@nimbus-sh/core 0.3.0 → 0.5.0

package/dist/_shared/tarball.js

@@ -0,0 +1,39 @@
+/**
+ * tarball.ts — a whole tarball, in memory, as a path→bytes map.
+ *
+ * The streaming primitives it walks with (`parseTarHeader`, `streamTarEntries`,
+ * `readableStreamToAsyncIterable`) live in `./tarball-stream.ts` — a
+ * dependency-free leaf, because `bundle-facet-workers.mjs` esbuilds that file
+ * into a string the loader pool injects into dynamic workers, where an import
+ * would not resolve.
+ *
+ * This half is for a caller that already holds the bytes: `gem install`, which
+ * fetches a `.gem` (a tar holding a gzipped tar) and needs both layers open at
+ * once. An installer streaming a tarball it is still downloading should drive
+ * `streamTarEntries` itself and never hold the whole thing.
+ */
+import { streamTarEntries, readableStreamToAsyncIterable, } from './tarball-stream.js';
+/** Extract every regular file. Gzipped input is decompressed first. */
+export async function extractTarball(tarball) {
+    const files = new Map();
+    const raw = new Uint8Array(tarball);
+    // Adapter: wrap the single buffer as an async iterable. If gzipped, pipe
+    // through DecompressionStream so the streaming parser still sees tar bytes.
+    let source;
+    if (raw[0] === 0x1f && raw[1] === 0x8b) {
+        const rs = new Blob([tarball]).stream().pipeThrough(new DecompressionStream('gzip'));
+        source = readableStreamToAsyncIterable(rs);
+    }
+    else {
+        source = (async function* () { yield raw; })();
+    }
+    try {
+        for await (const entry of streamTarEntries(source)) {
+            files.set(entry.name, entry.data);
+        }
+    }
+    catch {
+        return files;
+    }
+    return files;
+}

package/dist/_shared/w7-frame.js

@@ -724,7 +724,8 @@ function updateRecordCheck(seed, ...parts) {
 const CRC_SEED = 0xffff_ffff;
 let crcTable = null;
 function crc32Update(check, bytes) {
-    const table = crcTable ??= createCrcTable();
+    crcTable ??= createCrcTable();
+    const table = crcTable;
     let value = check;
     for (const byte of bytes)
         value = table[(value ^ byte) & 0xff] ^ (value >>> 8);

