package contentpayload

import (
	"bytes"
	"context"
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"os"
	"path"
	"path/filepath"
	"sort"
	"strings"
	"sync"
	"syscall"
)

const manifestFilename = "manifest.json"

var errFilesystemClosed = errors.New("content filesystem storage is closed")

type filesystemStorage struct {
	rootMu sync.RWMutex
	root   *os.File
}

func NewFilesystemTreeBackend(root string) (TreePayloadBackend, error) {
	root = strings.TrimSpace(root)
	if root == "" {
		return nil, fmt.Errorf("content storage root is required")
	}
	absolute, err := filepath.Abs(root)
	if err != nil {
		return nil, fmt.Errorf("resolve content storage root: %w", err)
	}
	if err := os.MkdirAll(absolute, 0o750); err != nil {
		return nil, fmt.Errorf("create content storage root: %w", err)
	}
	rootHandle, err := openRoot(absolute)
	if err != nil {
		return nil, err
	}
	return &filesystemStorage{root: rootHandle}, nil
}

func (s *filesystemStorage) Close() error {
	s.rootMu.Lock()
	defer s.rootMu.Unlock()
	if s.root == nil {
		return nil
	}
	err := s.root.Close()
	s.root = nil
	return err
}

// openPinnedRoot duplicates the constructor-opened directory descriptor while
// holding the lifecycle lock. Later pathname replacement cannot redirect it,
// and Close cannot invalidate the descriptor being duplicated.
func (s *filesystemStorage) openPinnedRoot() (*os.File, error) {
	s.rootMu.RLock()
	defer s.rootMu.RUnlock()
	if s.root == nil {
		return nil, errFilesystemClosed
	}
	return openDirectoryAt(s.root, nil, false)
}

func (s *filesystemStorage) StageTree(ctx context.Context, request StageTreeRequest) (StagedTree, error) {
	if err := ctx.Err(); err != nil {
		return StagedTree{}, err
	}
	workspaceID, err := safeID("workspace", request.WorkspaceID)
	if err != nil {
		return StagedTree{}, err
	}
	contentID, err := safeID("content", request.ContentID)
	if err != nil {
		return StagedTree{}, err
	}
	versionID, err := safeID("version", request.VersionID)
	if err != nil {
		return StagedTree{}, err
	}
	limits, err := NormalizeLimits(request.Limits)
	if err != nil {
		return StagedTree{}, err
	}
	if len(request.Files) > limits.MaxFiles {
		return StagedTree{}, fmt.Errorf("content version has %d files, limit is %d", len(request.Files), limits.MaxFiles)
	}
	files := append([]File(nil), request.Files...)
	for index := range files {
		files[index].Path, err = cleanFilePath(files[index].Path)
		if err != nil {
			return StagedTree{}, err
		}
	}
	sort.Slice(files, func(i, j int) bool { return files[i].Path < files[j].Path })
	for index := 1; index < len(files); index++ {
		if files[index-1].Path == files[index].Path {
			return StagedTree{}, fmt.Errorf("content version contains duplicate path %q", files[index].Path)
		}
	}

	manifest := Manifest{WorkspaceID: workspaceID, ContentID: contentID, VersionID: versionID, Files: make([]ManifestEntry, 0, len(files))}
	for _, file := range files {
		if err := ctx.Err(); err != nil {
			return StagedTree{}, err
		}
		if file.Content == nil || file.Size < 0 || file.Size > limits.MaxFileBytes {
			return StagedTree{}, fmt.Errorf("content file %q has invalid size %d", file.Path, file.Size)
		}
		if manifest.SizeBytes > limits.MaxTotalBytes-file.Size {
			return StagedTree{}, fmt.Errorf("content version exceeds %d byte limit", limits.MaxTotalBytes)
		}
		digest, err := s.putBlob(ctx, file.Content, file.Size)
		if err != nil {
			return StagedTree{}, fmt.Errorf("stage content file %q: %w", file.Path, err)
		}
		manifest.Files = append(manifest.Files, ManifestEntry{Path: file.Path, Digest: digest, SizeBytes: file.Size, Executable: file.Executable})
		manifest.SizeBytes += file.Size
	}
	manifest.RootDigest, err = manifestDigest(manifest.Files)
	if err != nil {
		return StagedTree{}, err
	}
	payload, err := json.Marshal(manifest)
	if err != nil {
		return StagedTree{}, fmt.Errorf("encode content manifest: %w", err)
	}
	if int64(len(payload)) > limits.MaxManifestBytes {
		return StagedTree{}, fmt.Errorf("content manifest exceeds %d byte limit", limits.MaxManifestBytes)
	}
	ref := ManifestRef(strings.Join([]string{workspaceID, contentID, versionID}, "/"))
	created, err := s.publishManifest(ctx, ref, payload)
	if err != nil {
		return StagedTree{}, err
	}
	return StagedTree{ManifestRef: ref, RootDigest: manifest.RootDigest, SizeBytes: manifest.SizeBytes, FileCount: len(manifest.Files), Created: created}, nil
}

