edgeway 0.1.0

data/js/cloudflare.js

@@ -0,0 +1,103 @@
+// The Cloudflare Workers side of an Edgeway app. A worker is three lines:
+//
+//   import app from "../build/app.wasm";
+//   import { createWorker } from "../build/edgeway/cloudflare.js";
+//   export default createWorker(app);
+//
+// build/edgeway/config.js is written by `edgeway build` from
+// config/database.yml: the environment name and the D1 binding.
+import { runCgi } from "./runtime.js";
+import config from "./config.js";
+import { jwtImports } from "./jwt.js";
+import { withCors } from "./cors.js";
+
+// The wasm import module "edgeway_d1" (lib/edgeway/service/cloudflare/d1.rb). Each call
+// answers the byte length of its JSON result; take() copies it out.
+//   query(binding, sql, binds)   -> {"rows": [...]}
+//   execute(binding, sql, binds) -> {"changes": n, "last_insert_id": id}
+//   batch(binding, statements)   -> {"results": [{"changes": n, "last_insert_id": id}, ...]}
+//                                   (statements: [[sql, binds], ...], one atomic D1 batch)
+// An error is {"error": "message"}.
+export function d1Imports(env, getInstance) {
+  const mem = () => new Uint8Array(getInstance().exports.memory.buffer);
+  const cstr = (p) => {
+    const b = mem();
+    let e = p;
+    while (b[e]) e++;
+    return new TextDecoder().decode(b.subarray(p, e));
+  };
+  let pending = new Uint8Array(0);
+
+  // fn(db, ...pointers) answers the result object; a failure is {error}.
+  const suspending = (fn) => new WebAssembly.Suspending(async (bindingPtr, ...ptrs) => {
+    let res;
+    try {
+      const name = cstr(bindingPtr) || config.d1Binding;
+      const db = env[name];
+      if (!db) throw new Error(`no D1 binding ${name}`);
+      res = await fn(db, ...ptrs);
+    } catch (e) {
+      res = { error: String(e?.message ?? e) };
+    }
+    pending = new TextEncoder().encode(JSON.stringify(res));
+    return pending.length;
+  });
+  const run = (fn) => suspending((db, sqlPtr, bindsPtr) =>
+    fn(db.prepare(cstr(sqlPtr)).bind(...JSON.parse(cstr(bindsPtr)))));
+
+  return {
+    edgeway_d1: {
+      query: run(async (st) => ({ rows: (await st.all()).results })),
+      execute: run(async (st) => {
+        const meta = (await st.run()).meta;
+        return { changes: meta.changes ?? 0, last_insert_id: meta.last_row_id ?? 0 };
+      }),
+      // db.batch() is one transaction: a failing statement rejects it and
+      // none of the statements stay applied.
+      batch: suspending(async (db, statementsPtr) => {
+        const statements = JSON.parse(cstr(statementsPtr));
+        const results = await db.batch(statements.map(([sql, binds]) => db.prepare(sql).bind(...binds)));
+        return {
+          results: results.map((r) => ({ changes: r.meta.changes ?? 0, last_insert_id: r.meta.last_row_id ?? 0 })),
+        };
+      }),
+      take(buf) {
+        mem().set(pending, buf);
+      },
+    },
+  };
+}
+
+// The settings of the framework that Edgeway.config reads in wasm. The CORS_*
+// ones and JWT_SECRET are read from env in JS (cors.js, jwt.js), so they stay
+// out.
+const FRAMEWORK_VARS = new Set([
+  "JWT_ISSUER", "JWT_AUDIENCE", "JWT_LEEWAY", "JWT_ALGORITHMS", "JWT_JWKS_URL",
+]);
+
+// The Worker's variables (strings) become CGI environment variables, which
+// Edgeway.config reads. Only an allow-list goes in, so a secret that the
+// Worker holds for something else is not readable by the app (or its logs):
+// the framework's settings, and the names that start with APP_, for the app's
+// own. JWT_SECRET never does: js/jwt.js reads it from env, so the key never
+// enters wasm.
+export function varsOf(env) {
+  const vars = {};
+  for (const [k, v] of Object.entries(env)) {
+    if (typeof v !== "string" || k === "JWT_SECRET") continue;
+    if (FRAMEWORK_VARS.has(k) || k.startsWith("APP_")) vars[k] = v;
+  }
+  return vars;
+}
+
+// appModule: the WebAssembly.Module that `import app from "...app.wasm"` gives.
