@nimbus-sh/fabric 0.1.0 → 0.2.0

package/dist/generation.js

@@ -0,0 +1,118 @@
+/**
+ * generation.ts — the isolate-generation clock, and the deferred
+ * reconciliation that runs once per fresh incarnation.
+ *
+ * Workerd hibernates Durable Objects between requests to free memory. On
+ * wake, the new isolate must rebuild its in-memory state from SQL — but it
+ * also needs to know "is this the same lifecycle as before, or did workerd
+ * recycle me?" That distinction matters for recovery (warmJoin vs cold init)
+ * and is captured by the isolate generation, a counter persisted across
+ * hibernations.
+ *
+ * State is keyed weakly off the actor's `ctx`, which lives exactly as long as
+ * the incarnation: a fresh isolate gets a fresh `ctx`, adopts the persisted
+ * counter, and bumps it once. The embedder reads `generation(ctx)` wherever it
+ * needs the incarnation number — one source of truth instead of mirrored host
+ * fields.
+ */
+import { errorText } from '@nimbus-sh/core/_shared/error-text.js';
+/**
+ * Storage key for the isolate-generation counter (cold-start +
+ * post-hibernation wake; one increment per fresh isolate).
+ *
+ * The VALUE is live production DO storage ('w9_isolate_gen') and must never
+ * change — renaming a storage key is a migration, and orphaned rows are the
+ * least of what it breaks.
+ */
+export const GENERATION_KEY = 'w9_isolate_gen';
+const states = new WeakMap();
+function stateOf(ctx) {
+    let state = states.get(ctx);
+    if (!state) {
+        state = { value: 0, adopted: false, coldStart: [], coldStartChain: Promise.resolve() };
+        states.set(ctx, state);
+    }
+    return state;
+}
+/** This incarnation's generation. Zero until {@link adoptGeneration} ran. */
+export function generation(ctx) {
+    return states.get(ctx)?.value ?? 0;
+}
+/** Increment + persist the generation counter once per fresh isolate. */
+export async function adoptGeneration(ctx) {
+    const state = stateOf(ctx);
+    if (state.adopted)
+        return;
+    state.adopted = true;
+    try {
+        const prev = (await ctx.storage.get(GENERATION_KEY));
+        // Adopt the persisted truth first, and adopt the bump only after the
+        // put resolves. An unpersisted `next` would be re-read as `prev` by the
+        // NEXT boot and re-issued — two instances sharing one generation is
+        // exactly the pid-aliasing this counter exists to prevent. Running on
+        // the previous persisted generation is the lesser lapse, and the
+        // put-failure case is replica-only in practice (replicas never spawn).
+        //
+        // What holds the guarantee is the output gate, not this await: measured,
+        // the block body resolves in 0 ms even with a confirmed put, because
+        // `await storage.put()` returns before durability. The gate is what
+        // keeps a pid from generation N from escaping before N is durable, which
+        // is why marking this put `allowUnconfirmed` is not a free speedup — see
+        // scratchpad/coldstart-s1.md.
+        state.value = typeof prev === 'number' ? prev : 0;
+        const next = state.value + 1;
+        await ctx.storage.put(GENERATION_KEY, next);
+        state.value = next;
+    }
+    catch (e) {
+        console.warn('[nimbus/W9] generation bump failed:', errorText(e));
+    }
+}
+/**
+ * Take on a generation without persisting it, and clear the adopted guard so
+ * a later {@link adoptGeneration} re-derives from storage. The
+ * destroy-and-recreate path uses this: it wipes storage, re-persists the
+ * pre-destroy counter, and runs the rest of this incarnation on the successor
+ * generation the next boot will derive.
+ */
+export function assumeGeneration(ctx, value) {
+    const state = stateOf(ctx);
+    state.value = value;
+    state.adopted = false;
+}
+/**
+ * Queue deferred async reconciliation for this incarnation.
+ *
+ * The task runs on the first {@link runColdStart} after registration — a turn
+ * the embedder already owns, NEVER the constructor's init gate. Awaiting
+ * recovery on the gate path is the trap this helper exists to avoid: the gate
+ * blocks every request to the object, and reconciliation wants a filesystem
+ * and a terminal that only a later turn has. The gate is also a wall, not
+ * just a stall: a `blockConcurrencyWhile` callback still pending at ~30 s
+ * (BLOCK_CONCURRENCY_CANCEL_MS, proven by probe) is cancelled and RESETS the
+ * object with every queued event — so never call {@link runColdStart} from
+ * inside one; the pump and the embedder's own turns are the places it runs.
+ */
+export function onColdStart(ctx, task) {
+    stateOf(ctx).coldStart.push(task);
+}
+/**
+ * Drain the queued cold-start tasks, serialized, each awaited so the turn
+ * that runs them pays for them. Idempotent between registrations: a drained
+ * queue is a cheap no-op, and a task registered after a drain runs on the
+ * next call.
+ */
+export function runColdStart(ctx) {
+    const state = stateOf(ctx);
+    if (state.coldStart.length === 0)
+        return state.coldStartChain;
+    const tasks = state.coldStart;
+    state.coldStart = [];
+    const chained = state.coldStartChain.then(async () => {
+        for (const task of tasks) {
+            await task();
+        }
+    });
+    state.coldStartChain = chained.catch(() => { });
+    return chained;
+}