func (s *filesystemStorage) OpenManifest(ctx context.Context, ref ManifestRef) (Manifest, error) {
	if err := ctx.Err(); err != nil {
		return Manifest{}, err
	}
	parts, err := manifestRefParts(ref)
	if err != nil {
		return Manifest{}, err
	}
	root, err := s.openPinnedRoot()
	if err != nil {
		return Manifest{}, err
	}
	defer root.Close()
	directory, err := openDirectoryAt(root, append([]string{"manifests"}, parts...), false)
	if err != nil {
		if errors.Is(err, syscall.ENOENT) {
			return Manifest{}, ErrNotFound
		}
		return Manifest{}, err
	}
	defer directory.Close()
	file, err := openRegularAt(directory, manifestFilename, os.O_RDONLY, 0)
	if errors.Is(err, os.ErrNotExist) {
		return Manifest{}, ErrNotFound
	}
	if err != nil {
		return Manifest{}, fmt.Errorf("open content manifest: %w", err)
	}
	defer file.Close()
	payload, err := io.ReadAll(io.LimitReader(file, DefaultLimits.MaxManifestBytes+1))
	if err != nil {
		return Manifest{}, fmt.Errorf("read content manifest: %w", err)
	}
	if int64(len(payload)) > DefaultLimits.MaxManifestBytes {
		return Manifest{}, fmt.Errorf("content manifest exceeds read limit")
	}
	var manifest Manifest
	if err := json.Unmarshal(payload, &manifest); err != nil {
		return Manifest{}, fmt.Errorf("decode content manifest: %w", err)
	}
	if err := validateManifest(manifest, parts); err != nil {
		return Manifest{}, err
	}
	return manifest, nil
}

func (s *filesystemStorage) OpenBlob(ctx context.Context, digest Digest, byteRange *ByteRange) (io.ReadCloser, BlobMeta, error) {
	if err := ctx.Err(); err != nil {
		return nil, BlobMeta{}, err
	}
	normalized, err := normalizeDigest(digest)
	if err != nil {
		return nil, BlobMeta{}, err
	}
	root, err := s.openPinnedRoot()
	if err != nil {
		return nil, BlobMeta{}, err
	}
	defer root.Close()
	directory, err := openDirectoryAt(root, []string{"blobs", string(normalized)[:2]}, false)
	if err != nil {
		if errors.Is(err, syscall.ENOENT) {
			return nil, BlobMeta{}, ErrNotFound
		}
		return nil, BlobMeta{}, err
	}
	defer directory.Close()
	file, err := openRegularAt(directory, string(normalized)[2:], os.O_RDONLY, 0)
	if errors.Is(err, os.ErrNotExist) {
		return nil, BlobMeta{}, ErrNotFound
	}
	if err != nil {
		return nil, BlobMeta{}, fmt.Errorf("open content blob: %w", err)
	}
	stat, err := file.Stat()
	if err != nil {
		file.Close()
		return nil, BlobMeta{}, fmt.Errorf("stat content blob: %w", err)
	}
	meta := BlobMeta{Digest: normalized, SizeBytes: stat.Size()}
	if meta.SizeBytes > DefaultLimits.MaxFileBytes {
		file.Close()
		return nil, BlobMeta{}, fmt.Errorf("content blob exceeds read limit")
	}
	computed, err := digestReader(file)
	if err != nil {
		file.Close()
		return nil, BlobMeta{}, err
	}
	if computed != normalized {
		file.Close()
		return nil, BlobMeta{}, fmt.Errorf("content blob digest mismatch: got %s, want %s", computed, normalized)
	}
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		file.Close()
		return nil, BlobMeta{}, fmt.Errorf("rewind content blob: %w", err)
	}
	if byteRange == nil {
		return file, meta, nil
	}
	if byteRange.Offset < 0 || byteRange.Length < 0 || byteRange.Offset > stat.Size() || byteRange.Length > stat.Size()-byteRange.Offset {
		file.Close()
		return nil, BlobMeta{}, fmt.Errorf("content blob range is invalid")
	}
	if _, err := file.Seek(byteRange.Offset, io.SeekStart); err != nil {
		file.Close()
		return nil, BlobMeta{}, fmt.Errorf("seek content blob: %w", err)
	}
	return struct {
		io.Reader
		io.Closer
	}{Reader: io.LimitReader(file, byteRange.Length), Closer: file}, meta, nil
}

