\n" <> BS.concat items <> indent depth <> "</attrs>\n")-  VLambda {} ->-    pure (indent depth <> "<function />\n")-  VBuiltin _ _ ->-    pure (indent depth <> "<function />\n")-  VDerivation _ ->-    pure (indent depth <> "<derivation />\n")-  VCompiledRegex _ ->-    pure (indent depth <> "<function />\n")-  where-    attrToXML d (name, thunk) = do-      v <- force thunk-      inner <- valueToXML d v-      pure (indent d <> "<attr name=" <> xmlQuote (TE.encodeUtf8 name) <> ">\n" <> inner <> indent d <> "</attr>\n")--indent :: Int -> BS.ByteString-indent n = BC.replicate (n * 2) ' '--xmlQuote :: BS.ByteString -> BS.ByteString-xmlQuote s = "\"" <> BC.concatMap escapeChar s <> "\""-  where-    escapeChar '<' = "&lt;"-    escapeChar '>' = "&gt;"-    escapeChar '&' = "&amp;"-    escapeChar '"' = "&quot;"-    escapeChar c = BC.singleton c---- ------------------------------------------------------------------------------ Builtin implementations - builtins.path--- ------------------------------------------------------------------------------- | @builtins.path { path; name?; filter?; sha256?; recursive?; }@------ Copy a path to the store and return the store path as a string with--- context.  @name@ defaults to the basename of @path@.  @filter@ is--- accepted but not yet applied (copies everything).-builtinPath :: (MonadEval m) => NixValue -> m NixValue-builtinPath (VAttrs attrs) = do-  pathStr <- forceAttrStr "builtins.path" "path" attrs-  nameOverride <- forceOptionalAttrStr attrs "name"-  expectedDigest <- case attrSetLookup "sha256" attrs of-    Nothing -> pure Nothing-    Just thunk -> do-      pinVal <- force thunk-      case pinVal of-        VStr pin _ -> do-          pinText <- decodedText "builtins.path" pin-          Just <$> decodeSha256Pin "builtins.path" pinText-        other -> throwEvalError ("builtins.path: 'sha256' must be a string, got " <> typeName other)-  let name = fromMaybe (canonBaseName pathStr) nameOverride-      pinSubject = "builtins.path: " <> pathStr-  storePathText <- case attrSetLookup "filter" attrs of-    Nothing -> copyPathToStore pathStr name (fmap (pinSubject,) expectedDigest)-    Just filterThunk -> do-      filterFn <- force filterThunk-      narBytes <- filteredSourceNar filterFn pathStr-      -- The sha256 pin applies to the FILTERED tree, as upstream.-      let filteredDigest = sha256Digest narBytes-      case expectedDigest of-        Just expected-          | expected /= filteredDigest ->-              throwEvalError-                ( pinSubject-                    <> ": hash mismatch: expected sha256:"-                    <> bytesToHexText expected-                    <> ", got sha256:"-                    <> bytesToHexText filteredDigest-                )-        _ -> pure ()-      addSourceNar name narBytes-  pure (sourceResultString storePathText)-builtinPath other =-  throwEvalError ("builtins.path: expected an attribute set, got " <> typeName other)---- | The result value both source importers return: the store path as a--- string carrying itself as context.-sourceResultString :: Text -> NixValue-sourceResultString storePathText =-  case parseStorePath defaultStoreDir storePathText of-    Just sp -> VStr (TE.encodeUtf8 storePathText) (plainContext sp)-    Nothing -> VStr (TE.encodeUtf8 storePathText) emptyContext---- | Serialise a source tree to a NAR, keeping only entries the Nix filter--- function accepts - upstream's addToStore filtering: the filter receives--- @(path, type)@ for every entry BELOW the root (the root itself is never--- filtered), and rejecting a directory prunes its whole subtree.  Child--- paths hand the filter @parent/name@ with a forward slash; both path--- styles reach Nix code only through separator-agnostic helpers like--- @baseNameOf@.-filteredSourceNar :: (MonadEval m) => NixValue -> Text -> m BS.ByteString-filteredSourceNar filterFn rootPath = do-  rootType <- getFileType rootPath-  entry <- buildEntry rootPath rootType-  pure (NAR.serialise entry)-  where-    buildEntry path fileType = case fileType of-      "regular" -> do-        executable <- isExecutableFile path-        bytes <- readFileBytes path-        pure (NAR.NarRegular executable bytes)-      "symlink" -> NAR.NarSymlink . TE.encodeUtf8 <$> readSymlinkTarget path-      "directory" -> do-        children <- listDirectory path-        kept <- mapM (keepChild path) children-        pure (NAR.NarDirectory (catMaybes kept))-      other -> throwEvalError ("builtins.path: unsupported file type '" <> other <> "' at " <> path)-    keepChild parent (name, childType) = do-      let childPath = parent <> "/" <> name-      keep <- filterAccepts childPath childType-      if keep-        then Just . (,) (TE.encodeUtf8 name) <$> buildEntry childPath childType-        else pure Nothing-    filterAccepts path fileType = do-      partial <- applyValue filterFn (mkStr path)-      result <- applyValue partial (mkStr fileType)-      case result of-        VBool b -> pure b-        other -> throwEvalError ("builtins.path: the filter function must return a Boolean, got " <> typeName other)---- ------------------------------------------------------------------------------ Builtin implementations - filterSource--- ------------------------------------------------------------------------------- | @builtins.filterSource filter path@ - copy a path to the store,--- filtering entries via a predicate.  The filter function receives--- @(path, type)@ where type is @"regular"@, @"directory"@, @"symlink"@,--- or @"unknown"@.  Equivalent to @builtins.path@ with a filter and the--- source's basename as the store name.-builtinFilterSource :: (MonadEval m) => NixValue -> NixValue -> m NixValue-builtinFilterSource filterFn (VPath path) = filterSourceInto filterFn path-builtinFilterSource filterFn (VStr path _) =-  filterSourceInto filterFn =<< decodedText "builtins.filterSource" path-builtinFilterSource _ other =-  throwEvalError ("builtins.filterSource: expected a path, got " <> typeName other)+--+-- Thunks, environments and values live in the C data layer, so+-- everything here that builds or forces one runs between+-- 'Nix.Eval.Arena.arenaInit' and 'Nix.Eval.Arena.arenaDestroy'+-- (@bracket_ arenaInit arenaDestroy@).  Outside that window the first+-- C call raises 'Nix.Eval.CStatus.ArenaNotInitialized' instead of+-- faulting.+module Nix.Eval+  ( -- * Values (re-exported from Types)+    NixValue (..),+    CompiledRegex (..),+    Thunk (..),++    -- * Attribute sets (re-exported from Types)+    AttrSet (..),+    CAttrSet,+    attrSetFromMap,+    attrSetLookup,+    attrSetKeys,+    attrSetToMap,+    attrSetToAscList,+    attrSetMember,+    attrSetElems,+    attrSetNull,+    attrSetRemoveKeys,+    attrSetSize,++    -- * String context (re-exported from Types)+    StringContextElement (..),+    StringContext (..),+    emptyContext,+    mkStr,++    -- * Environment (re-exported from Types)+    Env (..),+    emptyEnv,++    -- * Evaluation monad (re-exported from Types)+    MonadEval (..),+    EvalPolicy (..),+    PathExistence (..),+    unrestrictedPolicy,+    PureEval,+    runPureEval,++    -- * Evaluation+    eval,+    evalBytecode,+    force,++    -- * Helpers (for Builtins)+    typeName,+    evaluated,+    readThunkValue,+    deferApply,++    -- * Fetcher transport validation (pure, exported for tests)+    FetchGitArgs (..),+    checkGitUrl,+    checkGitRef,+    checkGitRev,+    gitInputUrl,++    -- * Remembered fetches (pure, exported for tests)+    FetchCache (..),+    fetchCacheKey,+    encodeFetchCache,+    decodeFetchCache,++    -- * Builtin registry+    BuiltinDef (..),+    builtinRegistry,+    builtinNames,++    -- * Platform+    currentSystemStr,+  )+where++import Control.Monad (foldM, foldM_, forM_, unless, void, when, (>=>))+import qualified Crypto.Hash as CH+import qualified Data.Array as Array+import Data.Bits (complement, xor, (.&.), (.|.))+import qualified Data.ByteArray as BA+import qualified Data.ByteString as BS+import qualified Data.ByteString.Builder as BB+import qualified Data.ByteString.Char8 as BC+import qualified Data.ByteString.Lazy as BL+import Data.Char (chr, digitToInt, intToDigit, isAsciiLower, isAsciiUpper, isDigit, isHexDigit, isOctDigit, ord, toUpper)+import Data.IORef (IORef, atomicModifyIORef', newIORef)+import Data.Int (Int64)+import Data.List (partition, sort, sortOn)+import Data.Map.Strict (Map)+import qualified Data.Map.Strict as Map+import Data.Maybe (catMaybes, fromMaybe, isJust, isNothing, listToMaybe)+import Data.Sequence (Seq (..))+import qualified Data.Sequence as Seq+import qualified Data.Set as Set+import Data.Text (Text)+import qualified Data.Text as T+import qualified Data.Text.Encoding as TE+import Data.Text.Encoding.Error (lenientDecode)+import qualified Data.Text.Read as TR+import Data.Time.Clock.POSIX (posixSecondsToUTCTime)+import Data.Time.Format (defaultTimeLocale, formatTime)+import Data.Word (Word32, Word8)+import Foreign.Ptr (Ptr, castPtr, nullPtr, ptrToWordPtr, wordPtrToPtr)+import Foreign.Storable (peekElemOff, pokeElemOff)+import Nix.Derivation (Derivation (..), DerivationOutput (..), textToPlatform, toATerm, toATermForHash)+import Nix.Derivation.StructuredAttrs (StructuredAttrs (..), encodeStructuredAttrs, structuredAttrsKey)+import Nix.Eval.CBytecode (appDeferred, cbcArg1, cbcArg2, cbcArg3, cbcCountedPayload, cbcData, cbcFlags, cbcOpcode, cbcShortArg, reservedApply1, reservedApply2, strpartEsc, strpartLit, pattern OpApp, pattern OpAssert, pattern OpAttrs, pattern OpBinary, pattern OpHasAttr, pattern OpIf, pattern OpIndStr, pattern OpLambda, pattern OpLet, pattern OpList, pattern OpLitBool, pattern OpLitFloat, pattern OpLitInt, pattern OpLitNull, pattern OpLitPath, pattern OpLitUri, pattern OpPathStr, pattern OpResolvedVar, pattern OpSearchPath, pattern OpSelect, pattern OpStr, pattern OpUnary, pattern OpVar, pattern OpWith, pattern OpWithVar)+import Nix.Eval.CEnv (cenvPushWith)+import Nix.Eval.CList (CList, clistDrop, clistIndex)+import Nix.Eval.CThunk (CThunkPtr)+import Nix.Eval.CanonPath (canonBaseName, canonDirName, canonPathValue)+import Nix.Eval.Compile (BcAttrKey (..), BcBinding (..), BcInheritedName (..), compileExpr, decodeBcBindings, decodeBcCaptureInfo, decodeBcFormals, reassembleDouble, reassembleInt64)+import Nix.Eval.Context (contextIsEmpty, extractAllOutputRefs, extractInputDrvs, extractInputSrcs, firstContextEncoded, plainContext)+import Nix.Eval.Operator (addToFloat, addToInteger, evalBinary, evalUnary, evalUpdate, expectInt, nixCompare, nixEqual, primAdd, primDiv, primMul, primSub)+import Nix.Eval.Policy (isAbsolutePath)+import Nix.Eval.Print (PrintOptions (..), formatXmlFloat, printValue)+import Nix.Eval.StringInterp (StringChunk (..), coerceToString, concatChunks, formatNixFloat, stripIndentedChunks)+import Nix.Eval.Symbol (Symbol (..), symbolBytes, symbolText)+import Nix.Eval.Types+  ( AttrSet (..),+    CAttrSet,+    CompiledRegex (..),+    Env (..),+    EvalFormal (..),+    EvalFormals (..),+    EvalPolicy (..),+    MonadEval (..),+    NixValue (..),+    PathExistence (..),+    PureEval,+    StringContext (..),+    StringContextElement (..),+    Thunk (..),+    allocCSlots,+    attrSetElems,+    attrSetFromMap,+    attrSetKeys,+    attrSetLookup,+    attrSetMapWithKey,+    attrSetMember,+    attrSetNull,+    attrSetRemoveKeys,+    attrSetSize,+    attrSetToAscList,+    attrSetToMap,+    buildCAttrSetKeys,+    buildCSlots,+    bytesToTextLossy,+    cheapThunkBc,+    checkedCPtr,+    clistFromThunks,+    clistLen,+    clistThunks,+    emptyContext,+    emptyEnv,+    envFromSlots,+    envLookup,+    envLookupResolved,+    envWithScopesRaw,+    evaluated,+    fillCAttrSetValues,+    fillCSlots,+    mkStr,+    mkStrBytes,+    mkSyntheticThunk,+    mkThunkBc,+    newCEnv,+    newMinimalEnv,+    readThunkValue,+    runPureEval,+    storePathOrThrow,+    thunkToCPtr,+    typeName,+    typeOfValue,+    unrestrictedPolicy,+    withScopesForCapture,+  )+import Nix.Expr.Resolve (undefinedVariableMessage)+import Nix.Expr.Types+  ( BinaryOp (..),+    CaptureInfo (..),+    Expr (..),+    UnaryOp (..),+  )+import Nix.Hash (base64HashLen, bytesToHexText, hashAlgoBytes, hashPlaceholder, hexHashLen, hexToBytes, makeFixedOutputPath, makeOutputPath, makeTextPath, nix32HashLen, sha256Digest)+import Nix.Json (IntegerRange (..), Json (..), parseJsonWith, renderJson)+import Nix.Store.Path (StorePath (spName), StorePathNameError (..), checkStorePathName, defaultStoreDir, defaultStoreDirText, parseStorePath, parseStorePathBaseName, storePathBaseNameError, storePathNameErrorText, storePathNameReasonText, storePathNameUpstreamText, storePathToText)+import Nix.Store.Path.Internal (maskedOutputPath)+import qualified NovaCache.Base32 as Nix32+import qualified NovaCache.Base64 as B64+import qualified NovaCache.NAR as NAR+import System.IO.Unsafe (unsafePerformIO)+import qualified System.Info+import Text.Regex.TDFA (matchAllText)+import qualified Text.Regex.TDFA as RE+import Text.Regex.TDFA.ByteString ()++-- | Evaluate a Nix expression in an environment.+-- Compiles the expression to bytecode and dispatches to 'evalBytecode'.+eval :: (MonadEval m) => Env -> Expr -> m NixValue+eval env expr =+  let bcIdx = unsafePerformIO (compileExpr expr)+   in evalBytecode env bcIdx++-- | Force a thunk to a value.+--+-- Delegates to 'forceThunk' which is a 'MonadEval' method - this+-- allows IO evaluators to implement memoization (caching the result+-- after the first force) while pure evaluators simply re-evaluate.+force :: (MonadEval m) => Thunk -> m NixValue+force = forceThunk evalBytecode++-- | Strict UTF-8 decode at a Text-typed boundary (attr names, filesystem+-- paths, algorithm names, ...).  A Nix string is a byte string; where the+-- implementation needs 'Text', invalid UTF-8 is a clean eval error - never+-- a lossy replacement, which would smuggle a DIFFERENT string through an+-- identity-bearing boundary.+decodedText :: (MonadEval m) => Text -> BS.ByteString -> m Text+decodedText what bytes = case TE.decodeUtf8' bytes of+  Right t -> pure t+  Left _ -> throwEvalError (what <> ": invalid UTF-8 in string")++-- | Evaluate a bytecode instruction by index.+-- This is the primary evaluator - reads opcodes from the C bytecode+-- store and dispatches.  All recursive evaluation goes through this+-- function, never through 'eval' directly.+evalBytecode :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBytecode env bcIdx =+  let opcode = unsafePerformIO (cbcOpcode bcIdx)+   in case opcode of+        OpLitInt ->+          let lo = unsafePerformIO (cbcArg1 bcIdx)+              hi = unsafePerformIO (cbcArg2 bcIdx)+           in pure (VInt (reassembleInt64 lo hi))+        OpLitFloat ->+          let lo = unsafePerformIO (cbcArg1 bcIdx)+              hi = unsafePerformIO (cbcArg2 bcIdx)+           in pure (VFloat (reassembleDouble lo hi))+        OpLitBool ->+          let flag = unsafePerformIO (cbcShortArg bcIdx)+           in pure (VBool (flag /= 0))+        OpLitNull -> pure VNull+        OpLitUri ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+           in pure (mkStrBytes (symbolBytes (Symbol sym)))+        OpLitPath ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+           in VPath <$> resolvePathLiteral (symbolText (Symbol sym))+        OpStr -> evalBcStr env bcIdx+        OpIndStr -> evalBcIndStr env bcIdx+        OpPathStr -> evalBcPathStr env bcIdx+        OpVar ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+           in evalVar env (symbolText (Symbol sym))+        OpWithVar ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+              name = symbolText (Symbol sym)+           in evalWithVar env name+        OpResolvedVar ->+          let level = fromIntegral (unsafePerformIO (cbcArg1 bcIdx))+              idx = fromIntegral (unsafePerformIO (cbcArg2 bcIdx))+           in force (envLookupResolved level idx env)+        OpAttrs -> evalBcAttrs env bcIdx+        OpList -> evalBcList env bcIdx+        OpSelect -> evalBcSelect env bcIdx+        OpHasAttr -> evalBcHasAttr env bcIdx+        OpApp -> evalBcApp env bcIdx+        OpLambda -> evalBcLambda env bcIdx+        OpLet -> evalBcLet env bcIdx+        OpIf ->+          let condIdx = unsafePerformIO (cbcArg1 bcIdx)+              thenIdx = unsafePerformIO (cbcArg2 bcIdx)+              elseIdx = unsafePerformIO (cbcArg3 bcIdx)+           in do+                condVal <- evalBytecode env condIdx+                case condVal of+                  VBool True -> evalBytecode env thenIdx+                  VBool False -> evalBytecode env elseIdx+                  _ -> throwEvalError ("'if' condition must be a Boolean, got " <> typeName condVal)+        OpWith ->+          let scopeIdx = unsafePerformIO (cbcArg1 bcIdx)+              bodyIdx = unsafePerformIO (cbcArg2 bcIdx)+              -- Lazy with: defer forcing the scope until a WITH_VAR lookup+              -- actually needs it.  This is critical for nixpkgs where+              -- all-packages.nix uses `with pkgs;` inside a fixpoint -+              -- eagerly forcing the scope would blackhole.+              scopeThunk = cheapThunkBc env scopeIdx+           in evalBytecode (pushLazyWithScope scopeThunk env) bodyIdx+        OpAssert ->+          let condIdx = unsafePerformIO (cbcArg1 bcIdx)+              bodyIdx = unsafePerformIO (cbcArg2 bcIdx)+           in do+                condVal <- evalBytecode env condIdx+                case condVal of+                  VBool True -> evalBytecode env bodyIdx+                  -- A failed assert is catchable by tryEval (upstream+                  -- AssertionError); a non-bool condition is a type error.+                  VBool False -> throwCatchableError "assertion failed"+                  _ -> throwEvalError ("assertion condition must be a Boolean, got " <> typeName condVal)+        OpUnary ->+          let flags_ = unsafePerformIO (cbcFlags bcIdx)+              operandIdx = unsafePerformIO (cbcArg1 bcIdx)+              unop = decodeUnaryOp flags_+              operate = evalBytecode env operandIdx >>= evalUnary unop+           in case unop of+                -- Upstream's parser turns @-e@ into @__sub 0 e@, a call+                -- frame around the operand's forcing.+                OpNegate -> withCallFrame operate+                OpNot -> operate+        OpBinary -> evalBcBinary env bcIdx+        OpSearchPath ->+          let sym = unsafePerformIO (cbcArg1 bcIdx)+           in evalSearchPath env (symbolText (Symbol sym))+        _ -> throwEvalError "evalBytecode: unknown opcode"++-- ---------------------------------------------------------------------------+-- Bytecode helpers+-- ---------------------------------------------------------------------------++-- | Decode a UnaryOp from bytecode flags.+decodeUnaryOp :: Word8 -> UnaryOp+decodeUnaryOp 0 = OpNot+decodeUnaryOp 1 = OpNegate+-- Unreachable: the tag is written by Nix.Eval.Compile's encodeUnaryOp, which+-- only emits 0 or 1.+decodeUnaryOp n = error ("decodeUnaryOp: unknown tag " <> show n)++-- | Decode a BinaryOp from bytecode flags.+decodeBinaryOp :: Word8 -> BinaryOp+decodeBinaryOp 0 = OpAdd+decodeBinaryOp 1 = OpSub+decodeBinaryOp 2 = OpMul+decodeBinaryOp 3 = OpDiv+decodeBinaryOp 4 = OpAnd+decodeBinaryOp 5 = OpOr+decodeBinaryOp 6 = OpImpl+decodeBinaryOp 7 = OpEq+decodeBinaryOp 8 = OpNeq+decodeBinaryOp 9 = OpLt+decodeBinaryOp 10 = OpLte+decodeBinaryOp 11 = OpGt+decodeBinaryOp 12 = OpGte+decodeBinaryOp 13 = OpConcat+decodeBinaryOp 14 = OpUpdate+-- Unreachable: the tag is written by Nix.Eval.Compile's encodeBinaryOp, which+-- only emits 0..14.+decodeBinaryOp n = error ("decodeBinaryOp: unknown tag " <> show n)++-- | Whether upstream's parser desugars the operator into a builtin call+-- (@__sub@, @__mul@, @__div@ or @__lessThan@; parser.y at 2.24.9), which+-- then costs a call frame while its operands are forced.  The others are+-- @Expr@ nodes of their own there and cost nothing.+desugaredToCall :: BinaryOp -> Bool+desugaredToCall op = case op of+  OpSub -> True+  OpMul -> True+  OpDiv -> True+  OpLt -> True+  OpLte -> True+  OpGt -> True+  OpGte -> True+  OpAdd -> False+  OpAnd -> False+  OpOr -> False+  OpImpl -> False+  OpEq -> False+  OpNeq -> False+  OpConcat -> False+  OpUpdate -> False++-- | Evaluate a binary operation from bytecode, with short-circuit+-- support for &&, ||, ->.+evalBcBinary :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcBinary env bcIdx0 = case op of+  OpAnd -> evalShortCircuitAnd env leftIdx rightIdx+  OpOr -> evalShortCircuitOr env leftIdx rightIdx+  OpImpl -> evalShortCircuitImpl env leftIdx rightIdx+  OpAdd -> evalAddition (evalBytecode env leftIdx) (evalBytecode env rightIdx)+  -- Not through 'operate', which forces both operands before either is+  -- looked at: the left must be checked before the right is evaluated.+  OpUpdate -> evalUpdate (evalBytecode env leftIdx) (evalBytecode env rightIdx)+  _+    | desugaredToCall op -> withCallFrame operate+    | otherwise -> operate+  where+    flags_ = unsafePerformIO (cbcFlags bcIdx0)+    leftIdx = unsafePerformIO (cbcArg1 bcIdx0)+    rightIdx = unsafePerformIO (cbcArg2 bcIdx0)+    op = decodeBinaryOp flags_+    operate = do+      leftVal <- evalBytecode env leftIdx+      rightVal <- evalBytecode env rightIdx+      evalBinary force op leftVal rightVal++-- | @+@, as upstream's @ExprConcatStrings::eval@ runs it over two operands+-- (eval.cc at 2.24.9, the same in 2.33.2).  The left operand is evaluated+-- and dealt with before the right is evaluated, and its type alone decides+-- what @+@ means: an integer or float makes it arithmetic, a path makes the+-- result a path, and anything else makes it string concatenation, each+-- operand coerced strictly (no numbers, Booleans, null or lists), with+-- upstream's message for a value that does not coerce.  So @{} + throw+-- "b"@ fails on the set without evaluating the throw, and @true + 1@ is a+-- coercion failure, not a refused addition.+--+-- Only a string on the left copies a path into the store, as upstream+-- copies only when the first operand is a string: @"x" + ./src@ carries+-- the source's store path in its context, while @{ outPath = ./src; } ++-- "x"@ is the path's own text with no context.  A path on the left+-- appends the right operand's text without a copy, and a right operand+-- carrying string context is refused, since a path value cannot keep the+-- reference.  Paths are Text here, so the appended bytes must decode.+evalAddition :: (MonadEval m) => m NixValue -> m NixValue -> m NixValue+evalAddition evalLeft evalRight =+  evalLeft >>= \case+    VInt a -> evalRight >>= addToInteger a+    VFloat a -> evalRight >>= addToFloat a+    VPath base -> do+      (appended, context) <- evalRight >>= coerceToString False force applyValue coercePathVerbatim+      unless (contextIsEmpty context) $+        throwEvalError "a string that refers to a store path cannot be appended to a path"+      text <- decodedText "path concatenation" appended+      pure (VPath (canonPathValue (base <> text)))+    left -> do+      let coercePath = case left of+            VStr {} -> coercePathToStore+            _ -> coercePathVerbatim+          coerce = coerceToString False force applyValue coercePath+      (leftStr, leftCtx) <- coerce left+      (rightStr, rightCtx) <- evalRight >>= coerce+      pure (VStr (leftStr <> rightStr) (leftCtx <> rightCtx))++-- | Bytecode short-circuit &&+evalShortCircuitAnd :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue+evalShortCircuitAnd env leftIdx rightIdx = do+  leftVal <- evalBytecode env leftIdx+  case leftVal of+    VBool False -> pure (VBool False)+    VBool True -> do+      rightVal <- evalBytecode env rightIdx+      case rightVal of+        VBool _ -> pure rightVal+        _ -> throwEvalError ("second operand of && must be a Boolean, got " <> typeName rightVal)+    _ -> throwEvalError ("first operand of && must be a Boolean, got " <> typeName leftVal)++-- | Bytecode short-circuit ||+evalShortCircuitOr :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue+evalShortCircuitOr env leftIdx rightIdx = do+  leftVal <- evalBytecode env leftIdx+  case leftVal of+    VBool True -> pure (VBool True)+    VBool False -> do+      rightVal <- evalBytecode env rightIdx+      case rightVal of+        VBool _ -> pure rightVal+        _ -> throwEvalError ("second operand of || must be a Boolean, got " <> typeName rightVal)+    _ -> throwEvalError ("first operand of || must be a Boolean, got " <> typeName leftVal)++-- | Bytecode short-circuit ->+evalShortCircuitImpl :: (MonadEval m) => Env -> Word32 -> Word32 -> m NixValue+evalShortCircuitImpl env leftIdx rightIdx = do+  leftVal <- evalBytecode env leftIdx+  case leftVal of+    VBool False -> pure (VBool True)+    VBool True -> do+      rightVal <- evalBytecode env rightIdx+      case rightVal of+        VBool _ -> pure rightVal+        _ -> throwEvalError ("second operand of -> must be a Boolean, got " <> typeName rightVal)+    _ -> throwEvalError ("first operand of -> must be a Boolean, got " <> typeName leftVal)++-- | Evaluate a string literal from bytecode data buffer.  A string with no+-- interpolation is one literal part, since the lexer joins a run of+-- characters and escapes into one chunk, and its value is that part's+-- bytes: upstream's parser makes it an @ExprString@ holding the value+-- (parser.y), where an interpolated string is an @ExprConcatStrings@.+evalBcStr :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcStr env bcIdx0 =+  case unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0) of+    (1, dataOff)+      | unsafePerformIO (cbcData dataOff) == strpartLit ->+          pure (VStr (symbolBytes (Symbol (unsafePerformIO (cbcData (dataOff + 1))))) emptyContext)+    (count, dataOff) -> do+      chunks <- evalBcStringParts env count dataOff+      let (text, ctx) = concatChunks chunks+      pure (VStr text ctx)++-- | Evaluate an indented string literal from bytecode data buffer.  The+-- common indentation is stripped before concatenation, part by part as+-- upstream strips it, so an interpolated multi-line value cannot drag the+-- computed indent down.+evalBcIndStr :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcIndStr env bcIdx0 = do+  let (count, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+  chunks <- evalBcStringParts env count dataOff+  let (text, ctx) = stripIndentedChunks chunks+  pure (VStr text ctx)++-- | Evaluate an interpolated path literal from the bytecode data+-- buffer.  The pieces concatenate with no separator, each interpolated+-- value coerced as a path segment, and the whole resolves like a plain+-- path literal - absolutized if still relative, @~\/@ expanded, and+-- canonicalized, so a @..@ or a slash arriving at runtime collapses+-- textually, matching upstream (verified against nix-instantiate+-- 2.33.2: @let v = "a\/.."; in .\/${v}@ is the base directory itself).+evalBcPathStr :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcPathStr env bcIdx0 = do+  let (count, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+  parts <- evalBcPathParts env count dataOff+  unless (all (contextIsEmpty . snd) parts) $+    throwEvalError "a string that refers to a store path cannot be appended to a path"+  text <- decodedText "path literal" (BS.concat (map fst parts))+  VPath <$> resolvePathLiteral text++-- | The path-segment walk under 'evalBcPathStr': literal pieces pass+-- through; an interpolated value coerces with upstream's path-segment+-- rules - a context-free string passes, and a path contributes its text+-- WITHOUT a store copy (unlike string interpolation, which copies).  The+-- context comes back with each piece, because a string carrying it is+-- refused only once every piece has coerced: a path value has nowhere to+-- keep the context that holds a store reference alive, and upstream's+-- @ExprConcatStrings::eval@ checks for one after its loop, so a later+-- piece that fails to coerce is the error reported.  Observed from+-- nix-instantiate 2.33.2.+evalBcPathParts :: (MonadEval m) => Env -> Int -> Word32 -> m [(BS.ByteString, StringContext)]+evalBcPathParts _ 0 _ = pure []+evalBcPathParts env n off = do+  let tag = unsafePerformIO (cbcData off)+      val = unsafePerformIO (cbcData (off + 1))+  part <- case tag of+    0 -> pure (symbolBytes (Symbol val), emptyContext)+    _ -> evalBytecode env val >>= coerceToString False force applyValue coercePathVerbatim+  rest <- evalBcPathParts env (n - 1) (off + 2)+  pure (part : rest)++-- | Evaluate string parts from the bytecode data buffer.  Each part is two+-- words: (tag, value), a symbol under 'strpartLit' or 'strpartEsc' and a+-- bytecode index under 'strpartInterp'.  The kind survives into the chunk+-- because an indented string strips an escape and an interpolation+-- differently.+evalBcStringParts :: (MonadEval m) => Env -> Int -> Word32 -> m [StringChunk]+evalBcStringParts _ 0 _ = pure []+evalBcStringParts env n off = do+  let tag = unsafePerformIO (cbcData off)+      val = unsafePerformIO (cbcData (off + 1))+  chunk <- decodeChunk tag val+  rest <- evalBcStringParts env (n - 1) (off + 2)+  pure (chunk : rest)+  where+    decodeChunk tag val+      | tag == strpartLit = pure (ChunkLit (symbolBytes (Symbol val)))+      | tag == strpartEsc = pure (ChunkEsc (symbolBytes (Symbol val)))+      | otherwise = do+          v <- evalBytecode env val+          (txt, ctx) <- coerceToStringInterp v+          pure (ChunkInterp txt ctx)++-- | Evaluate a list from bytecode data buffer.+evalBcList :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcList env bcIdx0 =+  let (count, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+      readChildren 0 _ = []+      readChildren n off =+        let childIdx = unsafePerformIO (cbcData off)+         in cheapThunkBc env childIdx : readChildren (n - 1) (off + 1)+   in pure (VList (clistFromThunks (map thunkToCPtr (readChildren count dataOff))))++-- | Evaluate a function application from bytecode.  A source application+-- ('EApp') evaluates the function position outside the call frame and+-- everything after it inside, as upstream's @ExprCall::eval@ evaluates+-- @fun@ before @callFunction@ opens the frame.  A builtin's deferred+-- application, one of the reserved instructions in @cbits\/nn_bytecode.c@,+-- opens the frame first and forces the function inside it, as upstream's+-- @forceValue@ on an app value is a @callFunction@ that forces the+-- function after the depth check.+evalBcApp :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcApp env bcIdx0+  | flags_ == appDeferred = withCallFrame (evalBytecode env funcIdx >>= callBc env argIdx)+  | otherwise = evalBytecode env funcIdx >>= withCallFrame . callBc env argIdx+  where+    flags_ = unsafePerformIO (cbcFlags bcIdx0)+    funcIdx = unsafePerformIO (cbcArg1 bcIdx0)+    argIdx = unsafePerformIO (cbcArg2 bcIdx0)++-- | Apply an evaluated function to the argument at a bytecode index,+-- inside the caller's frame.  The argument stays a thunk for a lambda+-- (the normal laziness) and is forced for a builtin, which forces anyway.+callBc :: (MonadEval m) => Env -> Word32 -> NixValue -> m NixValue+callBc env argIdx funcVal = case funcVal of+  VLambda closureEnv formals bodyBcIdx -> do+    let argThunk = cheapThunkBc env argIdx+    extEnv <- matchFormals closureEnv formals argThunk+    evalBytecode extEnv bodyBcIdx+  VBuiltin "tryEval" [] -> tryEvalAction (evalBytecode env argIdx)+  VBuiltin name [first]+    | Just finishFirst <- beforeSecondArgument name first -> finishFirst >> evalBytecode env argIdx+  VBuiltin name accArgs -> do+    argVal <- evalBytecode env argIdx+    applyBuiltin name accArgs argVal+  VAttrs attrs+    | Just functorThunk <- attrSetLookup "__functor" attrs -> do+        functor <- force functorThunk+        -- Upstream applies the functor to itself and to the argument in+        -- one nested callFunction, so both bodies run a frame below this+        -- one: 'applyValue' opens that frame for the self application,+        -- and the recursion opens it again for the argument.+        partiallyApplied <- applyValue functor funcVal+        withCallFrame (callBc env argIdx partiallyApplied)+  _ -> throwEvalError ("attempt to call " <> typeName funcVal <> ", which is not a function")++-- | @builtins.tryEval@ over an argument's evaluation: @{ success, value }@+-- with catchable errors (throw, failed assert - the only kinds+-- 'catchEvalError' recovers) mapped to @success = false@.  The catch must+-- wrap the ARGUMENT'S EVALUATION: an application path that forces the+-- argument before dispatching here has already let the throw escape.+-- Callers holding an already-forced value pass @pure val@ - nothing left+-- to catch, so it success-wraps, exactly as upstream treats a value in+-- WHNF.+tryEvalAction :: (MonadEval m) => m NixValue -> m NixValue+tryEvalAction act = do+  result <- catchEvalError act+  pure $ case result of+    Right val ->+      VAttrs+        ( attrSetFromMap $+            Map.fromList+              [ ("success", evaluated (VBool True)),+                ("value", evaluated val)+              ]+        )+    Left _ ->+      VAttrs+        ( attrSetFromMap $+            Map.fromList+              [ ("success", evaluated (VBool False)),+                ("value", evaluated (VBool False))+              ]+        )++-- | Evaluate a lambda literal from bytecode - returns VLambda.