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,eAAO,MAAM,cAAc,UAAU,CAAC;AA+BtC,eAAO,MAAM,YAAY,aAAa,CAAC;AACvC,eAAO,MAAM,aAAa;;;;CAAyD,CAAC;AACpF,eAAO,MAAM,eAAe,WAAW,CAAC;AAQxC,eAAO,MAAM,aAAa,WAAW,CAAC;AAQtC,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAGzC,eAAO,MAAM,UAAU,QAAS,CAAC;AACjC,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,YAAY,QAA0B,CAAC;AACpD,eAAO,MAAM,iBAAiB,QAAkB,CAAC;AACjD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,oCAAoC,QAAkB,CAAC;AAKpE,eAAO,MAAM,0BAA0B,QAAmB,CAAC;AAyB3D,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAa3D,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAO/C,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAQlD,eAAO,MAAM,yBAAyB,QAA6B,CAAC;AAGpE,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAsBvC,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AACrD,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAiBzD,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAoBzD,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAG3D,eAAO,MAAM,YAAY,+BAA+B,CAAC;AACzD,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,0BAA0B,QAA6B,CAAC;AACrE,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAGxC,eAAO,MAAM,iBAAiB,OAAO,CAAC;AACtC,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAC/C,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAC7C,eAAO,MAAM,oBAAoB,MAAM,CAAC;AASxC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAG3C,eAAO,MAAM,cAAc,eAAe,CAAC;AAkB3C,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAO9D,eAAO,MAAM,4CAA4C,QAAmB,CAAC;AAY7E,eAAO,MAAM,6BAA6B,QAAc,CAAC;AAGzD,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,eAAO,MAAM,YAAY,eAAe,CAAC;AACzC,eAAO,MAAM,YAAY,SAAS,CAAC;AACnC,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,YAAY,2EAA2E,CAAC;AACrG,eAAO,MAAM,oBAAoB,UAAqD,CAAC;AAiBvF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAe,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,eAAO,MAAM,cAAc,UAAU,CAAC;AA+BtC,eAAO,MAAM,YAAY,aAAa,CAAC;AACvC,eAAO,MAAM,aAAa;;;;CAAyD,CAAC;AACpF,eAAO,MAAM,eAAe,WAAW,CAAC;AAQxC,eAAO,MAAM,aAAa,WAAW,CAAC;AAQtC,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAGzC,eAAO,MAAM,UAAU,QAAS,CAAC;AACjC,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,YAAY,QAA0B,CAAC;AACpD,eAAO,MAAM,iBAAiB,QAAkB,CAAC;AACjD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,oCAAoC,QAAkB,CAAC;AAKpE,eAAO,MAAM,0BAA0B,QAAmB,CAAC;AAyB3D,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAa3D,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAO/C,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAQlD,eAAO,MAAM,yBAAyB,QAA6B,CAAC;AAGpE,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAyBvC,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AACrD,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAiBzD,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAoBzD,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAG3D,eAAO,MAAM,YAAY,+BAA+B,CAAC;AACzD,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,0BAA0B,QAA6B,CAAC;AACrE,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAGxC,eAAO,MAAM,iBAAiB,OAAO,CAAC;AACtC,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAC/C,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAC7C,eAAO,MAAM,oBAAoB,MAAM,CAAC;AASxC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAG3C,eAAO,MAAM,cAAc,eAAe,CAAC;AA6B3C,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAO9D,eAAO,MAAM,4CAA4C,QAAmB,CAAC;AAY7E,eAAO,MAAM,6BAA6B,QAAc,CAAC;AAGzD,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,eAAO,MAAM,YAAY,eAAe,CAAC;AACzC,eAAO,MAAM,YAAY,SAAS,CAAC;AACnC,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,YAAY,2EAA2E,CAAC;AACrG,eAAO,MAAM,oBAAoB,UAAqD,CAAC;AAiBvF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAe,CAAC"}