+export function createWorker(appModule) {
+  return {
+    fetch: withCors((request, env) => runCgi(appModule, request, {
+      extraEnv: { EDGEWAY_ENV: config.env, ...varsOf(env) },
+      // Both modules are always supplied, whether or not the app uses them:
+      // the wasm instance needs every import it declares.
+      imports: (getInstance) => ({ ...d1Imports(env, getInstance), ...jwtImports(env, getInstance) }),
+    })),
+  };
+}

data/js/cors.js

@@ -0,0 +1,87 @@
+// CORS, done in the Worker around the app (see README "CORS"). A preflight is
+// answered without starting the wasm, and a response made by the JS layer
+// itself (the 500 of a trap) gets the headers too, so a browser sees the real
+// status instead of an opaque CORS error. Nothing here is specific to a
+// platform. Cookies are not supported: Access-Control-Allow-Credentials is
+// never sent.
+const DEFAULT_HEADERS = "Authorization, Content-Type";
+const DEFAULT_MAX_AGE = "600";
+const METHODS = "GET, HEAD, POST, PUT, PATCH, DELETE";
+
+function json(status, body, headers = {}) {
+  return new Response(body, { status, headers: { "Content-Type": "application/json", ...headers } });
+}
+
+// The settings from the Worker's variables, or null when CORS is off.
+// A bad CORS_MAX_AGE is { error }: like JWT, a misconfiguration is a 500, not
+// a silent default.
+function settings(env) {
+  const list = (env.CORS_ORIGINS ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (list.length === 0) return null;
+  const maxAge = (env.CORS_MAX_AGE ?? "").trim() || DEFAULT_MAX_AGE;
+  if (!/^\d+$/.test(maxAge)) return { error: `CORS_MAX_AGE must be a non-negative integer, got "${env.CORS_MAX_AGE}"` };
+  return {
+    any: list.includes("*"),
+    origins: new Set(list),
+    headers: (env.CORS_HEADERS ?? "").trim() || DEFAULT_HEADERS,
+    maxAge,
+    expose: (env.CORS_EXPOSE_HEADERS ?? "").trim(),
+  };
+}
+
+// "null" is what sandboxed iframes and file: pages send; it names no site, so
+// it is refused even for "*".
+function allowed(cfg, origin) {
+  if (origin === null || origin === "null") return false;
+  return cfg.any || cfg.origins.has(origin);
+}
+
+// Appends Origin to Vary unless it (or *) is already there.
+function addVary(headers, ...names) {
+  const have = (headers.get("Vary") ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (have.includes("*")) return;
+  for (const n of names) {
+    if (!have.some((h) => h.toLowerCase() === n.toLowerCase())) have.push(n);
+  }
+  headers.set("Vary", have.join(", "));
+}
+
+// Wraps a fetch handler (request, env, ctx) -> Response.
+export function withCors(handler) {
+  return async (request, env, ctx) => {
+    const cfg = settings(env);
+    if (!cfg) return handler(request, env, ctx);
+    if (cfg.error) {
+      console.error(cfg.error);
+      return json(500, '{"error":"internal error"}\n');
+    }
+
+    const origin = request.headers.get("Origin");
+    const ok = origin !== null && allowed(cfg, origin);
+
+    if (request.method === "OPTIONS" && origin !== null && request.headers.has("Access-Control-Request-Method")) {
+      if (!ok) return json(403, '{"error":"origin not allowed"}\n', { Vary: "Origin" });
+      return new Response(null, {
+        status: 204,
+        headers: {
+          "Access-Control-Allow-Origin": origin,
+          "Access-Control-Allow-Methods": METHODS,
+          // Listed, not *: a * does not cover Authorization.
+          "Access-Control-Allow-Headers": cfg.headers,
+          "Access-Control-Max-Age": cfg.maxAge,
+          Vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
+        },
+      });
+    }
+
+    // Copied so the headers can be changed whatever the handler returned.