func (s *filesystemStorage) OpenFile(ctx context.Context, ref ManifestRef, filePath string, byteRange *ByteRange) (io.ReadCloser, BlobMeta, error) {
	filePath, err := cleanFilePath(filePath)
	if err != nil {
		return nil, BlobMeta{}, err
	}
	manifest, err := s.OpenManifest(ctx, ref)
	if err != nil {
		return nil, BlobMeta{}, err
	}
	index := sort.Search(len(manifest.Files), func(index int) bool { return manifest.Files[index].Path >= filePath })
	if index == len(manifest.Files) || manifest.Files[index].Path != filePath {
		return nil, BlobMeta{}, ErrNotFound
	}
	return s.OpenBlob(ctx, manifest.Files[index].Digest, byteRange)
}

func (s *filesystemStorage) Materialize(ctx context.Context, ref ManifestRef, destination string, requested MaterializeLimits) error {
	manifest, err := s.OpenManifest(ctx, ref)
	if err != nil {
		return err
	}
	limits := normalizedMaterializeLimits(requested)
	if len(manifest.Files) > limits.MaxFiles || manifest.SizeBytes > limits.MaxTotalBytes {
		return fmt.Errorf("content materialization exceeds limits")
	}
	destination = strings.TrimSpace(destination)
	if destination == "" {
		return fmt.Errorf("content materialization destination is required")
	}
	destination, err = filepath.Abs(destination)
	if err != nil {
		return fmt.Errorf("resolve content materialization destination: %w", err)
	}
	if _, err := os.Lstat(destination); !errors.Is(err, os.ErrNotExist) {
		if err == nil {
			return fmt.Errorf("content materialization destination already exists")
		}
		return fmt.Errorf("stat content materialization destination: %w", err)
	}
	parentPath := filepath.Dir(destination)
	parentPath, err = filepath.EvalSymlinks(parentPath)
	if err != nil {
		return fmt.Errorf("resolve content materialization parent: %w", err)
	}
	parent, err := openAbsoluteDirectory(parentPath)
	if err != nil {
		return fmt.Errorf("open content materialization parent: %w", err)
	}
	defer parent.Close()
	temporaryName, err := randomEntryName(".content-materialize-")
	if err != nil {
		return err
	}
	if err := mkdirAt(parent, temporaryName, 0o750); err != nil {
		return fmt.Errorf("create content materialization temp: %w", err)
	}
	temporary, err := openDirectoryAt(parent, []string{temporaryName}, false)
	if err != nil {
		return err
	}
	published := false
	defer func() {
		temporary.Close()
		if !published {
			_ = os.RemoveAll(filepath.Join(parentPath, temporaryName))
		}
	}()
	for _, entry := range manifest.Files {
		if err := ctx.Err(); err != nil {
			return err
		}
		if entry.SizeBytes > limits.MaxFileBytes {
			return fmt.Errorf("content file %q exceeds materialization limit", entry.Path)
		}
		cleaned, err := cleanFilePath(entry.Path)
		if err != nil {
			return err
		}
		components := strings.Split(cleaned, "/")
		directory, err := openDirectoryAt(temporary, components[:len(components)-1], true)
		if err != nil {
			return err
		}
		body, meta, err := s.OpenBlob(ctx, entry.Digest, nil)
		if err != nil {
			directory.Close()
			return err
		}
		if meta.SizeBytes != entry.SizeBytes {
			body.Close()
			directory.Close()
			return fmt.Errorf("content blob size does not match manifest")
		}
		mode := os.FileMode(0o640)
		if entry.Executable {
			mode = 0o750
		}
		if err := writeMaterializedFileAt(directory, components[len(components)-1], mode, body, entry.SizeBytes); err != nil {
			body.Close()
			directory.Close()
			return err
		}
		directory.Close()
		if err := body.Close(); err != nil {
			return fmt.Errorf("close content blob: %w", err)
		}
	}
	if err := temporary.Sync(); err != nil {
		return err
	}
	if err := renameAt(parent, temporaryName, parent, filepath.Base(destination)); err != nil {
		return fmt.Errorf("publish content materialization: %w", err)
	}
	published = true
	return parent.Sync()
}