package/dist/{facet-image-store.d.ts → image-store.d.ts}

@@ -1,5 +1,5 @@
 /**
- * facet-image-store.ts — materializing resident-process boot images into the
+ * image-store.ts — materializing resident-process boot images into the
  * content-addressed image store, and sweeping the ones nothing boots from.
  *
  * A resident process's module map is sized by the user's disk, so it does not
@@ -12,11 +12,11 @@
  * table.
  *
  * The filesystem itself stays the embedder's, reached through the
- * {@link FacetImageBlobStore} port — the store decides what is written where
+ * {@link ImageBlobStore} port — the store decides what is written where
  * and when; the port decides how bytes land on a disk and with what modes and
  * credentials.
  */
-import type { LaunchPacer } from './launch-pacer.js';
+import type { TurnBudget } from './turn-budget.js';
 /**
  * Bytes of an image written in one storage transaction.
  *
@@ -34,7 +34,7 @@ export declare const FACET_IMAGE_WRITE_SLICE_BYTES: number;
  * normalization are the implementation's: the store passes the same
  * store-relative paths it later roots and sweeps by.
  */
-export interface FacetImageBlobStore {
+export interface ImageBlobStore {
     /** Create a directory (and its parents) if it does not exist. */
     mkdirp(dir: string): void;
     /** The file's current size in bytes, or null when it does not exist. */
@@ -56,7 +56,7 @@ export interface FacetImageBlobStore {
  * hash's problem; everything else is idempotent — an image already present
  * at its own digest is already the bytes we were about to write.
  */
-export declare class FacetImageStore {
+export declare class ImageStore {
     private readonly blobs;
     private readonly isLive;
     /** pid → the boot images its facet loads from; the image sweep's root set. */
@@ -69,7 +69,7 @@ export declare class FacetImageStore {
      * @param isLive Whether a pid still names a running process. The root set
      *   is the process table, reached through this one predicate.
      */
-    constructor(blobs: () => FacetImageBlobStore, isLive: (pid: number) => boolean);
+    constructor(blobs: () => ImageBlobStore, isLive: (pid: number) => boolean);
     /**
      * The image store's directory, created before the first filesystem view is
      * built rather than on the first image write.
@@ -95,7 +95,7 @@ export declare class FacetImageStore {
      * Writing the sources here, once, is what lets the session stop holding
      * them: after this returns, the only thing it keeps is a path.
      */
-    materialize(pid: number, modules: Record<string, string>, pacer: LaunchPacer): Promise<Record<string, string>>;
+    materialize(pid: number, modules: Record<string, string>, pacer: TurnBudget): Promise<Record<string, string>>;
     /**
      * Drop every image no running process boots from.
      *
@@ -109,4 +109,4 @@ export declare class FacetImageStore {
      */
     private sweep;
 }
-//# sourceMappingURL=facet-image-store.d.ts.map
+//# sourceMappingURL=image-store.d.ts.map