+evalBcLambda :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcLambda env bcIdx0 =+  let flags_ = unsafePerformIO (cbcFlags bcIdx0)+      formalsOff = unsafePerformIO (cbcArg1 bcIdx0)+      bodyBcIdx = unsafePerformIO (cbcArg2 bcIdx0)+      captureOff = unsafePerformIO (cbcArg3 bcIdx0)+      formals = unsafePerformIO (decodeBcFormals flags_ formalsOff)+      captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)+   in pure (VLambda (buildCaptureEnv env captureInfo) formals bodyBcIdx)++-- | Evaluate a select expression from bytecode.+evalBcSelect :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcSelect env bcIdx0 = do+  let hasDef = unsafePerformIO (cbcFlags bcIdx0) /= 0+      targetIdx = unsafePerformIO (cbcArg1 bcIdx0)+      (pathLen, pathOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg2 bcIdx0)+      defIdx = unsafePerformIO (cbcArg3 bcIdx0)+  targetVal <- evalBytecode env targetIdx+  result <- walkBcAttrPath env pathLen pathOff targetVal+  case result of+    Just val -> pure val+    Nothing+      | hasDef -> evalBytecode env defIdx+      | otherwise -> do+          let pathName = collectBcAttrPathNames pathLen pathOff+              targetKeys = case targetVal of+                VAttrs attrs -> T.intercalate ", " (take 20 (attrSetKeys attrs))+                _ -> ""+          throwEvalError ("attribute '" <> pathName <> "' not found in " <> typeName targetVal <> " {" <> targetKeys <> "}")++-- | Evaluate a hasAttr expression from bytecode.+evalBcHasAttr :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcHasAttr env bcIdx0 = do+  let targetIdx = unsafePerformIO (cbcArg1 bcIdx0)+      (pathLen, pathOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg2 bcIdx0)+  targetVal <- evalBytecode env targetIdx+  VBool <$> hasBcAttrPath env pathLen pathOff targetVal++-- | Collect static attribute path names for error reporting.+collectBcAttrPathNames :: Int -> Word32 -> Text+collectBcAttrPathNames pathLen pathOff = T.intercalate "." (go pathLen pathOff)+  where+    go 0 _ = []+    go n off =+      let isExpr = unsafePerformIO (cbcData off)+          keyVal = unsafePerformIO (cbcData (off + 1))+          name = if isExpr /= 0 then "<expr>" else symbolText (Symbol keyVal)+       in name : go (n - 1) (off + 2)++-- | Resolve one attr-path element (two words at @off@) to its key text.+-- A dynamic key must produce a string - null included, as upstream's+-- select and has-attr key coercion rejects null with a type error.+resolveBcAttrKey :: (MonadEval m) => Env -> Word32 -> m Text+resolveBcAttrKey env off = do+  let isExpr = unsafePerformIO (cbcData off)+      keyVal = unsafePerformIO (cbcData (off + 1))+  if isExpr /= 0+    then do+      keyResult <- evalBytecode env keyVal+      case keyResult of+        VStr s _ -> decodedText "dynamic attribute key" s+        _ -> throwEvalError ("dynamic attribute key must be a string, got " <> typeName keyResult)+    else pure (symbolText (Symbol keyVal))++-- | Walk an attribute path stored in the bytecode data buffer.+-- Each element is two words: (is_expr, key_or_bc_idx).  Every matched+-- element is forced - select needs the terminal value, and the walk+-- needs each intermediate to be a set.+walkBcAttrPath :: (MonadEval m) => Env -> Int -> Word32 -> NixValue -> m (Maybe NixValue)+walkBcAttrPath _ 0 _ val = pure (Just val)+walkBcAttrPath env n off val = case val of+  VAttrs attrs -> do+    key <- resolveBcAttrKey env off+    case attrSetLookup key attrs of+      Just thunk -> do+        inner <- force thunk+        walkBcAttrPath env (n - 1) (off + 2) inner+      Nothing -> pure Nothing+  -- Non-attrset: attribute path cannot continue.  Return Nothing so+  -- that callers with a default (``a.b or def'') can handle it+  -- gracefully, matching C++ Nix behaviour.+  _ -> pure Nothing++-- | Presence walk for has-attr: intermediates force (the walk must reach+-- a set), but the terminal element is a membership check only - upstream+-- ``a ? b.c`` never evaluates the final attribute's value.+hasBcAttrPath :: (MonadEval m) => Env -> Int -> Word32 -> NixValue -> m Bool+hasBcAttrPath _ 0 _ _ = pure True+hasBcAttrPath env n off val = case val of+  VAttrs attrs -> do+    key <- resolveBcAttrKey env off+    case attrSetLookup key attrs of+      Just thunk+        | n == 1 -> pure True+        | otherwise -> do+            inner <- force thunk+            hasBcAttrPath env (n - 1) (off + 2) inner+      Nothing -> pure False+  _ -> pure False++-- | Evaluate attribute set from bytecode.+evalBcAttrs :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcAttrs env bcIdx0 = do+  let isRec = unsafePerformIO (cbcFlags bcIdx0) /= 0+      (bindCount, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+      captureOff = unsafePerformIO (cbcArg2 bcIdx0)+      bindings = unsafePerformIO (decodeBcBindings bindCount dataOff)+  if isRec+    then do+      let captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)+      evalBcRecAttrs env bindings captureInfo+    else evalBcNonRecAttrs env bindings++-- | Evaluate a non-recursive attr set from bytecode bindings.+--+-- Values go through 'cheapThunkBc', so a constant or a variable already in+-- scope becomes the value rather than a thunk over it, which is what+-- upstream's non-recursive @ExprAttrs::eval@ does through @maybeThunk@.  The+-- env here is the enclosing one and is fully built, so reading a variable+-- out of it now is safe; the recursive and @let@ paths knot-tie their own+-- frame and cannot make the same shortcut.+evalBcNonRecAttrs :: (MonadEval m) => Env -> [BcBinding] -> m NixValue+evalBcNonRecAttrs env bindings = do+  thunkMap <- buildBcThunkMap cheapThunkBc env env bindings+  pure (VAttrs (attrSetFromMap thunkMap))++-- | Build a let\/rec frame env, sharing the parent-chain and with-scope+-- plumbing otherwise repeated across the positional and dynamic paths.  The+-- frame's own bindings are positional slots (@slots@\/@slotCount@) or a lazy+-- name-table @scope@; the parent and with-scopes come from the enclosing @env@+-- and @captureInfo@.+newFrameEnv :: Env -> CaptureInfo -> Ptr CThunkPtr -> Int -> Maybe AttrSet -> Env+newFrameEnv env captureInfo slots slotCount scope =+  newCEnv slots slotCount scope (Just (buildCaptureEnv env captureInfo)) withArr withCount+  where+    (withArr, withCount) = case captureInfo of+      NoCaptureInfo -> envWithScopesRaw env+      Captures _ -> (nullPtr, 0)+      CapturesWithScopes _ -> withScopesForCapture env++-- | Evaluate a recursive attr set from bytecode bindings.+evalBcRecAttrs :: (MonadEval m) => Env -> [BcBinding] -> CaptureInfo -> m NixValue+evalBcRecAttrs env bindings captureInfo+  | allBcPositional bindings =+      -- Positional path: slots for variable lookup, CAttrSet for return.+      let slotCount = bcBindingSlotCount bindings+          slotsPtr = allocCSlots slotCount+          recEnv = newFrameEnv env captureInfo slotsPtr slotCount Nothing+          thunkList = buildBcSlotThunks recEnv env bindings+          filled = fillCSlots slotsPtr thunkList+          attrMap = buildBcAttrMapFromSlots bindings thunkList+       in filled `seq` pure (VAttrs (attrSetFromMap attrMap))+  | otherwise = do+      -- Dynamic-key path: the set has a ${dynamic} key, so names are not all+      -- known at compile time.  Not a corner-cutting fallback:+      -- it follows C++ Nix's env2 semantics.  The rec env holds the+      -- statically-named bindings as thunks, and the dynamic keys AND values are+      -- evaluated against it - so they can see static siblings and enclosing+      -- vars, but not another dynamic key.  The result is the static bindings+      -- plus the dynamic (name -> value) pairs.+      let scopeCset = buildCAttrSetKeys (bcBindingStaticKeys bindings)+          recEnv = newFrameEnv env captureInfo nullPtr 0 (Just (AttrSet scopeCset))+          (staticBs, dynBs) = partition bcBindingIsStatic bindings+      staticThunks <- buildBcThunkMap mkThunkBc recEnv env staticBs+      let scopeFilled = fillCAttrSetValues scopeCset staticThunks+      dynThunks <- scopeFilled `seq` buildBcThunkMap mkThunkBc recEnv env dynBs+      -- A dynamic key colliding with a static sibling is an eval error+      -- upstream ("dynamic attribute already defined"), never a merge.+      case Map.keys (Map.intersection dynThunks staticThunks) of+        (dupKey : _) -> throwEvalError ("dynamic attribute '" <> dupKey <> "' already defined")+        [] ->+          let allThunks = Map.union dynThunks staticThunks+              resultCset = buildCAttrSetKeys (Map.keys allThunks)+              filled = fillCAttrSetValues resultCset allThunks+           in filled `seq` pure (VAttrs (AttrSet resultCset))++-- | Evaluate a let expression from bytecode.+evalBcLet :: (MonadEval m) => Env -> Word32 -> m NixValue+evalBcLet env bcIdx0 = do+  let (bindCount, dataOff) =+        unsafePerformIO (cbcCountedPayload bcIdx0 =<< cbcArg1 bcIdx0)+      bodyIdx = unsafePerformIO (cbcArg2 bcIdx0)+      captureOff = unsafePerformIO (cbcArg3 bcIdx0)+      bindings = unsafePerformIO (decodeBcBindings bindCount dataOff)+      captureInfo = unsafePerformIO (decodeBcCaptureInfo captureOff)+  if allBcPositional bindings+    then do+      -- Positional path: slots for O(1) lookup.+      let slotCount = bcBindingSlotCount bindings+          slotsPtr = allocCSlots slotCount+          letEnv = newFrameEnv env captureInfo slotsPtr slotCount Nothing+          filled = fillCSlots slotsPtr (buildBcSlotThunks letEnv env bindings)+       in filled `seq` evalBytecode letEnv bodyIdx+    else do+      -- Dynamic path: a dynamic key, which the parser refuses in a let as+      -- upstream's parser.y does, so only an AST built outside the parser+      -- reaches here.  Keys and values resolve in the let env, which+      -- the body also sees.+      let cset = buildCAttrSetKeys (bcBindingStaticKeys bindings)+          letEnv = newFrameEnv env captureInfo nullPtr 0 (Just (AttrSet cset))+      thunkMap <- buildBcThunkMap mkThunkBc letEnv env bindings+      let filled = fillCAttrSetValues cset thunkMap+       in filled `seq` evalBytecode letEnv bodyIdx++-- | Check if all bytecode bindings are static keys (eligible for positional).+-- Must stay in sync with 'allStaticSingleKey' in 'Nix.Expr.Resolve'.+allBcPositional :: [BcBinding] -> Bool+allBcPositional = all isEligible+  where+    isEligible (BcNamed (BcStaticKey _) _) = True+    isEligible (BcInherit _ _) = True+    isEligible (BcInheritFrom _ _) = True+    isEligible _ = False++-- | Count positional slots for bytecode bindings.+-- Must stay in sync with 'lexicalScopeFromBindings' in 'Nix.Expr.Resolve'.+bcBindingSlotCount :: [BcBinding] -> Int+bcBindingSlotCount = foldl' countOne 0+  where+    countOne !acc (BcNamed (BcStaticKey _) _) = acc + 1+    countOne !acc (BcInherit _ _) = acc + 1+    countOne !acc (BcInheritFrom _ names) = acc + length names+    countOne !acc _ = acc++-- | Build thunks for positional bytecode bindings in declaration order.+-- An inherited variable is read from the enclosing env, as upstream's+-- @ExprAttrs::eval@ and @ExprLet::eval@ evaluate an Inherited attribute+-- there through @maybeThunk@ (eval.cc at 2.24.9); that env is fully+-- built, so the variable's own thunk can be shared now.+buildBcSlotThunks :: Env -> Env -> [BcBinding] -> [Thunk]+buildBcSlotThunks recEnv outerEnv = concatMap slotThunk+  where+    slotThunk (BcNamed (BcStaticKey _) valBcIdx) =+      [mkThunkBc recEnv valBcIdx]+    slotThunk (BcInherit _ valBcIdx) =+      [cheapThunkBc outerEnv valBcIdx]+    slotThunk (BcInheritFrom fromBcIdx names) =+      -- inherit (from) x y z; becomes one thunk per name that selects from the from-expr.+      -- Each thunk gets a minimal env with the from-value at slot 0.+      let fromThunk = mkThunkBc recEnv fromBcIdx+          mkInheritThunk (BcInheritedName _ selectBcIdx) =+            let (sp, sc) = buildCSlots [fromThunk]+                fromEnv = newMinimalEnv sp sc+             in mkSyntheticThunk fromEnv selectBcIdx+       in map mkInheritThunk names+    -- Unreachable: allBcPositional guards this path.+    slotThunk _ = []++-- | Build attr map from slots for positional bytecode bindings.+buildBcAttrMapFromSlots :: [BcBinding] -> [Thunk] -> Map Text Thunk+buildBcAttrMapFromSlots bindings thunks = go bindings thunks Map.empty+  where+    go [] _ !acc = acc+    go (BcNamed (BcStaticKey sym) _ : bs) (t : ts) !acc =+      go bs ts (Map.insert (symbolText (Symbol sym)) t acc)+    go (BcInherit sym _ : bs) (t : ts) !acc =+      go bs ts (Map.insert (symbolText (Symbol sym)) t acc)+    go (BcInheritFrom _ names : bs) ts !acc =+      let (used, rest) = splitAt (length names) ts+          accMerged = foldl' (\a (name, t0) -> Map.insert (inheritedNameText name) t0 a) acc (zip names used)+       in go bs rest accMerged+    -- Unreachable: allBcPositional guards this path.+    go (_ : bs) ts !acc = go bs ts acc++-- | Build thunk map for bytecode attrs (non-rec or fallback rec path).+-- | Build the name-to-thunk map for a set of bindings.+--+-- How a value becomes a thunk is the caller's decision: a non-recursive+-- attr set can resolve constants and in-scope variables immediately, while a+-- frame that is still being tied has to defer everything, since the slots+-- the variables point at are not filled yet.  An inherited variable is read+-- from @outerEnv@, the env around the binding set, which is always built+-- (for a non-recursive set it is @thunkEnv@ itself).+buildBcThunkMap :: (MonadEval m) => (Env -> Word32 -> Thunk) -> Env -> Env -> [BcBinding] -> m (Map Text Thunk)+buildBcThunkMap mkValueThunk thunkEnv outerEnv = foldM addBinding Map.empty+  where+    addBinding acc (BcNamed bcKey valBcIdx) = do+      resolved <- resolveBcKey thunkEnv bcKey+      case resolved of+        Nothing -> pure acc -- null key -> skip+        Just key -> insertChecked acc key (mkValueThunk thunkEnv valBcIdx)+    addBinding acc (BcInherit sym valBcIdx) =+      insertChecked acc (symbolText (Symbol sym)) (cheapThunkBc outerEnv valBcIdx)+    addBinding acc (BcInheritFrom fromBcIdx names) =+      -- inherit (from) name selects name from the from-expr.+      -- Create a small env with the from value at slot 0, then run the+      -- select the compiler made for name against it.+      let addInheritFrom a inherited@(BcInheritedName _ selectBcIdx) =+            let (sp, sc) = buildCSlots [mkThunkBc thunkEnv fromBcIdx]+                fromEnv = newMinimalEnv sp sc+             in insertChecked a (inheritedNameText inherited) (mkSyntheticThunk fromEnv selectBcIdx)+       in foldM addInheritFrom acc names++    -- The parser normalizes static keys to appear exactly once, so a+    -- collision here means an evaluated DYNAMIC key hit an existing+    -- attr - an eval error upstream, never a silent merge.+    insertChecked acc key thunk =+      case Map.lookup key acc of+        Nothing -> pure (Map.insert key thunk acc)+        Just _ -> throwEvalError ("dynamic attribute '" <> key <> "' already defined")++-- | Resolve a bytecode attr key to text.+resolveBcKey :: (MonadEval m) => Env -> BcAttrKey -> m (Maybe Text)+resolveBcKey _env (BcStaticKey sym) = pure (Just (symbolText (Symbol sym)))+resolveBcKey env (BcDynamicKey bcIdx0) = do+  val <- evalBytecode env bcIdx0+  case val of+    VStr s _ -> Just <$> decodedText "dynamic attribute key" s+    VNull -> pure Nothing+    _ -> throwEvalError ("dynamic attribute key must be a string, got " <> typeName val)++-- | Top-level keys knowable without evaluating any dynamic key: static keys+-- and inherited names.  These populate the rec env's name table while the+-- dynamic keys are evaluated, so a dynamic key can reference a static sibling+-- or an enclosing variable (matching C++ Nix's env2), but not another dynamic+-- key.+bcBindingStaticKeys :: [BcBinding] -> [Text]+bcBindingStaticKeys = concatMap oneBinding+  where+    oneBinding (BcNamed (BcStaticKey sym) _) = [symbolText (Symbol sym)]+    oneBinding (BcNamed _ _) = []+    oneBinding (BcInherit sym _) = [symbolText (Symbol sym)]+    oneBinding (BcInheritFrom _ names) = map inheritedNameText names++-- | The attribute name an @inherit (from)@ binds.+inheritedNameText :: BcInheritedName -> Text+inheritedNameText (BcInheritedName sym _) = symbolText (Symbol sym)++-- | True when a binding's top-level key is known statically (a static key or an+-- inherit).  These bindings populate the rec env's name table (C++ Nix's env2);+-- a binding with a dynamic top-level key does not - it is added to the value.+bcBindingIsStatic :: BcBinding -> Bool+bcBindingIsStatic (BcNamed (BcStaticKey _) _) = True+bcBindingIsStatic (BcNamed _ _) = False+bcBindingIsStatic (BcInherit _ _) = True+bcBindingIsStatic (BcInheritFrom _ _) = True++-- ---------------------------------------------------------------------------+-- Search paths (<nixpkgs>, <nixpkgs/lib>)+-- ---------------------------------------------------------------------------++-- | Evaluate a search path expression.+-- Desugars to @builtins.findFile builtins.nixPath "name"@ - exactly how+-- real Nix handles @\<name\>@ expressions.+evalSearchPath :: (MonadEval m) => Env -> Text -> m NixValue+evalSearchPath env name = do+  builtinsVal <- evalVar env "builtins"+  case builtinsVal of+    VAttrs builtinsAttrs ->+      case attrSetLookup "nixPath" builtinsAttrs of+        Just nixPathThunk -> do+          nixPathVal <- force nixPathThunk+          builtinFindFile nixPathVal (mkStr name)+        Nothing -> searchPathMiss name+    _ -> searchPathMiss name++-- | A lookup that matched no entry.  A CATCHABLE error (upstream raises+-- ThrownError here): nixpkgs' impure.nix wraps @<nixpkgs-overlays>@ in+-- @tryEval@ and relies on catching the miss.  The wording is upstream's+-- @findFile@: under @pure-eval@ the search path is empty by construction,+-- and the message says so instead of pointing at @NIX_PATH@.+searchPathMiss :: (MonadEval m) => Text -> m a+searchPathMiss name = do+  policy <- evalPolicy+  throwCatchableError $+    if epPureEval policy+      then "cannot look up '<" <> name <> ">' in pure evaluation mode (use '--impure' to override)"+      else "file '" <> name <> "' was not found in the Nix search path (add it using $NIX_PATH or -I)"++-- ---------------------------------------------------------------------------+-- Variables+-- ---------------------------------------------------------------------------++evalVar :: (MonadEval m) => Env -> Text -> m NixValue+evalVar env name =+  case envLookup name env of+    Just thunk -> force thunk+    Nothing -> throwEvalError (undefinedVariableMessage name)++-- | Evaluate a with-scoped variable: check with-scopes first (innermost+-- to outermost), then fall back to the standard name-based lookup+-- (parent chain to builtins).  For trimmed envs ('CapturesWithScopes'),+-- the root scope is already appended to 'envWithScopes' so the+-- with-scope lookup finds builtins without needing a parent chain.+-- Supports both resolved (CAttrSet*) and lazy (CThunk*, tagged with bit 0)+-- with-scope entries.  Lazy entries are forced on first lookup and the+-- pointer is updated in place so subsequent lookups hit the resolved+-- attrset directly.+evalWithVar :: (MonadEval m) => Env -> Text -> m NixValue+evalWithVar env name =+  let (withArr, withCount) = envWithScopesRaw env+   in evalWithVarScopes env name withArr (fromIntegral withCount) 0++evalWithVarScopes :: (MonadEval m) => Env -> Text -> Ptr (Ptr ()) -> Int -> Int -> m NixValue+evalWithVarScopes env name withArr count idx+  | idx >= count = evalVar env name+  | otherwise = do+      let scopePtr = unsafePerformIO (peekElemOff withArr idx)+      if isLazyWithScope scopePtr+        then do+          -- Lazy with-scope: force the thunk to get the attrset+          let thunkPtr = untagWithScope scopePtr+          scopeVal <- force (Thunk thunkPtr)+          case scopeVal of+            VAttrs (AttrSet cset) -> do+              -- Cache: replace the tagged thunk pointer with the resolved+              -- attrset pointer so future lookups are fast.+              let resolvedPtr = castPtr cset+              seq (unsafePerformIO (pokeElemOff withArr idx resolvedPtr)) (pure ())+              case attrSetLookup name (AttrSet cset) of+                Just thunk -> force thunk+                Nothing -> evalWithVarScopes env name withArr count (idx + 1)+            _ -> throwEvalError ("'with' requires a set, got " <> typeName scopeVal)+        else+          -- Resolved attrset scope (normal path)+          case attrSetLookup name (AttrSet (castPtr scopePtr)) of+            Just thunk -> force thunk+            Nothing -> evalWithVarScopes env name withArr count (idx + 1)++-- | Check if a with-scope pointer is tagged as lazy (bit 0 set).+isLazyWithScope :: Ptr () -> Bool+isLazyWithScope ptr = ptrToWordPtr ptr .&. 1 /= 0++-- | Remove the lazy tag from a with-scope pointer, returning a CThunkPtr.+untagWithScope :: Ptr () -> CThunkPtr+untagWithScope ptr =+  let tagged = ptrToWordPtr ptr+   in wordPtrToPtr (tagged .&. complement 1)++-- | Tag a CThunkPtr as a lazy with-scope (set bit 0).+tagLazyWithScope :: CThunkPtr -> Ptr ()+tagLazyWithScope ptr =+  let raw = ptrToWordPtr (castPtr ptr)+   in wordPtrToPtr (raw .|. 1)++-- | Push a lazy (thunk-based) with-scope onto the environment.+-- The scope is NOT forced until a WITH_VAR lookup actually needs it.+{-# NOINLINE pushLazyWithScope #-}+pushLazyWithScope :: Thunk -> Env -> Env+pushLazyWithScope (Thunk thunkPtr) =+  pushWithScopeRaw (tagLazyWithScope thunkPtr)++-- | Push a raw pointer as a with-scope.+{-# NOINLINE pushWithScopeRaw #-}+pushWithScopeRaw :: Ptr () -> Env -> Env+pushWithScopeRaw ptr (Env envPtr) =+  Env (unsafePerformIO (checkedCPtr "nn_env_push_with" =<< cenvPushWith envPtr ptr))++-- ---------------------------------------------------------------------------+-- Formals matching + env helpers (used by evalBcApp, applyValue, etc.)+-- ---------------------------------------------------------------------------++-- | Match a lambda's formals against an argument thunk.+matchFormals :: (MonadEval m) => Env -> EvalFormals -> Thunk -> m Env+matchFormals closureEnv (EFName _) argThunk =+  let (sp, sc) = buildCSlots [argThunk]+   in pure (envFromSlots sp sc closureEnv)+matchFormals closureEnv (EFSet formals allowExtra) argThunk = do+  argVal <- force argThunk+  matchFormalSet closureEnv formals allowExtra argVal Nothing+matchFormals closureEnv (EFNamedSet _ formals allowExtra) argThunk = do+  argVal <- force argThunk+  matchFormalSet closureEnv formals allowExtra argVal (Just argThunk)++-- | Match destructuring set pattern formals against an attrset value.+matchFormalSet :: (MonadEval m) => Env -> [EvalFormal] -> Bool -> NixValue -> Maybe Thunk -> m Env+matchFormalSet closureEnv formals allowExtra argVal atThunk =+  case argVal of+    VAttrs attrs -> do+      checkExtraKeys formals allowExtra attrs+      checkMissingFormals attrs formals+      -- A knot, and its laziness is load-bearing: formalEnv is built from+      -- the slots, and a default's thunk in the slots holds formalEnv, the+      -- env a default is evaluated in (it may name another formal or the+      -- @-pattern), as upstream's callFunction allocates env2 before it+      -- fills the values (eval.cc).  'mkThunkBc' keeps that env unforced+      -- behind a StablePtr; 'cheapThunkBc' would look a variable default+      -- up in formalEnv while formalEnv is being built, and fail <<loop>>.+      let formalEnv = envFromSlots formalSlotsPtr formalSlotCount closureEnv+          (formalSlotsPtr, formalSlotCount) = buildCSlots formalThunks+          formalThunks = case atThunk of+            Nothing -> map resolveOneFormal formals+            Just at -> at : map resolveOneFormal formals+          resolveOneFormal (EvalFormal name defBcIdx) =+            case attrSetLookup name attrs of+              Just thunk -> thunk+              Nothing -> case defBcIdx of+                Just bcIdx -> mkThunkBc formalEnv bcIdx+                Nothing -> error "matchFormalSet: missing required formal (unreachable)"+      pure formalEnv+    _ -> throwEvalError ("function expects a set argument, got " <> typeName argVal)++checkExtraKeys :: (MonadEval m) => [EvalFormal] -> Bool -> AttrSet -> m ()+checkExtraKeys _ True _ = pure ()+checkExtraKeys formals False attrs =+  let expected = map efName formals+      actual = attrSetKeys attrs+      extra = filter (`notElem` expected) actual+   in case extra of+        [] -> pure ()+        (k : _) -> throwEvalError ("unexpected attribute '" <> k <> "' in function argument")++checkMissingFormals :: (MonadEval m) => AttrSet -> [EvalFormal] -> m ()+checkMissingFormals attrs formals =+  let allMissing = [efName f | f <- formals, isNothing (efDefault f), not (attrSetMember (efName f) attrs)]+   in case allMissing of+        [] -> pure ()+        (name : _) ->+          let provided = attrSetKeys attrs+              provSnippet = T.intercalate ", " (take 20 provided)+              missSnippet = T.intercalate ", " allMissing+           in throwEvalError ("missing required attribute '" <> name <> "'; all missing: [" <> missSnippet <> "]; provided keys (" <> T.pack (show (length provided)) <> "): [" <> provSnippet <> "]")++-- | Build capture environment from capture info.+-- NoCaptureInfo: no trimming, use env as-is.+-- Captures: build minimal env from captured slots.+-- CapturesWithScopes: build minimal env + copy with-scopes.+buildCaptureEnv :: Env -> CaptureInfo -> Env+buildCaptureEnv env NoCaptureInfo = env+buildCaptureEnv env (Captures captureList) =+  let (slotsPtr, slotCount) = buildCSlots [envLookupResolved lvl idx env | (lvl, idx) <- captureList]+   in newMinimalEnv slotsPtr slotCount+buildCaptureEnv env (CapturesWithScopes captureList) =+  let (slotsPtr, slotCount) = buildCSlots [envLookupResolved lvl idx env | (lvl, idx) <- captureList]+      (withArr, withCount) = withScopesForCapture env+   in newCEnv slotsPtr slotCount Nothing Nothing withArr withCount++-- ---------------------------------------------------------------------------+-- Builtin registry (single-definition-site for all builtins)+-- ---------------------------------------------------------------------------++-- | A builtin function definition: its arity and implementation.+data BuiltinDef m = BuiltinDef+  { bdArity :: !Int,+    bdApply :: [NixValue] -> m NixValue+  }++-- | Define an arity-1 builtin.+builtin1 :: (MonadEval m) => Text -> (NixValue -> m NixValue) -> (Text, BuiltinDef m)+builtin1 name f =+  ( name,+    BuiltinDef 1 $ \case+      [a] -> f a+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+  )++-- | Define an arity-2 builtin.+builtin2 ::+  (MonadEval m) =>+  Text ->+  (NixValue -> NixValue -> m NixValue) ->+  (Text, BuiltinDef m)+builtin2 name f =+  ( name,+    BuiltinDef 2 $ \case+      [a, b] -> f a b+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+  )++-- | Define an arity-3 builtin.+builtin3 ::+  (MonadEval m) =>+  Text ->+  (NixValue -> NixValue -> NixValue -> m NixValue) ->+  (Text, BuiltinDef m)+builtin3 name f =+  ( name,+    BuiltinDef 3 $ \case+      [a, b, c] -> f a b c+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+  )++-- | Central registry of all builtins.  Adding a new builtin is a single+-- entry here plus its implementation function - no other files need changes.+builtinRegistry :: (MonadEval m) => Map Text (BuiltinDef m)+builtinRegistry =+  Map.fromList+    [ -- Type checking (arity 1)+      builtin1 "typeOf" (pure . mkStr . typeOfValue),+      builtin1 "isNull" (pure . VBool . isNullVal),+      builtin1 "isInt" (pure . VBool . isIntVal),+      builtin1 "isFloat" (pure . VBool . isFloatVal),+      builtin1 "isBool" (pure . VBool . isBoolVal),+      builtin1 "isString" (pure . VBool . isStringVal),+      builtin1 "isList" (pure . VBool . isListVal),+      builtin1 "isAttrs" (pure . VBool . isAttrsVal),+      builtin1 "isFunction" (pure . VBool . isFunctionVal),+      -- List operations (arity 1)+      builtin1 "length" builtinLength,+      builtin1 "head" builtinHead,+      builtin1 "tail" builtinTail,+      -- String operations (arity 1)+      builtin1 "toString" (fmap (uncurry VStr) . coerceToStringPermissive),+      builtin1 "stringLength" builtinStringLength,+      -- Control (arity 1)+      builtin1 "throw" builtinThrow,+      builtin1 "abort" builtinAbort,+      -- Attr set operations (arity 1)+      builtin1 "attrNames" builtinAttrNames,+      builtin1 "attrValues" builtinAttrValues,+      builtin1 "listToAttrs" builtinListToAttrs,+      -- Attr set operations (arity 2)+      builtin2 "hasAttr" builtinHasAttr,+      builtin2 "getAttr" builtinGetAttr,+      builtin2 "removeAttrs" builtinRemoveAttrs,+      builtin2 "intersectAttrs" builtinIntersectAttrs,+      builtin2 "catAttrs" builtinCatAttrs,+      -- List higher-order (arity 2)+      builtin2 "map" builtinMap,+      builtin2 "filter" builtinFilter,+      builtin2 "genList" builtinGenList,+      builtin2 "sort" builtinSort,+      builtin2 "concatMap" builtinConcatMap,+      builtin2 "any" builtinAny,+      builtin2 "all" builtinAll,+      builtin2 "elem" builtinElem,+      builtin2 "elemAt" builtinElemAt,+      builtin2 "partition" builtinPartition,+      builtin2 "groupBy" builtinGroupBy,+      -- String operations (arity 2)+      builtin2 "concatStringsSep" builtinConcatStringsSep,+      -- Arity 3+      builtin3 "foldl'" builtinFoldl,+      builtin3 "substring" builtinSubstring,+      -- Numeric+      builtin1 "isPath" (pure . VBool . isPathVal),+      builtin1 "ceil" builtinCeil,+      builtin1 "floor" builtinFloor,+      builtin2 "seq" builtinSeq,+      builtin2 "trace" builtinTrace,+      builtin2 "warn" builtinWarn,+      builtin1 "unsafeDiscardStringContext" builtinDiscardContext,+      builtin1 "unsafeDiscardOutputDependency" builtinDiscardOutputDep,+      builtin1 "addDrvOutputDependencies" builtinAddDrvOutputDeps,+      -- String context introspection+      builtin1 "hasContext" builtinHasContext,+      builtin1 "getContext" builtinGetContext,+      builtin2 "appendContext" builtinAppendContext,+      builtin1 "baseNameOf" builtinBaseNameOf,+      builtin1 "dirOf" builtinDirOf,+      builtin1 "concatLists" builtinConcatLists,+      builtin2 "lessThan" builtinLessThan,+      -- Arithmetic + bitwise+      builtin2 "add" primAdd,+      builtin2 "sub" primSub,+      builtin2 "mul" primMul,+      builtin2 "div" primDiv,+      builtin2 "bitAnd" (bitwise (.&.)),+      builtin2 "bitOr" (bitwise (.|.)),+      builtin2 "bitXor" (bitwise xor),+      -- Attr set higher-order+      builtin2 "mapAttrs" builtinMapAttrs,+      builtin1 "functionArgs" builtinFunctionArgs,+      builtin2 "zipAttrsWith" builtinZipAttrsWith,+      -- String manipulation+      builtin2 "match" builtinMatch,+      builtin2 "split" builtinSplit,+      builtin3 "replaceStrings" builtinReplaceStrings,+      builtin2 "compareVersions" builtinCompareVersions,+      builtin1 "splitVersion" builtinSplitVersion,+      builtin1 "parseDrvName" builtinParseDrvName,+      -- Serialization + hashing+      builtin1 "toJSON" builtinToJSON,+      builtin1 "fromJSON" builtinFromJSON,+      builtin2 "hashString" builtinHashString,+      -- Error handling + sequencing+      -- An argument reaching here is already forced (any throw happened+      -- before tryEval saw it), so it success-wraps; the catching paths+      -- are evalBcApp and applyValueLazy.+      builtin1 "tryEval" (tryEvalAction . pure),+      builtin2 "deepSeq" builtinDeepSeq,+      -- Graph traversal+      builtin1 "genericClosure" builtinGenericClosure,+      -- IO builtins (delegate to MonadEval methods)+      builtin1 "import" builtinImport,+      builtin1 "readFile" builtinReadFile,+      builtin1 "pathExists" builtinPathExists,+      builtin1 "readDir" builtinReadDir,+      builtin1 "getEnv" builtinGetEnv,+      builtin1 "toPath" builtinToPath,+      -- Store path operations+      builtin1 "placeholder" builtinPlaceholder,+      builtin1 "storePath" builtinStorePath,+      builtin2 "findFile" builtinFindFile,+      builtin2 "toFile" builtinToFile,+      builtin2 "scopedImport" builtinScopedImport,+      -- Network fetchers+      builtin1 "fetchurl" builtinFetchurl,+      builtin1 "fetchTarball" builtinFetchTarball,+      builtin1 "fetchGit" builtinFetchGit,+      -- Derivation construction.  The lazy 'derivation' wrapper is not a+      -- primop: it is upstream's derivation.nix, bound as a constant by+      -- "Nix.Builtins".+      builtin1 "derivationStrict" builtinDerivationStrict,+      -- Error context (pass-through - context only matters on error)+      builtin2 "addErrorContext" (\_ val -> pure val),+      -- Attr position (return null - nixpkgs handles this gracefully)+      builtin2 "unsafeGetAttrPos" (\_ _ -> pure VNull),+      -- Debugging (traceVerbose: same as trace for now, --trace-verbose not yet gated)+      builtin2 "traceVerbose" builtinTrace,+      builtin1 "break" pure,+      -- IO: file hashing + type detection+      builtin2 "hashFile" builtinHashFile,+      builtin1 "readFileType" builtinReadFileType,+      -- Serialization+      builtin1 "fromTOML" builtinFromTOML,+      -- Hash conversion+      builtin1 "convertHash" builtinConvertHash,+      -- XML serialization+      builtin1 "toXML" builtinToXML,+      -- Source filtering + path import+      builtin1 "path" builtinPath,+      builtin2 "filterSource" builtinFilterSource,+      -- Experimental feature stubs+      builtin2 "outputOf" builtinOutputOf,+      builtin1 "fetchTree" builtinFetchTree,+      builtin1 "fetchClosure" builtinFetchClosure+    ]++-- | Names of all registered builtins.