func (s *filesystemStorage) DeletePayload(ctx context.Context, ref ManifestRef) error {
	if err := ctx.Err(); err != nil {
		return err
	}
	parts, err := manifestRefParts(ref)
	if err != nil {
		return err
	}
	root, err := s.openPinnedRoot()
	if err != nil {
		return err
	}
	defer root.Close()
	parent, err := openDirectoryAt(root, append([]string{"manifests"}, parts[:2]...), false)
	if errors.Is(err, syscall.ENOENT) {
		return nil
	}
	if err != nil {
		return err
	}
	defer parent.Close()
	version, err := openDirectoryAt(parent, []string{parts[2]}, false)
	if errors.Is(err, syscall.ENOENT) {
		return nil
	}
	if err != nil {
		return err
	}
	if err := unlinkAt(version, manifestFilename, false); err != nil && !errors.Is(err, syscall.ENOENT) {
		version.Close()
		return fmt.Errorf("delete content manifest: %w", err)
	}
	version.Close()
	if err := unlinkAt(parent, parts[2], true); err != nil && !errors.Is(err, syscall.ENOENT) {
		return fmt.Errorf("delete content version directory: %w", err)
	}
	return nil
}

func (s *filesystemStorage) putBlob(ctx context.Context, content io.Reader, size int64) (Digest, error) {
	root, err := s.openPinnedRoot()
	if err != nil {
		return "", err
	}
	defer root.Close()
	temporaryName, err := randomEntryName(".content-blob-")
	if err != nil {
		return "", err
	}
	temporary, err := openRegularAt(root, temporaryName, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
	if err != nil {
		return "", fmt.Errorf("create content blob temp: %w", err)
	}
	defer unlinkAt(root, temporaryName, false)
	hash := sha256.New()
	written, copyErr := io.Copy(io.MultiWriter(temporary, hash), &contextLimitedReader{ctx: ctx, reader: content, remaining: size + 1})
	if copyErr != nil {
		temporary.Close()
		return "", fmt.Errorf("write content blob: %w", copyErr)
	}
	if written != size {
		temporary.Close()
		return "", fmt.Errorf("content blob size mismatch: got %d, want %d", written, size)
	}
	if err := temporary.Sync(); err != nil {
		temporary.Close()
		return "", fmt.Errorf("sync content blob: %w", err)
	}
	if err := temporary.Close(); err != nil {
		return "", fmt.Errorf("close content blob: %w", err)
	}
	digest := Digest(hex.EncodeToString(hash.Sum(nil)))
	directory, err := openDirectoryAt(root, []string{"blobs", string(digest)[:2]}, true)
	if err != nil {
		return "", err
	}
	defer directory.Close()
	blobName := string(digest)[2:]
	if err := linkAt(root, temporaryName, directory, blobName); err != nil {
		if !errors.Is(err, syscall.EEXIST) {
			return "", fmt.Errorf("publish content blob: %w", err)
		}
		if err := verifyExistingBlob(directory, blobName, digest, size); err != nil {
			return "", err
		}
	}
	if err := directory.Sync(); err != nil {
		return "", err
	}
	return digest, nil
}