package/dist/image-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-store.d.ts","sourceRoot":"","sources":["../src/image-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,QAA0D,CAAC;AAErG;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,wEAAwE;IACxE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACjD,kDAAkD;IAClD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAClE,2EAA2E;IAC3E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,qDAAqD;IACrD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU;IAanB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAbzB,8EAA8E;IAC9E,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;OAMG;gBAEgB,KAAK,EAAE,MAAM,cAAc,EAC3B,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO;IAGnD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;OAMG;IACG,WAAW,CACf,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAoDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,KAAK;CAgBd"}

package/dist/{facet-image-store.js → image-store.js}

@@ -1,5 +1,5 @@
 /**
- * facet-image-store.ts — materializing resident-process boot images into the
+ * image-store.ts — materializing resident-process boot images into the
  * content-addressed image store, and sweeping the ones nothing boots from.
  *
  * A resident process's module map is sized by the user's disk, so it does not
@@ -12,11 +12,11 @@
  * table.
  *
  * The filesystem itself stays the embedder's, reached through the
- * {@link FacetImageBlobStore} port — the store decides what is written where
+ * {@link ImageBlobStore} port — the store decides what is written where
  * and when; the port decides how bytes land on a disk and with what modes and
  * credentials.
  */
-import { MAX_TX_BLOB_BYTES, CHUNK_SIZE } from '@nimbus-sh/core/constants.js';
+import { MAX_TX_BLOB_BYTES, CHUNK_SIZE } from '@nimbus-sh/platform/limits.js';
 import { FACET_IMAGE_DIR, facetImageDigest, facetImagePath } from './process-fabric.js';
 /**
  * Bytes of an image written in one storage transaction.
@@ -37,7 +37,7 @@ export const FACET_IMAGE_WRITE_SLICE_BYTES = Math.floor(MAX_TX_BLOB_BYTES / CHUN
  * hash's problem; everything else is idempotent — an image already present
  * at its own digest is already the bytes we were about to write.
  */
-export class FacetImageStore {
+export class ImageStore {
     blobs;
     isLive;
     /** pid → the boot images its facet loads from; the image sweep's root set. */

package/dist/index.d.ts

@@ -6,16 +6,24 @@
  * at resolution; non-workerd consumers (tests, tooling) import the subpath
  * modules they need instead.
  */
-export * from './alarms.js';
+export * from './generation.js';
+export * from './timers.js';
+export * from './outbox.js';
+export * from './journal.js';
+export * from './do-calls.js';
+export * from './facet-pool.js';
+export * from './derived.js';
+export * from './connections.js';
+export * from './sealed.js';
 export * from './bindings.js';
-export * from './ctx-exports.js';
-export * from './facet-image-store.js';
-export * from './fanout-pool.js';
+export * from './composition.js';
+export * from './image-store.js';
+export * from './fanout.js';
 export * from './inner-do-registry.js';
-export * from './launch-journal.js';
-export * from './launch-pacer.js';
-export * from './loader-ledger.js';
-export * from './loader-pool.js';
+export * from './fenced-work.js';
+export * from './turn-budget.js';
+export * from './budgets.js';
+export * from './isolate-pool.js';
 export * from './process-fabric.js';
 export * from './process-host.js';
 export * from './workerd-facet-host.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -6,16 +6,24 @@
  * at resolution; non-workerd consumers (tests, tooling) import the subpath
  * modules they need instead.
  */
-export * from './alarms.js';
+export * from './generation.js';
+export * from './timers.js';
+export * from './outbox.js';
+export * from './journal.js';
+export * from './do-calls.js';
+export * from './facet-pool.js';
+export * from './derived.js';
+export * from './connections.js';
+export * from './sealed.js';
 export * from './bindings.js';
-export * from './ctx-exports.js';
-export * from './facet-image-store.js';
-export * from './fanout-pool.js';
+export * from './composition.js';
+export * from './image-store.js';
+export * from './fanout.js';
 export * from './inner-do-registry.js';
-export * from './launch-journal.js';
-export * from './launch-pacer.js';
-export * from './loader-ledger.js';
-export * from './loader-pool.js';
+export * from './fenced-work.js';
+export * from './turn-budget.js';
+export * from './budgets.js';
+export * from './isolate-pool.js';
 export * from './process-fabric.js';
 export * from './process-host.js';
 export * from './workerd-facet-host.js';