+builtinNames :: [Text]+builtinNames = Map.keys (builtinRegistry :: Map Text (BuiltinDef PureEval))++-- ---------------------------------------------------------------------------+-- Builtin dispatch (partial application via accumulated args)+-- ---------------------------------------------------------------------------++-- | Arity of a builtin (how many arguments before execution).+builtinArity :: Text -> Int+builtinArity name = maybe 1 bdArity (Map.lookup name (builtinRegistry :: Map Text (BuiltinDef PureEval)))++-- | Apply a builtin with accumulated args.  If we have enough args,+-- execute; otherwise return a partially applied builtin.+applyBuiltin :: (MonadEval m) => Text -> [NixValue] -> NixValue -> m NixValue+applyBuiltin name accArgs arg =+  let allArgs = accArgs ++ [arg]+      arity = builtinArity name+   in if length allArgs < arity+        then pure (VBuiltin name (precompileArgs name allArgs))+        else executeBuiltin name allArgs++-- | Pre-compile regex patterns at partial application time.+-- When builtins.match or builtins.split receives its first argument+-- (the pattern string), compile it immediately and store the compiled+-- RE.Regex in a VCompiledRegex, replacing the raw VStr.  The compiled+-- form is carried in VBuiltin's accumulated args and reused on every+-- subsequent application - zero recompilation.  Both builtins compile+-- the RAW pattern: match's whole-string requirement is a span check at+-- match time, not textual @^...$@ anchoring, which would misparse a+-- top-level alternation (@^a|b$@ is @(^a)|(b$)@).+precompileArgs :: Text -> [NixValue] -> [NixValue]+precompileArgs "match" [VStr pat _] = compiledRegexArg pat+precompileArgs "split" [VStr pat _] = compiledRegexArg pat+precompileArgs _ args = args++-- | The single-element arg list for a regex builtin: the compiled pattern+-- if valid, the raw string otherwise (the error surfaces at execute time).+compiledRegexArg :: BS.ByteString -> [NixValue]+compiledRegexArg pat = case cachedCompileRegex pat of+  Just compiled -> [VCompiledRegex (CompiledRegex pat compiled)]+  Nothing -> [VStr pat emptyContext]++-- | Apply a function value (lambda or builtin) to one argument, in a call+-- frame of its own.  Used by higher-order builtins to invoke+-- user-supplied functions.+applyValue :: (MonadEval m) => NixValue -> NixValue -> m NixValue+applyValue fun arg = withCallFrame (applyForced fun arg)++-- | 'applyValue' inside the caller's frame.+applyForced :: (MonadEval m) => NixValue -> NixValue -> m NixValue+applyForced (VLambda closureEnv formals bodyBcIdx) arg = do+  extEnv <- matchFormals closureEnv formals (evaluated arg)+  evalBytecode extEnv bodyBcIdx+applyForced (VBuiltin name accArgs) arg =+  applyBuiltin name accArgs arg+applyForced other _ =+  throwEvalError ("attempt to call " <> typeName other <> ", which is not a function")++-- | Apply a function value to an UNFORCED thunk argument.  Upstream's+-- higher-order list builtins (filter, any, all, partition, groupBy,+-- foldl') pass elements as unforced values, so an element the function+-- never inspects may contain a throw without failing the call.  A+-- builtin callee still receives a forced value (builtins force their+-- arguments regardless), and set-pattern formals force on destructuring+-- exactly as upstream does.+applyValueLazy :: (MonadEval m) => NixValue -> Thunk -> m NixValue+applyValueLazy fun argThunk = withCallFrame (applyUnforced fun argThunk)++-- | 'applyValueLazy' inside the caller's frame.+applyUnforced :: (MonadEval m) => NixValue -> Thunk -> m NixValue+applyUnforced (VLambda closureEnv formals bodyBcIdx) argThunk = do+  extEnv <- matchFormals closureEnv formals argThunk+  evalBytecode extEnv bodyBcIdx+-- tryEval's catch must wrap the argument's forcing (see 'tryEvalAction'):+-- map/filter passing a throwing element to tryEval yields success = false,+-- not an escaped error.+applyUnforced (VBuiltin "tryEval" []) argThunk = tryEvalAction (force argThunk)+applyUnforced (VBuiltin name [first]) argThunk+  | Just finishFirst <- beforeSecondArgument name first = finishFirst >> force argThunk+applyUnforced other argThunk = do+  val <- force argThunk+  applyForced other val++-- | Execute a builtin once all arguments are collected.+--+-- Direct case dispatch avoids rebuilding the polymorphic 'builtinRegistry'+-- Map on every call.  'builtinRegistry' is polymorphic in @m@ so GHC+-- cannot cache it as a CAF - it gets reconstructed on every use.+-- Pattern matching on the name is zero-allocation.+executeBuiltin :: (MonadEval m) => Text -> [NixValue] -> m NixValue+executeBuiltin name args = case name of+  -- Type checking (arity 1)+  "typeOf" -> apply1 (pure . mkStr . typeOfValue)+  "isNull" -> apply1 (pure . VBool . isNullVal)+  "isInt" -> apply1 (pure . VBool . isIntVal)+  "isFloat" -> apply1 (pure . VBool . isFloatVal)+  "isBool" -> apply1 (pure . VBool . isBoolVal)+  "isString" -> apply1 (pure . VBool . isStringVal)+  "isList" -> apply1 (pure . VBool . isListVal)+  "isAttrs" -> apply1 (pure . VBool . isAttrsVal)+  "isFunction" -> apply1 (pure . VBool . isFunctionVal)+  -- List operations (arity 1)+  "length" -> apply1 builtinLength+  "head" -> apply1 builtinHead+  "tail" -> apply1 builtinTail+  -- String operations (arity 1)+  "toString" -> apply1 (fmap (uncurry VStr) . coerceToStringPermissive)+  "stringLength" -> apply1 builtinStringLength+  -- Control (arity 1)+  "throw" -> apply1 builtinThrow+  "abort" -> apply1 builtinAbort+  -- Attr set operations (arity 1)+  "attrNames" -> apply1 builtinAttrNames+  "attrValues" -> apply1 builtinAttrValues+  "listToAttrs" -> apply1 builtinListToAttrs+  -- Attr set operations (arity 2)+  "hasAttr" -> apply2 builtinHasAttr+  "getAttr" -> apply2 builtinGetAttr+  "removeAttrs" -> apply2 builtinRemoveAttrs+  "intersectAttrs" -> apply2 builtinIntersectAttrs+  "catAttrs" -> apply2 builtinCatAttrs+  -- List higher-order (arity 2)+  "map" -> apply2 builtinMap+  "filter" -> apply2 builtinFilter+  "genList" -> apply2 builtinGenList+  "sort" -> apply2 builtinSort+  "concatMap" -> apply2 builtinConcatMap+  "any" -> apply2 builtinAny+  "all" -> apply2 builtinAll+  "elem" -> apply2 builtinElem+  "elemAt" -> apply2 builtinElemAt+  "partition" -> apply2 builtinPartition+  "groupBy" -> apply2 builtinGroupBy+  -- String operations (arity 2)+  "concatStringsSep" -> apply2 builtinConcatStringsSep+  -- Arity 3+  "foldl'" -> apply3 builtinFoldl+  "substring" -> apply3 builtinSubstring+  -- Numeric+  "isPath" -> apply1 (pure . VBool . isPathVal)+  "ceil" -> apply1 builtinCeil+  "floor" -> apply1 builtinFloor+  "seq" -> apply2 builtinSeq+  "trace" -> apply2 builtinTrace+  "warn" -> apply2 builtinWarn+  "unsafeDiscardStringContext" -> apply1 builtinDiscardContext+  "unsafeDiscardOutputDependency" -> apply1 builtinDiscardOutputDep+  "addDrvOutputDependencies" -> apply1 builtinAddDrvOutputDeps+  -- String context introspection+  "hasContext" -> apply1 builtinHasContext+  "getContext" -> apply1 builtinGetContext+  "appendContext" -> apply2 builtinAppendContext+  "baseNameOf" -> apply1 builtinBaseNameOf+  "dirOf" -> apply1 builtinDirOf+  "concatLists" -> apply1 builtinConcatLists+  "lessThan" -> apply2 builtinLessThan+  -- Arithmetic + bitwise+  "add" -> apply2 primAdd+  "sub" -> apply2 primSub+  "mul" -> apply2 primMul+  "div" -> apply2 primDiv+  "bitAnd" -> apply2 (bitwise (.&.))+  "bitOr" -> apply2 (bitwise (.|.))+  "bitXor" -> apply2 (bitwise xor)+  -- Attr set higher-order+  "mapAttrs" -> apply2 builtinMapAttrs+  "functionArgs" -> apply1 builtinFunctionArgs+  "zipAttrsWith" -> apply2 builtinZipAttrsWith+  -- String manipulation+  "match" -> apply2 builtinMatch+  "split" -> apply2 builtinSplit+  "replaceStrings" -> apply3 builtinReplaceStrings+  "compareVersions" -> apply2 builtinCompareVersions+  "splitVersion" -> apply1 builtinSplitVersion+  "parseDrvName" -> apply1 builtinParseDrvName+  -- Serialization + hashing+  "toJSON" -> apply1 builtinToJSON+  "fromJSON" -> apply1 builtinFromJSON+  "hashString" -> apply2 builtinHashString+  -- Error handling + sequencing+  -- Already-forced argument: success-wrap (see the registry entry).+  "tryEval" -> apply1 (tryEvalAction . pure)+  "deepSeq" -> apply2 builtinDeepSeq+  -- Graph traversal+  "genericClosure" -> apply1 builtinGenericClosure+  -- IO builtins (delegate to MonadEval methods)+  "import" -> apply1 builtinImport+  "readFile" -> apply1 builtinReadFile+  "pathExists" -> apply1 builtinPathExists+  "readDir" -> apply1 builtinReadDir+  "getEnv" -> apply1 builtinGetEnv+  "toPath" -> apply1 builtinToPath+  -- Store path operations+  "placeholder" -> apply1 builtinPlaceholder+  "storePath" -> apply1 builtinStorePath+  "findFile" -> apply2 builtinFindFile+  "toFile" -> apply2 builtinToFile+  "scopedImport" -> apply2 builtinScopedImport+  -- Network fetchers+  "fetchurl" -> apply1 builtinFetchurl+  "fetchTarball" -> apply1 builtinFetchTarball+  "fetchGit" -> apply1 builtinFetchGit+  -- Derivation construction+  "derivationStrict" -> apply1 builtinDerivationStrict+  -- Error context (pass-through - context only matters on error)+  "addErrorContext" -> apply2 (\_ val -> pure val)+  -- Attr position (return null - nixpkgs handles this gracefully)+  "unsafeGetAttrPos" -> apply2 (\_ _ -> pure VNull)+  -- Debugging (traceVerbose: same as trace for now)+  "traceVerbose" -> apply2 builtinTrace+  "break" -> apply1 pure+  -- IO: file hashing + type detection+  "hashFile" -> apply2 builtinHashFile+  "readFileType" -> apply1 builtinReadFileType+  -- Serialization+  "fromTOML" -> apply1 builtinFromTOML+  -- Hash conversion+  "convertHash" -> apply1 builtinConvertHash+  -- XML serialization+  "toXML" -> apply1 builtinToXML+  -- Source filtering + path import+  "path" -> apply1 builtinPath+  "filterSource" -> apply2 builtinFilterSource+  -- Experimental feature stubs+  "outputOf" -> apply2 builtinOutputOf+  "fetchTree" -> apply1 builtinFetchTree+  "fetchClosure" -> apply1 builtinFetchClosure+  _ -> throwEvalError ("unknown builtin '" <> name <> "'")+  where+    apply1 f = case args of+      [a] -> f a+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+    apply2 f = case args of+      [a, b] -> f a b+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")+    apply3 f = case args of+      [a, b, c] -> f a b c+      _ -> throwEvalError ("builtins." <> name <> ": internal arity error")++-- ---------------------------------------------------------------------------+-- Builtin implementations - type checking+-- ---------------------------------------------------------------------------++isNullVal :: NixValue -> Bool+isNullVal VNull = True+isNullVal _ = False++isIntVal :: NixValue -> Bool+isIntVal (VInt _) = True+isIntVal _ = False++isFloatVal :: NixValue -> Bool+isFloatVal (VFloat _) = True+isFloatVal _ = False++isBoolVal :: NixValue -> Bool+isBoolVal (VBool _) = True+isBoolVal _ = False++isStringVal :: NixValue -> Bool+isStringVal (VStr _ _) = True+isStringVal _ = False++isListVal :: NixValue -> Bool+isListVal (VList _) = True+isListVal _ = False++isAttrsVal :: NixValue -> Bool+isAttrsVal (VAttrs _) = True+isAttrsVal _ = False++isFunctionVal :: NixValue -> Bool+isFunctionVal (VLambda {}) = True+isFunctionVal (VBuiltin _ _) = True+isFunctionVal _ = False++-- ---------------------------------------------------------------------------+-- Builtin implementations - list (arity 1)+-- ---------------------------------------------------------------------------++builtinLength :: (MonadEval m) => NixValue -> m NixValue+builtinLength (VList cl) = pure (VInt (fromIntegral (clistLen cl)))+builtinLength other = throwEvalError (expectedList other)++-- | 2.24.9's @prim_head@ is its @elemAt@ at index 0, so an empty list+-- fails as an index past the end does.  From 2.26.0 upstream says+-- @'builtins.head' called on an empty list@ instead.+builtinHead :: (MonadEval m) => NixValue -> m NixValue+builtinHead (VList cl) = listElemAt cl 0+builtinHead other = throwEvalError (expectedList other)++-- | The result shares the argument's C array where upstream's+-- @prim_tail@ copies the elements after the first: a copy costs time and+-- arena memory in the list's length on every call, and sharing cannot be+-- observed because a list is never written after construction.  The+-- empty-list message is 2.24.9's; from 2.26.0 upstream says+-- @'builtins.tail' called on an empty list@.+builtinTail :: (MonadEval m) => NixValue -> m NixValue+builtinTail (VList cl)+  | clistLen cl == 0 = throwEvalError "'tail' called on an empty list"+  | otherwise = pure (VList (clistDrop 1 cl))+builtinTail other = throwEvalError (expectedList other)++-- | Upstream's @forceList@ failure (eval-inline.hh at 2.24.9).+expectedList :: NixValue -> Text+expectedList other =+  "expected a list but found " <> typeName other <> ": " <> printValue PrintForError other++-- | The element at an index, failing as the @elemAt@ helper behind+-- @prim_elemAt@ and @prim_head@ does (primops.cc at 2.24.9).  That helper+-- takes the index as a C @int@, so an index past 32 bits wraps there+-- before its bounds check; the whole index is checked here, as 2.33.2+-- checks it.  2.26.0 replaced the message with+-- @'builtins.elemAt' called with index N on a list of size M@.+listElemAt :: (MonadEval m) => CList -> Int64 -> m NixValue+listElemAt cl idx =+  maybe (throwEvalError ("list index " <> T.pack (show idx) <> " is out of bounds")) (force . Thunk) (clistIndex cl (fromIntegral idx))++-- ---------------------------------------------------------------------------+-- Builtin implementations - string (arity 1)+-- ---------------------------------------------------------------------------++-- | Byte length, as upstream: stringLength of a 2-byte character is 2, not 1.+builtinStringLength :: (MonadEval m) => NixValue -> m NixValue+builtinStringLength value = VInt . fromIntegral . BS.length . fst <$> coerceToStringInterp value++-- ---------------------------------------------------------------------------+-- Builtin implementations - control+-- ---------------------------------------------------------------------------++-- | The error channel is Text and display-only (tryEval discards the+-- message), so throw/abort messages decode lossily.+builtinThrow :: (MonadEval m) => NixValue -> m NixValue+builtinThrow (VStr msg _) = throwCatchableError (bytesToTextLossy msg)+builtinThrow other = throwEvalError ("builtins.throw: expected a string, got " <> typeName other)++builtinAbort :: (MonadEval m) => NixValue -> m NixValue+builtinAbort (VStr msg _) = abortEvaluation (bytesToTextLossy msg)+builtinAbort other = abortEvaluation ("builtins.abort: expected a string, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - attr set (arity 1)+-- ---------------------------------------------------------------------------++builtinAttrNames :: (MonadEval m) => NixValue -> m NixValue+builtinAttrNames (VAttrs attrs) =+  -- Nix returns attribute names lexicographically sorted; the C array is in+  -- interned-symbol order, so sort here (consistent with builtins.attrValues,+  -- which sorts via attrSetElems).+  let thunks = map (evaluated . mkStr) (sort (attrSetKeys attrs))+   in pure (VList (clistFromThunks (map thunkToCPtr thunks)))+builtinAttrNames other =+  throwEvalError ("builtins.attrNames: expected a set, got " <> typeName other)++builtinAttrValues :: (MonadEval m) => NixValue -> m NixValue+builtinAttrValues (VAttrs attrs) =+  pure (VList (clistFromThunks (map thunkToCPtr (attrSetElems attrs))))+builtinAttrValues other =+  throwEvalError ("builtins.attrValues: expected a set, got " <> typeName other)++builtinListToAttrs :: (MonadEval m) => NixValue -> m NixValue+builtinListToAttrs (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  pairs <- mapM listToAttrsPair thunks+  -- Nix listToAttrs uses first-wins: if duplicate name, first element wins.+  let firstWins = Map.fromListWith (\_ kept -> kept) pairs+  pure (VAttrs (attrSetFromMap firstWins))+builtinListToAttrs other =+  throwEvalError ("builtins.listToAttrs: expected a list, got " <> typeName other)++-- | Extract { name, value } from a thunk for listToAttrs.+listToAttrsPair :: (MonadEval m) => Thunk -> m (Text, Thunk)+listToAttrsPair thunk = do+  val <- force thunk+  case val of+    VAttrs attrs -> do+      nameThunk <-+        maybe (throwEvalError "builtins.listToAttrs: element missing 'name'") pure $+          attrSetLookup "name" attrs+      nameVal <- force nameThunk+      case nameVal of+        VStr keyName _ ->+          case attrSetLookup "value" attrs of+            Just valueThunk -> do+              key <- decodedText "builtins.listToAttrs: attribute name" keyName+              pure (key, valueThunk)+            Nothing -> throwEvalError "builtins.listToAttrs: element missing 'value'"+        _ -> throwEvalError "builtins.listToAttrs: 'name' must be a string"+    _ -> throwEvalError "builtins.listToAttrs: element must be a set"++-- ---------------------------------------------------------------------------+-- Builtin implementations - attr set (arity 2)+-- ---------------------------------------------------------------------------++builtinHasAttr :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinHasAttr (VStr key _) (VAttrs attrs) = do+  name <- decodedText "builtins.hasAttr" key+  pure (VBool (attrSetMember name attrs))+builtinHasAttr (VStr _ _) other =+  throwEvalError ("builtins.hasAttr: expected a set, got " <> typeName other)+builtinHasAttr other _ =+  throwEvalError ("builtins.hasAttr: expected a string, got " <> typeName other)++builtinGetAttr :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinGetAttr (VStr key _) (VAttrs attrs) = do+  name <- decodedText "builtins.getAttr" key+  case attrSetLookup name attrs of+    Just thunk -> force thunk+    Nothing -> throwEvalError ("builtins.getAttr: attribute '" <> name <> "' not found")+builtinGetAttr (VStr _ _) other =+  throwEvalError ("builtins.getAttr: expected a set, got " <> typeName other)+builtinGetAttr other _ =+  throwEvalError ("builtins.getAttr: expected a string, got " <> typeName other)++builtinRemoveAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinRemoveAttrs (VAttrs attrs) (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  keys <- mapM forceToString thunks+  pure (VAttrs (attrSetRemoveKeys keys attrs))+  where+    forceToString thunk = do+      val <- force thunk+      case val of+        VStr s _ -> decodedText "builtins.removeAttrs" s+        _ -> throwEvalError "builtins.removeAttrs: key list must contain strings"+builtinRemoveAttrs (VAttrs _) other =+  throwEvalError ("builtins.removeAttrs: expected a list, got " <> typeName other)+builtinRemoveAttrs other _ =+  throwEvalError ("builtins.removeAttrs: expected a set, got " <> typeName other)++builtinIntersectAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinIntersectAttrs (VAttrs a) (VAttrs b) =+  -- Iterate keys of 'a' (typically the smaller set, e.g. functionArgs)+  -- and point-lookup each in 'b' (typically the large set, e.g. nixpkgs).+  -- This avoids materializing all thunks in 'b'.+  let keysA = attrSetKeys a+      result = Map.fromList [(k, thunk) | k <- keysA, Just thunk <- [attrSetLookup k b]]+   in pure (VAttrs (attrSetFromMap result))+builtinIntersectAttrs (VAttrs _) other =+  throwEvalError ("builtins.intersectAttrs: expected a set, got " <> typeName other)+builtinIntersectAttrs other _ =+  throwEvalError ("builtins.intersectAttrs: expected a set, got " <> typeName other)++builtinCatAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinCatAttrs (VStr key _) (VList cl) = do+  name <- decodedText "builtins.catAttrs" key+  let thunks = map Thunk (clistThunks cl)+  vals <- catAttrsCollect name thunks+  pure (VList (clistFromThunks (map thunkToCPtr vals)))+builtinCatAttrs (VStr _ _) other =+  throwEvalError ("builtins.catAttrs: expected a list, got " <> typeName other)+builtinCatAttrs other _ =+  throwEvalError ("builtins.catAttrs: expected a string, got " <> typeName other)++-- | Collect values for a given key from a list of attrsets.+-- Tail-recursive with accumulator to avoid stack overflow on large lists.+catAttrsCollect :: (MonadEval m) => Text -> [Thunk] -> m [Thunk]+catAttrsCollect key = go []+  where+    go !acc [] = pure (reverse acc)+    go !acc (thunk : rest) = do+      val <- force thunk+      case val of+        VAttrs attrs ->+          case attrSetLookup key attrs of+            Just found -> go (found : acc) rest+            Nothing -> go acc rest+        _ -> throwEvalError "builtins.catAttrs: list element must be a set"++-- ---------------------------------------------------------------------------+-- Builtin implementations - list higher-order (arity 2)+-- ---------------------------------------------------------------------------++builtinMap :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinMap func (VList cl) =+  -- Lazy: each element is a deferred application, forced only on demand.+  let thunks = map Thunk (clistThunks cl)+   in pure (VList (clistFromThunks (map (thunkToCPtr . deferApply func) thunks)))+builtinMap _ other =+  throwEvalError ("builtins.map: expected a list, got " <> typeName other)++builtinFilter :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinFilter predFn (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  filtered <- filterThunks predFn thunks+  pure (VList (clistFromThunks (map thunkToCPtr filtered)))+builtinFilter _ other =+  throwEvalError ("builtins.filter: expected a list, got " <> typeName other)++filterThunks :: (MonadEval m) => NixValue -> [Thunk] -> m [Thunk]+filterThunks _ [] = pure []+filterThunks predFn (thunk : rest) = do+  result <- applyValueLazy predFn thunk+  case result of+    VBool True -> (thunk :) <$> filterThunks predFn rest+    VBool False -> filterThunks predFn rest+    _ -> throwEvalError "builtins.filter: predicate must return a bool"++builtinGenList :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinGenList func (VInt n)+  | n < 0 = throwEvalError "builtins.genList: length must be non-negative"+  | otherwise =+      -- Lazy: each element is a deferred @f i@, forced only on demand.+      -- The index is an argument value, as upstream's @prim_genList@+      -- allocates an int and an app per element, so every element runs+      -- the same code.+      let fnThunk = evaluated func+          mkIndexThunk = thunkToCPtr . deferApplyThunk fnThunk . evaluated . VInt+       in pure (VList (clistFromThunks (map mkIndexThunk [0 .. n - 1])))+builtinGenList _ other =+  throwEvalError ("builtins.genList: expected an integer, got " <> typeName other)++builtinSort :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinSort comparator (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  vals <- mapM force thunks+  sorted <- mergeSort (sortComparison comparator) vals+  pure (VList (clistFromThunks (map (thunkToCPtr . evaluated) sorted)))+builtinSort _ other =+  throwEvalError ("builtins.sort: expected a list, got " <> typeName other)++-- | The comparison a sort runs between two elements.  A bare+-- @builtins.lessThan@ compares directly, as upstream's @prim_sort@+-- bypasses @callFunction@ for it (primops.cc at 2.24.9) and so opens no+-- call frame; any other comparator is applied as a function, one frame+-- per application.+sortComparison :: (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue+sortComparison (VBuiltin "lessThan" []) a b = builtinLessThan a b+sortComparison cmp a b = applyValue cmp a >>= (`applyValue` b)++-- | Stable O(n log n) merge sort under a comparison answering whether its+-- first argument is strictly less than its second.+mergeSort :: (MonadEval m) => (NixValue -> NixValue -> m NixValue) -> [NixValue] -> m [NixValue]+mergeSort _ [] = pure []+mergeSort _ [x] = pure [x]+mergeSort isLess xs = do+  let half = length xs `div` 2+      (left, right) = splitAt half xs+  sortedLeft <- mergeSort isLess left+  sortedRight <- mergeSort isLess right+  mergeSorted isLess sortedLeft sortedRight++mergeSorted :: (MonadEval m) => (NixValue -> NixValue -> m NixValue) -> [NixValue] -> [NixValue] -> m [NixValue]+mergeSorted _ [] ys = pure ys+mergeSorted _ xs [] = pure xs+mergeSorted isLess (x : xs) (y : ys) = do+  -- Stable merge: take the right element only when it is STRICTLY less than the+  -- left (@isLess y x@).  On a tie - neither strictly less - take the left+  -- element, so comparator-equal elements keep their input order, matching C+++  -- Nix's std::stable_sort.  (Comparing @isLess x y@ instead would emit @y@ on+  -- a tie and reverse equal runs.)+  result <- isLess y x+  case result of+    VBool True -> (y :) <$> mergeSorted isLess (x : xs) ys+    VBool False -> (x :) <$> mergeSorted isLess xs (y : ys)+    _ -> throwEvalError "builtins.sort: comparator must return a bool"++builtinConcatMap :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinConcatMap func (VList cl) = do+  -- Semi-eager: must force each application to discover list structure for+  -- concatenation, but element thunks within those sub-lists stay lazy.+  let thunks = map Thunk (clistThunks cl)+      deferredApps = map (deferApply func) thunks+  results <- mapM force deferredApps+  concatted <- mapM extractList results+  pure (VList (clistFromThunks (map thunkToCPtr (concat concatted))))+builtinConcatMap _ other =+  throwEvalError ("builtins.concatMap: expected a list, got " <> typeName other)++extractList :: (MonadEval m) => NixValue -> m [Thunk]+extractList (VList cl) = pure (map Thunk (clistThunks cl))+extractList other =+  throwEvalError ("builtins.concatMap: function must return a list, got " <> typeName other)++builtinAny :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinAny predFn (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  result <- anyThunk predFn thunks+  pure (VBool result)+builtinAny _ other =+  throwEvalError ("builtins.any: expected a list, got " <> typeName other)++anyThunk :: (MonadEval m) => NixValue -> [Thunk] -> m Bool+anyThunk _ [] = pure False+anyThunk predFn (thunk : rest) = do+  result <- applyValueLazy predFn thunk+  case result of+    VBool True -> pure True+    VBool False -> anyThunk predFn rest+    _ -> throwEvalError "builtins.any: predicate must return a bool"++builtinAll :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinAll predFn (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  result <- allThunk predFn thunks+  pure (VBool result)+builtinAll _ other =+  throwEvalError ("builtins.all: expected a list, got " <> typeName other)++allThunk :: (MonadEval m) => NixValue -> [Thunk] -> m Bool+allThunk _ [] = pure True+allThunk predFn (thunk : rest) = do+  result <- applyValueLazy predFn thunk+  case result of+    VBool True -> allThunk predFn rest+    VBool False -> pure False+    _ -> throwEvalError "builtins.all: predicate must return a bool"++builtinElem :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinElem needle (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  found <- elemCheck needle thunks+  pure (VBool found)+builtinElem _ other =+  throwEvalError ("builtins.elem: expected a list, got " <> typeName other)++elemCheck :: (MonadEval m) => NixValue -> [Thunk] -> m Bool+elemCheck _ [] = pure False+elemCheck needle (thunk : rest) = do+  val <- force thunk+  eq <- nixEqual force needle val+  if eq then pure True else elemCheck needle rest++-- | The index is checked before the list: @prim_elemAt@ forces it with+-- @forceInt@ (eval.cc) before its @elemAt@ forces the list.+builtinElemAt :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinElemAt (VList cl) (VInt idx) = listElemAt cl idx+builtinElemAt other (VInt _) = throwEvalError (expectedList other)+builtinElemAt _ other =+  throwEvalError ("expected an integer but found " <> typeName other <> ": " <> printValue PrintForError other)++builtinPartition :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinPartition predFn (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  (rightThunks, wrongThunks) <- partitionThunks predFn thunks+  pure+    ( VAttrs+        ( attrSetFromMap $+            Map.fromList+              [ ("right", evaluated (VList (clistFromThunks (map thunkToCPtr rightThunks)))),+                ("wrong", evaluated (VList (clistFromThunks (map thunkToCPtr wrongThunks))))+              ]+        )+    )+builtinPartition _ other =+  throwEvalError ("builtins.partition: expected a list, got " <> typeName other)++-- | Tail-recursive partition with accumulator to avoid stack overflow.+partitionThunks :: (MonadEval m) => NixValue -> [Thunk] -> m ([Thunk], [Thunk])+partitionThunks predFn = go [] []+  where+    go !rs !ws [] = pure (reverse rs, reverse ws)+    go !rs !ws (thunk : rest) = do+      result <- applyValueLazy predFn thunk+      case result of+        VBool True -> go (thunk : rs) ws rest+        VBool False -> go rs (thunk : ws) rest+        _ -> throwEvalError "builtins.partition: predicate must return a bool"++builtinGroupBy :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinGroupBy func (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  groups <- groupByCollect func thunks Map.empty+  pure (VAttrs (attrSetFromMap (Map.map (evaluated . VList . clistFromThunks . map thunkToCPtr . reverse) groups)))+builtinGroupBy _ other =+  throwEvalError ("builtins.groupBy: expected a list, got " <> typeName other)++groupByCollect ::+  (MonadEval m) =>+  NixValue ->+  [Thunk] ->+  Map Text [Thunk] ->+  m (Map Text [Thunk])+groupByCollect _ [] acc = pure acc+groupByCollect func (thunk : rest) acc = do+  result <- applyValueLazy func thunk+  case result of+    VStr key _ -> do+      name <- decodedText "builtins.groupBy" key+      groupByCollect func rest (Map.insertWith (++) name [thunk] acc)+    _ -> throwEvalError "builtins.groupBy: function must return a string"++-- ---------------------------------------------------------------------------+-- Builtin implementations - string (arity 2)+-- ---------------------------------------------------------------------------++builtinConcatStringsSep :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinConcatStringsSep (VStr sep sepCtx) (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  pairs <- mapM forceToStrCtx thunks+  let texts = map fst pairs+      mergedCtx = sepCtx <> mconcat (map snd pairs)+  pure (VStr (BS.intercalate sep texts) mergedCtx)+  where+    forceToStrCtx thunk = do+      val <- force thunk+      -- Nix 2.24's coerceToString defaults copyToStore=true and+      -- concatStringsSep passes no override, so a path element is copied into+      -- the store and the result carries its SCPlain context.  Non-string+      -- scalars still error (coerceMore=False), matching interpolation.+      coerceToStringInterp val+builtinConcatStringsSep (VStr _ _) other =+  throwEvalError ("builtins.concatStringsSep: expected a list, got " <> typeName other)+builtinConcatStringsSep other _ =+  throwEvalError ("builtins.concatStringsSep: expected a string, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - arity 3+-- ---------------------------------------------------------------------------++builtinFoldl :: (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue+builtinFoldl op initial (VList cl) =+  foldlStrict op initial (map Thunk (clistThunks cl))+builtinFoldl _ _ other =+  throwEvalError ("builtins.foldl': expected a list, got " <> typeName other)++-- | Strict left fold: apply @op acc elem@ for each element.  The+-- accumulator is forced each step (upstream foldl' strictness); the+-- element is passed as an unforced thunk, as upstream does.+foldlStrict :: (MonadEval m) => NixValue -> NixValue -> [Thunk] -> m NixValue+foldlStrict _ acc [] = pure acc+foldlStrict op acc (thunk : rest) = do+  partial <- applyValue op acc+  stepped <- applyValueLazy partial thunk+  foldlStrict op stepped rest++-- | Byte-indexed slicing, as upstream: offsets and lengths count bytes,+-- and a slice may fall mid-codepoint (the resulting bytes are the value).+builtinSubstring :: (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue+builtinSubstring (VInt start) (VInt len) value+  | start < 0 = throwEvalError "builtins.substring: negative start position"+  | otherwise = do+      (s, ctx) <- coerceToStringInterp value+      let startPos = fromIntegral start+          -- Nix clamps len to available length (negative len means rest of string)+          available = BS.length s - startPos+          clampedLen =+            if len < 0+              then available+              else min (fromIntegral len) available+      -- Context is preserved through substring (matching real Nix).+      pure (VStr (BS.take clampedLen (BS.drop startPos s)) ctx)+builtinSubstring _ _ _ =+  throwEvalError "builtins.substring: start and length must be integers"++-- ---------------------------------------------------------------------------+-- Builtin helpers+-- ---------------------------------------------------------------------------++-- | Build a thunk that defers @f arg@ - the application only happens when+-- the thunk is forced.  Runs the reserved 'reservedApply1' in a+-- self-contained env, upstream's @mkApp@.  Slot 0 = function, slot 1 =+-- argument.+deferApply :: NixValue -> Thunk -> Thunk+deferApply func = deferApplyThunk (evaluated func)++-- | 'deferApply' with the function already a thunk, so a builtin that+-- makes one application per element shares one function thunk across+-- them, as upstream's primops share @args[0]@.