+    const res = await handler(request, env, ctx);
+    const out = new Response(res.body, res);
+    if (ok) {
+      out.headers.set("Access-Control-Allow-Origin", origin);
+      if (cfg.expose) out.headers.set("Access-Control-Expose-Headers", cfg.expose);
+    }
+    addVary(out.headers, "Origin");
+    return out;
+  };
+}

data/js/jwt.js

@@ -0,0 +1,279 @@
+// JWT signature verification with WebCrypto, for tokens an external IdP
+// issued (Auth0, Firebase, Cognito, ...; Cloudflare Access is not supported yet). Nothing here is
+// specific to a platform: cloudflare.js hands jwtImports the Worker's env.
+// This checks the signature and the algorithm only; the claims (exp, iss,
+// aud, ...) are checked in Ruby (lib/edgeway/http/auth/jwt.rb).
+//
+// Settings (strings in the env):
+//   JWT_ALGORITHMS  comma-separated allow-list, default "RS256". The token's
+//                   alg must be in it, whatever the token says ("none" never is)
+//   JWT_JWKS_URL    where the public keys are, for RS*/PS*/ES*/EdDSA; https,
+//                   except http://localhost, 127.0.0.1 and [::1]
+//   JWT_SECRET      the shared secret, for HS*; at least as long as the hash
+//                   (RFC 7518 3.2): 32 bytes for HS256, 48 for HS384, 64 for HS512
+// A key never serves the other family: an HS* token is checked only with
+// JWT_SECRET, and any other only with a key of the JWKS (so a public key
+// can't be passed off as an HMAC secret).
+//
+// Hardened as jose does (and a little more): a JWKS is never used past its TTL
+// (no stale fallback), is fetched with a timeout, no redirect, only on status
+// 200 and at most MAX_JWKS bytes; a token with a `crit` header is refused
+// (RFC 7515 4.1.11: no extension is understood), and a JWKS key needs a `kid`
+// on the token and, if it has key_ops, "verify" in them.
+
+const MAX_TOKEN = 8192;
+// A JWKS is kept this long, and re-fetched early (for an unknown kid) at
+// most this often.
+const JWKS_TTL_MS = 10 * 60 * 1000;
+const JWKS_MIN_REFETCH_MS = 30 * 1000;
+const JWKS_TIMEOUT_MS = 5000;
+const MAX_JWKS = 64 * 1024;
+
+// alg => how WebCrypto imports the key and verifies. The hash size is
+// the RSA-PSS salt length.
+const HASHES = { 256: "SHA-256", 384: "SHA-384", 512: "SHA-512" };
+function algorithm(alg) {
+  const m = /^(HS|RS|PS|ES)(256|384|512)$/.exec(alg);
+  if (m) {
+    const [, family, bits] = m;
+    const hash = HASHES[bits];
+    switch (family) {
+      case "HS": return { family: "HS", import: { name: "HMAC", hash }, verify: { name: "HMAC" } };
+      case "RS": return { family: "RS", kty: "RSA", import: { name: "RSASSA-PKCS1-v1_5", hash }, verify: { name: "RSASSA-PKCS1-v1_5" } };
+      case "PS": return {
+        family: "PS", kty: "RSA", import: { name: "RSA-PSS", hash },
+        verify: { name: "RSA-PSS", saltLength: Number(bits) / 8 },
+      };
+      case "ES": {
+        const crv = { 256: "P-256", 384: "P-384" }[bits];   // ES512 (P-521) is left out
+        if (!crv) return null;
+        return { family: "ES", kty: "EC", crv, import: { name: "ECDSA", namedCurve: crv }, verify: { name: "ECDSA", hash } };
+      }
+    }
+  }
+  if (alg === "EdDSA") return { family: "EdDSA", kty: "OKP", crv: "Ed25519", import: { name: "Ed25519" }, verify: { name: "Ed25519" } };
+  return null;
+}
+
+// "invalid": the token is bad (401). "unavailable": it could not be checked
+// (a missing setting, the JWKS can't be fetched), which is the server's
+// problem (500).
+class JwtError extends Error {
+  constructor(message, unavailable = false) {
+    super(message);
+    this.unavailable = unavailable;
+  }
+}
+
+function b64urlDecode(s) {
+  // A length of 1 mod 4 is never valid base64 (and makes atob throw a plain
+  // Error, which would be reported as "unavailable" instead of a bad token).