package/dist/{loader-pool.d.ts → isolate-pool.d.ts}

@@ -1,5 +1,5 @@
 /**
- * loader-pool.ts — Nimbus loader-isolate pool based on cloudflare-parallel.
+ * isolate-pool.ts — Nimbus loader-isolate pool based on cloudflare-parallel.
  *
  * Adds Nimbus-specific behavior to the upstream pool design:
  *   1. **Stable-slot isolate reuse**. Upstream's #counter++ gives every
@@ -14,7 +14,7 @@
  *      reach https://registry.npmjs.org without a proxy binding).
  *   3. **Supervisor autoinjection**. The pool grabs the embedder's
  *      registered supervisor entrypoint stub (see `supervisorEntrypoint` in
- *      ctx-exports.ts) and forwards it as `env.SUPERVISOR` to every facet,
+ *      composition.ts) and forwards it as `env.SUPERVISOR` to every facet,
  *      same pattern as git-network-facet.ts. Callers can add more bindings
  *      via `extraBindings`.
  *   4. **Fail-loud defaults**: timeout 60s, retries 0, onError 'throw'.
@@ -38,11 +38,11 @@ export type FacetTaskFn<A, R> = {
     task(args: A, env: FacetBindings): R | Promise<R>;
 }['task'];
 /** The one binding a pool needs off whichever env its host hands it. */
-export interface LoaderPoolEnv {
+export interface IsolatePoolEnv {
     LOADER?: WorkerLoader;
 }
-/** Options handed to LoaderPool's constructor. */
-export interface LoaderPoolOptions {
+/** Options handed to IsolatePool's constructor. */
+export interface IsolatePoolOptions {
     /** Maximum concurrent in-flight facets. Default 4. */
     concurrency?: number;
     /** Per-task timeout in ms. Default 60_000. */
@@ -79,8 +79,8 @@ export interface LoaderPoolOptions {
      * Override the `doId` baked into the auto-injected SUPERVISOR binding.
      * Default: `ctx.id.toString()` (the DO that constructs the pool).
      *
-     * Used by FanoutPool's peer-DO branch (peer-DO fanout): peer DOs
-     * construct their per-task LoaderPool from inside
+     * Used by Fanout's peer-DO branch (peer-DO fanout): peer DOs
+     * construct their per-task IsolatePool from inside
      * `_rpcFanoutExecute`, where `ctx` is the PEER DO's ctx. Without this
      * override the peer's auto-injected SUPERVISOR routes back to the
      * peer DO itself — so writes (e.g. install-batch-facet's
@@ -151,7 +151,7 @@ export interface LoaderPoolOptions {
     wasmModules?: Record<string, ArrayBuffer>;
 }
 /** Per-call override (merged with pool defaults). */
-export interface LoaderCallOptions {
+export interface IsolateCallOptions {
     timeoutMs?: number;
     retries?: number;
     /**
@@ -186,7 +186,7 @@ export interface LoaderCallOptions {
     wasmModules?: Record<string, ArrayBuffer>;
 }
 /** Per-map override. Adds onError strategy for partial failures. */
-export interface LoaderMapOptions extends LoaderCallOptions {
+export interface IsolateMapOptions extends IsolateCallOptions {
     /** Concurrency override for this call. Defaults to pool's concurrency. */
     concurrency?: number;
     /**
@@ -216,7 +216,7 @@ export declare function assembleLoaderWorkerModuleSource(options: LoaderWorkerMo
  *
  * Typical use:
  *
- *   const pool = new LoaderPool(env, ctx, {
+ *   const pool = new IsolatePool(env, ctx, {
  *     concurrency: 4,
  *     tag: 'npm-install',
  *   });
@@ -225,10 +225,10 @@ export declare function assembleLoaderWorkerModuleSource(options: LoaderWorkerMo