+deferApplyThunk :: Thunk -> Thunk -> Thunk+deferApplyThunk fnThunk argThunk =+  let (sp, sc) = buildCSlots [fnThunk, argThunk]+      env = newMinimalEnv sp sc+   in mkSyntheticThunk env reservedApply1++-- | The non-copying path coercion: the path text verbatim, no context -+-- upstream's @coerceToString@ with @copyToStore = false@.+coercePathVerbatim :: (MonadEval m) => Text -> m (BS.ByteString, StringContext)+coercePathVerbatim p = pure (TE.encodeUtf8 p, emptyContext)++-- | The copy-to-store path coercion: the path becomes its source store+-- path, carried in the context - upstream's @copyToStore = true@.  Passed+-- into 'coerceToString' so a path reached through an attrset's @outPath@+-- (or a @__toString@ result) coerces exactly as the same path written+-- directly would; a fixed path case in the engine dropped both the copy+-- and the context for every such value.+coercePathToStore :: (MonadEval m) => Text -> m (BS.ByteString, StringContext)+coercePathToStore p = do+  (spText, ctx) <- sourcePathWithContext p+  pure (TE.encodeUtf8 spText, ctx)++-- | @builtins.toString@'s coercion: permissive, a path verbatim+-- (upstream's @coerceMore@ without @copyToStore@).+coerceToStringPermissive :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)+coerceToStringPermissive = coerceToString True force applyValue coercePathVerbatim++-- | Coerce a value to a string for a DERIVATION field (an env value or an+-- arg).  Like 'coerceToStringPermissive', but a path is copied into+-- the store: it becomes its source store path, with that path added to the+-- string context so it lands in the derivation's @inputSrcs@ - matching C+++-- Nix's copy-to-store coercion of paths in derivation arguments/environment.+coerceToStoreString :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)+coerceToStoreString = coerceToString True force applyValue coercePathToStore++-- | Upstream's @coerceToString@ at its default arguments (@coerceMore =+-- false@, @copyToStore = true@): what string interpolation (@"${...}"@) and+-- every builtin taking a string that calls it without overrides use.  Like+-- 'coerceToString', but a path literal is copied into the store and replaced+-- by its source store path (with context), unlike 'builtins.toString', which+-- does not copy.+coerceToStringInterp :: (MonadEval m) => NixValue -> m (BS.ByteString, StringContext)+coerceToStringInterp = coerceToString False force applyValue coercePathToStore++-- | The store path a source path literal coerces to, carrying its+-- SCPlain context - the copy-to-store coercion shared by interpolation,+-- derivation arguments/env values, and @builtins.toJSON@.+sourcePathWithContext :: (MonadEval m) => Text -> m (Text, StringContext)+sourcePathWithContext p+  -- An already-in-store path coerces to itself with an SCPlain (Opaque)+  -- reference - never re-copied.  This is the shared choke point for+  -- interpolation, derivation args, concatStringsSep, and toJSON, so all of+  -- them inherit the in-store short-circuit (and the Windows re-NAR fix).+  | Just sp <- enclosingStorePath p = pure (p, plainContext sp)+  | otherwise = do+      spText <- storeSourcePath p+      case parseStorePath defaultStoreDir spText of+        Just sp -> pure (spText, plainContext sp)+        Nothing -> pure (spText, mempty)++-- | The current system platform string.+currentSystemStr :: Text+currentSystemStr = case (System.Info.arch, System.Info.os) of+  ("x86_64", "mingw32") -> "x86_64-windows"+  ("x86_64", "darwin") -> "x86_64-darwin"+  ("aarch64", "darwin") -> "aarch64-darwin"+  ("aarch64", "linux") -> "aarch64-linux"+  ("x86_64", "linux") -> "x86_64-linux"+  (arch, os) -> T.pack arch <> "-" <> T.pack os++-- | Store dir with trailing slash, for building store paths.+storeDirPrefix :: Text+storeDirPrefix = defaultStoreDirText <> "/"++-- ---------------------------------------------------------------------------+-- Builtin implementations - numeric + context+-- ---------------------------------------------------------------------------++isPathVal :: NixValue -> Bool+isPathVal (VPath _) = True+isPathVal _ = False++builtinCeil :: (MonadEval m) => NixValue -> m NixValue+builtinCeil (VFloat f) = intFromDouble "builtins.ceil" ceiling f+builtinCeil (VInt n) = pure (VInt n)+builtinCeil other = throwEvalError ("builtins.ceil: expected a number, got " <> typeName other)++builtinFloor :: (MonadEval m) => NixValue -> m NixValue+builtinFloor (VFloat f) = intFromDouble "builtins.floor" floor f+builtinFloor (VInt n) = pure (VInt n)+builtinFloor other = throwEvalError ("builtins.floor: expected a number, got " <> typeName other)++-- | Round a float to Int64 with the checks Nix 2.24 performs: NaN,+-- infinity, and out-of-range values are eval errors, never a garbage+-- Int64 out of Haskell's unchecked conversion.+intFromDouble :: (MonadEval m) => Text -> (Double -> Integer) -> Double -> m NixValue+intFromDouble ctx rounder f+  | isNaN f = throwEvalError (ctx <> ": NaN cannot be converted to an integer")+  | isInfinite f = throwEvalError (ctx <> ": infinity cannot be converted to an integer")+  | rounded < toInteger (minBound :: Int64) || rounded > toInteger (maxBound :: Int64) =+      throwEvalError (ctx <> ": " <> formatNixFloat f <> " is out of integer range")+  | otherwise = pure (VInt (fromInteger rounded))+  where+    rounded = rounder f++builtinDiscardContext :: (MonadEval m) => NixValue -> m NixValue+builtinDiscardContext value = mkStrBytes . fst <$> coerceToStringInterp value++-- | @builtins.unsafeDiscardOutputDependency@ - downgrade all-outputs (DrvDeep)+-- references to a plain (Opaque) reference on the same @.drv@ path, and KEEP+-- derivation-output (Built) references unchanged, matching upstream.  It+-- formerly dropped both kinds and kept only plain references, losing the+-- @.drv@ reference the downgrade must preserve.  'Set.map' also folds a+-- downgraded element into an existing plain reference on the same path.+builtinDiscardOutputDep :: (MonadEval m) => NixValue -> m NixValue+builtinDiscardOutputDep value = do+  (s, StringContext ctx) <- coerceToStringInterp value+  pure (VStr s (StringContext (Set.map downgrade ctx)))+  where+    downgrade (SCAllOutputs sp) = SCPlain sp+    downgrade other = other++-- | @builtins.addDrvOutputDependencies@ - the inverse of the+-- 'builtinDiscardOutputDep' downgrade for a single element: upgrade a plain+-- (Opaque) reference to a @.drv@ path into an all-outputs (DrvDeep) reference.+-- Upstream requires the string's context to have exactly one element and+-- errors on a derivation-output (Built) element or a non-@.drv@ plain path.+builtinAddDrvOutputDeps :: (MonadEval m) => NixValue -> m NixValue+builtinAddDrvOutputDeps value = do+  (s, StringContext ctx) <- coerceToStringInterp value+  case Set.toList ctx of+    [only] -> VStr s . StringContext . Set.singleton <$> upgrade only+    _ ->+      throwEvalError+        ( "builtins.addDrvOutputDependencies: the string must have exactly one "+            <> "context element, but has "+            <> T.pack (show (Set.size ctx))+        )+  where+    upgrade (SCPlain sp)+      | ".drv" `T.isSuffixOf` spName sp = pure (SCAllOutputs sp)+      | otherwise =+          throwEvalError+            ( "builtins.addDrvOutputDependencies: path "+                <> storePathToText defaultStoreDir sp+                <> " is not a derivation"+            )+    upgrade (SCAllOutputs sp) = pure (SCAllOutputs sp)+    upgrade (SCDrvOutput _ outName) =+      throwEvalError+        ( "builtins.addDrvOutputDependencies: can only act on derivations, not "+            <> "on a derivation output such as "+            <> outName+        )++-- | Check whether a string has any context elements.+builtinHasContext :: (MonadEval m) => NixValue -> m NixValue+builtinHasContext (VStr _ ctx) = pure (VBool (ctx /= emptyContext))+builtinHasContext other =+  throwEvalError ("builtins.hasContext: expected a string, got " <> typeName other)++-- | Return the context of a string as an attrset.+--+-- Each key is a store path string.  Each value is an attrset with:+--   - @path@: true if there's a SCPlain reference+--   - @allOutputs@: true if there's a SCAllOutputs reference+--   - @outputs@: list of output names from SCDrvOutput references+builtinGetContext :: (MonadEval m) => NixValue -> m NixValue+builtinGetContext (VStr _ (StringContext ctx)) = do+  let grouped = groupContextByPath (Set.toList ctx)+      attrMap = Map.map contextEntryToAttrs grouped+  pure (VAttrs (attrSetFromMap attrMap))+builtinGetContext other =+  throwEvalError ("builtins.getContext: expected a string, got " <> typeName other)++-- | Intermediate representation for grouping context elements by store path.+data ContextEntry = ContextEntry+  { cePath :: !Bool,+    ceAllOutputs :: !Bool,+    ceOutputs :: ![Text]+  }++-- | Group context elements by their store path.+groupContextByPath :: [StringContextElement] -> Map Text ContextEntry+groupContextByPath = foldl' addElement Map.empty+  where+    addElement acc (SCPlain sp) =+      Map.insertWith mergeEntry (spToText sp) (ContextEntry True False []) acc+    addElement acc (SCDrvOutput sp outName) =+      Map.insertWith mergeEntry (spToText sp) (ContextEntry False False [outName]) acc+    addElement acc (SCAllOutputs sp) =+      Map.insertWith mergeEntry (spToText sp) (ContextEntry False True []) acc+    -- 'Set.toList' feeds elements in ascending order and 'old' holds the+    -- earlier (smaller) output names, so 'old ++ new' keeps the rendered+    -- outputs list ascending, as upstream getContext produces it.+    mergeEntry new old =+      ContextEntry+        (cePath new || cePath old)+        (ceAllOutputs new || ceAllOutputs old)+        (ceOutputs old ++ ceOutputs new)+    -- Context keys are identity, not IO: always the canonical /nix/store+    -- spelling, never the platform file-path mapping.+    spToText = storePathToText defaultStoreDir++-- | Convert a ContextEntry to an attrset thunk.+contextEntryToAttrs :: ContextEntry -> Thunk+contextEntryToAttrs entry =+  let fields =+        [("path", evaluated (VBool True)) | cePath entry]+          ++ [("allOutputs", evaluated (VBool True)) | ceAllOutputs entry]+          ++ [("outputs", evaluated (VList (clistFromThunks [thunkToCPtr (evaluated (mkStr o)) | o <- ceOutputs entry]))) | not (null (ceOutputs entry))]+   in evaluated (VAttrs (attrSetFromMap (Map.fromList fields)))++-- | Append context entries to a string from an attrset.+--+-- @builtins.appendContext string contextAttrset@ adds the specified+-- context elements to the string.+builtinAppendContext :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinAppendContext (VStr s ctx) (VAttrs contextAttrs) = do+  newCtx <- parseContextAttrs (attrSetToMap contextAttrs)+  pure (VStr s (ctx <> newCtx))+builtinAppendContext (VStr _ _) other =+  throwEvalError ("builtins.appendContext: second argument must be a set, got " <> typeName other)+builtinAppendContext other _ =+  throwEvalError ("builtins.appendContext: first argument must be a string, got " <> typeName other)++-- | Parse a context attrset into a StringContext.+-- Each key is a store path; each value is an attrset with optional+-- @path@, @allOutputs@, and @outputs@ fields.+parseContextAttrs :: (MonadEval m) => Map Text Thunk -> m StringContext+parseContextAttrs attrs = do+  elements <- mapM parseOneCtx (Map.toList attrs)+  pure (StringContext (Set.fromList (concat elements)))+  where+    parseOneCtx (pathText, thunk) = do+      val <- force thunk+      case val of+        VAttrs inner -> do+          -- The key must parse as a store path, as upstream requires; a+          -- fabricated identity here would flow into derivation inputs.+          sp <- case parseStorePath defaultStoreDir pathText of+            Just parsed -> pure parsed+            Nothing ->+              throwEvalError+                ("builtins.appendContext: context key is not a store path: " <> pathText)+          hasPath <- getBoolAttr "path" inner+          hasAllOuts <- getBoolAttr "allOutputs" inner+          outNames <- getOutputsList inner+          let pathElems = [SCPlain sp | hasPath]+              allOutElems = [SCAllOutputs sp | hasAllOuts]+              outElems = [SCDrvOutput sp o | o <- outNames]+          pure (pathElems ++ allOutElems ++ outElems)+        _ -> throwEvalError "builtins.appendContext: context entry must be a set"++    getBoolAttr key attrs' = case attrSetLookup key attrs' of+      Nothing -> pure False+      Just thunk -> do+        val <- force thunk+        case val of+          VBool b -> pure b+          _ -> pure False++    getOutputsList attrs' = case attrSetLookup "outputs" attrs' of+      Nothing -> pure []+      Just thunk -> do+        val <- force thunk+        case val of+          VList cl -> mapM (forceToOutputName . Thunk) (clistThunks cl)+          _ -> pure []++    forceToOutputName thunk = do+      val <- force thunk+      case val of+        VStr s _ -> decodedText "builtins.appendContext" s+        _ -> throwEvalError "builtins.appendContext: output name must be a string"++-- | For a STRING operand, upstream's rule is textual: everything after+-- the final @/@.  For a PATH operand the value may be native-spelled+-- (eval's base dir can be a native Windows path), so the split is+-- separator-aware via 'canonBaseName'.+builtinBaseNameOf :: (MonadEval m) => NixValue -> m NixValue+builtinBaseNameOf (VPath p) = pure (mkStr (canonBaseName p))+-- Anything else is coerced to a string without a copy, as upstream's+-- prim_baseNameOf coerces it (primops.cc at 2.24.9): an outPath or a+-- __toString answers, an integer does not.+builtinBaseNameOf other = do+  (s, ctx) <- coerceToString False force applyValue coercePathVerbatim other+  pure (VStr (lastComponentBytes s) ctx)++-- | Byte-level last component for string operands ('/' is a single byte+-- in UTF-8 and never occurs inside a multi-byte sequence).+lastComponentBytes :: BS.ByteString -> BS.ByteString+lastComponentBytes t = case reverse (filter (not . BS.null) (BC.split '/' t)) of+  [] -> ""+  (final : _) -> final++-- | String operands keep upstream's textual '/'-only rule+-- ('dirComponentBytes'); path operands may be native-spelled and split+-- separator-aware via 'canonDirName'.+builtinDirOf :: (MonadEval m) => NixValue -> m NixValue+builtinDirOf (VPath p) = pure (VPath (canonDirName p))+-- Only a path value stays a path (prim_dirOf); anything else is coerced+-- to a string without a copy, so a set whose outPath is a path gives a+-- string.+builtinDirOf other = do+  (s, ctx) <- coerceToString False force applyValue coercePathVerbatim other+  pure (VStr (dirComponentBytes s) ctx)++-- | Byte-level dir component for string operands: everything before the+-- last '/' byte, with upstream's "." / "/" edge results.+dirComponentBytes :: BS.ByteString -> BS.ByteString+dirComponentBytes t =+  case BC.elemIndexEnd '/' t of+    Nothing -> "."+    Just idx ->+      let dir = BS.take idx t+       in if BS.null dir then "/" else dir++builtinConcatLists :: (MonadEval m) => NixValue -> m NixValue+builtinConcatLists (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  sublists <- mapM forceThenExtractList thunks+  pure (VList (clistFromThunks (concat sublists)))+  where+    forceThenExtractList thunk = do+      val <- force thunk+      case val of+        VList innerCl -> pure (clistThunks innerCl)+        _ -> throwEvalError "builtins.concatLists: element must be a list"+builtinConcatLists other =+  throwEvalError ("builtins.concatLists: expected a list, got " <> typeName other)++builtinLessThan :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinLessThan a b = VBool <$> nixCompare force a b++-- ---------------------------------------------------------------------------+-- Builtin implementations - arithmetic + bitwise+-- ---------------------------------------------------------------------------++-- | @prim_bitAnd@ and its kin (primops.cc at 2.24.9): both operands go+-- through @forceInt@, the left first.+bitwise :: (MonadEval m) => (Int64 -> Int64 -> Int64) -> NixValue -> NixValue -> m NixValue+bitwise op a b = VInt <$> (op <$> expectInt a <*> expectInt b)++-- ---------------------------------------------------------------------------+-- Builtin implementations - attr set higher-order+-- ---------------------------------------------------------------------------++builtinMapAttrs :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinMapAttrs func (VAttrs attrs) =+  -- Each attr value is a deferred @f key val@, forced only on demand.+  -- Eagerly builds all thunks via attrSetMapWithKey - with C arena thunks+  -- (~16 bytes each), this is cheaper than the former MappedAttrs overhead+  -- and keeps all data off the GHC heap.+  -- Slot 0 = function, slot 1 = key, slot 2 = value.+  pure (VAttrs (attrSetMapWithKey deferAttr attrs))+  where+    fnThunk = evaluated func+    deferAttr key valThunk =+      let (sp, sc) = buildCSlots [fnThunk, evaluated (mkStr key), valThunk]+          env = newMinimalEnv sp sc+       in mkSyntheticThunk env reservedApply2+builtinMapAttrs _ other =+  throwEvalError ("builtins.mapAttrs: expected a set, got " <> typeName other)++-- | Formals for lambdas, an empty set for builtins, an error otherwise -+-- including functor sets: upstream's primop never consults+-- @__functionArgs@ (nixpkgs lib.functionArgs handles that in Nix).+builtinFunctionArgs :: (MonadEval m) => NixValue -> m NixValue+builtinFunctionArgs (VLambda _ formals _) = pure (formalsToAttrs formals)+builtinFunctionArgs (VBuiltin _ _) = pure (VAttrs (attrSetFromMap Map.empty))+builtinFunctionArgs _ = throwEvalError "'functionArgs' requires a function"++formalsToAttrs :: EvalFormals -> NixValue+formalsToAttrs (EFName _) = VAttrs (attrSetFromMap Map.empty)+formalsToAttrs (EFSet formals _) = formalsListToAttrs formals+formalsToAttrs (EFNamedSet _ formals _) = formalsListToAttrs formals++formalsListToAttrs :: [EvalFormal] -> NixValue+formalsListToAttrs formals =+  VAttrs+    $ attrSetFromMap+    $ Map.fromList+      [(efName f, evaluated (VBool (isJust (efDefault f)))) | f <- formals]++builtinZipAttrsWith :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinZipAttrsWith func (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  attrSets <- mapM forceToAttrSet thunks+  let merged = mergeAllAttrs attrSets+      -- Lazy: each result is a deferred f(name)(values) thunk, not eagerly+      -- evaluated.  Critical for nixpkgs evalModules fixpoint - config is a+      -- self-referencing lazy attrset that must be COMPUTED (holding the lazy+      -- result) before any individual attribute thunks are forced.+      resultPairs = map (deferZip (evaluated func)) (Map.toList merged)+  pure (VAttrs (attrSetFromMap (Map.fromList resultPairs)))+  where+    forceToAttrSet thunk = do+      val <- force thunk+      case val of+        VAttrs attrs -> pure (attrSetToMap attrs)+        _ -> throwEvalError "builtins.zipAttrsWith: list element must be a set"+    mergeAllAttrs = foldl' (\acc m -> Map.unionWith (++) acc (Map.map (: []) m)) Map.empty+    -- Slot 0 = function, slot 1 = name, slot 2 = values list.+    deferZip fnThunk (key, thunkList) =+      let valueList = VList (clistFromThunks (map thunkToCPtr thunkList))+          (slots, slotCount) = buildCSlots [fnThunk, evaluated (mkStr key), evaluated valueList]+          env = newMinimalEnv slots slotCount+       in (key, mkSyntheticThunk env reservedApply2)+builtinZipAttrsWith _ other =+  throwEvalError ("builtins.zipAttrsWith: expected a list, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - string manipulation+-- ---------------------------------------------------------------------------++builtinReplaceStrings ::+  (MonadEval m) => NixValue -> NixValue -> NixValue -> m NixValue+builtinReplaceStrings (VList fromCl) (VList toCl) (VStr input inputCtx) = do+  let fromThunks = map Thunk (clistThunks fromCl)+      toThunks = map Thunk (clistThunks toCl)+  when (length fromThunks /= length toThunks) $+    throwEvalError "builtins.replaceStrings: 'from' and 'to' must have the same length"+  froms <- mapM forceStr fromThunks+  -- Match-gated replacement forcing, as upstream: a 'to' element is+  -- forced - and its context joins the result - only the first time its+  -- pattern matches, memoized per index.  An unmatched replacement is+  -- never evaluated, so it may throw or diverge harmlessly.+  --+  -- Matching and stepping are byte-level, as upstream: an empty @from@+  -- element inserts between BYTES, so a 2-byte character gets a+  -- replacement inside it.  Chunks accumulate reversed, one BS.concat+  -- at the end.+  let rules = zip3 [0 :: Int ..] (map fst froms) toThunks+      findRule txt =+        listToMaybe [r | r@(_, from, _) <- rules, BS.null from || from `BS.isPrefixOf` txt]+      forcedTo memo (i, _, toThunk) = case Map.lookup i memo of+        Just hit -> pure (hit, memo)+        Nothing -> do+          forced <- forceStr toThunk+          pure (forced, Map.insert i forced memo)+      step remaining acc memo+        | BS.null remaining = case findRule remaining of+            -- At end of string, still check for an empty-from match.+            Just rule -> do+              ((to, _), advanced) <- forcedTo memo rule+              pure (to : acc, advanced)+            Nothing -> pure (acc, memo)+        | otherwise = case findRule remaining of+            Just rule@(_, from, _) -> do+              ((to, _), advanced) <- forcedTo memo rule+              if BS.null from+                then case BS.uncons remaining of+                  -- empty-from: insert replacement then advance ONE BYTE+                  Just (byte, after) -> step after (BS.singleton byte : to : acc) advanced+                  -- Unreachable: the null string is handled by the guard above.+                  Nothing -> pure (to : acc, advanced)+                else step (BS.drop (BS.length from) remaining) (to : acc) advanced+            Nothing -> case BS.uncons remaining of+              Just (byte, after) -> step after (BS.singleton byte : acc) memo+              Nothing -> pure (acc, memo)+  (revChunks, forcedTos) <- step input [] Map.empty+  let mergedCtx = inputCtx <> mconcat (map snd (Map.elems forcedTos))+  pure (VStr (BS.concat (reverse revChunks)) mergedCtx)+  where+    forceStr thunk = do+      val <- force thunk+      case val of+        VStr s ctx -> pure (s, ctx)+        _ -> throwEvalError "builtins.replaceStrings: elements must be strings"+builtinReplaceStrings _ _ (VStr _ _) =+  throwEvalError "builtins.replaceStrings: first two arguments must be lists"+builtinReplaceStrings _ _ other =+  throwEvalError ("builtins.replaceStrings: expected a string, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - regex (POSIX ERE via regex-tdfa)+-- ---------------------------------------------------------------------------++-- ---------------------------------------------------------------------------+-- Regex compilation cache+-- ---------------------------------------------------------------------------++-- | Global regex compilation cache.  Keyed by the raw pattern bytes+-- (match and split share entries).  Idempotent memoization via+-- unsafePerformIO - same rationale as thunk memoization.+{-# NOINLINE regexCacheRef #-}+regexCacheRef :: IORef (Map BS.ByteString RE.Regex)+regexCacheRef = unsafePerformIO (newIORef Map.empty)++-- | Compile options matching C++ Nix's POSIX ERE semantics: no multiline+-- mode, so @^@\/@$@ anchor only at the string boundaries and @.@ (and a+-- negated bracket class) match a newline.  regex-tdfa's default has+-- multiline=True, which silently diverges on any subject containing @\n@.+wholeStringCompOpt :: RE.CompOption+wholeStringCompOpt = RE.defaultCompOpt {RE.multiline = False}++-- | Compile a regex from its raw pattern bytes, using the global cache to+-- avoid recompilation.  Compiling from bytes makes the PATTERN byte-level+-- too, matching upstream: a multi-byte character in the pattern is a+-- sequence of single-byte atoms, so it lines up with byte-level subjects.+-- Returns Nothing for invalid patterns.  NOINLINE prevents GHC from+-- inlining and floating the unsafePerformIO reads.+{-# NOINLINE cachedCompileRegex #-}+cachedCompileRegex :: BS.ByteString -> Maybe RE.Regex+cachedCompileRegex pat =+  unsafePerformIO $ do+    cache <- atomicModifyIORef' regexCacheRef (\c -> (c, c))+    case Map.lookup pat cache of+      Just compiled -> pure (Just compiled)+      Nothing -> case RE.makeRegexOptsM wholeStringCompOpt RE.defaultExecOpt pat :: Maybe RE.Regex of+        Nothing -> pure Nothing+        Just compiled -> do+          atomicModifyIORef' regexCacheRef (\c -> (Map.insert pat compiled c, ()))+          pure (Just compiled)++-- ---------------------------------------------------------------------------+-- Regex builtins+-- ---------------------------------------------------------------------------++-- | @builtins.match regex str@: match a POSIX ERE against a string.+-- The regex must match the ENTIRE string (like C++ Nix's regex_match).+-- Returns @null@ if no match, or a list of capture group strings+-- (@null@ for non-participating groups).+builtinMatch :: (MonadEval m) => NixValue -> NixValue -> m NixValue+-- Pre-compiled path: regex was compiled at partial-application time.+builtinMatch (VCompiledRegex (CompiledRegex _ compiled)) (VStr str _) =+  matchWithCompiled compiled str+-- Direct 2-arg call: use global compilation cache.+builtinMatch (VStr regex _) (VStr str _) =+  case cachedCompileRegex regex of+    Nothing -> throwEvalError ("builtins.match: invalid regex: " <> bytesToTextLossy regex)+    Just compiled -> matchWithCompiled compiled str+builtinMatch (VStr _ _) other =+  throwEvalError ("builtins.match: expected a string, got " <> typeName other)+builtinMatch (VCompiledRegex _) other =+  throwEvalError ("builtins.match: expected a string, got " <> typeName other)+builtinMatch other _ =+  throwEvalError ("builtins.match: expected a string (regex), got " <> typeName other)++-- | Shared match logic for pre-compiled and freshly-compiled regex paths.+--+-- Whole-string semantics via a span check on the leftmost-longest match:+-- if any whole-string match exists it starts at 0, and POSIX picks the+-- longest match at the leftmost start, so the reported match spans the+-- whole subject exactly when a whole-string match exists.  This is what+-- regex_match gives C++ Nix; textual @^...$@ anchoring is NOT equivalent+-- (it misparses top-level alternation).+matchWithCompiled :: (MonadEval m) => RE.Regex -> BS.ByteString -> m NixValue+matchWithCompiled compiled str =+  case RE.matchOnceText compiled str of+    Just (beforeMatch, match, afterMatch)+      | BS.null beforeMatch,+        BS.null afterMatch ->+          -- match is an Array of (bytes, (offset, len)) pairs.+          -- Index 0 is the full match; indices 1.. are capture groups.+          let captureGroups = drop 1 (Array.elems match)+              -- A non-participating capture group has offset (-1); C++ Nix+              -- yields null for it, not the empty string.+              toThunk (s, (off, _)) =+                if off < 0 then evaluated VNull else evaluated (mkStrBytes s)+           in pure (VList (clistFromThunks (map (thunkToCPtr . toThunk) captureGroups)))+    _ -> pure VNull++-- | @builtins.split regex str@: split a string by a POSIX ERE.+-- Returns an alternating list of non-matched strings and match-group lists.+-- Example: @split "(x)" "axbxc"@ yields @["a" ["x"] "b" ["x"] "c"]@+builtinSplit :: (MonadEval m) => NixValue -> NixValue -> m NixValue+-- Pre-compiled path: regex was compiled at partial-application time.+builtinSplit (VCompiledRegex (CompiledRegex _ compiled)) (VStr str _) =+  splitWithCompiled compiled str+-- Direct 2-arg call: use global compilation cache.+builtinSplit (VStr regex _) (VStr str _) =+  case cachedCompileRegex regex of+    Nothing -> throwEvalError ("builtins.split: invalid regex: " <> bytesToTextLossy regex)+    Just compiled -> splitWithCompiled compiled str+builtinSplit (VStr _ _) other =+  throwEvalError ("builtins.split: expected a string, got " <> typeName other)+builtinSplit (VCompiledRegex _) other =+  throwEvalError ("builtins.split: expected a string, got " <> typeName other)+builtinSplit other _ =+  throwEvalError ("builtins.split: expected a string (regex), got " <> typeName other)++-- | Shared split logic for pre-compiled and freshly-compiled regex paths.+splitWithCompiled :: (MonadEval m) => RE.Regex -> BS.ByteString -> m NixValue+splitWithCompiled compiled str =+  let allMatches = matchAllText compiled str+      result = buildSplitResult str 0 allMatches+   in pure (VList (clistFromThunks (map thunkToCPtr result)))++-- | Build the alternating list for builtins.split.  Offsets from the+-- ByteString regex instance are byte offsets, so slicing is O(1)+-- 'BS.take'/'BS.drop'.+buildSplitResult :: BS.ByteString -> Int -> [Array.Array Int (BS.ByteString, (Int, Int))] -> [Thunk]+buildSplitResult remaining pos [] =+  -- No more matches - emit the rest of the string.+  [evaluated (mkStrBytes (BS.drop pos remaining))]+buildSplitResult remaining pos (match : rest) =+  let elems = Array.elems match+      (_, (matchStart, matchLen)) = case elems of+        (full : _) -> full+        [] -> ("", (pos, 0)) -- defensive: should not happen from matchAllText+        -- Bytes before this match+      before = BS.take (matchStart - pos) (BS.drop pos remaining)+      -- Capture groups (indices 1..)+      groups = drop 1 elems+      -- A non-participating capture group has offset (-1) becomes null (as 'match').+      groupThunks =+        map (\(s, (off, _)) -> if off < 0 then evaluated VNull else evaluated (mkStrBytes s)) groups+      -- Continue after this match+      afterPos = matchStart + matchLen+   in evaluated (mkStrBytes before)+        : evaluated (VList (clistFromThunks (map thunkToCPtr groupThunks)))+        : buildSplitResult remaining afterPos rest++builtinCompareVersions :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinCompareVersions (VStr a _) (VStr b _) =+  pure (VInt (compareVersionParts (splitVersionStr a) (splitVersionStr b)))+builtinCompareVersions _ _ = throwEvalError "builtins.compareVersions: expected two strings"++-- | Convert 'Ordering' to the Nix compareVersions convention: -1, 0, 1.+ordToNix :: Ordering -> Int64+ordToNix LT = -1+ordToNix EQ = 0+ordToNix GT = 1++compareVersionParts :: [BS.ByteString] -> [BS.ByteString] -> Int64+compareVersionParts [] [] = 0+-- When one version runs out, Nix pads the shorter side with an empty+-- component and keeps comparing - so "1.0" > "1.0pre" (empty sorts AFTER+-- "pre"), not "<" as a naive length comparison would give.+compareVersionParts [] (b : bs) =+  case compareComponent "" b of+    EQ -> compareVersionParts [] bs+    cmp -> ordToNix cmp+compareVersionParts (a : as) [] =+  case compareComponent a "" of+    EQ -> compareVersionParts as []+    cmp -> ordToNix cmp+compareVersionParts (a : as) (b : bs) =+  case compareComponent a b of+    EQ -> compareVersionParts as bs+    cmp -> ordToNix cmp++-- | Byte-level alpha classification, as upstream (C @isalpha@ over+-- bytes): a non-ASCII letter is a separator, never an alphabetic+-- component.  Digits need no counterpart - 'isDigit' is @0-9@ only.+isVersionAlpha :: Char -> Bool+isVersionAlpha c = isAsciiLower c || isAsciiUpper c++compareComponent :: BS.ByteString -> BS.ByteString -> Ordering+compareComponent a b+  | a == b = EQ+  | allDigits a && allDigits b = compare (readInt a) (readInt b)+  -- "pre" sorts before everything else (Nix pre-release convention)+  | a == "pre" = LT+  | b == "pre" = GT+  | a == "" = LT+  | b == "" = GT+  -- Alphabetic components sort before numeric in Nix+  | isAlphaComp a && allDigits b = LT+  | allDigits a && isAlphaComp b = GT+  | otherwise = compare a b+  where+    allDigits t = not (BS.null t) && BC.all isDigit t+    isAlphaComp t = case BC.uncons t of+      Just (c, _) -> isVersionAlpha c+      Nothing -> False+    readInt :: BS.ByteString -> Int64+    readInt = BC.foldl' (\acc c -> acc * 10 + fromIntegral (digitToInt c)) (0 :: Int64)++splitVersionStr :: BS.ByteString -> [BS.ByteString]+splitVersionStr t+  | BS.null t = []+  | otherwise =+      let (component, rest) = spanComponent t+       in component : splitVersionAfterComponent rest++splitVersionAfterComponent :: BS.ByteString -> [BS.ByteString]+splitVersionAfterComponent t = case BC.uncons t of+  Nothing -> []+  -- '.' and '-' are both component separators in Nix's version grammar, so a+  -- '-' is skipped, not emitted as a one-character component.