+  if (!/^[A-Za-z0-9_-]*$/.test(s) || s.length % 4 === 1) throw new JwtError("bad base64url");
+  const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/"));
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+}
+
+function parseJsonPart(s, what) {
+  let v;
+  try {
+    v = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(b64urlDecode(s)));
+  } catch {
+    throw new JwtError(`${what} is not valid`);
+  }
+  if (v === null || typeof v !== "object" || Array.isArray(v)) throw new JwtError(`${what} is not an object`);
+  return v;
+}
+
+// JWKS cache: url => { keys, at, imported: Map }. It lives at module scope:
+// a wasm instance is made per request, but the isolate (and so this module)
+// is reused. Only data is kept, never a Promise, because a Worker can't
+// await I/O that another request started.
+const sharedCache = new Map();
+
+// Only https, so a JWKS can't be swapped on the way; a local server (tests,
+// `wrangler dev`) may use http.
+function jwksUrlAllowed(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return false;
+  }
+  if (u.protocol === "https:") return true;
+  return u.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname);
+}
+
+// The body of res as text, at most MAX_JWKS bytes (checked on Content-Length
+// when there is one, and again while reading, because a chunked body has none).
+async function limitedText(res) {
+  const declared = res.headers?.get("content-length");
+  if (declared !== null && declared !== undefined && Number(declared) > MAX_JWKS) throw new Error("response is too large");
+  if (!res.body) throw new Error("no body");
+  const reader = res.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > MAX_JWKS) {
+      await reader.cancel().catch(() => {});
+      throw new Error("response is too large");
+    }
+    chunks.push(value);
+  }
+  const all = new Uint8Array(size);
+  let at = 0;
+  for (const c of chunks) {
+    all.set(c, at);
+    at += c.byteLength;
+  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(all);
+}
+
+export function jwtVerifier(env, { fetch = globalThis.fetch, now = Date.now, cache = sharedCache, timeoutMs = JWKS_TIMEOUT_MS } = {}) {
+  const allowed = String(env.JWT_ALGORITHMS || "RS256").split(",").map((s) => s.trim()).filter(Boolean);
+
+  async function loadKeys(url, force) {
+    const entry = cache.get(url);
+    const t = now();
+    if (entry && (force ? t - entry.at < JWKS_MIN_REFETCH_MS : t - entry.at < JWKS_TTL_MS)) return entry;
+    // No stale JWKS: past its TTL (or when a forced refetch fails) a failed
+    // fetch is "unavailable", never an old key.
+    try {
+      const res = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      if (res.status !== 200) throw new Error(`status ${res.status}`);
+      const keys = JSON.parse(await limitedText(res)).keys;
+      if (!Array.isArray(keys)) throw new Error("no keys");
+      const fresh = { keys, at: t, imported: new Map() };
+      cache.set(url, fresh);
+      return fresh;
+    } catch (e) {
+      throw new JwtError(`cannot fetch the JWKS: ${e?.message ?? e}`, true);
+    }
+  }
+
+  // A key of the JWKS that can verify alg, selected by kid.
+  function pick(entry, alg, algo, kid) {
+    const fits = (k) => k && k.kty === algo.kty && (k.use === undefined || k.use === "sig")
+      && (k.key_ops === undefined || (Array.isArray(k.key_ops) && k.key_ops.includes("verify")))
+      && (k.alg === undefined || k.alg === alg || (alg === "EdDSA" && k.alg === "Ed25519")) && (algo.crv === undefined || k.crv === algo.crv);
+    return entry.keys.find((k) => k.kid === kid && fits(k));
+  }
+
+  async function importJwk(entry, jwk, algo) {
+    // imported: jwk => Map(alg name => CryptoKey). A JWK without `alg` can be
+    // used for several (RS256, RS384...), and each needs its own hash.
+    let keys = entry.imported.get(jwk);
+    if (!keys) entry.imported.set(jwk, (keys = new Map()));
+    const id = algo.import.name + (algo.import.hash ?? algo.import.namedCurve ?? "");
+    let key = keys.get(id);
+    if (!key) {
+      // pick() accepted "Ed25519" as the alg of an EdDSA key, but workerd's
+      // importKey refuses a JWK whose alg is not "EdDSA" (node accepts it).