  *     toFetch,
  *   );
  */
-export declare class LoaderPool {
+export declare class IsolatePool {
     #private;
     private readonly loader;
-    /** The hosting actor, as the loader-ledger's per-DO key. */
+    /** The hosting actor, as the loader budget ledger's per-DO key. */
     private readonly ctx;
     private readonly concurrency;
     private readonly defaultTimeoutMs;
@@ -240,7 +240,7 @@ export declare class LoaderPool {
     private readonly preambleHash;
     /**
      * WASM modules to ship in the LOADER `modules` map. See
-     * LoaderPoolOptions.wasmModules for the rationale. Stored in
+     * IsolatePoolOptions.wasmModules for the rationale. Stored in
      * insertion order so the per-import preamble we generate matches
      * across pool dispatches (cache-key stability).
      */
@@ -262,25 +262,25 @@ export declare class LoaderPool {
      * 12 chars is enough entropy for DO ids to collide-free per process.
      */
     private readonly doIdShort;
-    constructor(env: unknown, ctx: DurableObjectState, opts?: LoaderPoolOptions);
+    constructor(env: unknown, ctx: DurableObjectState, opts?: IsolatePoolOptions);
     /** Effective concurrency used when no per-call override is supplied. */
     get defaultConcurrency(): number;
     /**
      * Run `fn` once with `arg` on a slot isolate. Returns the result or
      * throws TimeoutError / RetryExhaustedError / ExecutionError.
      */
-    submit<T, R>(fn: FacetTaskFn<T, R>, arg: T, opts?: LoaderCallOptions): Promise<Awaited<R>>;
+    submit<T, R>(fn: FacetTaskFn<T, R>, arg: T, opts?: IsolateCallOptions): Promise<Awaited<R>>;
     /**
      * Run `fn` on every item in `items`, at most `concurrency` at a time,
      * pinned to stable slots so warm isolates are reused.
      *
      * Results are returned in input order. Failure handling per `onError`.
      */
-    map<T, R>(fn: FacetTaskFn<T, R>, items: T[], opts?: LoaderMapOptions): Promise<Array<Awaited<R> | null>>;
+    map<T, R>(fn: FacetTaskFn<T, R>, items: T[], opts?: IsolateMapOptions): Promise<Array<Awaited<R> | null>>;
     /**
      * Same shape as `map`, but accepts a pre-serialized function source
      * string instead of a live function reference. Used by
-     * `FanoutPool`'s peer-DO leg, where the function was already
+     * `Fanout`'s peer-DO leg, where the function was already
      * serialized on the coordinator side and forwarded over RPC.
      *
      * The fnSource MUST be the output of `serializeFunction(fn)`
@@ -294,7 +294,7 @@ export declare class LoaderPool {
      * No fn-validation runs here (it already ran on the coordinator);
      * the peer trusts the caller to forward a valid serialization.
      */
-    mapSource<T, R>(fnSource: string, items: T[], opts?: LoaderMapOptions): Promise<Array<Awaited<R> | null>>;
+    mapSource<T, R>(fnSource: string, items: T[], opts?: IsolateMapOptions): Promise<Array<Awaited<R> | null>>;
     /**
      * Release any RPC stubs held by the pool. Call this once the caller
      * is done with the pool (post-`map`/`submit`) so the underlying
@@ -312,4 +312,4 @@ export declare class LoaderPool {
      */
     dispose(): void;
 }
-//# sourceMappingURL=loader-pool.d.ts.map
+//# sourceMappingURL=isolate-pool.d.ts.map