+  Just (sep, rest) | sep == '.' || sep == '-' -> splitVersionStr rest+  Just _ -> splitVersionStr t++spanComponent :: BS.ByteString -> (BS.ByteString, BS.ByteString)+spanComponent t = case BC.uncons t of+  Nothing -> ("", "")+  Just (c, rest)+    | isDigit c -> BC.span isDigit t+    | isVersionAlpha c -> BC.span isVersionAlpha t+    | otherwise -> (BS.take 1 t, rest)++builtinSplitVersion :: (MonadEval m) => NixValue -> m NixValue+builtinSplitVersion (VStr s _) =+  pure (VList (clistFromThunks (map (thunkToCPtr . evaluated . mkStrBytes) (splitVersionComponents s))))+builtinSplitVersion other =+  throwEvalError ("builtins.splitVersion: expected a string, got " <> typeName other)++splitVersionComponents :: BS.ByteString -> [BS.ByteString]+splitVersionComponents t = case BC.uncons t of+  Nothing -> []+  Just ('.', rest) -> splitVersionComponents rest+  Just (c, _)+    | isDigit c ->+        let (digits, rest) = BC.span isDigit t+         in digits : splitVersionComponents rest+    | isVersionAlpha c ->+        let (alpha, rest) = BC.span isVersionAlpha t+         in alpha : splitVersionComponents rest+    | otherwise ->+        -- Non-alphanumeric separator byte (e.g. '-', '_'): consume it+        splitVersionComponents (BS.drop 1 t)++builtinParseDrvName :: (MonadEval m) => NixValue -> m NixValue+builtinParseDrvName (VStr s _) =+  let (name, version) = parseName s+   in pure+        ( VAttrs+            ( attrSetFromMap $+                Map.fromList+                  [ ("name", evaluated (mkStrBytes name)),+                    ("version", evaluated (mkStrBytes version))+                  ]+            )+        )+builtinParseDrvName other =+  throwEvalError ("builtins.parseDrvName: expected a string, got " <> typeName other)++parseName :: BS.ByteString -> (BS.ByteString, BS.ByteString)+parseName t =+  case findVersionDash t 0 of+    Nothing -> (t, "")+    Just idx -> (BS.take idx t, BS.drop (idx + 1) t)++findVersionDash :: BS.ByteString -> Int -> Maybe Int+findVersionDash t idx = case BC.uncons (BS.drop idx t) of+  Nothing -> Nothing+  Just ('-', after)+    | Just (d, _) <- BC.uncons after,+      isDigit d ->+        Just idx+  Just _ -> findVersionDash t (idx + 1)++-- ---------------------------------------------------------------------------+-- Builtin implementations - serialization + hashing+-- ---------------------------------------------------------------------------++builtinToJSON :: (MonadEval m) => NixValue -> m NixValue+builtinToJSON val = do+  (json, ctx) <- valueToJSON val+  pure (VStr (renderJson json) ctx)++-- | The JSON of a value, with the context of every string it holds.+-- Strings decode strictly: upstream's serializer (nlohmann) REJECTS+-- invalid UTF-8, so invalid bytes are an eval error, matching upstream.+-- 'Nix.Json.renderJson' writes the result; @builtins.toJSON@ and a+-- structured-attributes derivation's @__json@ share both halves, as+-- upstream's share @printValueAsJSON@.+valueToJSON :: (MonadEval m) => NixValue -> m (Json, StringContext)+valueToJSON VNull = pure (JsonNull, emptyContext)+valueToJSON (VBool b) = pure (JsonBool b, emptyContext)+valueToJSON (VInt n) = pure (JsonInt (toInteger n), emptyContext)+valueToJSON (VFloat f) = pure (JsonFloat f, emptyContext)+valueToJSON (VStr s ctx) = do+  decoded <- decodedText "builtins.toJSON" s+  pure (JsonString decoded, ctx)+valueToJSON (VList cl) = do+  let thunks = map Thunk (clistThunks cl)+  vals <- mapM force thunks+  results <- mapM valueToJSON vals+  pure (JsonArray (map fst results), mconcat (map snd results))+-- An attrset is upstream's three-way choice (value-to-json.cc at 2.24.9):+-- a __toString result coerced as tryAttrsToString is called there, with+-- coerceMore and copyToStore both off, so the result must already be a+-- string or a path and a path stays its own absolute text; otherwise the+-- outPath value, converted as any value is, so it need not be a string;+-- otherwise an object.+valueToJSON (VAttrs attrs)+  | Just _ <- attrSetLookup "__toString" attrs = do+      (s, ctx) <- coerceToString False force applyValue coercePathVerbatim (VAttrs attrs)+      decoded <- decodedText "builtins.toJSON" s+      pure (JsonString decoded, ctx)+  | Just outPathThunk <- attrSetLookup "outPath" attrs = force outPathThunk >>= valueToJSON+  | otherwise = do+      results <- mapM jsonMember (Map.toAscList (attrSetToMap attrs))+      pure (JsonObject (Map.fromAscList [(key, json) | (key, json, _) <- results]), mconcat [ctx | (_, _, ctx) <- results])+  where+    jsonMember (key, thunk) = do+      val <- force thunk+      (json, ctx) <- valueToJSON val+      pure (key, json, ctx)+-- A path serializes as its source store path, with context - the same+-- copy-to-store coercion as interpolation (upstream value-to-json.cc+-- serializes paths with copyToStore = true).+valueToJSON (VPath p) = do+  (spText, ctx) <- sourcePathWithContext p+  pure (JsonString spText, ctx)+valueToJSON (VLambda {}) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"+valueToJSON (VBuiltin _ _) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"+valueToJSON (VCompiledRegex _) = throwEvalError "builtins.toJSON: cannot convert a function to JSON"++-- | Upstream reads the string with nlohmann's parser (json-to-value.cc),+-- which is what 'parseJsonWith' implements for the builder's @__json@ too:+-- strict RFC 8259, so a trailing comma, a raw control character or a lone+-- surrogate is refused.  'NixRange' keeps every integer a 'VInt' can hold.+builtinFromJSON :: (MonadEval m) => NixValue -> m NixValue+builtinFromJSON (VStr s _) = do+  -- JSON input must be valid UTF-8 (upstream's parser rejects it too).+  decoded <- decodedText "builtins.fromJSON" s+  either throwEvalError (pure . jsonToValue) (parseJsonWith NixRange decoded)+builtinFromJSON other =+  throwEvalError ("builtins.fromJSON: expected a string, got " <> typeName other)++parseHex4 :: Text -> Maybe (Int, Text)+parseHex4 t+  | T.length t >= 4 =+      let hex = T.take 4 t+       in if T.all isHexDigit hex+            then Just (readHex4 hex, T.drop 4 t)+            else Nothing+  | otherwise = Nothing++readHex4 :: Text -> Int+readHex4 = T.foldl' (\acc c -> acc * 16 + digitToInt c) 0++jsonToValue :: Json -> NixValue+jsonToValue json = case json of+  JsonNull -> VNull+  JsonBool b -> VBool b+  JsonInt n -> VInt (fromInteger n)+  JsonFloat d -> VFloat d+  JsonString str -> mkStr str+  JsonArray items -> VList (clistFromThunks (map (thunkToCPtr . evaluated . jsonToValue) items))+  JsonObject members -> VAttrs (attrSetFromMap (Map.map (evaluated . jsonToValue) members))++builtinHashString :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinHashString (VStr algo _) (VStr input _) = do+  -- The payload IS the hashed bytes - no encode step, so a mid-codepoint+  -- substring hashes to the sha256 of exactly those bytes, as upstream.+  algoName <- decodedText "builtins.hashString" algo+  hashBytesWithAlgo "hashString" algoName input+builtinHashString (VStr _ _) other =+  throwEvalError ("builtins.hashString: expected a string, got " <> typeName other)+builtinHashString other _ =+  throwEvalError ("builtins.hashString: expected a string, got " <> typeName other)++digestToHex :: (BA.ByteArrayAccess a) => a -> Text+digestToHex = bytesToHexText . BA.convert++-- ---------------------------------------------------------------------------+-- Builtin implementations - deep evaluation+-- ---------------------------------------------------------------------------++builtinDeepSeq :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinDeepSeq first second = deepForce first >> pure second++-- | What a builtin returning its second argument does with its first+-- before it forces that second: @prim_deepSeq@ forces the first deeply,+-- @prim_trace@ prints it and @prim_warn@ warns with it, and only then does+-- each force the second (primops.cc at 2.24.9).  A builtin's arguments+-- are forced before it runs, so an application that has the second still+-- unforced does this first.+beforeSecondArgument :: (MonadEval m) => Text -> NixValue -> Maybe (m ())+beforeSecondArgument name first = case name of+  "deepSeq" -> Just (deepForce first)+  "trace" -> Just (emitTrace first)+  "warn" -> Just (emitWarning first)+  _ -> Nothing++deepForce :: (MonadEval m) => NixValue -> m ()+deepForce (VList cl) = mapM_ ((force >=> deepForce) . Thunk) (clistThunks cl)+deepForce (VAttrs attrs) = mapM_ (force >=> deepForce) (attrSetElems attrs)+deepForce _ = pure ()++-- | @builtins.seq a b@ - evaluate @a@ to WHNF, then return @b@.+builtinSeq :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinSeq !_first = pure++-- | @builtins.trace msg val@ - print @msg@ to stderr, return @val@.+builtinTrace :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinTrace msgVal result = emitTrace msgVal >> pure result++emitTrace :: (MonadEval m) => NixValue -> m ()+emitTrace msgVal = traceMessage . ("trace: " <>) $ case msgVal of+  VStr s _ -> bytesToTextLossy s+  other -> printValue PrintInFull other++-- | @builtins.warn msg val@ - print warning to stderr, return @val@.+--+-- The message must be a string: upstream's @prim_warn@ forces it with+-- @forceString@ (primops.cc at 2.24.9), leaving room to extend the+-- argument later, where @builtins.trace@ prints any value.+builtinWarn :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinWarn msgVal result = emitWarning msgVal >> pure result++-- | Upstream logs the message as a warning from an expression, which its+-- logger prefixes @evaluation warning:@.+emitWarning :: (MonadEval m) => NixValue -> m ()+emitWarning msgVal = case msgVal of+  VStr s _ -> traceMessage ("evaluation warning: " <> bytesToTextLossy s)+  other ->+    throwEvalError ("expected a string but found " <> typeName other <> ": " <> printValue PrintForError other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - graph traversal+-- ---------------------------------------------------------------------------++builtinGenericClosure :: (MonadEval m) => NixValue -> m NixValue+builtinGenericClosure (VAttrs attrs) = do+  startSetThunk <-+    maybe (throwEvalError "builtins.genericClosure: missing 'startSet'") pure $+      attrSetLookup "startSet" attrs+  operatorThunk <-+    maybe (throwEvalError "builtins.genericClosure: missing 'operator'") pure $+      attrSetLookup "operator" attrs+  startSetVal <- force startSetThunk+  operatorVal <- force operatorThunk+  case startSetVal of+    VList cl -> do+      let items = map Thunk (clistThunks cl)+      result <- closureLoop operatorVal (Seq.fromList items) [] []+      pure (VList (clistFromThunks (map (thunkToCPtr . evaluated) result)))+    _ -> throwEvalError "builtins.genericClosure: 'startSet' must be a list"+builtinGenericClosure other =+  throwEvalError ("builtins.genericClosure: expected a set, got " <> typeName other)++-- | BFS loop for genericClosure.  Uses Data.Sequence for O(1) queue+-- append (the old list-based version was O(n) per operator call).+-- seenKeys is still a linear scan - Nix value equality is monadic so+-- Set/HashMap is not directly applicable without specialising on key type.+closureLoop ::+  (MonadEval m) =>+  NixValue ->+  Seq Thunk ->+  [NixValue] ->+  [NixValue] ->+  m [NixValue]+closureLoop _ Empty _ acc = pure (reverse acc)+closureLoop operator (thunk :<| rest) seenKeys acc = do+  item <- force thunk+  key <- extractKey item+  alreadySeen <- keyInList key seenKeys+  if alreadySeen+    then closureLoop operator rest seenKeys acc+    else do+      newItems <- applyValue operator item+      case newItems of+        VList newCl ->+          closureLoop operator (rest <> Seq.fromList (map Thunk (clistThunks newCl))) (key : seenKeys) (item : acc)+        _ -> throwEvalError "builtins.genericClosure: operator must return a list"++extractKey :: (MonadEval m) => NixValue -> m NixValue+extractKey (VAttrs attrs) =+  case attrSetLookup "key" attrs of+    Just thunk -> force thunk+    Nothing -> throwEvalError "builtins.genericClosure: item missing 'key' attribute"+extractKey _ = throwEvalError "builtins.genericClosure: item must be a set with 'key'"++keyInList :: (MonadEval m) => NixValue -> [NixValue] -> m Bool+keyInList _ [] = pure False+keyInList key (seen : rest) = do+  eq <- nixEqual force key seen+  if eq then pure True else keyInList key rest++-- ---------------------------------------------------------------------------+-- IO builtins (delegate to MonadEval methods)+-- ---------------------------------------------------------------------------++-- | Upstream's @coerceToPath@ (eval.cc at 2.24.9), which every builtin+-- taking a path runs its argument through: a path is itself, an attribute+-- set's @__toString@ result is coerced again (it may be a path), and any+-- other value is coerced to a string without a copy, which must spell an+-- absolute path.  The string's bytes name a filesystem path, so they+-- decode strictly, the label naming the builtin if they cannot.  The+-- context the coercion gathers comes back with the path.+coerceToPathWithContext :: (MonadEval m) => Text -> NixValue -> m (Text, StringContext)+coerceToPathWithContext _ (VPath p) = pure (p, emptyContext)+coerceToPathWithContext label val@(VAttrs attrs)+  | Just toStringThunk <- attrSetLookup "__toString" attrs = do+      toStringFn <- force toStringThunk+      coerceToPathWithContext label =<< applyValue toStringFn val+coerceToPathWithContext label val = do+  (bytes, ctx) <- coerceToString False force applyValue coercePathVerbatim val+  path <- absolutePathString =<< decodedText label bytes+  pure (path, ctx)++-- | 'coerceToPathWithContext' for a builtin that reads the path and keeps+-- no string.+coerceToPath :: (MonadEval m) => Text -> NixValue -> m Text+coerceToPath label val = fst <$> coerceToPathWithContext label val++-- | Upstream @coerceToPath@'s rule for a string operand: it must spell an+-- absolute path, which is then canonicalized like any path value+-- (@rootPath(CanonPath(path))@).  A relative string is refused with+-- upstream's wording rather than read against the working directory,+-- which is also what keeps the access policy sound: the path checked is+-- the path opened.+absolutePathString :: (MonadEval m) => Text -> m Text+absolutePathString s+  | isAbsolutePath canonical = pure canonical+  | otherwise = throwEvalError ("string '" <> s <> "' doesn't represent an absolute path")+  where+    canonical = canonPathValue s++builtinImport :: (MonadEval m) => NixValue -> m NixValue+builtinImport val = importFile =<< coerceToPath "import" val++builtinReadFile :: (MonadEval m) => NixValue -> m NixValue+builtinReadFile val = do+  p <- coerceToPath "builtins.readFile" val+  bytes <- readFileBytes p+  -- The value is the file's RAW BYTES, as upstream: no BOM stripping, no+  -- UTF-16 transcoding, no replacement characters (the auto-decode stays+  -- on the parser/import path only).  The only rejection is NUL, which a+  -- Nix string cannot represent upstream.+  when (BS.elem 0 bytes) $+    throwEvalError+      ("builtins.readFile: the contents of the file '" <> p <> "' cannot be represented as a Nix string")+  pure (mkStrBytes bytes)++-- | @builtins.pathExists@.  Whether a directory is demanded is read off+-- the argument's spelling before coercion, as upstream's+-- @prim_pathExists@ reads it: a string ending in @/@ or @/.@, which+-- canonicalization would otherwise erase.+builtinPathExists :: (MonadEval m) => NixValue -> m NixValue+builtinPathExists val = do+  p <- coerceToPath "builtins.pathExists" val+  VBool <$> doesPathExist (existenceQuery val) p+  where+    existenceQuery (VStr s _)+      | BS.isSuffixOf "/" s || BS.isSuffixOf "/." s = ExistsAsDirectory+    existenceQuery _ = ExistsAsEntry++builtinReadDir :: (MonadEval m) => NixValue -> m NixValue+builtinReadDir val = do+  p <- coerceToPath "builtins.readDir" val+  entries <- listDirectory p+  pure (VAttrs (attrSetFromMap (Map.fromList [(name, evaluated (mkStr fileType)) | (name, fileType) <- entries])))++-- ---------------------------------------------------------------------------+-- Builtin implementations - environment + paths+-- ---------------------------------------------------------------------------++builtinGetEnv :: (MonadEval m) => NixValue -> m NixValue+builtinGetEnv (VStr name _) = mkStrBytes <$> getEnvVar name+builtinGetEnv other =+  throwEvalError ("builtins.getEnv: expected a string, got " <> typeName other)++-- | Upstream's @prim_toPath@ returns the coerced path as a string, with+-- its context, not as a path value (primops.cc at 2.24.9).+builtinToPath :: (MonadEval m) => NixValue -> m NixValue+builtinToPath val = do+  (path, ctx) <- coerceToPathWithContext "builtins.toPath" val+  pure (VStr (TE.encodeUtf8 path) ctx)++-- ---------------------------------------------------------------------------+-- Builtin implementations - store path operations+-- ---------------------------------------------------------------------------++builtinPlaceholder :: (MonadEval m) => NixValue -> m NixValue+builtinPlaceholder (VStr outputName _) = do+  name <- decodedText "builtins.placeholder" outputName+  pure (mkStr (hashPlaceholder name))+builtinPlaceholder other =+  throwEvalError ("builtins.placeholder: expected a string, got " <> typeName other)++-- | Refused outright under @pure-eval@, before the argument is looked at,+-- as upstream's @prim_storePath@ is: a dependency on a store path that+-- merely exists is ambient state.+builtinStorePath :: (MonadEval m) => NixValue -> m NixValue+builtinStorePath val = do+  policy <- evalPolicy+  if epPureEval policy+    then throwEvalError "'builtins.storePath' is not allowed in pure evaluation mode"+    else validateStorePath =<< resolvedUnlessStorePath =<< coerceToPath "builtins.storePath" val+  where+    -- prim_storePath resolves the path's symlinks unless the path is itself+    -- a store path, a link directly in the store (primops.cc:1613 at+    -- 2.24.9), so a link outside the store into it names its target.+    resolvedUnlessStorePath path+      | isBareStorePath path = pure path+      | otherwise = resolveSymlinks path+    isBareStorePath path = case T.stripPrefix storeDirPrefix path of+      Just base -> not (T.any (== '/') base) && isJust (parseStorePathBaseName base)+      Nothing -> False++-- | @builtins.storePath@ - mark an already-in-store path as such.  Upstream+-- returns a STRING carrying an Opaque (SCPlain) context entry for the enclosing+-- store path, NOT a bare path: the Opaque marker is what stops a later coercion+-- from re-serialising (re-NARing) the already-present path into a new store+-- path.  Returning a context-free path (the old behavior) re-copied the path on+-- coercion - a wrong store path on Unix, and a file-not-found on Windows, where+-- the canonical @/nix/store@ text is not the on-disk location.+--+-- A path outside the store is upstream's @isInStore@ refusal; one inside+-- it whose component is no store path is its @StorePath@ constructor's+-- ('storePathBaseNameError').+validateStorePath :: (MonadEval m) => Text -> m NixValue+validateStorePath p = case T.stripPrefix storeDirPrefix p of+  Just rest+    | not (T.null rest) -> case parseStorePathBaseName base of+        Just sp -> pure (VStr (TE.encodeUtf8 p) (plainContext sp))+        Nothing -> throwEvalError (fromMaybe ("store path '" <> base <> "' has no '-' after its hash") (storePathBaseNameError base))+    where+      base = T.takeWhile (/= '/') rest+  _ -> throwEvalError ("path '" <> p <> "' is not in the Nix store")++-- | The store path enclosing an absolute path under the store dir, or+-- 'Nothing' if the path is not in the store.  Accepts a bare store path and a+-- subpath (@\/nix\/store\/\<hash\>-\<name\>\/sub@ resolves to its+-- @\<hash\>-\<name\>@ component), the way upstream marks the enclosing store+-- path Opaque for either.  The component passes the same charset+-- validation as every other store-path parse boundary.+enclosingStorePath :: Text -> Maybe StorePath+enclosingStorePath p = do+  rest <- T.stripPrefix storeDirPrefix p+  parseStorePathBaseName (T.takeWhile (/= '/') rest)++-- ---------------------------------------------------------------------------+-- Builtin implementations - Nix search path+-- ---------------------------------------------------------------------------++builtinFindFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinFindFile (VList cl) (VStr name _) = do+  entries <- mapM (forceSearchEntry . Thunk) (clistThunks cl)+  findFirst entries name+builtinFindFile (VList _) other =+  throwEvalError ("builtins.findFile: expected a string, got " <> typeName other)+builtinFindFile other _ =+  throwEvalError ("builtins.findFile: expected a list, got " <> typeName other)++-- | Extract {prefix, path} from a search path entry thunk, as the bytes+-- the entry holds.  Upstream keeps both as byte strings, so an entry+-- whose prefix or path has no UTF-8 reading is still an entry, and one+-- that names something else does not stop the lookup.+forceSearchEntry :: (MonadEval m) => Thunk -> m (BS.ByteString, BS.ByteString)+forceSearchEntry thunk = do+  val <- force thunk+  case val of+    VAttrs attrs -> do+      prefixThunk <-+        maybe (throwEvalError "builtins.findFile: entry missing 'prefix'") pure $+          attrSetLookup "prefix" attrs+      pathThunk <-+        maybe (throwEvalError "builtins.findFile: entry missing 'path'") pure $+          attrSetLookup "path" attrs+      prefixVal <- force prefixThunk+      pathVal <- force pathThunk+      prefix <- case prefixVal of+        VStr s _ -> pure s+        _ -> throwEvalError "builtins.findFile: 'prefix' must be a string"+      path <- case pathVal of+        VStr s _ -> pure s+        VPath s -> pure (TE.encodeUtf8 s)+        _ -> throwEvalError "builtins.findFile: 'path' must be a string or path"+      pure (prefix, path)+    _ -> throwEvalError "builtins.findFile: search path entry must be a set"++-- | Iterate search path entries, checking for a match.  A miss is+-- 'searchPathMiss'.  The existence probe is the policy-gated one: a+-- candidate the policy refuses counts as absent, which is stricter than+-- the oracle (2.24.9 probes outside its accessor and would hand the path+-- back) and quieter than 2.33.2 (which refuses from here), and which+-- gives no caller an existence oracle over paths it may not read.+--+-- A matching entry's candidate becomes a path value, which is text, so+-- one with no UTF-8 reading is an error where upstream would probe the+-- bytes; a lossy spelling would probe a different file.+findFirst :: (MonadEval m) => [(BS.ByteString, BS.ByteString)] -> BS.ByteString -> m NixValue+findFirst [] name = searchPathMiss (bytesToTextLossy name)+findFirst ((prefix, path) : rest) name = case searchPathSuffix prefix name of+  Nothing -> findFirst rest name+  Just suffix -> do+    candidate <- canonPathValue <$> decodedText "builtins.findFile" (if BS.null suffix then path else path <> "/" <> suffix)+    exists <- doesPathExist ExistsAsEntry candidate+    if exists+      then pure (VPath candidate)+      else findFirst rest name++-- | The part of a looked-up name below a search path prefix that names+-- it, compared byte for byte: upstream's+-- @LookupPath::Prefix::suffixIfPotentialMatch@ (src/libexpr/search-path.cc+-- at Nix 2.24.9).  An empty prefix names every lookup.+searchPathSuffix :: BS.ByteString -> BS.ByteString -> Maybe BS.ByteString+searchPathSuffix prefix name+  | BS.null prefix = Just name+  | prefix == name = Just BS.empty+  | otherwise = BS.stripPrefix (prefix <> "/") name++-- ---------------------------------------------------------------------------+-- Builtin implementations - store file creation+-- ---------------------------------------------------------------------------++builtinToFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinToFile (VStr name _) (VStr contents ctx) = do+  fileName <- decodedText "builtins.toFile" name+  refs <- toFileRefs ctx+  -- The contents are stored (and hashed) as their raw bytes.+  storePath <- writeToStore fileName contents refs+  -- Upstream returns a STRING whose context is the new path itself; the+  -- refs travel through the store path computation, not the eval context.+  let selfContext = maybe emptyContext plainContext (parseStorePath defaultStoreDir storePath)+  pure (VStr (TE.encodeUtf8 storePath) selfContext)+builtinToFile (VStr _ _) other =+  throwEvalError ("builtins.toFile: expected a string, got " <> typeName other)+builtinToFile other _ =+  throwEvalError ("builtins.toFile: expected a string, got " <> typeName other)++-- | The store-path references a toFile output may carry: the contents'+-- plain-path context, in sorted order.  A derivation-output reference is+-- an error, exactly as upstream ("files created by builtins.toFile may+-- not reference derivations").+toFileRefs :: (MonadEval m) => StringContext -> m [StorePath]+toFileRefs (StringContext elems) = mapM refOf (Set.toAscList elems)+  where+    refOf (SCPlain sp) = pure sp+    refOf (SCDrvOutput _ _) =+      throwEvalError "builtins.toFile: files created by toFile may not reference derivations"+    refOf (SCAllOutputs _) =+      throwEvalError "builtins.toFile: files created by toFile may not reference derivations"++-- ---------------------------------------------------------------------------+-- Builtin implementations - scoped import+-- ---------------------------------------------------------------------------++builtinScopedImport :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinScopedImport (VAttrs attrs) pathVal = do+  p <- coerceToPath "builtins.scopedImport" pathVal+  let scope = Map.toList (attrSetToMap attrs)+  scopedImportFile scope p+builtinScopedImport other _ =+  throwEvalError ("builtins.scopedImport: expected a set, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - network fetchers+-- ---------------------------------------------------------------------------++builtinFetchurl :: (MonadEval m) => NixValue -> m NixValue+builtinFetchurl (VStr url _) = do+  urlText <- decodedText "builtins.fetchurl" url+  fetchUrlSimple urlText Nothing+builtinFetchurl (VAttrs attrs) = do+  url <- forceAttrStr "builtins.fetchurl" "url" attrs+  sha256 <- forceOptionalAttrStr attrs "sha256"+  fetchUrlSimple url sha256+builtinFetchurl other =+  throwEvalError ("builtins.fetchurl: expected a string or set, got " <> typeName other)++builtinFetchTarball :: (MonadEval m) => NixValue -> m NixValue+builtinFetchTarball (VStr url _) = do+  urlText <- decodedText "builtins.fetchTarball" url+  fetchAndExtractTarball urlText Nothing tarballSourceName+builtinFetchTarball (VAttrs attrs) = do+  url <- forceAttrStr "builtins.fetchTarball" "url" attrs+  sha256 <- forceOptionalAttrStr attrs "sha256"+  nameOverride <- forceOptionalAttrStr attrs "name"+  fetchAndExtractTarball url sha256 (fromMaybe tarballSourceName nameOverride)+builtinFetchTarball other =+  throwEvalError ("builtins.fetchTarball: expected a string or set, got " <> typeName other)++-- | Upstream's default store name for fetched source trees.+tarballSourceName :: Text+tarballSourceName = "source"++-- | Download a tarball, extract it, verify the optional sha256 pin, and+-- copy the tree to its content-addressed store path.  The pin is the+-- recursive NAR hash of the EXTRACTED tree, as upstream.  Download and+-- extraction share one shell pipeline to avoid binary-as-text encoding+-- issues.  The scratch dir is exclusively created with an unpredictable+-- name ('createScratchDir') and removed once the tree reaches the store.+fetchAndExtractTarball :: (MonadEval m) => Text -> Maybe Text -> Text -> m NixValue+fetchAndExtractTarball url mSha256 name = do+  checkUri url+  requireFetchPin "fetchTarball" mSha256+  extractDir <- createScratchDir "nova-nix-tarball-"+  -- The -- separator prevents argument injection from the URL.+  (code, _, errOut) <-+    runProcess+      "sh"+      [ "-c",+        "curl -sSfL -- \"$1\" | tar -xz -C \"$2\" --strip-components=1",+        "--",+        url,+        extractDir+      ]+      ""+  case code of+    0 -> do+      pin <- traverse (decodeSha256Pin "builtins.fetchTarball") mSha256+      storePath <-+        copyPathToStore+          extractDir+          name+          (fmap ("builtins.fetchTarball: " <> url,) pin)+      removeScratchDir extractDir+      pure (VPath storePath)+    _ -> do+      removeScratchDir extractDir+      throwEvalError ("builtins.fetchTarball: " <> errOut)++-- | Transports 'builtinFetchGit' accepts.  Also spelled into the+-- clone's @protocol.*.allow@ config, so git enforces the same set+-- internally.+allowedGitSchemes :: [Text]+allowedGitSchemes = ["http", "https", "ssh", "git", "file"]++-- | Validate a fetchGit URL's transport before anything spawns.  git's+-- transport-helper syntax (@\<helper\>::\<address\>@) makes the helper+-- name a command to run as the transport (@ext::@ runs a shell command,+-- @fd::@ reads a descriptor), so evaluating an expression carrying such+-- a URL would execute it.  Accepted: an allowlisted explicit scheme, an+-- scp-like remote, or a local path.  Left carries the eval-error text.+checkGitUrl :: Text -> Either Text Text+checkGitUrl url+  | T.null url = Left "builtins.fetchGit: empty url"+  | not (T.null schemeRest),+    schemeShaped scheme,+    T.toLower scheme `elem` allowedGitSchemes =+      Right url+  | not (T.null schemeRest) = Left (disallowed scheme)+  | Just helper <- helperPrefix = Left (disallowed helper)+  | otherwise = Right url+  where+    (scheme, schemeRest) = T.breakOn "://" url+    -- RFC 3986 scheme shape; anything else before :// is not a scheme.+    schemeShaped s = case T.uncons s of+      Just (leading, rest) -> asciiAlpha leading && T.all schemeChar rest+      Nothing -> False+    schemeChar c = asciiAlpha c || isDigit c || c == '+' || c == '-' || c == '.'+    asciiAlpha c = isAsciiLower c || isAsciiUpper c+    -- <helper>:: counts only when the prefix is shaped like a helper+    -- name; "[::1]"-style scp hosts contain :: but are not helpers.+    helperPrefix = case T.breakOn "::" url of+      (prefix, rest)+        | not (T.null rest),+          T.null prefix || T.all helperChar prefix ->+            Just prefix+      _ -> Nothing+    helperChar c = asciiAlpha c || isDigit c || c == '-' || c == '_'+    disallowed t =+      "builtins.fetchGit: transport '" <> t <> "' is not allowed in url: " <> url++-- | What @git fetch@ asks for when the caller pinned no @ref@: the+-- remote's default branch.+defaultFetchRef :: Text+defaultFetchRef = "HEAD"++-- | What @git checkout@ resolves when the caller pinned no @rev@: the+-- tip of whatever the fetch just brought down.+fetchHeadRef :: Text+fetchHeadRef = "FETCH_HEAD"++-- | Characters upstream's @refRegexS@ allows after the first one.+gitRefTrailingPunctuation :: [Char]+gitRefTrailingPunctuation = "_./@+-"++-- | Validate a @ref@ against upstream's @refRegexS@+-- (@[a-zA-Z0-9\@][a-zA-Z0-9_.\/\@+-]*@).  The leading class excludes+-- @-@, and that is the load-bearing part: git parses options after the+-- remote name, so a @ref@ of @--upload-pack=\<cmd\>@ names the command+-- git runs as the transport.  Left carries the eval-error text.+checkGitRef :: Text -> Either Text Text+checkGitRef ref = case T.uncons ref of+  Just (leading, rest)+    | refLeadChar leading,+      T.all refChar rest ->+        Right ref+  _ -> Left ("builtins.fetchGit: ref is not a valid git ref name: " <> ref)+  where+    refLeadChar c = asciiAlphaNum c || c == '@'+    refChar c = asciiAlphaNum c || c `elem` gitRefTrailingPunctuation+    asciiAlphaNum c = isAsciiLower c || isAsciiUpper c || isDigit c++-- | Hex characters in a full SHA-1.+gitRevHexLength :: Int+gitRevHexLength = 40++-- | Validate a @rev@ against upstream's @revRegexS@ (@[0-9a-fA-F]{40}@).+-- Upstream parses it as a SHA-1 @Hash@ before it reaches git, which+-- rejects a tag or an abbreviated prefix as well as a leading @-@: a+-- \"pinned\" fetch that still resolves through git's DWIM rules is not+-- pinned.  Left carries the eval-error text.+checkGitRev :: Text -> Either Text Text+checkGitRev rev+  | T.length rev == gitRevHexLength,+    T.all isHexDigit rev =+      Right rev+  | otherwise = Left ("builtins.fetchGit: rev is not a full SHA-1: " <> rev)++-- | @-c@ config pinning the clone to 'allowedGitSchemes': every+-- transport defaults to never, each allowed scheme is re-enabled.  This+-- enforces what URL validation cannot see up front - a helper reached+-- indirectly, or a @remote-\<helper\>@ binary on PATH.+gitTransportConfig :: [Text]+gitTransportConfig =+  [ "-c",+    "protocol.allow=never",+    -- Keep checkout bytes platform-independent: no CRLF rewriting.+    "-c",+    "core.autocrlf=false",+    "-c",+    "core.eol=lf",+    -- Fail loudly rather than hash a symlink as a plain file (Git for+    -- Windows' fallback when it can't create real symlinks).+    "-c",+    "core.symlinks=true"+  ]+    ++ concat [["-c", "protocol." <> scheme <> ".allow=always"] | scheme <- allowedGitSchemes]++-- | The parsed arguments of a @builtins.fetchGit@ call.  A record+-- rather than positional threading: eight independent knobs invite+-- transposition, and the names keep every site readable.+data FetchGitArgs = FetchGitArgs+  { fgaUrl :: !Text,+    fgaName :: !Text,+    fgaRef :: !(Maybe Text),+    fgaRev :: !(Maybe Text),+    fgaSubmodules :: !Bool,+    fgaShallow :: !Bool,+    fgaAllRefs :: !Bool,+    fgaNarHash :: !(Maybe Text)+  }++-- | The attributes @builtins.fetchGit@ accepts.  Anything outside the+-- set is an error rather than a silent drop - an ignored attribute is+-- exactly how an unhonored pin stays invisible.  Upstream refuses the+-- same way ("input attribute '...' not supported by scheme 'git'",+-- observed from nix-instantiate 2.33.2).