func (s *filesystemStorage) publishManifest(ctx context.Context, ref ManifestRef, payload []byte) (bool, error) {
	parts, err := manifestRefParts(ref)
	if err != nil {
		return false, err
	}
	root, err := s.openPinnedRoot()
	if err != nil {
		return false, err
	}
	defer root.Close()
	grandparent, err := openDirectoryAt(root, append([]string{"manifests"}, parts[:2]...), true)
	if err != nil {
		return false, err
	}
	defer grandparent.Close()
	if versionDirectory, openErr := openDirectoryAt(grandparent, []string{parts[2]}, false); openErr == nil {
		existingFile, readErr := openRegularAt(versionDirectory, manifestFilename, os.O_RDONLY, 0)
		versionDirectory.Close()
		if readErr != nil {
			return false, readErr
		}
		existing, readErr := io.ReadAll(io.LimitReader(existingFile, DefaultLimits.MaxManifestBytes+1))
		existingFile.Close()
		if readErr != nil {
			return false, readErr
		}
		if bytes.Equal(existing, payload) {
			return false, nil
		}
		return false, ErrAlreadyExists
	} else if !errors.Is(openErr, syscall.ENOENT) {
		return false, openErr
	}
	temporaryName, err := randomEntryName(".content-version-")
	if err != nil {
		return false, err
	}
	if err := mkdirAt(grandparent, temporaryName, 0o750); err != nil {
		return false, fmt.Errorf("create content version temp: %w", err)
	}
	temporary, err := openDirectoryAt(grandparent, []string{temporaryName}, false)
	if err != nil {
		return false, err
	}
	published := false
	defer func() {
		if published {
			temporary.Close()
			return
		}
		unlinkAt(temporary, manifestFilename, false)
		temporary.Close()
		unlinkAt(grandparent, temporaryName, true)
	}()
	manifestFile, err := openRegularAt(temporary, manifestFilename, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o640)
	if err != nil {
		return false, fmt.Errorf("create content manifest: %w", err)
	}
	if _, err := manifestFile.Write(payload); err != nil {
		manifestFile.Close()
		return false, fmt.Errorf("write content manifest: %w", err)
	}
	if err := manifestFile.Sync(); err != nil {
		manifestFile.Close()
		return false, fmt.Errorf("sync content manifest: %w", err)
	}
	if err := manifestFile.Close(); err != nil {
		return false, fmt.Errorf("close content manifest: %w", err)
	}
	if err := temporary.Sync(); err != nil {
		return false, err
	}
	if err := ctx.Err(); err != nil {
		return false, err
	}
	if err := renameAt(grandparent, temporaryName, grandparent, parts[2]); err != nil {
		if versionDirectory, openErr := openDirectoryAt(grandparent, []string{parts[2]}, false); openErr == nil {
			existingFile, readErr := openRegularAt(versionDirectory, manifestFilename, os.O_RDONLY, 0)
			versionDirectory.Close()
			if readErr != nil {
				return false, readErr
			}
			existing, readErr := io.ReadAll(io.LimitReader(existingFile, DefaultLimits.MaxManifestBytes+1))
			existingFile.Close()
			if readErr != nil {
				return false, readErr
			}
			if bytes.Equal(existing, payload) {
				return false, nil
			}
			return false, ErrAlreadyExists
		}
		return false, fmt.Errorf("publish content manifest: %w", err)
	}
	published = true
	if err := grandparent.Sync(); err != nil {
		return true, err
	}
	return true, nil
}

func verifyExistingBlob(directory *os.File, name string, expectedDigest Digest, expectedSize int64) error {
	file, err := openRegularAt(directory, name, os.O_RDONLY, 0)
	if err != nil {
		return fmt.Errorf("open existing content blob: %w", err)
	}
	defer file.Close()
	stat, err := file.Stat()
	if err != nil {
		return fmt.Errorf("stat existing content blob: %w", err)
	}
	if stat.Size() != expectedSize {
		return fmt.Errorf("existing content blob size mismatch: got %d, want %d", stat.Size(), expectedSize)
	}
	actualDigest, err := digestReader(file)
	if err != nil {
		return fmt.Errorf("verify existing content blob: %w", err)
	}
	if actualDigest != expectedDigest {
		return fmt.Errorf("existing content blob digest mismatch: got %s, want %s", actualDigest, expectedDigest)
	}
	return nil
}