package/dist/isolate-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolate-pool.d.ts","sourceRoot":"","sources":["../src/isolate-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAgBH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACnD,CAAC,MAAM,CAAC,CAAC;AAEV,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAClC;;;;;;;;;;;;;;;;OAgBG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C;AAED,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CACrC;AAkCD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,+BAA+B,GACvC,MAAM,CAyDR;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,WAAW;;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAsC;IAEtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAOzB;IACH;;;;4DAIwD;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGjC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,kBAAkB,EACvB,IAAI,CAAC,EAAE,kBAAkB;IAmG3B,wEAAwE;IACxE,IAAI,kBAAkB,IAAI,MAAM,CAE/B;IA8VD;;;OAGG;IACG,MAAM,CAAC,CAAC,EAAE,CAAC,EACf,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,GAAG,EAAE,CAAC,EACN,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAatB;;;;;OAKG;IACG,GAAG,CAAC,CAAC,EAAE,CAAC,EACZ,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACrB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAOpC;;;;;;;;;;;;;;;;OAgBG;IACG,SAAS,CAAC,CAAC,EAAE,CAAC,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IA+DpC;;;;;;;;;;;;;;OAcG;IACH,OAAO,IAAI,IAAI;CAQhB"}

package/dist/{loader-pool.js → isolate-pool.js}

@@ -1,5 +1,5 @@
 /**
- * loader-pool.ts — Nimbus loader-isolate pool based on cloudflare-parallel.
+ * isolate-pool.ts — Nimbus loader-isolate pool based on cloudflare-parallel.
  *
  * Adds Nimbus-specific behavior to the upstream pool design:
  *   1. **Stable-slot isolate reuse**. Upstream's #counter++ gives every
@@ -14,7 +14,7 @@
  *      reach https://registry.npmjs.org without a proxy binding).
  *   3. **Supervisor autoinjection**. The pool grabs the embedder's
  *      registered supervisor entrypoint stub (see `supervisorEntrypoint` in
- *      ctx-exports.ts) and forwards it as `env.SUPERVISOR` to every facet,
+ *      composition.ts) and forwards it as `env.SUPERVISOR` to every facet,
  *      same pattern as git-network-facet.ts. Callers can add more bindings
  *      via `extraBindings`.
  *   4. **Fail-loud defaults**: timeout 60s, retries 0, onError 'throw'.
@@ -24,13 +24,13 @@
  * and binding types used by this implementation.
  */
 import { CF_COMPAT_DATE } from '@nimbus-sh/core/constants.js';
-import { supervisorEntrypoint } from './ctx-exports.js';
-import { disposeRpcResource } from '@nimbus-sh/core/_shared/rpc-dispose.js';
+import { supervisorEntrypoint } from './composition.js';
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { serializeFunction, hashSource } from './vendor/serialize.js';
-import { beginLoaderFetch, recordLoaderId, withDynamicWorkerCapNamed } from './loader-ledger.js';
-import { assertModuleMapWithinCodeLimit } from './workerd-facet-host.js';
-import { recordFailure, setLastFacetId, getLastRpcFrame } from '@nimbus-sh/core/observability/oom-discriminator.js';
-import { classifyError } from '@nimbus-sh/core/observability/oom-classify.js';
+import { beginLoaderFetch, recordLoaderId, withDynamicWorkerCapNamed } from './budgets.js';
+import { assertModuleMapWithinCodeLimit } from './budgets.js';
+import { recordFailure, setLastFacetId, getLastRpcFrame } from '@nimbus-sh/platform/oom-discriminator.js';
+import { classifyError } from '@nimbus-sh/platform/oom-classify.js';
 import { BindingError, ExecutionError, RetryExhaustedError, TimeoutError, } from './vendor/errors.js';
 /**
  * esbuild runtime helpers re-declared at the top of every generated facet
@@ -95,7 +95,7 @@ export function assembleLoaderWorkerModuleSource(options) {
  *
  * Typical use:
  *
- *   const pool = new LoaderPool(env, ctx, {
+ *   const pool = new IsolatePool(env, ctx, {
  *     concurrency: 4,
  *     tag: 'npm-install',
  *   });
@@ -104,9 +104,9 @@ export function assembleLoaderWorkerModuleSource(options) {
  *     toFetch,
  *   );
  */
-export class LoaderPool {
+export class IsolatePool {
     loader;
-    /** The hosting actor, as the loader-ledger's per-DO key. */
+    /** The hosting actor, as the loader budget ledger's per-DO key. */
     ctx;
     concurrency;
     defaultTimeoutMs;