+fetchGitSupportedAttrs :: [Text]+fetchGitSupportedAttrs = ["url", "name", "ref", "rev", "submodules", "shallow", "allRefs", "narHash"]++builtinFetchGit :: (MonadEval m) => NixValue -> m NixValue+builtinFetchGit (VStr rawUrl _) = do+  url <- decodedText "builtins.fetchGit" rawUrl+  fetchGit+    FetchGitArgs+      { fgaUrl = url,+        fgaName = "source",+        fgaRef = Nothing,+        fgaRev = Nothing,+        fgaSubmodules = False,+        fgaShallow = False,+        fgaAllRefs = False,+        fgaNarHash = Nothing+      }+builtinFetchGit (VAttrs attrs) = do+  case filter (`notElem` fetchGitSupportedAttrs) (Map.keys (attrSetToMap attrs)) of+    (unsupported : _) ->+      throwEvalError ("builtins.fetchGit: attribute '" <> unsupported <> "' not supported")+    [] -> pure ()+  url <- forceAttrStr "builtins.fetchGit" "url" attrs+  name <- fromMaybe "source" <$> forceOptionalAttrStr attrs "name"+  ref <- forceOptionalAttrStr attrs "ref"+  rev <- forceOptionalAttrStr attrs "rev"+  submodules <- forceOptionalAttrBool "builtins.fetchGit" attrs "submodules" False+  shallow <- forceOptionalAttrBool "builtins.fetchGit" attrs "shallow" False+  allRefs <- forceOptionalAttrBool "builtins.fetchGit" attrs "allRefs" False+  narHash <- forceOptionalAttrStr attrs "narHash"+  fetchGit+    FetchGitArgs+      { fgaUrl = url,+        fgaName = name,+        fgaRef = ref,+        fgaRev = rev,+        fgaSubmodules = submodules,+        fgaShallow = shallow,+        fgaAllRefs = allRefs,+        fgaNarHash = narHash+      }+builtinFetchGit other =+  throwEvalError ("builtins.fetchGit: expected a string or set, got " <> typeName other)++-- | Fetch one revision into the store; returns upstream's @fetchGit@+-- attrset (@outPath@, @rev@, @shortRev@, @revCount@, @submodules@,+-- @lastModified@, @lastModifiedDate@, @narHash@).  @ref@ and @rev@ are+-- validated to upstream's shapes before they reach git (see+-- 'checkGitRef' and 'checkGitRev'); neither may lead with @-@.+fetchGit :: (MonadEval m) => FetchGitArgs -> m NixValue+fetchGit args =+  case (,,) <$> checkGitUrl (fgaUrl args) <*> traverse checkGitRef (fgaRef args) <*> traverse checkGitRev (fgaRev args) of+    Left err -> throwEvalError err+    Right (url, checkedRef, checkedRev) -> do+      let name = fgaName args+          submodules = fgaSubmodules args+          shallow = fgaShallow args+          inputUrl = gitInputUrl args {fgaUrl = url, fgaRef = checkedRef, fgaRev = checkedRev}+      -- Upstream's order (fetchTree.cc): the pure-mode lock check, then+      -- the URI gate, before anything is fetched or remembered.  A rev+      -- is what locks a git input at 2.24.9 (GitInputScheme::isLocked).+      policy <- evalPolicy+      when (epPureEval policy && isNothing checkedRev) $+        throwEvalError ("in pure evaluation mode, 'fetchGit' will not fetch unlocked input '" <> inputUrl <> "'")+      checkUri inputUrl+      -- Only a pinned rev is cached: a bare ref means "whatever this branch+      -- points at now", which a note taken earlier cannot answer.+      cached <- case checkedRev of+        Nothing -> pure Nothing+        Just rev -> do+          entry <- lookupFetchCache (fetchCacheKey url name rev submodules shallow)+          case entry >>= decodeFetchCache of+            Nothing -> pure Nothing+            Just fields -> do+              -- The note is only good while the tree it names is still+              -- there, and a hit has to re-record the write the fetch it+              -- stands in for would have recorded: on disk and registered+              -- are different facts, and a derivation naming an+              -- unregistered outPath fails to build.+              adopted <- adoptStorePath (fcStorePath fields)+              pure (if adopted then Just fields else Nothing)+      fields <- case cached of+        Just hit -> pure hit+        Nothing -> fetchGitUncached args {fgaUrl = url} checkedRef checkedRev+      -- A declared narHash pins the tree; a mismatch is an error on the+      -- hit and fresh paths alike, never a silent recompute.  Upstream's+      -- orientation: "expected" is what the fetch produced, "got" is the+      -- declared pin (observed from nix-instantiate 2.33.2).+      case fgaNarHash args of+        Nothing -> pure ()+        Just declared ->+          let computed = "sha256-" <> fcNarHash fields+           in unless (declared == computed) $+                throwEvalError+                  ("builtins.fetchGit: NAR hash mismatch in '" <> url <> "', expected '" <> computed <> "' but got '" <> declared <> "'")+      pure (fetchGitResult submodules fields)++-- | The URL upstream renders a @fetchGit@ input as+-- (@fetchers::Input::toURLString@ at 2.24.9): the url after @fixGitURL@+-- (an scp-like @user\@host:path@ becomes @ssh://user\@host/path@, a bare+-- path becomes @file://@ plus the path), its scheme prefixed @git+@ unless+-- it is @git@ already, and the query carrying the input's attributes in+-- key order as @ParsedURL::to_string@ sorts them: @exportIgnore=1@ (which+-- @fetchGit@ sets unless submodules are on), @ref@, @rev@, @shallow=1@,+-- @submodules=1@.  This is the string @checkURI@ matches @allowed-uris@+-- against and the one the pure-mode refusal names, so an operator's+-- prefix has to be written for this form (@git+https://...@), as it does+-- upstream.+gitInputUrl :: FetchGitArgs -> Text+gitInputUrl args =+  let fixed = fixGitUrl (fgaUrl args)+      (scheme, afterScheme) = T.breakOn ":" fixed+      (authority, afterAuthority) = case T.stripPrefix "://" afterScheme of+        Just rest -> let (host, more) = T.break (\c -> c == '/' || c == '?' || c == '#') rest in (Just host, more)+        Nothing -> (Nothing, T.drop 1 afterScheme)+      (pathPart, afterPath) = T.break (\c -> c == '?' || c == '#') afterAuthority+      (queryPart, fragmentPart) = case T.uncons afterPath of+        Just ('?', rest) -> T.break (== '#') rest+        _ -> ("", afterPath)+      urlQuery = Map.fromList (map queryPair (filter (not . T.null) (T.splitOn "&" queryPart)))+      queryPair pair =+        let (k, v) = T.breakOn "=" pair+         in (percentDecode k, percentDecode (T.drop 1 v))+      pins =+        catMaybes+          [ ("rev",) . T.toLower <$> fgaRev args,+            ("ref",) <$> fgaRef args,+            ("shallow", "1") <$ guardFlag (fgaShallow args),+            ("submodules", "1") <$ guardFlag (fgaSubmodules args),+            ("exportIgnore", "1") <$ guardFlag (not (fgaSubmodules args))+          ]+      query = Map.union (Map.fromList pins) urlQuery+      renderedScheme = if scheme == gitScheme then scheme else "git+" <> scheme+      renderedQuery+        | Map.null query = ""+        | otherwise = "?" <> T.intercalate "&" [percentEncode queryKeep k <> "=" <> percentEncode queryKeep v | (k, v) <- Map.toAscList query]+      renderedFragment = case T.stripPrefix "#" fragmentPart of+        Just fragment | not (T.null fragment) -> "#" <> percentEncode "" (percentDecode fragment)+        _ -> ""+   in renderedScheme+        <> ":"+        <> maybe "" ("//" <>) authority+        <> percentEncode pathKeep (percentDecode pathPart)+        <> renderedQuery+        <> renderedFragment+  where+    guardFlag flag = if flag then Just () else Nothing++-- | The one scheme upstream leaves without a @git+@ prefix.+gitScheme :: Text+gitScheme = "git"++-- | Characters @ParsedURL::to_string@ leaves unencoded in a path and in a+-- query (@allowedInPath@ and @allowedInQuery@ in url.cc).+pathKeep, queryKeep :: Text+pathKeep = ":@/"+queryKeep = ":@/?"++-- | Upstream @fixGitURL@ (url.cc at 2.24.9): an scp-like remote not+-- starting with @/@ (@([^\/]*)\@(.*):(.*)@, the first group as long as a+-- match allows, the second greedy) is rewritten to @ssh://@; a @file:@ URL+-- and anything with @://@ pass through; a bare path becomes a @file://@+-- URL.+fixGitUrl :: Text -> Text+fixGitUrl url+  | not (T.isPrefixOf "/" url),+    Just (user, hostAndPath) <- scpSplit url =+      let (host, path) = T.breakOnEnd ":" hostAndPath+       in "ssh://" <> user <> "@" <> T.dropEnd 1 host <> "/" <> path+  | T.isPrefixOf "file:" url = url+  | not (T.isInfixOf "://" url) = "file://" <> url+  | otherwise = url+  where+    -- The longest slash-free prefix ending at an '@' whose remainder still+    -- carries a ':' is what the regex's backtracking selects.+    scpSplit u =+      let slashFree = T.takeWhile (/= '/') u+          candidates = [i | (i, c) <- zip [0 ..] (T.unpack slashFree), c == '@']+          viable i = T.any (== ':') (T.drop (i + 1) u)+       in case reverse (filter viable candidates) of+            (i : _) -> Just (T.take i u, T.drop (i + 1) u)+            [] -> Nothing++-- | @percentEncode@ from url.cc: unreserved characters and the kept set+-- pass, every other byte of the UTF-8 form becomes @%XX@.+percentEncode :: Text -> Text -> Text+percentEncode keep = T.concat . map encodeByte . BS.unpack . TE.encodeUtf8+  where+    encodeByte byte+      | unreserved byte || T.any (== chr (fromIntegral byte)) keep = T.singleton (chr (fromIntegral byte))+      | otherwise = T.pack ('%' : hexPair byte)+    unreserved byte =+      let c = chr (fromIntegral byte)+       in isAsciiLower c || isAsciiUpper c || isDigit c || c `elem` unreservedPunctuation+    hexPair byte = map (toUpper . intToDigit) [fromIntegral byte `div` hexBase, fromIntegral byte `mod` hexBase]++-- | The unreserved punctuation of RFC 3986, kept as is.+unreservedPunctuation :: [Char]+unreservedPunctuation = "-._~"++hexBase :: Int+hexBase = 16++-- | @percentDecode@ from url.cc, over the UTF-8 bytes.  A malformed escape+-- is kept literally; upstream throws BadURL there, which this renderer+-- has no reason to reproduce for an error message's sake.+percentDecode :: Text -> Text+percentDecode = TE.decodeUtf8With lenientDecode . BS.pack . go . BS.unpack . TE.encodeUtf8+  where+    go (percent : hi : lo : rest)+      | percent == percentByte,+        isHexDigit (chr (fromIntegral hi)),+        isHexDigit (chr (fromIntegral lo)) =+          fromIntegral (digitToInt (chr (fromIntegral hi)) * hexBase + digitToInt (chr (fromIntegral lo))) : go rest+    go (byte : rest) = byte : go rest+    go [] = []+    percentByte = fromIntegral (ord '%')++-- | The fetch-everything refspec @allRefs@ selects, upstream's exact+-- spelling: every remote ref lands under the same local name, so a+-- pinned rev reachable from ANY ref becomes fetchable even when the+-- remote refuses a direct SHA want.+allRefsFetchSpec :: Text+allRefsFetchSpec = "refs/*:refs/*"++-- | The fetch itself, when nothing is remembered about it.  @checkedRef@+-- and @checkedRev@ have already passed 'checkGitRef'\/'checkGitRev'.+-- The scratch clone is removed on success once the tree is copied out,+-- and by 'onEvalError' when any step throws: a failing fetch must not+-- leave the clone behind.+fetchGitUncached :: (MonadEval m) => FetchGitArgs -> Maybe Text -> Maybe Text -> m FetchCache+fetchGitUncached args checkedRef checkedRev = do+  cloneDir <- createScratchDir "nova-nix-fetchgit-"+  fetchGitInClone args checkedRef checkedRev cloneDir+    `onEvalError` removeScratchDir cloneDir++-- | Every step of an uncached fetch that can throw, run under+-- 'fetchGitUncached''s scratch-dir cleanup.+fetchGitInClone :: (MonadEval m) => FetchGitArgs -> Maybe Text -> Maybe Text -> Text -> m FetchCache+fetchGitInClone args checkedRef checkedRev cloneDir = do+  let ctx = "builtins.fetchGit"+      git = gitRun ctx cloneDir+      url = fgaUrl args+      name = fgaName args+      submodules = fgaSubmodules args+      shallow = fgaShallow args+      depthArgs = if shallow then ["--depth", "1"] else []+      -- An allRefs fetch writes every remote ref, including the one the+      -- scratch clone's unborn HEAD names, which git refuses in a repo+      -- with a worktree (upstream fetches into a BARE cache repo and+      -- never hits this).  The refusal protects a checked-out branch+      -- from moving under the worktree; the explicit checkout below+      -- replaces the worktree state anyway, so allowing it is safe.+      updateHeadArgs = ["--update-head-ok" | fgaAllRefs args]+      -- Upstream's refspec ternary, in its order.  @allRefs@ fetches+      -- everything.  Otherwise a pinned rev is itself the refspec: a+      -- depth-1 fetch of a branch tip cannot contain any other revision,+      -- so asking the remote for the SHA is what lets @shallow@ and+      -- @rev@ compose (and what finds a rev not on the fetched ref).  A+      -- server may refuse a SHA it does not advertise; that surfaces as+      -- git's own fetch error, the same surface upstream has, and+      -- @allRefs = true@ is the caller's way around it.+      fetchTarget+        | fgaAllRefs args = allRefsFetchSpec+        | Just pinned <- checkedRev = pinned+        | otherwise = fromMaybe defaultFetchRef checkedRef+      -- The pinned rev when there is one; under an allRefs fetch with+      -- only a ref, that ref (FETCH_HEAD after a refs/* fetch is+      -- whichever ref arrived last, not the named one); otherwise+      -- whatever the fetch brought down.+      checkoutTarget = case (checkedRev, fgaAllRefs args, checkedRef) of+        (Just pinned, _, _) -> pinned+        (Nothing, True, Just ref) -> ref+        _ -> fetchHeadRef+  _ <- git ["init", "--quiet", "."]+  _ <- git ["remote", "add", "origin", "--", url]+  -- @--@ before the remote: git keeps parsing options after it, so+  -- without a separator a refspec is indistinguishable from a flag.+  _ <- git (["fetch", "--quiet"] ++ depthArgs ++ updateHeadArgs ++ ["--", "origin", fetchTarget])+  -- Trailing @--@, not leading: @git checkout -- X@ reads X as a+  -- pathspec, the opposite of what a leading separator means elsewhere.+  _ <- git ["checkout", "--quiet", checkoutTarget, "--"]+  when submodules $+    void (git ["submodule", "update", "--init", "--recursive"])+  markExecutablesFromIndex ctx cloneDir+  rev <- git ["rev-parse", "HEAD"]+  -- Truncated history cannot answer rev-list: the count would be the+  -- fetch depth, not the revision's depth, and @revCount@ can reach a+  -- derivation's environment.  Upstream reports 0 under @shallow@ (its+  -- fetcher skips computing the attribute and eval fills the default;+  -- observed from nix-instantiate 2.33.2), so 0 is recorded here and+  -- cache hits replay it.+  revCount <-+    if shallow+      then pure 0+      else decodeDecimal ctx =<< git ["rev-list", "--count", "HEAD"]+  lastModifiedText <- git ["show", "-s", "--format=%ct", "HEAD"]+  removeGitMetadata ctx cloneDir+  storePath <- copyPathToStore cloneDir name Nothing+  narHash <- narHashOfPath cloneDir+  removeScratchDir cloneDir+  lastModified <- decodeDecimal ctx lastModifiedText+  let fields =+        FetchCache+          { fcStorePath = storePath,+            fcRev = rev,+            fcRevCount = revCount,+            fcLastModified = lastModified,+            fcNarHash = bytesToBase64 narHash+          }+  -- Remembered only for a pinned revision; see fetchGit.  @allRefs@ is+  -- deliberately not in the key: it changes only whether a fetch can+  -- succeed, never what a given revision's entry holds.+  case checkedRev of+    Nothing -> pure ()+    Just pinned -> writeFetchCache (fetchCacheKey url name pinned submodules shallow) (encodeFetchCache fields)+  pure fields++-- | Mark every file git records as executable (mode 100755) in the+-- checked-out tree.  A no-op on Unix; on Windows the mode has nowhere to+-- live on disk, so it's read back from the index before @.git@ is stripped.+markExecutablesFromIndex :: (MonadEval m) => Text -> Text -> m ()+markExecutablesFromIndex ctx cloneDir = do+  listing <- gitRun ctx cloneDir ["ls-files", "--recurse-submodules", "--stage", "-z"]+  mapM_ markOne (T.split (== '\0') listing)+  where+    markOne row+      | Just rest <- T.stripPrefix "100755 " row,+        (_, tabbed) <- T.breakOn "\t" rest,+        Just relPath <- T.stripPrefix "\t" tabbed,+        not (T.null relPath) =+          setExecutableFile (cloneDir <> "/" <> relPath)+      | otherwise = pure ()++-- | What @builtins.fetchGit@ hands back, from the few facts about a fetch+-- that are worth keeping.  Shared by the fetch and by the cache, so the two+-- cannot describe the same tree differently.+data FetchCache = FetchCache+  { fcStorePath :: !Text,+    fcRev :: !Text,+    fcRevCount :: !Integer,+    fcLastModified :: !Integer,+    fcNarHash :: !Text+  }+  deriving (Eq, Show)++fetchGitResult :: Bool -> FetchCache -> NixValue+fetchGitResult submodules fields =+  let lastModifiedDate =+        T.pack+          ( formatTime+              defaultTimeLocale+              "%Y%m%d%H%M%S"+              (posixSecondsToUTCTime (fromIntegral (fcLastModified fields)))+          )+   in VAttrs+        ( attrSetFromMap $+            Map.fromList+              [ ("outPath", evaluated (VPath (canonPathValue (fcStorePath fields)))),+                ("rev", evaluated (mkStr (fcRev fields))),+                ("shortRev", evaluated (mkStr (T.take 7 (fcRev fields)))),+                ("revCount", evaluated (VInt (fromIntegral (fcRevCount fields)))),+                ("submodules", evaluated (VBool submodules)),+                ("lastModified", evaluated (VInt (fromIntegral (fcLastModified fields)))),+                ("lastModifiedDate", evaluated (mkStr lastModifiedDate)),+                ("narHash", evaluated (mkStr ("sha256-" <> fcNarHash fields)))+              ]+        )++-- | What a remembered fetch is filed under.  Everything that decides what+-- comes back is in the key, so a hit cannot describe a different fetch: the+-- URL, the store name, the revision, whether submodules were taken, and+-- whether the clone was shallow.+--+-- @shallow@ is in the key even though it cannot change the tree, because it+-- decides @revCount@: a shallow fetch reports 0 where a full clone of the+-- same rev counts the real depth.  Sharing an entry between the two would+-- let whichever ran first decide what the other sees, and @revCount@ can+-- reach a derivation's environment, so that is a reproducibility problem+-- rather than a stale-data one.+--+-- The leading version tag invalidates every entry written before a change+-- in what the fields mean.  It last moved for the Windows executable bit,+-- which changes the @narHash@ of any tree holding an executable file.+fetchCacheKey :: Text -> Text -> Text -> Bool -> Bool -> Text+fetchCacheKey url name rev submodules shallow =+  T.intercalate+    "\n"+    [ "fetchGit-2",+      url,+      name,+      rev,+      if submodules then "submodules" else "no-submodules",+      if shallow then "shallow" else "full"+    ]++-- | One field per line, in a fixed order.  Anything that does not read back+-- as exactly five lines is treated as no entry at all.+encodeFetchCache :: FetchCache -> Text+encodeFetchCache fields =+  T.intercalate+    "\n"+    [ fcStorePath fields,+      fcRev fields,+      T.pack (show (fcRevCount fields)),+      T.pack (show (fcLastModified fields)),+      fcNarHash fields+    ]++decodeFetchCache :: Text -> Maybe FetchCache+decodeFetchCache raw = case T.splitOn "\n" raw of+  [storePath, rev, revCount, lastModified, narHash] -> do+    count <- readDecimalMaybe revCount+    modified <- readDecimalMaybe lastModified+    -- Every field is checked, the last one included.  Truncation before+    -- the last field yields fewer than five and is rejected above, but a+    -- write cut inside narHash still yields five and would otherwise+    -- decode as valid with a short hash - and an entry is trusted for as+    -- long as its store path survives.+    validBase64Sha256 narHash+    pure+      FetchCache+        { fcStorePath = storePath,+          fcRev = rev,+          fcRevCount = count,+          fcLastModified = modified,+          fcNarHash = narHash+        }+  _ -> Nothing+  where+    readDecimalMaybe t = case TR.decimal t of+      Right (value, rest) | T.null rest -> Just value+      _ -> Nothing+    -- Base64 of 32 bytes: 44 characters, the last one the single pad.+    validBase64Sha256 t =+      if T.length t == 44 && T.all isBase64Char (T.init t) && T.last t == '='+        then Just ()+        else Nothing+    isBase64Char c = isAsciiUpper c || isAsciiLower c || isDigit c || c == '+' || c == '/'++-- | Run one git subcommand under the same transport allowlist as the URL+-- check.  Returns trimmed stdout; a nonzero exit throws with git's stderr.+gitRun :: (MonadEval m) => Text -> Text -> [Text] -> m Text+gitRun ctx cloneDir args = do+  (code, out, err) <- runProcess "git" (gitTransportConfig ++ ["-C", cloneDir] ++ args) ""+  if code == 0+    then pure (T.strip out)+    else throwEvalError (ctx <> ": git " <> T.unwords args <> " failed: " <> err)++-- | Strip every @.git@ entry (clone's own, and each submodule's) before the+-- tree is copied to the store.  Walked directly, not shelled out to+-- @find@\/@rm@: no @sh@ on a bare Windows install.+removeGitMetadata :: (MonadEval m) => Text -> Text -> m ()+removeGitMetadata _ctx = go+  where+    go dir = do+      entries <- listDirectory dir+      forM_ entries $ \(name, fileType) ->+        let path = dir <> "/" <> name+         in if name == ".git"+              then removeScratchDir path+              else when (fileType == "directory") $ go path++-- | Parse a decimal from trusted git stdout (@rev-list --count@, @show+-- --format=%ct@); a failure means git itself misbehaved.+decodeDecimal :: (MonadEval m) => Text -> Text -> m Integer+decodeDecimal ctx t = case TR.decimal t of+  Right (n, rest) | T.null rest -> pure n+  _ -> throwEvalError (ctx <> ": expected a decimal integer from git, got " <> t)++-- | Fetch a URL and optionally verify its hash.+fetchUrlSimple :: (MonadEval m) => Text -> Maybe Text -> m NixValue+fetchUrlSimple url mSha256 = do+  -- Upstream's order (fetchTree.cc, fetch()): the URI gate, then the+  -- name, then pure mode's hash requirement, all before the download.+  checkUri url+  -- The store name derives from the URL alone, so an unusable name fails+  -- here, before the download side effect.  Upstream rejects the same+  -- names when it adds the fetched file to the store.+  let name = urlBaseName url+  case checkStorePathName name of+    Left err -> throwEvalError ("builtins.fetchurl: " <> storePathNameErrorText err)+    Right () -> pure ()+  requireFetchPin "fetchurl" mSha256+  -- Download to a file, not through the text-mode stdout pipe (which mangles+  -- binary), read the raw bytes, verify the pin if one was given, then store at+  -- the canonical fixed-output path.  The file lives in an exclusively+  -- created scratch directory ('createScratchDir'), removed once read.+  scratch <- createScratchDir "nova-nix-fetchurl-"+  bytes <- downloadInto scratch url `onEvalError` removeScratchDir scratch+  removeScratchDir scratch+  mapM_ (verifyFetchPin "builtins.fetchurl" url bytes) mSha256+  storePath <- addFixedOutputFile name bytes+  pure (VPath storePath)++-- | Fetch a URL into the scratch directory and hand back its bytes.+downloadInto :: (MonadEval m) => Text -> Text -> m BS.ByteString+downloadInto scratch url = do+  let tmpFile = scratch <> "/" <> downloadFileName+  (code, _, stderr) <- runProcess "curl" ["-sSfL", "-o", tmpFile, "--", url] ""+  if code /= 0+    then throwEvalError ("builtins.fetchurl: fetch failed: " <> stderr)+    else readFileBytes tmpFile++-- | The downloaded file's name inside its scratch directory.+downloadFileName :: Text+downloadFileName = "download"++-- | Upstream's pure-mode rule for @fetchurl@ and @fetchTarball@+-- (fetchTree.cc): without a @sha256@ the fetch is refused, since its+-- result would be whatever the network answers today.+requireFetchPin :: (MonadEval m) => Text -> Maybe Text -> m ()+requireFetchPin who pin = do+  policy <- evalPolicy+  when (epPureEval policy && isNothing pin) $+    throwEvalError ("in pure evaluation mode, '" <> who <> "' requires a 'sha256' argument")++-- | Store name for a fetched URL: its basename (minus query/fragment), matching+-- C++ Nix's @baseNameOf url@ default so the fixed-output path agrees with it.+urlBaseName :: Text -> Text+urlBaseName url =+  let stripped = T.takeWhile (\c -> c /= '?' && c /= '#') url+      base = T.takeWhileEnd (/= '/') stripped+   in if T.null base then "source" else base++-- | Verify fetched bytes against a user-supplied sha256 pin, erroring on+-- mismatch.  Accepts SRI, @sha256:@-prefixed, and bare digest forms.+verifyFetchPin :: (MonadEval m) => Text -> Text -> BS.ByteString -> Text -> m ()+verifyFetchPin ctx url bytes expectedStr = do+  expected <- decodeSha256Pin ctx expectedStr+  let got = sha256Digest bytes+  when (expected /= got) $+    throwEvalError+      ( ctx+          <> ": hash mismatch for "+          <> url+          <> "\n  expected: "+          <> expectedStr+          <> "\n  got:      sha256:"+          <> bytesToHexText got+      )++-- | Decode a sha256 pin to raw bytes, reusing the convertHash decoders (SRI,+-- @sha256:@-prefixed, or a bare hex/nix32/base64 digest).+decodeSha256Pin :: (MonadEval m) => Text -> Text -> m BS.ByteString+decodeSha256Pin ctx s+  | Just (algo, b64) <- parseSRI s = do+      requireSha256 algo+      decodeSRI ctx algo b64+  | Just (algo, rest) <- parseAlgoPrefix s = do+      requireSha256 algo+      snd <$> decodeWithAlgo algo rest+  | otherwise = snd <$> decodeWithAlgo "sha256" s+  where+    -- The pin names a sha256 digest specifically, so a spelling carrying+    -- its own algorithm tag must carry sha256 - a sha512 pin here is an+    -- error at decode time, as upstream's typed Hash parse.+    requireSha256 "sha256" = pure ()+    requireSha256 algo =+      throwEvalError (ctx <> ": hash '" <> s <> "' should have type 'sha256', not '" <> algo <> "'")++-- | Force a required string attribute from an attrset, using full Nix string+-- coercion (VStr, VPath, VInt, VBool, VAttrs via __toString/outPath).+-- A coercion failure (or a throwing attr value) propagates with its own+-- message, as upstream - swallowing it here once masked user throws.+-- The Text result decodes strictly: callers use it as a name, URL, or+-- platform string, none of which may carry invalid UTF-8 here.+forceAttrStr :: (MonadEval m) => Text -> Text -> AttrSet -> m Text+forceAttrStr builtin key attrs = do+  bytes <- forceAttrBytes builtin key attrs+  decodedText builtin bytes++-- | Like 'forceAttrStr' but returns the coerced RAW BYTES.+forceAttrBytes :: (MonadEval m) => Text -> Text -> AttrSet -> m BS.ByteString+forceAttrBytes builtin key attrs =+  case attrSetLookup key attrs of+    Nothing -> throwEvalError (builtin <> ": missing required attribute '" <> key <> "'")+    Just thunk -> do+      val <- force thunk+      (s, _ctx) <- coerceToString True force applyValue coercePathVerbatim val+      pure s++-- | Force an optional string attribute via full Nix coercion.  A present+-- but uncoercible (or throwing) value is an error, not 'Nothing'.+forceOptionalAttrStr :: (MonadEval m) => AttrSet -> Text -> m (Maybe Text)+forceOptionalAttrStr attrs key =+  case attrSetLookup key attrs of+    Nothing -> pure Nothing+    Just thunk -> do+      val <- force thunk+      (s, _ctx) <- coerceToString True force applyValue coercePathVerbatim val+      Just <$> decodedText "string attribute" s++-- | Force an optional boolean attribute; present but non-boolean is an error,+-- not a silent coercion.+forceOptionalAttrBool :: (MonadEval m) => Text -> AttrSet -> Text -> Bool -> m Bool+forceOptionalAttrBool builtin attrs key def =+  case attrSetLookup key attrs of+    Nothing -> pure def+    Just thunk -> do+      val <- force thunk+      case val of+        VBool b -> pure b+        other -> throwEvalError (builtin <> ": attribute '" <> key <> "' should be a bool, but is " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - derivation construction+-- ---------------------------------------------------------------------------++-- | Resolve an input derivation's modulo hash (hex) for the ATerm substitution+-- 'toATermForHash' performs.  The drv-hash cache is populated bottom-up as each+-- derivation is evaluated, so an in-session input hits directly.  A miss - a+-- cross-session reference, or a path fabricated by @builtins.appendContext@ -+-- reads the input @.drv@ from the store and recurses, exactly as upstream+-- @hashDerivationModulo@ does.  A miss whose @.drv@ cannot be read (pure+-- evaluation, or a @.drv@ absent from the store) fails loudly: a divergent+-- derivation hash is never emitted from a guessed input hash.  Reading the+-- store is an effect, so hashing a dependent derivation is an IO-evaluator+-- capability - pure evaluation, which cannot read the store, cannot do it.+resolveInputModulo :: (MonadEval m) => (StorePath, [Text]) -> m (Text, [Text])+resolveInputModulo (sp, outs) = do+  let inputPathText = storePathToText defaultStoreDir sp+  cached <- lookupDrvHash inputPathText+  case cached of+    Just hex -> pure (hex, outs)+    Nothing -> do+      mDrv <- readStoreDerivation sp+      case mDrv of+        Just inputDrv -> do+          hex <- derivationModuloHex inputDrv+          cacheDrvHash inputPathText hex+          pure (hex, outs)+        Nothing ->+          throwEvalError+            ( "derivation: cannot compute the input-derivation modulo hash for "+                <> inputPathText+                <> " - it was not evaluated in this session and its .drv is not "+                <> "readable from the store (dependent-derivation hashing needs the IO evaluator)"+            )++-- | The derivation-modulo hash (hex) of a derivation, matching upstream+-- @hashDerivationModulo@: a fixed-output derivation hashes the+-- @fixed:out:\<algo\>:\<hash\>:\<path\>@ form; an input-addressed derivation+-- substitutes each input's modulo hash into its ATerm and hashes that.  These+-- are the same two rules 'builtinDerivationStrict' applies when it first+-- computes a derivation's hash, so a store-read input yields the value it had+-- in-session.+derivationModuloHex :: (MonadEval m) => Derivation -> m Text+derivationModuloHex drv = case drvOutputs drv of+  [DerivationOutput "out" outPath algoField hashHex]+    | not (T.null algoField) && not (T.null hashHex) ->+        let outPathText = storePathToText defaultStoreDir outPath+            fixedForm = "fixed:out:" <> algoField <> ":" <> hashHex <> ":" <> outPathText+         in pure (bytesToHexText (sha256Digest (TE.encodeUtf8 fixedForm)))+  _ -> do+    inputSubst <- mapM resolveInputModulo (Map.toList (drvInputDrvs drv))+    pure (bytesToHexText (sha256Digest (toATermForHash False (Just inputSubst) drv)))++-- | The full output-name list of an all-outputs (upstream DrvDeep) reference:+-- every output name of the referenced @.drv@, which upstream's derivationStrict+-- inserts into the consuming derivation's inputDrvs.  Mirrors the+-- 'resolveInputModulo' ladder - an in-session derivation from the recorded+-- ATerm ('lookupSessionDrv'), else a cross-session @.drv@ read from the store+-- ('readStoreDerivation'), else a loud error rather than a dropped reference+-- (which would under-hash the dependent).  Pure evaluation can read neither+-- source, so a dependent carrying an all-outputs reference errors there,+-- consistent with dependent-derivation hashing being an IO-evaluator capability.+resolveAllOutputNames :: (MonadEval m) => StorePath -> m [Text]+resolveAllOutputNames sp = map doName . drvOutputs <$> derivationAt sp++-- | The derivation a @.drv@ path names, from this session or the store.+derivationAt :: (MonadEval m) => StorePath -> m Derivation+derivationAt sp = do+  let drvPathText = storePathToText defaultStoreDir sp+  session <- lookupSessionDrv drvPathText+  case session of+    Just drv -> pure drv+    Nothing -> do+      onDisk <- readStoreDerivation sp+      case onDisk of+        Just drv -> pure drv+        Nothing ->+          throwEvalError+            ( "derivation: cannot resolve the output names of the all-outputs reference "+                <> drvPathText+                <> " - it was not evaluated in this session and its .drv is not "+                <> "readable from the store (all-outputs references need the IO evaluator)"+            )++-- | The filesystem closure of the @.drv@ files an all-outputs context+-- names, as upstream's derivationStrict takes it for each+-- (@computeFSClosure@, primops.cc:1382 at 2.24.9): every @.drv@ reachable+-- through @inputDrvs@, every source in their @inputSrcs@, and the+-- references this session recorded for a source it wrote.+allOutputsClosure :: (MonadEval m) => [StorePath] -> m (Set.Set StorePath)+allOutputsClosure = go Set.empty+  where+    go !seen [] = pure seen+    go !seen (sp : rest)+      | Set.member sp seen = go seen rest+      | ".drv" `T.isSuffixOf` spName sp = do+          drv <- derivationAt sp+          go (Set.insert sp seen) (Map.keys (drvInputDrvs drv) ++ drvInputSrcs drv ++ rest)+      | otherwise = do+          refs <- fromMaybe [] <$> lookupSessionReferences sp+          go (Set.insert sp seen) (refs ++ rest)++-- | Eager derivation computation - @builtins.derivationStrict@.  Forces all+-- input attrs into env vars, content-hashes, and returns upstream's result+-- set: @drvPath@ and one attribute per output holding that output's path,+-- each carrying its store context (primops.cc, @prim_derivationStrict@).+-- The @derivation@ wrapper ("Nix.Builtins") reaches this only through+-- @outPath@ and @drvPath@, so forcing a derivation to WHNF never runs it.+builtinDerivationStrict :: (MonadEval m) => NixValue -> m NixValue+builtinDerivationStrict (VAttrs attrs) = do+  -- Extract required attributes.  The name and system are Text (they feed+  -- store-path and platform machinery); the builder stays raw bytes - it+  -- lands byte-exact in the ATerm's builder field.+  -- prim_derivationStrict names the attribute outside the line its+  -- forceStringNoCtx adds.