func manifestRefParts(ref ManifestRef) ([]string, error) {
	parts := strings.Split(string(ref), "/")
	if len(parts) != 3 {
		return nil, fmt.Errorf("content manifest reference is invalid")
	}
	for index, part := range parts {
		value, err := safeID("manifest reference", part)
		if err != nil {
			return nil, err
		}
		parts[index] = value
	}
	return parts, nil
}

func normalizeDigest(digest Digest) (Digest, error) {
	normalized := strings.ToLower(strings.TrimSpace(string(digest)))
	if len(normalized) != sha256.Size*2 {
		return "", fmt.Errorf("content blob digest is invalid")
	}
	if _, err := hex.DecodeString(normalized); err != nil {
		return "", fmt.Errorf("content blob digest is invalid")
	}
	return Digest(normalized), nil
}

func safeID(kind, value string) (string, error) {
	value = strings.TrimSpace(value)
	if value == "" || value == "." || value == ".." || strings.ContainsAny(value, "/\\\x00") {
		return "", fmt.Errorf("content %s id is invalid", kind)
	}
	return value, nil
}

func cleanFilePath(value string) (string, error) {
	value = strings.TrimSpace(strings.ReplaceAll(value, "\\", "/"))
	if value == "" || strings.HasPrefix(value, "/") {
		return "", fmt.Errorf("content file path is invalid")
	}
	for _, segment := range strings.Split(value, "/") {
		if segment == "" || segment == "." || segment == ".." {
			return "", fmt.Errorf("content file path %q is invalid", value)
		}
	}
	cleaned := path.Clean(value)
	if cleaned != value {
		return "", fmt.Errorf("content file path %q is invalid", value)
	}
	return cleaned, nil
}

// NormalizeLimits applies the canonical Content Store defaults used by every
// tree payload backend. Callers that persist or compare request semantics must
// use this function rather than reimplementing the defaulting rules.
func NormalizeLimits(limits Limits) (Limits, error) {
	values := []struct {
		name    string
		value   int64
		maximum int64
	}{
		{name: "max files", value: int64(limits.MaxFiles), maximum: int64(DefaultLimits.MaxFiles)},
		{name: "max file bytes", value: limits.MaxFileBytes, maximum: DefaultLimits.MaxFileBytes},
		{name: "max total bytes", value: limits.MaxTotalBytes, maximum: DefaultLimits.MaxTotalBytes},
		{name: "max manifest bytes", value: limits.MaxManifestBytes, maximum: DefaultLimits.MaxManifestBytes},
	}
	for _, item := range values {
		if item.value < 0 || item.value > item.maximum {
			return Limits{}, fmt.Errorf("content %s %d is outside owner bounds [0,%d]", item.name, item.value, item.maximum)
		}
	}
	defaults := DefaultLimits
	if limits.MaxFiles > 0 {
		defaults.MaxFiles = limits.MaxFiles
	}
	if limits.MaxFileBytes > 0 {
		defaults.MaxFileBytes = limits.MaxFileBytes
	}
	if limits.MaxTotalBytes > 0 {
		defaults.MaxTotalBytes = limits.MaxTotalBytes
	}
	if limits.MaxManifestBytes > 0 {
		defaults.MaxManifestBytes = limits.MaxManifestBytes
	}
	return defaults, nil
}

func normalizedMaterializeLimits(limits MaterializeLimits) MaterializeLimits {
	defaults := DefaultLimits
	if limits.MaxFiles > 0 {
		defaults.MaxFiles = limits.MaxFiles
	}
	if limits.MaxFileBytes > 0 {
		defaults.MaxFileBytes = limits.MaxFileBytes
	}
	if limits.MaxTotalBytes > 0 {
		defaults.MaxTotalBytes = limits.MaxTotalBytes
	}
	return MaterializeLimits{MaxFiles: defaults.MaxFiles, MaxFileBytes: defaults.MaxFileBytes, MaxTotalBytes: defaults.MaxTotalBytes}
}