@@ -118,7 +118,7 @@ export class LoaderPool {
     preambleHash;
     /**
      * WASM modules to ship in the LOADER `modules` map. See
-     * LoaderPoolOptions.wasmModules for the rationale. Stored in
+     * IsolatePoolOptions.wasmModules for the rationale. Stored in
      * insertion order so the per-import preamble we generate matches
      * across pool dispatches (cache-key stability).
      */
@@ -145,7 +145,7 @@ export class LoaderPool {
         // claim is checked on the next line.
         const loader = env?.LOADER;
         if (!loader || typeof loader.get !== 'function') {
-            throw new BindingError('LoaderPool: env.LOADER binding missing or invalid. ' +
+            throw new BindingError('IsolatePool: env.LOADER binding missing or invalid. ' +
                 'Add a [[worker_loaders]] entry to wrangler.jsonc.');
         }
         this.loader = loader;
@@ -174,12 +174,12 @@ export class LoaderPool {
                     // Reached only when a caller broke the declared option type, so the
                     // value is whatever it really was rather than the ArrayBuffer here.
                     const got = bytes?.constructor?.name;
-                    throw new BindingError(`LoaderPool: wasmModules['${name}'] must be ArrayBuffer ` +
+                    throw new BindingError(`IsolatePool: wasmModules['${name}'] must be ArrayBuffer ` +
                         `(got ${got || typeof bytes}).`);
                 }
                 const id = name.replace(/[^A-Za-z0-9_]/g, '_').replace(/^[^A-Za-z_]/, '_');
                 if (seenIds.has(id)) {
-                    throw new BindingError(`LoaderPool: wasmModules key '${name}' collides with another after ` +
+                    throw new BindingError(`IsolatePool: wasmModules key '${name}' collides with another after ` +
                         `identifier-sanitisation (id='${id}'). Pick distinct module names.`);
                 }
                 seenIds.add(id);
@@ -259,17 +259,17 @@ export class LoaderPool {
         for (const [name, bytes] of Object.entries(perCall)) {
             if (!(bytes instanceof ArrayBuffer)) {
                 const got = bytes?.constructor?.name;
-                throw new BindingError(`LoaderPool: per-call wasmModules['${name}'] must be ` +
+                throw new BindingError(`IsolatePool: per-call wasmModules['${name}'] must be ` +
                     `ArrayBuffer (got ${got || typeof bytes}).`);
             }
             const id = name.replace(/[^A-Za-z0-9_]/g, '_').replace(/^[^A-Za-z_]/, '_');
             if (ctorIds.has(id)) {
-                throw new BindingError(`LoaderPool: per-call wasmModules key '${name}' (sanitised ` +
+                throw new BindingError(`IsolatePool: per-call wasmModules key '${name}' (sanitised ` +
                     `id='${id}') collides with a constructor-time wasm module. ` +
                     `Per-call modules cannot shadow pool-defaults. Pick a distinct name.`);
             }
             if (seen.has(id)) {
-                throw new BindingError(`LoaderPool: per-call wasmModules key '${name}' (sanitised ` +
+                throw new BindingError(`IsolatePool: per-call wasmModules key '${name}' (sanitised ` +
                     `id='${id}') collides with another per-call key. Pick distinct names.`);
             }
             seen.add(id);
@@ -352,7 +352,7 @@ export class LoaderPool {
         // re-import (the user fn is serialized via fn.toString and doesn't
         // carry import statements).
         //
-        // Per-call entries (passed via LoaderCallOptions.wasmModules
+        // Per-call entries (passed via IsolateCallOptions.wasmModules
         // — used by the wasm-runner shell command) are appended to the same
         // table. Naming collision with constructor entries is rejected
         // upstream in #materialisePerCallWasm so the import block here
@@ -584,7 +584,7 @@ export class LoaderPool {
     /**
      * Same shape as `map`, but accepts a pre-serialized function source
      * string instead of a live function reference. Used by
-     * `FanoutPool`'s peer-DO leg, where the function was already
+     * `Fanout`'s peer-DO leg, where the function was already
      * serialized on the coordinator side and forwarded over RPC.
      *
      * The fnSource MUST be the output of `serializeFunction(fn)`