package/dist/constants.js

@@ -132,10 +132,13 @@ export const FACET_TIMEOUT_MS = 30_000; // 30s execution timeout
 // JavaScript, so workerd's per-module text-size limit applies to the
 // JSON-escaped form (each `\n` / `\"` / `\u` adds bytes, plus the
 // per-key string-quote overhead).
-// raw → boots, 8 MiB raw → fails. Encoded as JSON that's roughly 18-25 MiB
-// of module text. We target 22 MiB encoded as the hard ceiling, leaving
-// ~2-3 MiB of headroom for the rest of the worker module (shims, runner
-// boot code) and any minor drift in the eviction loop's accounting.
+// Measured: 8 MiB raw failed to boot; the passing raw bound was measured
+// too, but the number was lost to comment truncation before it ever
+// reached git, so only the failing side is known. Encoded as JSON that's
+// roughly 18-25 MiB of module text. We target 22 MiB encoded as the hard
+// ceiling, leaving ~2-3 MiB of headroom for the rest of the worker module
+// (shims, runner boot code) and any minor drift in the eviction loop's
+// accounting.
 //
 // facet-manager.ts:buildPrefetchBundle uses TextEncoder().encode().length
 // to measure exact UTF-8 bytes (not JS string .length, which counts UTF-16
@@ -207,20 +210,31 @@ export const NIMBUS_AI_GATEWAY_PORT = 8790;
 export const CF_COMPAT_DATE = '2026-04-01';
 // ── Supervisor heap budget [C'.1] ───────────────────────────────────────
 //
-// The supervisor isolate's 128 MiB workerd cap is a HARD platform ceiling
-// (per docs/research/cf-primitives-dossier.md §6 invariant I1 — 128 MiB
-// per V8 isolate, may be shared across same-class peer DOs co-tenanting in
-// one process). Nimbus targets HALF of that as a self-imposed soft ceiling
-// so the supervisor always has runway when workerd LRU-evicts neighbours
-// or AIR (Asynchronous Isolate Recreation) folds growing isolates.
+// Three distinct memory regimes, not one shared pool:
 //
-// 64 MiB is a budget, not a measurement, and nothing enforces it.
+//   - Supervisor DO isolate: 128 MiB HARD platform ceiling ("Each isolate
+//     can consume up to 128 MB of memory" —
+//     https://developers.cloudflare.com/workers/platform/limits/).
+//   - Facets: ~208-256 MiB EACH, measured — memory independent of the
+//     supervisor and of each other (1,664 MiB live across 8 facets +
+//     parent) but CPU SHARED across the actor thread. See
+//     packages/worker/src/loaders/process-fabric.ts.
+//   - Peer DOs: independent memory AND CPU budgets, measured 1.2 GiB
+//     live across 8 peers.
+//
+// Nimbus targets HALF of the supervisor's 128 MiB as a self-imposed soft
+// ceiling so the supervisor always has runway when workerd LRU-evicts
+// neighbours or AIR (Asynchronous Isolate Recreation) folds growing
+// isolates.
+//
+// 64 MiB is a soft admission budget, not a measurement — the right value
+// is unmeasured — and nothing enforces it directly.
 // src/observability/heap-estimate.ts sums the INSTRUMENTED contributors —
-// the supervisor baseline, VFS LRU and in-flight writes, pre-bundle slices,
-// and streaming RPC buffers — which is a lower bound, not full coverage.
-// The prefetch-bundle path in facets/manager.ts allocates against this
-// budget without accounting for it; see HEAP_BLIND_SPOTS for the current
-// gap. Read a low percentOfCeiling accordingly.
+// the supervisor baseline, VFS LRU and in-flight writes, pre-bundle
+// slices, streaming RPC buffers, and the prefetch-bundle build lease and
+// cache gauge — which is a lower bound, not full coverage; allocation
+// sites known to be missing are listed in HEAP_BLIND_SPOTS. Read a low
+// percentOfCeiling accordingly.
 export const SUPERVISOR_HEAP_CEILING_BYTES = 64 * 1024 * 1024;
 // Shared allowance for transient allocations in the supervisor DO. With the
 // VFS LRU shrunk to 8 MiB during an active reservation, 40 MiB of admitted

package/dist/observability/oom-classify.d.ts

@@ -60,7 +60,7 @@
  * the union narrow and additive — adding a new value is fine, but
  * never re-purpose an existing one.
  */
-declare const OOM_CAUSES: readonly ["sqlite_nomem", "oom", "cpu_exceeded", "clone_refused", "rpc_timeout", "subrequest_cap", "condemnation", "hard_evict", "unknown"];
+declare const OOM_CAUSES: readonly ["sqlite_nomem", "oom", "cpu_exceeded", "clone_refused", "rpc_timeout", "subrequest_cap", "dynamic_worker_cap", "condemnation", "hard_evict", "unknown"];
 export type OomCause = typeof OOM_CAUSES[number];
 export declare function isOomCause(input: unknown): input is OomCause;
 /**

package/dist/observability/oom-classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oom-classify.d.ts","sourceRoot":"","sources":["../../src/observability/oom-classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,QAAA,MAAM,UAAU,6IAUN,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAEjD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAItD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAoDrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgBpD"}
+{"version":3,"file":"oom-classify.d.ts","sourceRoot":"","sources":["../../src/observability/oom-classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,QAAA,MAAM,UAAU,mKAWN,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAEjD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAItD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CA0DrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgBpD"}