func manifestDigest(entries []ManifestEntry) (Digest, error) {
	payload, err := json.Marshal(entries)
	if err != nil {
		return "", fmt.Errorf("encode content manifest entries: %w", err)
	}
	sum := sha256.Sum256(payload)
	return Digest(hex.EncodeToString(sum[:])), nil
}

func validateManifest(manifest Manifest, refParts []string) error {
	if manifest.WorkspaceID != refParts[0] || manifest.ContentID != refParts[1] || manifest.VersionID != refParts[2] {
		return fmt.Errorf("content manifest identity does not match reference")
	}
	var total int64
	if len(manifest.Files) > DefaultLimits.MaxFiles {
		return fmt.Errorf("content manifest file count exceeds limit")
	}
	for index, entry := range manifest.Files {
		cleaned, err := cleanFilePath(entry.Path)
		if err != nil || cleaned != entry.Path {
			return fmt.Errorf("content manifest contains invalid path")
		}
		if index > 0 && manifest.Files[index-1].Path >= entry.Path {
			return fmt.Errorf("content manifest paths are not unique and sorted")
		}
		if _, err := normalizeDigest(entry.Digest); err != nil || entry.SizeBytes < 0 || entry.SizeBytes > DefaultLimits.MaxFileBytes {
			return fmt.Errorf("content manifest contains invalid blob metadata")
		}
		if total > DefaultLimits.MaxTotalBytes-entry.SizeBytes {
			return fmt.Errorf("content manifest size exceeds limit")
		}
		total += entry.SizeBytes
	}
	if total != manifest.SizeBytes {
		return fmt.Errorf("content manifest aggregate size mismatch")
	}
	digest, err := manifestDigest(manifest.Files)
	if err != nil {
		return err
	}
	if digest != manifest.RootDigest {
		return fmt.Errorf("content manifest root digest mismatch")
	}
	return nil
}

func digestReader(reader io.Reader) (Digest, error) {
	hash := sha256.New()
	if _, err := io.Copy(hash, reader); err != nil {
		return "", fmt.Errorf("hash content object: %w", err)
	}
	return Digest(hex.EncodeToString(hash.Sum(nil))), nil
}

func randomEntryName(prefix string) (string, error) {
	var value [16]byte
	if _, err := rand.Read(value[:]); err != nil {
		return "", fmt.Errorf("generate content temporary name: %w", err)
	}
	return prefix + hex.EncodeToString(value[:]), nil
}

func writeMaterializedFileAt(directory *os.File, name string, mode os.FileMode, source io.Reader, size int64) error {
	file, err := openRegularAt(directory, name, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
	if err != nil {
		return fmt.Errorf("create materialized content file: %w", err)
	}
	written, copyErr := io.Copy(file, io.LimitReader(source, size+1))
	if copyErr != nil {
		file.Close()
		return fmt.Errorf("write materialized content file: %w", copyErr)
	}
	if written != size {
		file.Close()
		return fmt.Errorf("materialized content file size mismatch")
	}
	if err := file.Sync(); err != nil {
		file.Close()
		return fmt.Errorf("sync materialized content file: %w", err)
	}
	if err := file.Close(); err != nil {
		return fmt.Errorf("close materialized content file: %w", err)
	}
	return nil
}

func syncDirectory(directory string) error {
	file, err := os.Open(directory)
	if err != nil {
		return fmt.Errorf("open content storage directory: %w", err)
	}
	defer file.Close()
	if err := file.Sync(); err != nil {
		return fmt.Errorf("sync content storage directory: %w", err)
	}
	return nil
}

type contextLimitedReader struct {
	ctx       context.Context
	reader    io.Reader
	remaining int64
}

func (r *contextLimitedReader) Read(buffer []byte) (int, error) {
	if err := r.ctx.Err(); err != nil {
		return 0, err
	}
	if r.remaining <= 0 {
		return 0, io.EOF
	}
	if int64(len(buffer)) > r.remaining {
		buffer = buffer[:r.remaining]
	}
	read, err := r.reader.Read(buffer)
	r.remaining -= int64(read)
	return read, err
}