+  let nameTrace =+        traceIfPresent attrs "name" "while evaluating the derivation attribute 'name'"+          . traceIfPresent attrs "name" "while evaluating the `name` attribute passed to builtins.derivationStrict"+  -- Read with forceStringNoCtx (primops.cc:1130 at 2.24.9): a string with+  -- no context, never a value coerced to one.  An absent name is getAttr's+  -- error.+  drvName <- nameTrace $ case attrSetLookup "name" attrs of+    Nothing -> throwEvalError "attribute 'name' missing"+    Just thunk -> decodedText "derivation" =<< structuredStringValue RefuseContext =<< force thunk+  -- Upstream processes every other attribute inside a catch that names it+  -- (derivationStrictInternal); an absent one has nothing to name.+  let traceAttr key = traceIfPresent attrs key (derivationAttrTrace drvName key)+  -- The name becomes the store-path name of the .drv and of every output,+  -- so it must satisfy the store-path name rules.  The path constructors+  -- re-check what they build; this early check reports the offending+  -- FIELD rather than a composed path name.+  case checkStorePathName drvName of+    Left err ->+      throwEvalError ("invalid derivation name: " <> storePathNameUpstreamText err <> ". Please pass a different 'name'.")+    Right () -> pure ()+  passing <-+    addErrorTrace "while evaluating the `__structuredAttrs` attribute passed to builtins.derivationStrict" $+      attrPassingOf attrs+  let fieldContext = "derivation \"" <> drvName <> "\""+      optionalCoerced key =+        traverse (\thunk -> fst <$> (coerceToString True force applyValue coercePathToStore =<< force thunk)) (attrSetLookup key attrs)+      optionalString rule key = traverse (force >=> structuredStringValue rule) (attrSetLookup key attrs)+      -- Upstream checks both once its attribute loop is done, the builder+      -- first, and an empty one counts as absent (primops.cc:1403).+      requiredFields (systemValue, builderValue) = do+        builderBytes <- required "builder" builderValue+        systemBytes <- required "system" systemValue+        systemText <- decodedText fieldContext systemBytes+        pure (systemText, builderBytes)+      required key value = case value of+        Just bytes | not (BS.null bytes) -> pure bytes+        _ -> throwEvalError ("required attribute '" <> key <> "' missing")+  -- A structured derivation's builder and system are read as strings+  -- (upstream's forceString and forceStringNoCtx) rather than coerced.+  -- Otherwise they are the strings their environment entries coerce to,+  -- a path copied to the store (primops.cc:1347 at 2.24.9).+  (system, builder) <- case passing of+    PassAsEnvironment ->+      requiredFields+        =<< (,)+          <$> traceAttr "system" (optionalCoerced "system")+          <*> traceAttr "builder" (optionalCoerced "builder")+    PassAsStructuredAttrs ->+      requiredFields+        =<< (,)+          <$> traceAttr "system" (optionalString RefuseContext "system")+          <*> traceAttr "builder" (optionalString AllowContext "builder")++  -- __ignoreNulls: when true, null-valued attrs are dropped from the+  -- derivation env (stdenv.mkDerivation sets it); when absent or false,+  -- null coerces to "" like any other coerceMore value - C++ Nix semantics.+  ignoreNulls <- case attrSetLookup "__ignoreNulls" attrs of+    Nothing -> pure False+    Just thunk ->+      addErrorTrace "while evaluating the `__ignoreNulls` attribute passed to builtins.derivationStrict" $+        force thunk >>= expectDerivationBool++  -- Extract optional outputs (default ["out"]).  Each refusal below names+  -- the attribute, as upstream's handleOutputs runs inside its catch.+  outputNames <- traceAttr "outputs" $ case attrSetLookup "outputs" attrs of+    Nothing -> pure ["out"]+    Just thunk -> do+      val <- force thunk+      case val of+        VList cl -> case passing of+          PassAsEnvironment -> mapM (forceToText . Thunk) (clistThunks cl)+          PassAsStructuredAttrs -> mapM (structuredOutputName fieldContext . Thunk) (clistThunks cl)+        -- A null outputs attr is dropped by __ignoreNulls, falling back to+        -- the default output set; without it, null is an error as upstream.+        VNull | ignoreNulls -> pure ["out"]+        _ -> throwEvalError "derivation: 'outputs' must be a list of strings"++  -- Each output name composes into a store-path name (drvName-<output>)+  -- and names the on-disk location the builder later clears and moves+  -- onto, so it must satisfy the same store-path name rules (the+  -- composed length is re-checked at construction).+  traceAttr "outputs" $ forM_ outputNames $ \outName ->+    case checkStorePathName outName of+      Left err ->+        throwEvalError+          ( "derivation \""+              <> drvName+              <> "\": invalid derivation output name '"+              <> outName+              <> "': "+              <> storePathNameReasonText (spneReason err)+          )+      Right () -> pure ()++  -- Upstream's derivationStrict walks the output names in order and refuses+  -- a repeated name and the name drvPath, which its result set already+  -- carries, then refuses an empty list (primops.cc, handleOutputs in+  -- derivationStrictInternal).+  let checkOutputName seen outName+        | Set.member outName seen = throwEvalError ("duplicate derivation output '" <> outName <> "'")+        | outName == "drvPath" = throwEvalError "invalid derivation output name 'drvPath'"+        | otherwise = pure (Set.insert outName seen)+  traceAttr "outputs" $ do+    foldM_ checkOutputName Set.empty outputNames+    when (null outputNames) (throwEvalError "derivation cannot have an empty set of outputs")++  -- Extract optional args (default []).  Path literals in args (e.g. stdenv's+  -- ./default-builder.sh) are copied into the store; their source paths flow+  -- into inputSrcs via the returned context.+  (builderArgs, argsContext) <- traceAttr "args" $ case attrSetLookup "args" attrs of+    Nothing -> pure ([], mempty)+    Just thunk -> do+      val <- force thunk+      case val of+        VList cl -> do+          parts <- mapM (\t -> force (Thunk t) >>= coerceToStoreString) (clistThunks cl)+          pure (map fst parts, mconcat (map snd parts))+        VNull | ignoreNulls -> pure ([], mempty)+        _ -> throwEvalError "derivation: 'args' must be a list of strings"++  -- Materialize once, reuse for both env collection and result merge+  let materialized = attrSetToMap attrs++  -- Collect the attrs into the build env, EXCLUDING "args" (C++ Nix puts+  -- args in the Derive() args field, never the env): one string-coerced+  -- entry each, or one JSON object under __json for a structured+  -- derivation.  The per-output env vars ($out, ...) are added below in+  -- both modes.  Carries merged context.+  let envAttrs = Map.delete "__ignoreNulls" (Map.delete "args" materialized)+  (drvEnvPairs, envContext) <- case passing of+    PassAsEnvironment -> collectDrvEnvWithContext drvName ignoreNulls envAttrs+    PassAsStructuredAttrs -> do+      (members, ctx) <- collectStructuredAttrs drvName ignoreNulls (Map.delete structuredAttrsFlag envAttrs)+      forM_ (Map.keys (Map.restrictKeys members structuredPlainStrings)) $ \key ->+        traceAttr key (structuredString RefuseContext fieldContext key attrs)+      forM_ (Map.keys (Map.restrictKeys members structuredDisabledChecks)) $+        traceMessage . disabledByStructuredAttrs drvName+      pure ([(structuredAttrsKey, encodeStructuredAttrs (StructuredAttrs members))], ctx)++  let fullContext = envContext <> argsContext+      builtInputDrvs = extractInputDrvs fullContext+      allOutputRefs = extractAllOutputRefs fullContext+  -- All-outputs (DrvDeep) references - e.g. an embedded @dep.drvPath@ - add+  -- the referenced .drv's whole closure, as upstream's derivationStrict+  -- does: every path in it to inputSrcs, every .drv in it to inputDrvs with+  -- ALL its output names.  Merged in BEFORE drvRefs and the modulo+  -- substitution so both the dependent's own .drv hash and its output paths+  -- account for the reference.+  deepClosure <- allOutputsClosure allOutputRefs+  deepInputDrvs <-+    Map.fromList+      <$> mapM (\drvSp -> (,) drvSp <$> resolveAllOutputNames drvSp) (filter ((".drv" `T.isSuffixOf`) . spName) (Set.toList deepClosure))+  let inputDrvs = Map.unionWith (++) builtInputDrvs deepInputDrvs+      inputSrcs = Set.toList (Set.fromList (extractInputSrcs fullContext) <> deepClosure)+      platform = textToPlatform system+      baseEnv = Map.fromList drvEnvPairs+      drvRefs = inputSrcs ++ Map.keys inputDrvs+      drvFileName = drvName <> ".drv"+      -- Build a Derivation sharing this call's inputs/platform/builder/args.+      mkDrv outs env =+        Derivation+          { drvOutputs = outs,+            drvInputDrvs = inputDrvs,+            drvInputSrcs = inputSrcs,+            drvPlatform = platform,+            drvBuilder = builder,+            drvArgs = builderArgs,+            drvEnv = env+          }+      -- Output carrying only its name; the path is masked at render time.+      maskedOutput name = DerivationOutput name maskedOutputPath "" ""++  -- Fixed-output derivations (fetchurl etc.) are content-addressed and hash+  -- via the @fixed:out:@ scheme; input-addressed derivations recurse through+  -- the modulo hashes of their inputs.+  mFixed <- detectFixedOutput attrs++  -- Path construction returns Left on a name the store rules reject; the+  -- early field checks above make that unreachable here except through+  -- composition (drvName <> ".drv", drvName-output past the length cap),+  -- which only the constructors see.+  let drvContext = "derivation \"" <> drvName <> "\""+  (outPaths, completeDrv, moduloHash) <- case mFixed of+    Just (foAlgo, foMode, foDigest) -> do+      foPath <- storePathOrThrow drvContext (makeFixedOutputPath drvName foAlgo foMode foDigest)+      let foPathText = storePathToText defaultStoreDir foPath+          algoField = (if foMode == "recursive" then "r:" else "") <> foAlgo+          foHashHex = bytesToHexText foDigest+          foModulo =+            sha256Digest+              (TE.encodeUtf8 ("fixed:out:" <> algoField <> ":" <> foHashHex <> ":" <> foPathText))+          contents =+            mkDrv+              [DerivationOutput "out" foPath algoField foHashHex]+              (Map.insert "out" (TE.encodeUtf8 foPathText) baseEnv)+      pure ([("out", foPathText)], contents, foModulo)+    Nothing -> do+      inputSubst <- mapM resolveInputModulo (Map.toList inputDrvs)+      let maskedEnv = foldr (`Map.insert` "") baseEnv outputNames+          maskedDrv = mkDrv (map maskedOutput outputNames) maskedEnv+          -- Masked modulo hash yields this derivation's own output paths.+          moduloMasked = sha256Digest (toATermForHash True (Just inputSubst) maskedDrv)+      outStorePaths <-+        mapM+          (\n -> (,) n <$> storePathOrThrow drvContext (makeOutputPath n moduloMasked drvName))+          outputNames+      let outPathTexts = [(n, storePathToText defaultStoreDir sp) | (n, sp) <- outStorePaths]+          realEnv = foldr (\(n, t) e -> Map.insert n (TE.encodeUtf8 t) e) baseEnv outPathTexts+          contents = mkDrv [DerivationOutput n sp "" "" | (n, sp) <- outStorePaths] realEnv+          -- Unmasked modulo hash (real outputs, inputs substituted) cached for+          -- when this derivation is itself an input to another.+          moduloUnmasked = sha256Digest (toATermForHash False (Just inputSubst) contents)+      pure (outPathTexts, contents, moduloUnmasked)++  -- The .drv's bytes are rendered once, as upstream's writeDerivation hashes+  -- and writes the one unparse.  They are recorded whole so the build driver+  -- can materialize the entire input-.drv closure before building; bottom-up+  -- eval guarantees every transitive input is recorded by the time a+  -- dependent is.+  let aterm = toATerm completeDrv+  drvSP <- storePathOrThrow drvContext (makeTextPath drvFileName (sha256Digest aterm) drvRefs)+  let drvPathText = storePathToText defaultStoreDir drvSP+  cacheDrvHash drvPathText (bytesToHexText moduloHash)+  recordDrvAterm drvPathText aterm++  -- drvPath carries the whole derivation (upstream's DrvDeep); an output+  -- path carries that one output of it.+  let drvPathCtx = StringContext (Set.singleton (SCAllOutputs drvSP))+      outPathCtx outName = StringContext (Set.singleton (SCDrvOutput drvSP outName))+      outputEntry (outName, outP) = (outName, evaluated (VStr (TE.encodeUtf8 outP) (outPathCtx outName)))+      resultAttrs =+        Map.fromList+          (("drvPath", evaluated (VStr (TE.encodeUtf8 drvPathText) drvPathCtx)) : map outputEntry outPaths)++  pure (VAttrs (attrSetFromMap resultAttrs))+builtinDerivationStrict other =+  throwEvalError ("derivation: expected a set, got " <> typeName other)++-- | Detect a fixed-output derivation.  Returns @Just (algo, mode, rawDigest)@+-- when @outputHash@ is present and non-empty (fetchurl, fetchgit, ...), else+-- 'Nothing' for an ordinary input-addressed derivation.  @mode@ is+-- @\"flat\"@ or @\"recursive\"@; @algo@ is e.g. @\"sha256\"@.+detectFixedOutput :: (MonadEval m) => AttrSet -> m (Maybe (Text, Text, BS.ByteString))+detectFixedOutput attrs =+  case attrSetLookup "outputHash" attrs of+    Nothing -> pure Nothing+    Just thunk -> do+      val <- force thunk+      case val of+        VStr rawHash _+          | not (BS.null rawHash) -> do+              ohash <- decodedText "derivation: outputHash" rawHash+              ohAlgo <- optDrvStrAttr "outputHashAlgo" attrs+              ohMode <- optDrvStrAttr "outputHashMode" attrs+              (algo, digest) <- normalizeFixedHash ohash ohAlgo+              let mode = if ohMode == "recursive" then "recursive" else "flat"+              pure (Just (algo, mode, digest))+        _ -> pure Nothing++-- | Read an optional string attribute, defaulting to @\"\"@ when absent or+-- not a string.+optDrvStrAttr :: (MonadEval m) => Text -> AttrSet -> m Text+optDrvStrAttr key attrs =+  case attrSetLookup key attrs of+    Nothing -> pure ""+    Just thunk -> do+      val <- force thunk+      case val of+        VStr s _ -> decodedText ("derivation: " <> key) s+        _ -> pure ""++-- | Decode a fixed-output hash (SRI @algo-base64@, @algo:hash@, or a bare+-- hash plus a separate algorithm) to its algorithm name and raw bytes.+-- A non-empty @outputHashAlgo@ must name a known algorithm and agree with+-- the algorithm an SRI or prefixed spelling carries: the enforced+-- algorithm must be the declared one, never a silent substitute.+normalizeFixedHash :: (MonadEval m) => Text -> Text -> m (Text, BS.ByteString)+normalizeFixedHash ohash ohAlgo+  | Just (algo, b64) <- parseSRI ohash = do+      requireDeclaredAlgo algo+      bytes <- decodeSRI "derivation" algo b64+      pure (algo, bytes)+  | Just (algo, rest) <- parseAlgoPrefix ohash = do+      requireDeclaredAlgo algo+      decodeWithAlgo algo rest+  | not (T.null ohAlgo) = decodeWithAlgo ohAlgo ohash+  | otherwise =+      throwEvalError ("derivation: cannot determine outputHash algorithm for " <> ohash)+  where+    -- 'decodeSha256Pin's requireSha256 with the expected type supplied by+    -- @outputHashAlgo@ instead of fixed at sha256 (upstream's typed Hash+    -- parse, hash.cc parseAny with an expected type).  An unknown declared+    -- algorithm is an error even when the spelling carries its own tag.+    requireDeclaredAlgo embedded+      | T.null ohAlgo = pure ()+      | Nothing <- hashAlgoBytes ohAlgo =+          throwEvalError ("unknown hash algorithm '" <> ohAlgo <> "'")+      | embedded == ohAlgo = pure ()+      | otherwise =+          throwEvalError+            ("derivation: hash '" <> ohash <> "' should have type '" <> ohAlgo <> "', not '" <> embedded <> "'")++-- | Force a thunk to a Text string via full Nix coercion (strict decode:+-- used for output names, which are ASCII-shaped identity components).+forceToText :: (MonadEval m) => Thunk -> m Text+forceToText thunk = do+  val <- force thunk+  (s, _ctx) <- coerceToString True force applyValue coercePathVerbatim val+  decodedText "derivation" s++-- | Collect all derivation attributes into env pairs via full Nix coercion+-- (__toString, outPath, list-to-space-separated-string), along with the+-- merged string context from all collected values.  Values are RAW BYTES:+-- they flow byte-exact into the ATerm env section (and its hash).+--+-- A coercion failure (a thrown attr value, an uncoercible function, a failed+-- import inside the value) fails the WHOLE derivation, as in C++ Nix.+-- Swallowing it silently produces a wrong .drv - this exact bug once turned+-- a seed derivation with 17 failed src attrs into an empty no-input drv that+-- "built" successfully.  Null attrs are dropped only under __ignoreNulls;+-- otherwise null coerces to @""@ like any other coerceMore value.+collectDrvEnvWithContext :: (MonadEval m) => Text -> Bool -> Map Text Thunk -> m ([(Text, BS.ByteString)], StringContext)+collectDrvEnvWithContext drvName ignoreNulls attrs = do+  let pairs = Map.toList attrs+  results <- mapM coerceEnvAttr pairs+  let envPairs = catMaybes [fmap (\(k, v, _) -> (k, v)) r | r <- results]+      mergedCtx = mconcat [ctx | Just (_, _, ctx) <- results]+  pure (envPairs, mergedCtx)+  where+    coerceEnvAttr (key, thunk) = addErrorTrace (derivationAttrTrace drvName key) $ do+      val <- force thunk+      case val of+        VNull | ignoreNulls -> pure Nothing+        _ -> do+          (s, ctx) <- coerceToStoreString val+          pure (Just (key, s, ctx))++-- | How a derivation hands its attributes to the builder.+data AttrPassing+  = -- | One environment variable per attribute, each coerced to a string.+    PassAsEnvironment+  | -- | @__structuredAttrs = true@: one JSON object under @__json@, so an+    -- attribute may be a set or a list (upstream's @jsonObject@ branch of+    -- @derivationStrictInternal@, primops.cc at 2.24.9).+    PassAsStructuredAttrs++-- | The attribute choosing structured attributes.  It is not itself one of+-- them: upstream leaves it out of the JSON object.+structuredAttrsFlag :: Text+structuredAttrsFlag = "__structuredAttrs"++-- | Upstream reads @__structuredAttrs@ before any other attribute and as a+-- boolean, whatever @__ignoreNulls@ says, refusing anything else with+-- @forceBool@'s message.+attrPassingOf :: (MonadEval m) => AttrSet -> m AttrPassing+attrPassingOf attrs = case attrSetLookup structuredAttrsFlag attrs of+  Nothing -> pure PassAsEnvironment+  Just thunk -> do+    structured <- force thunk >>= expectDerivationBool+    pure (if structured then PassAsStructuredAttrs else PassAsEnvironment)++-- | Whether a string field read without coercion may carry context: a+-- structured derivation's builder may (upstream's forceString), the name+-- and the fields upstream reads with forceStringNoCtx may not.+data StringContextRule = AllowContext | RefuseContext++-- | A string field of a structured derivation, as upstream reads it:+-- a string, never a value coerced to one.+structuredString :: (MonadEval m) => StringContextRule -> Text -> Text -> AttrSet -> m BS.ByteString+structuredString rule fieldContext key attrs = case attrSetLookup key attrs of+  Nothing -> throwEvalError (fieldContext <> ": missing required attribute '" <> key <> "'")+  Just thunk -> force thunk >>= structuredStringValue rule++-- | 'structuredString' of a value already in hand.+structuredStringValue :: (MonadEval m) => StringContextRule -> NixValue -> m BS.ByteString+structuredStringValue rule val = case (val, rule) of+  (VStr s ctx, RefuseContext)+    | Just shown <- firstContextEncoded ctx ->+        throwEvalError ("the string '" <> bytesToTextLossy s <> "' is not allowed to refer to a store path (such as '" <> shown <> "')")+  (VStr s _, _) -> pure s+  (other, _) ->+    throwEvalError ("expected a string but found " <> typeName other <> ": " <> printValue PrintForError other)++-- | An element of a structured derivation's @outputs@ list: a string+-- without context, where the environment would coerce it.+structuredOutputName :: (MonadEval m) => Text -> Thunk -> m Text+structuredOutputName fieldContext thunk =+  force thunk >>= structuredStringValue RefuseContext >>= decodedText fieldContext++-- | The attributes a structured derivation reads as plain strings, past+-- @system@ and the outputs list, which are read where they are used.+structuredPlainStrings :: Set.Set Text+structuredPlainStrings = Set.fromList ["outputHash", "outputHashAlgo", "outputHashMode"]++-- | Reference and size checks that a structured derivation takes from+-- @outputChecks@ instead; upstream warns when one is set at the top level.+structuredDisabledChecks :: Set.Set Text+structuredDisabledChecks =+  Set.fromList+    ["allowedReferences", "allowedRequisites", "disallowedReferences", "disallowedRequisites", "maxSize", "maxClosureSize"]++-- | Upstream's warning for a 'structuredDisabledChecks' attribute.+disabledByStructuredAttrs :: Text -> Text -> Text+disabledByStructuredAttrs drvName key =+  "warning: In a derivation named '"+    <> drvName+    <> "', 'structuredAttrs' disables the effect of the derivation attribute '"+    <> key+    <> "'; use 'outputChecks.<output>."+    <> key+    <> "' instead"++-- | Collect a structured derivation's attributes into the members of its+-- @__json@ object, each converted as @builtins.toJSON@ converts it (upstream+-- calls the same @printValueAsJSON@), with the merged context of every+-- string they hold.  Null attributes are dropped only under+-- @__ignoreNulls@, as in 'collectDrvEnvWithContext'.+collectStructuredAttrs :: (MonadEval m) => Text -> Bool -> Map Text Thunk -> m (Map Text Json, StringContext)+collectStructuredAttrs drvName ignoreNulls attrs = do+  results <- mapM member (Map.toAscList attrs)+  let members = catMaybes results+  pure (Map.fromAscList [(key, json) | (key, json, _) <- members], mconcat [ctx | (_, _, ctx) <- members])+  where+    member (key, thunk) = addErrorTrace (derivationAttrTrace drvName key) $ do+      val <- force thunk+      case val of+        VNull | ignoreNulls -> pure Nothing+        _ -> do+          (json, ctx) <- valueToJSON val+          pure (Just (key, json, ctx))++-- | Upstream's line of context for a failure processing one attribute of+-- a derivation's argument set (derivationStrictInternal, primops.cc at+-- 2.24.9).+derivationAttrTrace :: Text -> Text -> Text+derivationAttrTrace drvName key = "while evaluating attribute '" <> key <> "' of derivation '" <> drvName <> "'"++-- | Run the action with a line of context when the attribute is present,+-- and as it is when it is absent, which leaves a missing attribute's+-- refusal unadorned.+traceIfPresent :: (MonadEval m) => AttrSet -> Text -> Text -> m a -> m a+traceIfPresent attrs key line action+  | attrSetMember key attrs = addErrorTrace line action+  | otherwise = action++-- | A derivation's Boolean switch, refused with upstream's @forceBool@+-- message.+expectDerivationBool :: (MonadEval m) => NixValue -> m Bool+expectDerivationBool (VBool b) = pure b+expectDerivationBool other = throwEvalError ("expected a Boolean but found " <> typeName other <> ": " <> printValue PrintForError other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - hashFile, readFileType+-- ---------------------------------------------------------------------------++-- | @builtins.hashFile algo path@ - hash raw bytes of a file on disk.+-- Returns base-16 hex string, matching @builtins.hashString@ output format.+builtinHashFile :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinHashFile (VStr algo _) pathVal = do+  algoName <- decodedText "builtins.hashFile" algo+  bytes <- readFileBytes =<< coerceToPath "builtins.hashFile" pathVal+  hashBytesWithAlgo "hashFile" algoName bytes+builtinHashFile other _ =+  throwEvalError ("builtins.hashFile: expected a string, got " <> typeName other)++-- | Shared hash dispatch for raw 'ByteString' input.+hashBytesWithAlgo :: (MonadEval m) => Text -> Text -> BS.ByteString -> m NixValue+hashBytesWithAlgo ctx algo bytes = case algo of+  "sha256" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA256)))+  "sha512" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA512)))+  "sha1" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.SHA1)))+  "md5" -> pure (mkStr (digestToHex (CH.hash bytes :: CH.Digest CH.MD5)))+  _ -> throwEvalError ("builtins." <> ctx <> ": unknown hash algorithm '" <> algo <> "'")++-- | @builtins.readFileType path@ - classify a filesystem entry.+-- Returns @"regular"@, @"directory"@, @"symlink"@, or @"unknown"@.+builtinReadFileType :: (MonadEval m) => NixValue -> m NixValue+builtinReadFileType val = mkStr <$> (getFileType =<< coerceToPath "builtins.readFileType" val)++-- ---------------------------------------------------------------------------+-- Builtin implementations - convertHash+-- ---------------------------------------------------------------------------++-- | @builtins.convertHash { hash, hashAlgo?, toHashFormat }@ - convert+-- between hash representations.  Supports base16, nix32, base64, and sri.+builtinConvertHash :: (MonadEval m) => NixValue -> m NixValue+builtinConvertHash (VAttrs attrs) = do+  hashVal <- requireStrAttr "convertHash" "hash" attrs+  toFmt <- requireStrAttr "convertHash" "toHashFormat" attrs+  -- Detect input format and decode to raw bytes + algo+  (algo, rawBytes) <- decodeHashInput attrs hashVal+  -- Encode to target format+  case toFmt of+    "base16" -> pure (mkStr (bytesToHexText rawBytes))+    "nix32" -> pure (mkStr (Nix32.encode rawBytes))+    "base32" -> pure (mkStr (Nix32.encode rawBytes)) -- deprecated alias+    "base64" -> pure (mkStr (bytesToBase64 rawBytes))+    "sri" -> pure (mkStr (algo <> "-" <> bytesToBase64 rawBytes))+    _ -> throwEvalError ("builtins.convertHash: unknown toHashFormat '" <> toFmt <> "'")+builtinConvertHash other =+  throwEvalError ("builtins.convertHash: expected a set, got " <> typeName other)++-- | Extract algo + raw bytes from the hash input, handling SRI, prefixed, and plain formats.+decodeHashInput :: (MonadEval m) => AttrSet -> Text -> m (Text, BS.ByteString)+decodeHashInput attrs hashStr+  -- SRI format: algo-base64+  | Just (algo, b64) <- parseSRI hashStr = do+      bytes <- decodeSRI "convertHash" algo b64+      pure (algo, bytes)+  -- Prefixed format: algo:hex or algo:nix32+  | Just (algo, rest) <- parseAlgoPrefix hashStr =+      decodeWithAlgo algo rest+  -- Plain hash - need hashAlgo attribute+  | otherwise = do+      algo <- requireStrAttr "convertHash" "hashAlgo" attrs+      decodeWithAlgo algo hashStr++-- | Decode a bare hash string for a known algorithm, keyed by length as+-- upstream (@hash.cc@ @Hash@ parsing): an algorithm's base16, nix32, and+-- base64 spellings have pairwise distinct lengths, so the input length+-- selects the decoder and every other length is an error.  Trying decoders+-- in sequence instead mis-reads edge inputs - an all-hex-digit string of+-- nix32 length is a nix32 hash, and a truncated hash must be rejected, not+-- decoded by whichever shorter format happens to accept it.+decodeWithAlgo :: (MonadEval m) => Text -> Text -> m (Text, BS.ByteString)+decodeWithAlgo algo s = case hashAlgoBytes algo of+  Nothing -> throwEvalError ("unknown hash algorithm '" <> algo <> "'")+  Just size+    | T.length s == hexHashLen size -> accept size "base16" (hexToBytes s)+    | T.length s == nix32HashLen size -> accept size "nix32" (rightToMaybe (Nix32.decode s))+    | T.length s == base64HashLen size -> accept size "base64" (rightToMaybe (decodeBase64Pure s))+    | otherwise ->+        throwEvalError ("hash '" <> s <> "' has wrong length for hash algorithm '" <> algo <> "'")+  where+    accept size spelling decoded = case decoded of+      Just bytes | BS.length bytes == size -> pure (algo, bytes)+      _ -> throwEvalError ("hash '" <> s <> "' is not a valid " <> spelling <> " " <> algo <> " hash")+    rightToMaybe = either (const Nothing) Just++-- | Decode an SRI digest (@algo-base64@) with the decoded-length check+-- every spelling gets upstream (hash.cc checks SRI too): well-formed+-- base64 of the wrong byte count is an invalid hash at eval time, not a+-- short digest that defers failure to fetch or build time.  Shared by+-- convertHash, the fetch pins, and fixed-output outputHash.+decodeSRI :: (MonadEval m) => Text -> Text -> Text -> m BS.ByteString+decodeSRI ctx algo b64 = case hashAlgoBytes algo of+  -- Unreachable via parseSRI (it admits only known algorithm tags), but+  -- this helper must not silently skip the check for an unknown one.+  Nothing -> throwEvalError ("unknown hash algorithm '" <> algo <> "'")+  Just size -> do+    bytes <- decodeBase64E ctx b64+    when (BS.length bytes /= size) $+      throwEvalError+        ("hash '" <> algo <> "-" <> b64 <> "' has wrong length for hash algorithm '" <> algo <> "'")+    pure bytes++-- | Parse @sha256-base64...@ SRI format.+parseSRI :: Text -> Maybe (Text, Text)+parseSRI t = case T.breakOn "-" t of+  (algo, rest)+    | not (T.null rest) && algo `elem` ["sha256", "sha512", "sha1", "md5"] ->+        Just (algo, T.drop 1 rest)+  _ -> Nothing++-- | Parse @sha256:value@ prefixed format.+parseAlgoPrefix :: Text -> Maybe (Text, Text)+parseAlgoPrefix t = case T.breakOn ":" t of+  (algo, rest)+    | not (T.null rest) && algo `elem` ["sha256", "sha512", "sha1", "md5"] ->+        Just (algo, T.drop 1 rest)+  _ -> Nothing++-- | Require a string attribute from an attrset.+requireStrAttr :: (MonadEval m) => Text -> Text -> AttrSet -> m Text+requireStrAttr ctx key attrs = case attrSetLookup key attrs of+  Just thunk -> do+    val <- force thunk+    case val of+      VStr s _ -> decodedText ("builtins." <> ctx) s+      _ -> throwEvalError ("builtins." <> ctx <> ": " <> key <> " must be a string")+  Nothing -> throwEvalError ("builtins." <> ctx <> ": missing required attribute '" <> key <> "'")++-- ---------------------------------------------------------------------------+-- Base64 encode/decode - delegates to nova-cache (base64-bytestring under the hood)+-- ---------------------------------------------------------------------------++-- | Encode bytes to base64.+bytesToBase64 :: BS.ByteString -> Text+bytesToBase64 = B64.encode++-- | Decode base64 text to bytes (pure).+decodeBase64Pure :: Text -> Either Text BS.ByteString+decodeBase64Pure t =+  -- Strip whitespace and any existing padding, then re-pad to a multiple of+  -- 4.  base64-bytestring's 'decode' requires correct padding, so SRI hashes+  -- (correctly-padded standard base64, e.g. @sha256-...NQ=@) would otherwise be+  -- rejected once their trailing @=@ was removed.+  let stripped = T.filter (\c -> c /= '\n' && c /= '\r' && c /= '=') t+      padLen = (4 - (T.length stripped `mod` 4)) `mod` 4+      padded = stripped <> T.replicate padLen "="+   in case B64.decode padded of+        Right bytes -> Right bytes+        Left _ -> Left "invalid base64"++-- | Decode base64 with error context for builtins.+decodeBase64E :: (MonadEval m) => Text -> Text -> m BS.ByteString+decodeBase64E ctx t = case decodeBase64Pure t of+  Right bytes -> pure bytes+  Left _ -> throwEvalError ("builtins." <> ctx <> ": invalid base64 encoding")++-- ---------------------------------------------------------------------------+-- Builtin implementations - fromTOML+-- ---------------------------------------------------------------------------++-- | @builtins.fromTOML str@ - parse a TOML document to a Nix value.+-- Hand-rolled parser covering the TOML v1.0 subset used by nixpkgs:+-- bare/quoted keys, dotted keys, basic/literal strings (multiline),+-- integers (dec/hex/oct/bin), floats (inc. inf/nan), booleans,+-- inline tables, arrays, array-of-tables, and standard tables.+-- Datetimes are represented as strings (matching real Nix).+builtinFromTOML :: (MonadEval m) => NixValue -> m NixValue+builtinFromTOML (VStr s _) = do+  -- TOML is UTF-8 by definition; upstream's parser rejects invalid bytes.+  decoded <- decodedText "builtins.fromTOML" s+  case parseTOML decoded of+    Right val -> pure val+    Left err -> throwEvalError ("builtins.fromTOML: " <> err)+builtinFromTOML other =+  throwEvalError ("builtins.fromTOML: expected a string, got " <> typeName other)++-- | Intermediate TOML value before conversion to NixValue.+data TOMLValue+  = TOMLStr !Text+  | TOMLInt !Int64+  | TOMLFloat !Double+  | TOMLBool !Bool+  | TOMLArray ![TOMLValue]+  | TOMLTable !(Map Text TOMLValue)+  deriving (Show)++-- | Parse a TOML document into a NixValue.+parseTOML :: Text -> Either Text NixValue+parseTOML input = do+  table <- parseTOMLDoc (T.lines input)+  pure (tomlToNix (TOMLTable table))++-- | Convert a TOMLValue to NixValue.+tomlToNix :: TOMLValue -> NixValue+tomlToNix val = case val of+  TOMLStr s -> mkStr s+  TOMLInt n -> VInt n+  TOMLFloat d -> VFloat d+  TOMLBool b -> VBool b+  TOMLArray xs -> VList (clistFromThunks (map (thunkToCPtr . evaluated . tomlToNix) xs))+  TOMLTable m -> VAttrs (attrSetFromMap (Map.map (evaluated . tomlToNix) m))++-- | Parse all lines of a TOML document into a table.+parseTOMLDoc :: [Text] -> Either Text (Map Text TOMLValue)+parseTOMLDoc lns = go lns [] Map.empty+  where+    go [] _ root = Right root+    go (line : rest) currentPath root+      | T.null stripped || T.isPrefixOf "#" stripped =+          -- Empty line or comment+          go rest currentPath root+      | T.isPrefixOf "[[" stripped && T.isSuffixOf "]]" stripped =+          -- Array of tables: [[key]]+          let keyStr = T.strip (T.drop 2 (T.dropEnd 2 stripped))+              keys = parseDottedKey keyStr+           in go rest keys (insertArrayTable keys root)+      | T.isPrefixOf "[" stripped && T.isSuffixOf "]" stripped =+          -- Standard table: [key]+          let keyStr = T.strip (T.drop 1 (T.dropEnd 1 stripped))+              keys = parseDottedKey keyStr+           in go rest keys (ensureTable keys root)+      | otherwise =+          -- Key = value pair.  