package/dist/observability/oom-classify.js

@@ -67,6 +67,7 @@ const OOM_CAUSES = [
     'clone_refused',
     'rpc_timeout',
     'subrequest_cap',
+    'dynamic_worker_cap',
     'condemnation',
     'hard_evict',
     'unknown',
@@ -115,6 +116,12 @@ export function classifyMessage(msg) {
     // Subrequest cap (Cloudflare platform)
     if (m.includes('too many subrequests'))
         return 'subrequest_cap';
+    // Worker Loader concurrency cap (Cloudflare platform): a Durable Object
+    // admits ~5-6 concurrent dynamic workers, and loader-cache entries are
+    // never released — every distinct loader.get(id) permanently consumes a
+    // slot, so this cap recurs until the DO itself is replaced.
+    if (m.includes('too many concurrent dynamic workers'))
+        return 'dynamic_worker_cap';
     // Memory exhaustion. workerd trace outcome `exceededMemory`; in-band it
     // arrives as a `broken.exceededMemory` actor break, a "…exceeded [its]
     // memory limit" kill, or the "Memory limit exceeded" RangeError.

package/dist/observability/oom-discriminator.d.ts

@@ -116,7 +116,7 @@ export interface DiagRecoveryEvent {
     toState: SessionState;
     /** Human-readable trigger ('ws-close', 'isolate-evicted', etc.). */
     trigger: string;
-    /** _w9IsolateGen at the time of the event. Lets a probe detect the
+    /** _isolateGen at the time of the event. Lets a probe detect the
      *  difference between an in-isolate transition and a cross-isolate one
      *  (the latter implies workerd recycled the DO). */
     isolateGen: number;

package/dist/runtime/clang-runner.d.ts

@@ -0,0 +1,38 @@
+/**
+ * clang-runner.ts — compile, link, and execute C programs for Nimbus WASI.
+ *
+ * Architecture (compile-link-run, two facet calls):
+ *
+ *   compile  : clang.wasm + sysroot subset for C includes + user .c
+ *              → produces .o bytes (returned to supervisor).
+ *   link     : lld.wasm + sysroot subset for link (crt1.o + libc.a)
+ *              + .o from compile → produces .wasm executable.
+ *   write    : final .wasm flushed to user VFS at the requested path.
+ *
+ * The filesystem both halves see is the one WASI layer every other
+ * non-node runtime uses (wasi-instance.ts), seeded and sealed.
+ *
+ * Splitting compile and link into separate facet calls keeps each
+ * call under the empirical payload ceiling. Each ships:
+ *
+ *   - compile: 31 MiB clang.wasm + ~1.3 MiB sysroot subset (C includes).
+ *   - link   : 19 MiB lld.wasm + ~0.75 MiB libs + tiny .o.
+ *
+ * Sysroot subset extraction happens supervisor-side via a small ustar
+ * parser. The full sysroot.tar is parsed once when the clang runtime
+ * warms for a session; compile/link calls reuse the filtered subsets.
+ *
+ * Dispatch stays direct: no sleeps, no caller-side retries, and no
+ * catch-and-continue around loader failures.
+ */
+import type { RuntimeManifest } from './runtime-manifest.js';
+import type { SqliteVFS } from '../vfs/sqlite-vfs.js';
+import type { Command } from '../substrate/lifo/commands/types.js';
+import type { FacetHost } from './facet-host.js';
+/** Build the runner factory. Closes over the facet host + vfs. */
+export declare function makeClangRunnerFactory(deps: {
+    facets: FacetHost;
+    vfs: SqliteVFS;
+}): (manifest: RuntimeManifest, installRoot: string, binName: string, binKind: string | undefined) => Command;
+export declare const CLANG_RUNNER_PREAMBLE: string;
+//# sourceMappingURL=clang-runner.d.ts.map

package/dist/runtime/clang-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clang-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/clang-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,EAAE,OAAO,EAAkB,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAS,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAQxD,kEAAkE;AAClE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,SAAS,CAAC;CAChB,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAC7F,OAAO,CAiTV;AA8jBD,eAAO,MAAM,qBAAqB,QAAiE,CAAC"}