+      const usable = jwk.alg === "Ed25519" ? { ...jwk, alg: "EdDSA" } : jwk;
+      key = await crypto.subtle.importKey("jwk", usable, algo.import, false, ["verify"]);
+      keys.set(id, key);
+    }
+    return key;
+  }
+
+  async function keyFor(alg, algo, kid) {
+    if (algo.family === "HS") {
+      if (!env.JWT_SECRET) throw new JwtError("JWT_SECRET is not set", true);
+      const secret = new TextEncoder().encode(env.JWT_SECRET);
+      // RFC 7518 3.2: a key at least as long as the hash output.
+      const need = Number(alg.slice(2)) / 8;
+      if (secret.length < need) throw new JwtError(`JWT_SECRET is too short for ${alg} (${need} bytes at least)`, true);
+      return crypto.subtle.importKey("raw", secret, algo.import, false, ["verify"]);
+    }
+    const url = env.JWT_JWKS_URL;
+    if (!url) throw new JwtError("JWT_JWKS_URL is not set", true);
+    if (!jwksUrlAllowed(url)) throw new JwtError("JWT_JWKS_URL must be https (http only for localhost)", true);
+    if (kid === undefined) throw new JwtError("kid is required");
+    let entry = await loadKeys(url, false);
+    let jwk = pick(entry, alg, algo, kid);
+    if (!jwk) {
+      // A key rotated in: look again, but not for every bad token.
+      entry = await loadKeys(url, true);
+      jwk = pick(entry, alg, algo, kid);
+    }
+    if (!jwk) throw new JwtError("unknown kid");
+    return importJwk(entry, jwk, algo);
+  }
+
+  // => { header, payload }; throws JwtError.
+  async function verify(token) {
+    if (token.length > MAX_TOKEN) throw new JwtError("token is too long");
+    const parts = token.split(".");
+    if (parts.length !== 3) throw new JwtError("token is not a JWT");
+    const header = parseJsonPart(parts[0], "header");
+    // Edgeway understands no extension, so a token that insists on one
+    // ("crit", RFC 7515 4.1.11) is refused.
+    if ("crit" in header) throw new JwtError("crit header is not supported");
+    const alg = header.alg;
+    if (typeof alg !== "string" || !allowed.includes(alg)) throw new JwtError("algorithm is not allowed");
+    const algo = algorithm(alg);
+    if (!algo) throw new JwtError("algorithm is not supported");
+    if (header.kid !== undefined && typeof header.kid !== "string") throw new JwtError("kid is not a string");
+    // Decoded before keyFor, so a malformed token costs no JWKS fetch.
+    const signature = b64urlDecode(parts[2]);
+    const key = await keyFor(alg, algo, header.kid);
+    const signed = new TextEncoder().encode(`${parts[0]}.${parts[1]}`);
+    let ok = false;
+    try {
+      ok = await crypto.subtle.verify(algo.verify, key, signature, signed);
+    } catch {
+      // A malformed signature (the wrong length...) is just not valid.
+    }
+    if (!ok) throw new JwtError("signature is not valid");
+    return { header, payload: parseJsonPart(parts[1], "payload") };
+  }
+
+  // The JSON the wasm side reads.
+  return async (token) => {
+    try {
+      return await verify(token);
+    } catch (e) {
+      if (!(e instanceof JwtError)) throw e;
+      return e.unavailable ? { error: e.message, unavailable: true } : { error: e.message };
+    }
+  };
+}
+
+// The wasm import module "edgeway_jwt" (lib/edgeway/service/cloudflare/jwt.rb):
+//   verify(token) -> {"header": {...}, "payload": {...}}
+//                  | {"error": "message"}                      the token is bad
+//                  | {"error": "message", "unavailable": true}  it can't be checked
+// Like D1, a call answers the byte length of the result and take() copies it
+// out; verify is wrapped in WebAssembly.Suspending (the WebCrypto and fetch
+// Promises are awaited with the wasm stack suspended).