The value may span physical lines (arrays+          -- and multi-line strings - the Cargo.lock shapes), so join+          -- until brackets and multi-line string delimiters balance.+          let (logical, remaining) = joinLogicalLine stripped rest+           in case parseKVLine logical of+                Right (keys, val) ->+                  go remaining currentPath (insertNested (currentPath ++ keys) val root)+                Left err -> Left err+      where+        stripped = T.strip line++-- | Which TOML string form a scan position is inside.+data TomlStringState = TSNone | TSBasic | TSLiteral | TSMultiBasic | TSMultiLiteral+  deriving (Eq)++-- | Scanner state for joining physical lines into one logical+-- key = value line: array-bracket depth outside strings, plus the+-- string form currently open.+data TomlScan = TomlScan+  { tsBracketDepth :: !Int,+    tsString :: !TomlStringState+  }++emptyTomlScan :: TomlScan+emptyTomlScan = TomlScan 0 TSNone++-- | Whether a logical value is still open at end of line: inside a+-- multi-line string, or under an unclosed array bracket.  A single-line+-- string left open is NOT continuable (TOML basic\/literal strings+-- cannot span lines) - the value parser reports that case.+tomlNeedsMoreLines :: TomlScan -> Bool+tomlNeedsMoreLines st =+  tsBracketDepth st > 0+    || tsString st == TSMultiBasic+    || tsString st == TSMultiLiteral++-- | Scan one physical line, returning the state at end of line and the+-- line's visible text: a comment outside strings is cut here, where the+-- string context is still known ('#' inside any string form is content).+scanTomlLine :: TomlScan -> Text -> (TomlScan, Text)+scanTomlLine st0 line = go st0 line 0+  where+    go st t !seen = case T.uncons t of+      Nothing -> (st, line)+      Just (c, rest) ->+        let one newSt = go newSt rest (seen + 1)+            jump n newSt = go newSt (T.drop (n - 1) rest) (seen + n)+         in case tsString st of+              TSBasic+                | c == '\\' -> jump 2 st+                | c == '"' -> one st {tsString = TSNone}+                | otherwise -> one st+              TSLiteral+                | c == '\'' -> one st {tsString = TSNone}+                | otherwise -> one st+              TSMultiBasic+                | c == '\\' -> jump 2 st+                | c == '"', Just _ <- T.stripPrefix "\"\"" rest -> jump 3 st {tsString = TSNone}+                | otherwise -> one st+              TSMultiLiteral+                | c == '\'', Just _ <- T.stripPrefix "''" rest -> jump 3 st {tsString = TSNone}+                | otherwise -> one st+              TSNone+                | c == '#' -> (st, T.take seen line)+                | c == '"', Just _ <- T.stripPrefix "\"\"" rest -> jump 3 st {tsString = TSMultiBasic}+                | c == '"' -> one st {tsString = TSBasic}+                | c == '\'', Just _ <- T.stripPrefix "''" rest -> jump 3 st {tsString = TSMultiLiteral}+                | c == '\'' -> one st {tsString = TSLiteral}+                | c == '[' -> one st {tsBracketDepth = tsBracketDepth st + 1}+                | c == ']' -> one st {tsBracketDepth = max 0 (tsBracketDepth st - 1)}+                | otherwise -> one st++-- | Join physical lines into one logical key = value line, returning it+-- with the unconsumed lines.  An unterminated construct at end of input+-- hands what accumulated to the value parser, which reports the specific+-- failure.+joinLogicalLine :: Text -> [Text] -> (Text, [Text])+joinLogicalLine firstLine rest0 =+  let (st0, visible0) = scanTomlLine emptyTomlScan firstLine+   in go st0 [visible0] rest0+  where+    -- Reversed line chunks, joined once - O(n) in the logical line's+    -- length instead of the O(n^2) of appending per physical line.+    go st !chunks remaining+      | not (tomlNeedsMoreLines st) = (T.intercalate "\n" (reverse chunks), remaining)+      | otherwise = case remaining of+          [] -> (T.intercalate "\n" (reverse chunks), [])+          (next : more) ->+            let (advanced, visible) = scanTomlLine st next+             in go advanced (visible : chunks) more++-- | Parse a key = value line.+parseKVLine :: Text -> Either Text ([Text], TOMLValue)+parseKVLine line =+  let (keyPart, afterEq) = splitAtEquals line+   in case T.uncons afterEq of+        Nothing -> Left ("expected '=' in: " <> line)+        Just _ -> do+          let val = T.strip afterEq+          parsed <- parseTOMLValue val+          Right (parseDottedKey (T.strip keyPart), parsed)++-- | Split a line at the first unquoted '=' sign.+-- O(n) via bulk spans into a chunk list instead of O(n^2) T.snoc.+splitAtEquals :: Text -> (Text, Text)+splitAtEquals = go []+  where+    keyPart chunks = T.concat (reverse chunks)+    go !chunks t = case T.uncons t of+      Nothing -> (keyPart chunks, T.empty)+      Just ('=', rest) -> (keyPart chunks, rest)+      Just ('"', rest) ->+        let (quoted, after) = T.break (== '"') rest+         in case T.uncons after of+              Just ('"', r) -> go ("\"" : quoted : "\"" : chunks) r+              _ -> go (quoted : "\"" : chunks) after+      Just ('\'', rest) ->+        let (quoted, after) = T.break (== '\'') rest+         in case T.uncons after of+              Just ('\'', r) -> go ("'" : quoted : "'" : chunks) r+              _ -> go (quoted : "'" : chunks) after+      Just (_, _) ->+        let (plain, after) = T.break (\c -> c == '=' || c == '"' || c == '\'') t+         in go (plain : chunks) after++-- | Parse dotted key like @foo.bar."baz qux"@ into @["foo", "bar", "baz qux"]@.+parseDottedKey :: Text -> [Text]+parseDottedKey t+  | T.null t = []+  | otherwise = case T.uncons t of+      Just ('"', rest) ->+        let (key, after) = T.break (== '"') rest+         in key : parseDottedKey (T.drop 1 (T.stripStart (dropDot after)))+      Just ('\'', rest) ->+        let (key, after) = T.break (== '\'') rest+         in key : parseDottedKey (T.drop 1 (T.stripStart (dropDot after)))+      _ ->+        let (key, after) = T.break (\c -> c == '.' || c == '"') t+         in T.strip key : case T.uncons after of+              Nothing -> []+              Just _ -> parseDottedKey (T.drop 1 (T.stripStart after))+  where+    dropDot txt = case T.uncons txt of+      Just ('.', rest) -> rest+      _ -> txt++-- | Parse a TOML value (right side of '=').+parseTOMLValue :: Text -> Either Text TOMLValue+parseTOMLValue t =+  let stripped = T.strip t+      -- Strip inline comments (not inside strings)+      cleaned = stripInlineComment stripped+   in case T.uncons cleaned of+        Nothing -> Left "empty value"+        Just ('"', _)+          | T.isPrefixOf "\"\"\"" cleaned -> parseMultilineBasicStr (T.drop 3 cleaned)+          | otherwise -> parseBasicStr (T.drop 1 cleaned)+        Just ('\'', _)+          | T.isPrefixOf "'''" cleaned -> parseMultilineLiteralStr (T.drop 3 cleaned)+          | otherwise -> parseLiteralStr (T.drop 1 cleaned)+        Just ('{', _) -> parseInlineTable cleaned+        Just ('[', _) -> parseInlineArray cleaned+        Just ('t', _)+          | T.isPrefixOf "true" cleaned -> Right (TOMLBool True)+        Just ('f', _)+          | T.isPrefixOf "false" cleaned -> Right (TOMLBool False)+        Just ('i', _)+          | T.isPrefixOf "inf" cleaned -> Right (TOMLFloat (1 / 0))+        Just ('+', rest)+          | T.isPrefixOf "inf" rest -> Right (TOMLFloat (1 / 0))+          | T.isPrefixOf "nan" rest -> Right (TOMLFloat (0 / 0))+        Just ('-', rest)+          | T.isPrefixOf "inf" rest -> Right (TOMLFloat (negate (1 / 0)))+          | T.isPrefixOf "nan" rest -> Right (TOMLFloat (0 / 0))+        Just ('n', _)+          | T.isPrefixOf "nan" cleaned -> Right (TOMLFloat (0 / 0))+        _ -> parseTOMLNumberOrDatetime cleaned++-- | Strip inline comment from a value (not inside quotes).+-- O(n) via bulk spans into a chunk list instead of O(n^2)+-- per-character T.cons (each cons copies the whole tail).+stripInlineComment :: Text -> Text+stripInlineComment = go (0 :: Int) []+  where+    finish chunks = T.concat (reverse chunks)+    go depth !chunks t = case T.uncons t of+      Nothing -> finish chunks+      Just ('#', _) | depth == 0 -> finish chunks+      Just ('"', rest)+        | depth == 0 ->+            let (str, after) = T.break (== '"') rest+             in go depth (T.take 1 after : str : "\"" : chunks) (T.drop 1 after)+      Just ('[', rest) -> go (depth + 1) ("[" : chunks) rest+      Just ('{', rest) -> go (depth + 1) ("{" : chunks) rest+      Just (']', rest) -> go (max 0 (depth - 1)) ("]" : chunks) rest+      Just ('}', rest) -> go (max 0 (depth - 1)) ("}" : chunks) rest+      Just (c, rest) ->+        -- c is plain (or a quote/hash inside brackets, kept as content);+        -- take it plus the whole plain run after it in one span.+        let (plain, after) = T.break scanBreak rest+         in go depth (plain : T.singleton c : chunks) after+    scanBreak c = c == '#' || c == '"' || c == '[' || c == '{' || c == ']' || c == '}'++-- | Parse a basic (double-quoted) TOML string.+-- O(n) via chunk list + T.concat instead of O(n^2) T.snoc.+parseBasicStr :: Text -> Either Text TOMLValue+parseBasicStr = go []+  where+    go !chunks t = case T.uncons t of+      Nothing -> Left "unterminated basic string"+      Just ('"', _) -> Right (TOMLStr (T.concat (reverse chunks)))+      Just ('\\', rest) -> case T.uncons rest of+        Just ('n', r) -> go ("\n" : chunks) r+        Just ('t', r) -> go ("\t" : chunks) r+        Just ('r', r) -> go ("\r" : chunks) r+        Just ('\\', r) -> go ("\\" : chunks) r+        Just ('"', r) -> go ("\"" : chunks) r+        Just ('b', r) -> go ("\b" : chunks) r+        Just ('f', r) -> go ("\f" : chunks) r+        Just ('u', r) -> case parseHex4 r of+          Just (cp, r2) -> go (T.singleton (chr cp) : chunks) r2+          Nothing -> Left "invalid \\u escape"+        _ -> Left "invalid escape sequence"+      Just (c, rest) -> go (T.singleton c : chunks) rest++-- | Parse a literal (single-quoted) TOML string.+parseLiteralStr :: Text -> Either Text TOMLValue+parseLiteralStr t =+  let (content, rest) = T.break (== '\'') t+   in case T.uncons rest of+        Just ('\'', _) -> Right (TOMLStr content)+        _ -> Left "unterminated literal string"++-- | Parse a multiline basic string.+parseMultilineBasicStr :: Text -> Either Text TOMLValue+parseMultilineBasicStr t =+  case T.breakOn "\"\"\"" t of+    (content, rest)+      | T.isPrefixOf "\"\"\"" rest ->+          Right (TOMLStr (T.replace "\\\n" "" (stripLeadingNewline content)))+      | otherwise -> Left ("unterminated multiline basic string, remaining: " <> T.take 20 rest)++-- | Parse a multiline literal string.+parseMultilineLiteralStr :: Text -> Either Text TOMLValue+parseMultilineLiteralStr t =+  case T.breakOn "'''" t of+    (content, rest)+      | T.isPrefixOf "'''" rest -> Right (TOMLStr (stripLeadingNewline content))+      | otherwise -> Left "unterminated multiline literal string"++-- | Strip a leading newline (TOML spec: first newline after opening quotes is trimmed).+stripLeadingNewline :: Text -> Text+stripLeadingNewline t = case T.uncons t of+  Just ('\n', rest) -> rest+  Just ('\r', rest) -> case T.uncons rest of+    Just ('\n', r) -> r+    _ -> rest+  _ -> t++-- | Parse a TOML number or datetime.+parseTOMLNumberOrDatetime :: Text -> Either Text TOMLValue+parseTOMLNumberOrDatetime s+  -- Hex, octal, binary integers+  | T.isPrefixOf "0x" s || T.isPrefixOf "0X" s = parseHexInt (T.drop 2 s)+  | T.isPrefixOf "0o" s || T.isPrefixOf "0O" s = parseOctInt (T.drop 2 s)+  | T.isPrefixOf "0b" s || T.isPrefixOf "0B" s = parseBinInt (T.drop 2 s)+  -- Contains date separators, so treat as a datetime string+  | T.any (== 'T') s && T.any (== '-') s = Right (TOMLStr s)+  | T.count "-" s >= 2 && T.any isDigit s = Right (TOMLStr s)+  | T.any (== ':') s && T.any isDigit s = Right (TOMLStr s)+  -- Float (has dot or exponent)+  | T.any (== '.') s || T.any (\c -> c == 'e' || c == 'E') s = parseFloat s+  -- Plain integer+  | otherwise = parseInt s++-- | Parse a plain decimal integer, ignoring underscores.+parseInt :: Text -> Either Text TOMLValue+parseInt t =+  let cleaned = T.filter (/= '_') t+      (sign, digits) = case T.uncons cleaned of+        Just ('+', rest) -> (1 :: Integer, rest)+        Just ('-', rest) -> (-1, rest)+        _ -> (1, cleaned)+   in case readDecimal digits of+        Just n -> tomlInt t (sign * n)+        Nothing -> Left ("invalid integer: " <> t)++parseHexInt :: Text -> Either Text TOMLValue+parseHexInt t =+  let cleaned = T.filter (/= '_') t+   in case readHexT cleaned of+        Just n -> tomlInt t n+        Nothing -> Left ("invalid hex integer: " <> t)++parseOctInt :: Text -> Either Text TOMLValue+parseOctInt t =+  let cleaned = T.filter (/= '_') t+   in case readOctT cleaned of+        Just n -> tomlInt t n+        Nothing -> Left ("invalid octal integer: " <> t)++parseBinInt :: Text -> Either Text TOMLValue+parseBinInt t =+  let cleaned = T.filter (/= '_') t+   in case readBinT cleaned of+        Just n -> tomlInt t n+        Nothing -> Left ("invalid binary integer: " <> t)++-- | Finish a parsed TOML integer: a value outside the 64-bit signed range+-- is a parse error, as upstream's TOML parser reports - silently wrapping+-- would hand the evaluator a different number than the document wrote.+tomlInt :: Text -> Integer -> Either Text TOMLValue+tomlInt original n+  | n < toInteger (minBound :: Int64) || n > toInteger (maxBound :: Int64) =+      Left ("integer out of 64-bit range: " <> original)+  | otherwise = Right (TOMLInt (fromInteger n))++parseFloat :: Text -> Either Text TOMLValue+parseFloat t =+  let cleaned = T.filter (/= '_') t+   in case readDouble cleaned of+        Just d -> Right (TOMLFloat d)+        Nothing -> Left ("invalid float: " <> t)++-- Digit readers accumulate an unbounded 'Integer'; 'tomlInt' applies the+-- 64-bit range gate after any sign, so the minimum int64 (whose magnitude+-- alone exceeds the maximum) still parses.++-- | Read an unbounded decimal integer from Text.+readDecimal :: Text -> Maybe Integer+readDecimal t+  | T.null t = Nothing+  | T.all isDigit t = Just (T.foldl' (\acc c -> acc * 10 + fromIntegral (digitToInt c)) 0 t)+  | otherwise = Nothing++readHexT :: Text -> Maybe Integer+readHexT t+  | T.null t = Nothing+  | T.all isHexDigit t = Just (T.foldl' (\acc c -> acc * 16 + fromIntegral (digitToInt c)) 0 t)+  | otherwise = Nothing++readOctT :: Text -> Maybe Integer+readOctT t+  | T.null t = Nothing+  | T.all isOctDigit t =+      Just (T.foldl' (\acc c -> acc * 8 + fromIntegral (digitToInt c)) 0 t)+  | otherwise = Nothing++readBinT :: Text -> Maybe Integer+readBinT t+  | T.null t = Nothing+  | T.all (\c -> c == '0' || c == '1') t =+      Just (T.foldl' (\acc c -> acc * 2 + fromIntegral (digitToInt c)) 0 t)+  | otherwise = Nothing++readDouble :: Text -> Maybe Double+readDouble t = case reads (T.unpack t) of+  [(d, "")] -> Just d+  _ -> Nothing++-- | Parse an inline table: @{ key = val, ... }@.+parseInlineTable :: Text -> Either Text TOMLValue+parseInlineTable t = case T.uncons t of+  Just ('{', rest) ->+    let inner = T.strip (T.dropWhileEnd (== '}') (T.strip rest))+     in if T.null inner+          then Right (TOMLTable Map.empty)+          else do+            pairs <- mapM parseInlineKV (splitCommas inner)+            Right (TOMLTable (Map.fromList (concatMap flattenPair pairs)))+  _ -> Left "expected '{'"+  where+    flattenPair (keys, val) = case keys of+      [] -> []+      [k] -> [(k, val)]+      (k : ks) -> [(k, nestKeys ks val)]+    nestKeys [] v = v+    nestKeys (k : ks) v = TOMLTable (Map.singleton k (nestKeys ks v))++-- | Parse an inline array: @[ val, ... ]@.+parseInlineArray :: Text -> Either Text TOMLValue+parseInlineArray t = case T.uncons t of+  Just ('[', rest) ->+    let inner = T.strip (T.dropWhileEnd (== ']') (T.strip rest))+     in if T.null inner+          then Right (TOMLArray [])+          else do+            vals <- mapM (parseTOMLValue . T.strip) (splitCommas inner)+            Right (TOMLArray vals)+  _ -> Left "expected '['"++-- | Parse a single key=value pair in an inline table.+parseInlineKV :: Text -> Either Text ([Text], TOMLValue)+parseInlineKV t =+  let (keyPart, afterEq) = splitAtEquals (T.strip t)+   in do+        val <- parseTOMLValue (T.strip afterEq)+        Right (parseDottedKey (T.strip keyPart), val)++-- | Split on commas not inside brackets or braces.+-- O(n) via chunk list + T.concat instead of O(n^2) T.snoc.+splitCommas :: Text -> [Text]+splitCommas = go (0 :: Int) []+  where+    finalize chunks =+      let t = T.concat (reverse chunks)+       in [t | not (T.null (T.strip t))]+    go _ !chunks t | T.null t = finalize chunks+    go depth !chunks t = case T.uncons t of+      Nothing -> finalize chunks+      Just (',', rest) | depth == 0 -> T.concat (reverse chunks) : go 0 [] rest+      Just ('[', rest) -> go (depth + 1) ("[" : chunks) rest+      Just ('{', rest) -> go (depth + 1) ("{" : chunks) rest+      Just (']', rest) -> go (max 0 (depth - 1)) ("]" : chunks) rest+      Just ('}', rest) -> go (max 0 (depth - 1)) ("}" : chunks) rest+      Just ('"', rest) ->+        let (str, after) = T.break (== '"') rest+            consumed = "\"" <> str <> T.take 1 after+         in go depth (consumed : chunks) (T.drop 1 after)+      Just (c, rest) -> go depth (T.singleton c : chunks) rest++-- | Insert a value at a nested key path into a table.+insertNested :: [Text] -> TOMLValue -> Map Text TOMLValue -> Map Text TOMLValue+insertNested [] _ m = m+insertNested [k] v m = Map.insert k v m+insertNested (k : ks) v m = case Map.lookup k m of+  -- Under a [[table]] header the path crosses an array of tables: keys+  -- belong to its LAST element, not to a table replacing the array.+  Just (TOMLArray xs)+    | (TOMLTable lastInner : prev) <- reverse xs ->+        Map.insert k (TOMLArray (reverse prev ++ [TOMLTable (insertNested ks v lastInner)])) m+  Just (TOMLTable inner) -> Map.insert k (TOMLTable (insertNested ks v inner)) m+  _ -> Map.insert k (TOMLTable (insertNested ks v Map.empty)) m++-- | Ensure a table path exists (for @[table]@ headers).+ensureTable :: [Text] -> Map Text TOMLValue -> Map Text TOMLValue+ensureTable [] m = m+ensureTable [k] m = case Map.lookup k m of+  Just (TOMLTable _) -> m+  Nothing -> Map.insert k (TOMLTable Map.empty) m+  _ -> m+ensureTable (k : ks) m =+  let sub = case Map.lookup k m of+        Just (TOMLTable inner) -> inner+        _ -> Map.empty+   in Map.insert k (TOMLTable (ensureTable ks sub)) m++-- | Insert an entry into an array-of-tables (@[[table]]@).+insertArrayTable :: [Text] -> Map Text TOMLValue -> Map Text TOMLValue+insertArrayTable [] m = m+insertArrayTable [k] m = case Map.lookup k m of+  Just (TOMLArray xs) -> Map.insert k (TOMLArray (xs ++ [TOMLTable Map.empty])) m+  Nothing -> Map.insert k (TOMLArray [TOMLTable Map.empty]) m+  _ -> Map.insert k (TOMLArray [TOMLTable Map.empty]) m+insertArrayTable (k : ks) m =+  let sub = case Map.lookup k m of+        Just (TOMLTable inner) -> inner+        Just (TOMLArray xs) ->+          -- Descend into the last element of the array+          case reverse xs of+            (TOMLTable inner : _) -> inner+            _ -> Map.empty+        _ -> Map.empty+      updated = insertArrayTable ks sub+   in case Map.lookup k m of+        Just (TOMLArray xs) ->+          case reverse xs of+            (TOMLTable _ : prev) ->+              Map.insert k (TOMLArray (reverse prev ++ [TOMLTable updated])) m+            _ -> Map.insert k (TOMLTable updated) m+        _ -> Map.insert k (TOMLTable updated) m++-- ---------------------------------------------------------------------------+-- Builtin implementations - toXML+-- ---------------------------------------------------------------------------++-- | @builtins.toXML val@ - the value as upstream's @prim_toXML@ writes it:+-- @printValueAsXML@ forcing every value and recording no positions+-- (value-to-xml.cc and xml-writer.cc at 2.24.9).  The result keeps the+-- contexts of the strings written into it, so a derivation built from the+-- document depends on the store paths it names, as upstream's does.+--+-- Built over BYTES: upstream's writer copies a string into an attribute+-- value with only its five escapes, so invalid UTF-8 passes through raw+-- rather than erroring (unlike toJSON, whose upstream serializer+-- validates).+builtinToXML :: (MonadEval m) => NixValue -> m NixValue+builtinToXML val = do+  (body, XmlWritten ctx _) <- valueToXML 1 (XmlWritten emptyContext Set.empty) val+  let document =+        "<?xml version='1.0' encoding='utf-8'?>\n"+          <> xmlOpen 0 "expr" []+          <> body+          <> xmlClose 0 "expr"+  pure (VStr (BL.toStrict (BB.toLazyByteString document)) ctx)++-- | What writing a document has gathered so far: the contexts of the+-- strings written, and the drvPaths of the derivations written in full,+-- each of which a later occurrence writes as @<repeated />@ (upstream's+-- @drvsSeen@).  That is also what ends the cycle every derivation's+-- @all@ and output attributes close.+data XmlWritten = XmlWritten !StringContext !(Set.Set BS.ByteString)++-- | One XML attribute: its name and its unescaped value.+type XmlAttr = (BS.ByteString, BS.ByteString)++-- | Write one value as the element upstream writes for it, at the given+-- depth (an element's depth is the number of elements open around it, and+-- each level indents two spaces).+valueToXML :: (MonadEval m) => Int -> XmlWritten -> NixValue -> m (BB.Builder, XmlWritten)+valueToXML depth written val = case val of+  VInt n -> leaf "int" [("value", BC.pack (show n))]+  VBool b -> leaf "bool" [("value", if b then "true" else "false")]+  VStr s ctx ->+    let XmlWritten seenCtx seenDrvs = written+     in pure (xmlEmpty depth "string" [("value", s)], XmlWritten (seenCtx <> ctx) seenDrvs)+  VPath p -> leaf "path" [("value", TE.encodeUtf8 p)]+  VNull -> leaf "null" []+  VFloat d -> leaf "float" [("value", TE.encodeUtf8 (formatXmlFloat d))]+  VList cl ->+    xmlElement depth "list" [] $+      foldM (writeChild (\thunk inner -> force thunk >>= valueToXML (depth + 1) inner)) (mempty, written) (map Thunk (clistThunks cl))+  VAttrs attrs -> do+    identity <- xmlDerivationIdentity attrs+    case identity of+      Nothing -> xmlElement depth "attrs" [] (attrsToXML (depth + 1) written attrs)+      Just (drvAttrs, drvPath) ->+        let XmlWritten seenCtx seenDrvs = written+         in xmlElement depth "derivation" drvAttrs $+              if BS.null drvPath || Set.member drvPath seenDrvs+                then pure (xmlEmpty (depth + 1) "repeated" [], written)+                else attrsToXML (depth + 1) (XmlWritten seenCtx (Set.insert drvPath seenDrvs)) attrs+  VLambda _ formals _ -> xmlElement depth "function" [] (pure (formalsToXML (depth + 1) formals, written))+  -- A primop, applied in part or not at all, is not a lambda, which+  -- upstream writes as unevaluated (its FIXME: primops are not serialized).+  VBuiltin _ _ -> leaf "unevaluated" []+  VCompiledRegex _ -> leaf "unevaluated" []+  where+    leaf name attrs = pure (xmlEmpty depth name attrs, written)++-- | Each attribute of a set, in name order, as an @attr@ element holding+-- its value.+attrsToXML :: (MonadEval m) => Int -> XmlWritten -> AttrSet -> m (BB.Builder, XmlWritten)+attrsToXML depth written attrs =+  foldM (writeChild attrToXML) (mempty, written) (attrSetToAscList attrs)+  where+    attrToXML (name, thunk) inner =+      xmlElement depth "attr" [("name", TE.encodeUtf8 name)] (force thunk >>= valueToXML (depth + 1) inner)++-- | Append one child's output to what its siblings wrote, threading what+-- the document has gathered from one to the next.+writeChild :: (Monad m) => (a -> XmlWritten -> m (BB.Builder, XmlWritten)) -> (BB.Builder, XmlWritten) -> a -> m (BB.Builder, XmlWritten)+writeChild write (before, written) child = do+  (out, next) <- write child written+  pure (before <> out, next)++-- | The XML attributes of a derivation's element and the drvPath that+-- identifies it, or 'Nothing' for a set that is not a derivation: upstream's+-- @isDerivation@, a @type@ attribute that is the string @"derivation"@.+-- @drvPath@ and @outPath@ are written only when they are strings, and their+-- contexts are not gathered here: a derivation written in full gathers them+-- as attributes, and a repeated one adds none.+xmlDerivationIdentity :: (MonadEval m) => AttrSet -> m (Maybe ([XmlAttr], BS.ByteString))+xmlDerivationIdentity attrs = do+  typeVal <- traverse force (attrSetLookup "type" attrs)+  case typeVal of+    Just (VStr "derivation" _) -> do+      drvPath <- stringAttr "drvPath"+      outPath <- stringAttr "outPath"+      let present = [(key, s) | (key, Just s) <- [("drvPath", drvPath), ("outPath", outPath)]]+      pure (Just (present, fromMaybe "" drvPath))+    _ -> pure Nothing+  where+    stringAttr key = do+      found <- traverse force (attrSetLookup key attrs)+      pure $ case found of+        Just (VStr s _) -> Just s+        _ -> Nothing++-- | A lambda's argument pattern: @varpat@ for a plain argument, otherwise+-- @attrspat@ naming the formals in name order, with the @\@@ binding and+-- the ellipsis as its attributes.+formalsToXML :: Int -> EvalFormals -> BB.Builder+formalsToXML depth formals = case formals of+  EFName name -> xmlEmpty depth "varpat" [("name", TE.encodeUtf8 name)]+  EFSet entries ellipsis -> attrsPattern (ellipsisAttr ellipsis) entries+  EFNamedSet name entries ellipsis -> attrsPattern (ellipsisAttr ellipsis <> [("name", TE.encodeUtf8 name)]) entries+  where+    ellipsisAttr ellipsis = [("ellipsis", "1") | ellipsis]+    attrsPattern attrs entries =+      xmlOpen depth "attrspat" attrs+        <> foldMap (\formal -> xmlEmpty (depth + 1) "attr" [("name", TE.encodeUtf8 (efName formal))]) (sortOn efName entries)+        <> xmlClose depth "attrspat"++-- | An element with children: the opening tag, what the children write one+-- level deeper, and the closing tag.+xmlElement :: (Monad m) => Int -> BS.ByteString -> [XmlAttr] -> m (BB.Builder, XmlWritten) -> m (BB.Builder, XmlWritten)+xmlElement depth name attrs children = do+  (inner, written) <- children+  pure (xmlOpen depth name attrs <> inner <> xmlClose depth name, written)++-- | Upstream's @XMLWriter@ lines.  The attributes are written in the order+-- given, which callers keep sorted by name as upstream's @std::map@ is.+xmlOpen, xmlEmpty :: Int -> BS.ByteString -> [XmlAttr] -> BB.Builder+xmlOpen depth name attrs = xmlIndent depth <> "<" <> BB.byteString name <> foldMap xmlAttr attrs <> ">\n"+xmlEmpty depth name attrs = xmlIndent depth <> "<" <> BB.byteString name <> foldMap xmlAttr attrs <> " />\n"++xmlClose :: Int -> BS.ByteString -> BB.Builder+xmlClose depth name = xmlIndent depth <> "</" <> BB.byteString name <> ">\n"++xmlIndent :: Int -> BB.Builder+xmlIndent depth = BB.byteString (BC.replicate (2 * depth) ' ')++-- | One attribute with upstream's escapes.  A newline is written as a+-- character reference because an XML parser normalizes a literal one in an+-- attribute value to a space (XML 1.0, section 3.3.3).+xmlAttr :: XmlAttr -> BB.Builder+xmlAttr (name, value) = " " <> BB.byteString name <> "=\"" <> BC.foldr (\c rest -> escapeChar c <> rest) mempty value <> "\""+  where+    escapeChar '"' = "&quot;"+    escapeChar '<' = "&lt;"+    escapeChar '>' = "&gt;"+    escapeChar '&' = "&amp;"+    escapeChar '\n' = "&#xA;"+    escapeChar c = BB.char8 c++-- ---------------------------------------------------------------------------+-- Builtin implementations - builtins.path+-- ---------------------------------------------------------------------------++-- | @builtins.path { path; name?; filter?; sha256?; recursive?; }@+--+-- Copy a path to the store and return the store path as a string with+-- context.  @name@ defaults to the basename of @path@.  @filter@ is+-- accepted but not yet applied (copies everything).+builtinPath :: (MonadEval m) => NixValue -> m NixValue+builtinPath (VAttrs attrs) = do+  -- prim_path coerces the attribute with coerceToPath and checks for it+  -- once its attribute loop is done (primops.cc at 2.24.9).+  pathStr <- case attrSetLookup "path" attrs of+    Nothing -> throwEvalError "missing required 'path' attribute in the first argument to builtins.path"+    Just thunk -> coerceToPath "builtins.path" =<< force thunk+  nameOverride <- forceOptionalAttrStr attrs "name"+  expectedDigest <- case attrSetLookup "sha256" attrs of+    Nothing -> pure Nothing+    Just thunk -> do+      pinVal <- force thunk+      case pinVal of+        VStr pin _ -> do+          pinText <- decodedText "builtins.path" pin+          Just <$> decodeSha256Pin "builtins.path" pinText+        other -> throwEvalError ("builtins.path: 'sha256' must be a string, got " <> typeName other)+  let name = fromMaybe (canonBaseName pathStr) nameOverride+      pinSubject = "builtins.path: " <> pathStr+  storePathText <- case attrSetLookup "filter" attrs of+    Nothing -> copyPathToStore pathStr name (fmap (pinSubject,) expectedDigest)+    Just filterThunk -> do+      filterFn <- force filterThunk+      narBytes <- filteredSourceNar filterFn pathStr+      -- The sha256 pin applies to the FILTERED tree, as upstream.+      let filteredDigest = sha256Digest narBytes+      case expectedDigest of+        Just expected+          | expected /= filteredDigest ->+              throwEvalError+                ( pinSubject+                    <> ": hash mismatch: expected sha256:"+                    <> bytesToHexText expected+                    <> ", got sha256:"+                    <> bytesToHexText filteredDigest+                )+        _ -> pure ()+      addSourceNar name narBytes+  pure (sourceResultString storePathText)+builtinPath other =+  throwEvalError ("builtins.path: expected an attribute set, got " <> typeName other)++-- | The result value both source importers return: the store path as a+-- string carrying itself as context.+sourceResultString :: Text -> NixValue+sourceResultString storePathText =+  case parseStorePath defaultStoreDir storePathText of+    Just sp -> VStr (TE.encodeUtf8 storePathText) (plainContext sp)+    Nothing -> VStr (TE.encodeUtf8 storePathText) emptyContext++-- | Serialise a source tree to a NAR, keeping only entries the Nix filter+-- function accepts - upstream's addToStore filtering: the filter receives+-- @(path, type)@ for every entry BELOW the root (the root itself is never+-- filtered), and rejecting a directory prunes its whole subtree.  Child+-- paths hand the filter @parent/name@ with a forward slash; both path+-- styles reach Nix code only through separator-agnostic helpers like+-- @baseNameOf@.+filteredSourceNar :: (MonadEval m) => NixValue -> Text -> m BS.ByteString+filteredSourceNar filterFn rawRoot = do+  -- The root is resolved through its symlinks before the walk, as+  -- upstream's addPath and filterSource resolve theirs: a root that is a+  -- symlink stores what it points at, and no entry below has a symlink+  -- above it for the lstats to refuse.+  rootPath <- resolveSymlinks rawRoot+  rootType <- getFileType rootPath+  entry <- buildEntry rootPath rootType+  pure (NAR.serialise entry)+  where+    buildEntry path fileType = case fileType of+      "regular" -> do+        executable <- isExecutableFile path+        bytes <- readFileBytes path+        pure (NAR.NarRegular executable bytes)+      "symlink" -> NAR.NarSymlink . TE.encodeUtf8 <$> readSymlinkTarget path+      "directory" -> do+        children <- listDirectory path+        kept <- mapM (keepChild path) children+        pure (NAR.NarDirectory (catMaybes kept))+      other -> throwEvalError ("builtins.path: unsupported file type '" <> other <> "' at " <> path)+    keepChild parent (name, childType) = do+      let childPath = parent <> "/" <> name+      keep <- filterAccepts childPath childType+      if keep+        then Just . (,) (TE.encodeUtf8 name) <$> buildEntry childPath childType+        else pure Nothing+    filterAccepts path fileType = do+      partial <- applyValue filterFn (mkStr path)+      result <- applyValue partial (mkStr fileType)+      case result of+        VBool b -> pure b+        other -> throwEvalError ("builtins.path: the filter function must return a Boolean, got " <> typeName other)++-- ---------------------------------------------------------------------------+-- Builtin implementations - filterSource+-- ---------------------------------------------------------------------------++-- | @builtins.filterSource filter path@ - copy a path to the store,+-- filtering entries via a predicate.  The filter function receives+-- @(path, type)@ where type is @"regular"@, @"directory"@, @"symlink"@,+-- or @"unknown"@.  Equivalent to @builtins.path@ with a filter and the+-- source's basename as the store name.+builtinFilterSource :: (MonadEval m) => NixValue -> NixValue -> m NixValue+builtinFilterSource filterFn pathVal = filterSourceInto filterFn =<< coerceToPath "builtins.filterSource" pathVal  filterSourceInto :: (MonadEval m) => NixValue -> Text -> m NixValue filterSourceInto filterFn path = do