+export function jwtImports(env, getInstance, options = {}) {
+  const mem = () => new Uint8Array(getInstance().exports.memory.buffer);
+  const cstr = (p) => {
+    const b = mem();
+    let e = p;
+    while (b[e]) e++;
+    return new TextDecoder().decode(b.subarray(p, e));
+  };
+  const verifier = jwtVerifier(env, options);
+  let pending = new Uint8Array(0);
+
+  return {
+    edgeway_jwt: {
+      verify: new WebAssembly.Suspending(async (tokenPtr) => {
+        let res;
+        try {
+          res = await verifier(cstr(tokenPtr));
+        } catch (e) {
+          res = { error: String(e?.message ?? e), unavailable: true };
+        }
+        pending = new TextEncoder().encode(JSON.stringify(res));
+        return pending.length;
+      }),
+      take(buf) {
+        mem().set(pending, buf);
+      },
+    },
+  };
+}

data/js/runtime.js

@@ -0,0 +1,99 @@
+// Runs a Spinel-built app.wasm once per request, CGI style: the request
+// becomes CGI environment variables and STDIN, the program's stdout becomes
+// the Response. Nothing here is specific to a platform; cloudflare.js
+// supplies the imports a platform adds (D1, ...) and the environment.
+import { WASI } from "./wasi-shim.js";
+import { cgiEnv, cgiResponse, concatBytes } from "./cgi.js";
+
+// SPINEL_GC_SLAB_MB: the size of the GC slab, read from the WASI env at start.
+// The default 64 MB makes an instance 77 MiB; with 8 MB it is ~21 MiB, so
+// more requests fit in the 128 MB of an isolate.
+const SLAB_MB = "8";
+
+// The largest request body accepted. The body is copied into the instance's
+// STDIN (and the CGI env), so an unbounded one would exhaust the isolate.
+const MAX_BODY = 1024 * 1024;
+
+function payloadTooLarge() {
+  return new Response('{"error":"payload too large"}\n', {
+    status: 413,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+// The request's body as bytes, or null when it is over MAX_BODY. Content-Length
+// is checked first, but a client can lie or send chunked, so the stream is
+// read with a cap as well.
+async function readBody(request) {
+  const declared = request.headers.get("content-length");
+  if (declared !== null && Number(declared) > MAX_BODY) return null;
+  if (!request.body) return new Uint8Array(0);
+  const chunks = [];
+  let total = 0;
+  const reader = request.body.getReader();
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > MAX_BODY) {
+      await reader.cancel();
+      return null;
+    }
+    chunks.push(value);
+  }
+  return concatBytes(chunks);
+}
+
+function internalError() {
+  return new Response('{"error":"internal error"}\n', {
+    status: 500,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+// Runs appModule (a WebAssembly.Module) for one request and answers the
+// Response.
+//   extraEnv: more CGI environment variables (strings), such as the app's
+//             settings and EDGEWAY_ENV.
+//   imports:  (getInstance) => { moduleName: { name: fn } }, the wasm import
+//             modules besides WASI. A function wrapped in
+//             WebAssembly.Suspending may await (JSPI).
+export async function runCgi(appModule, request, { extraEnv = {}, imports = () => ({}) } = {}) {
+  const body = request.method === "GET" || request.method === "HEAD"
+    ? new Uint8Array(0)
+    : await readBody(request);
+  if (body === null) return payloadTooLarge();
+
+  const out = [];
+  let err = "";
+  const wasi = new WASI({
+    args: ["app"],
+    env: { ...extraEnv, ...cgiEnv(request, body), SPINEL_GC_SLAB_MB: SLAB_MB },
+    stdin: body,
+    onStdoutBytes: (b) => out.push(b),
+    onStderr: (s) => (err += s),
+  });
+  // Whatever goes wrong inside the app (a trap, a non-zero exit) is logged
+  // and answered with a fixed body: stderr and error messages never reach
+  // the client.
+  let status;
+  try {
+    // A fresh instance per request: no state leaks between requests.
+    let instance;
+    instance = new WebAssembly.Instance(appModule, {
+      wasi_snapshot_preview1: wasi.wasiImport,
+      ...imports(() => instance),
+    });
+    status = await wasi.startAsync(instance);
+  } catch (e) {
+    console.error("app trapped:", e, err);
+    return internalError();
+  }
+  if (err) console.error(err);
+  if (status !== 0) {
+    console.error(`app exited with ${status}`);
+    return internalError();
+  }
+
+  return cgiResponse(concatBytes(out));
+}