@nimbus-sh/fabric 0.1.0 → 0.3.0

package/dist/alarms.d.ts

@@ -1,134 +0,0 @@
-/**
- * alarms.ts — Durable Object alarm multiplexing + isolate-generation
- * machinery, persisted across hibernation.
- *
- * Workerd hibernates Durable Objects between requests to free memory. On
- * wake, the new isolate must rebuild its in-memory state from SQL — but it
- * also needs to know "is this the same lifecycle as before, or did workerd
- * recycle me?" That distinction matters for recovery (warmJoin vs cold init)
- * and is captured by the isolate generation, a counter persisted across
- * hibernations.
- *
- * A Durable Object has ONE alarm, and a second `setAlarm()` silently
- * overwrites the first — so every alarm-driven subsystem coordinates through
- * a single reason→deadline map and one dispatcher. Reasons are plain strings
- * registered by the embedder: `scheduleAlarm` arms one, and `dispatchAlarm`
- * runs the embedder-supplied handler for every reason whose deadline has
- * passed.
- */
-/**
- * The storage the alarm map lives in. `setAlarm` is optional because
- * `wrangler dev` serves a storage without it, which is the whole reason
- * scheduling degrades to a no-op instead of throwing.
- */
-export interface AlarmStorage {
-    get(key: string): Promise<unknown>;
-    put(key: string, value: unknown): Promise<void>;
-    delete(key: string): Promise<boolean>;
-    setAlarm?(scheduledTime: number): Promise<void>;
-}
-/** The hosting actor's context, as the alarm coordination reads it. */
-export interface AlarmContext {
-    storage: AlarmStorage;
-}
-/**
- * Multi-reason alarm coordination map.
- *
- * JSON-serialised `Record<reason, deadlineMsEpoch>` where keys are the
- * embedder's canonical reason strings (e.g. 'w9-flush', 'log-janitor'). The
- * alarm() dispatcher reads this on fire, dispatches every reason whose
- * deadline has passed, and re-arms `ctx.storage.setAlarm` at the earliest
- * remaining deadline.
- *
- * Why a map (not a single nextAlarmAt + reason): two subsystems can have
- * distinct deadlines. Without the map, the later setAlarm() call would
- * overwrite the earlier reason silently, breaking whichever subsystem
- * expected its deadline.
- *
- * Forward-compat: the dispatcher silently drops unknown reasons so a
- * rollback from a future deploy that added new reasons doesn't leave the
- * alarm stuck.
- *
- * The VALUE is live production DO storage ('w1_next_alarm_reasons', from the
- * workstream that introduced it) and must never change — renaming a storage
- * key is a migration, and orphaned rows are the least of what it breaks.
- */
-export declare const ALARM_REASONS_KEY = "w1_next_alarm_reasons";
-/**
- * Storage key for the isolate-generation counter (cold-start +
- * post-hibernation wake; one increment per fresh isolate).
- *
- * The VALUE is live production DO storage ('w9_isolate_gen') and must never
- * change, same contract as {@link ALARM_REASONS_KEY}.
- */
-export declare const ISOLATE_GEN_KEY = "w9_isolate_gen";
-/**
- * The host instance carrying the per-instance alarm chain. The field lives on
- * the embedder's DO instance so one chain serializes every alarm-map
- * read-modify-write for that instance (see {@link scheduleAlarm}).
- */
-export interface AlarmHost {
-    _alarmChain?: Promise<unknown>;
-}
-/** The host instance carrying the isolate-generation state. */
-export interface IsolateGenHost {
-    _isolateGen: number;
-    _isolateGenPersisted: boolean;
-}
-/**
- * Schedule (or re-schedule) an alarm reason. Coordinated via a single map in
- * DO storage so multiple subsystems don't clobber each other's `setAlarm()`
- * calls.
- *
- * Semantics:
- *   - Reads the existing reasons map.
- *   - Sets `map[reason] = whenMs` IF `whenMs` is sooner than the
- *     currently-pending deadline for that reason (or no entry exists).
- *     Later-than-pending requests are silently ignored — the existing
- *     alarm will fire and re-arm anyway.
- *   - Writes the map back and calls `ctx.storage.setAlarm(min(deadlines))`.
- *
- * Cost: 1 storage read + 1 storage write + 1 setAlarm per call. setAlarm
- * itself is billed as 1 row written per DO pricing. At a 60s janitor
- * cadence, this is ~$0.05/mo/session at scale — dwarfed by the
- * hibernation duration savings.
- *
- * Fail-soft: any throw is swallowed with a warn. On older runtimes /
- * wrangler-dev where setAlarm is unavailable, this is a no-op (the
- * subsystem's in-isolate setTimeout fallback continues to work).
- */
-export declare function scheduleAlarm(host: AlarmHost, ctx: AlarmContext, reason: string, whenMs: number): Promise<boolean>;
-/**
- * What one alarm handler may return: nothing, or a deadline this reason
- * re-arms itself at. Re-arming through the return value keeps the map's
- * read-modify-write inside the dispatcher, where it is serialized.
- */
-export type AlarmHandlerResult = void | {
-    rearmAt: number;
-};
-/** The embedder's reasons, each with the handler that answers it. */
-export type AlarmHandlers = Record<string, (now: number) => AlarmHandlerResult | Promise<AlarmHandlerResult>>;
-/**
- * Multi-reason alarm dispatcher. Called from the DO's `alarm()` handler with
- * the embedder's handler map.
- *
- * For each pending reason whose deadline has passed, run its handler.
- * Handlers are awaited in place: the alarm invocation is the fresh turn a
- * re-entering subsystem asked for, and it has to stay the one paying for the
- * work it just released.
- *
- * After running fireable reasons, re-arms `ctx.storage.setAlarm` at the
- * earliest remaining deadline. If no reasons remain, deletes the map key and
- * does NOT call setAlarm — the DO becomes hibernation-eligible after the 10s
- * idle window.
- *
- * Forward/back-compat: unknown reasons silently dropped. `onLegacyAlarm`
- * covers an alarm that fires with no map at all — a deploy from before the
- * map existed left a bare `setAlarm` behind, and the embedder decides what
- * that one-time fire means (one dispatch later the map is populated by the
- * next scheduleAlarm call).
- */
-export declare function dispatchAlarm(host: AlarmHost, ctx: AlarmContext, handlers: AlarmHandlers, onLegacyAlarm?: () => void): Promise<void>;
-/** Increment + persist the isolate-gen counter once per fresh isolate. */
-export declare function maybeBumpIsolateGen(host: IsolateGenHost, ctx: AlarmContext): Promise<void>;
-//# sourceMappingURL=alarms.d.ts.map

package/dist/alarms.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"alarms.d.ts","sourceRoot":"","sources":["../src/alarms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,QAAQ,CAAC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAChC;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CA8BlB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,MAAM,CAChC,MAAM,EACN,CAAC,GAAG,EAAE,MAAM,KAAK,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,aAAa,EACvB,aAAa,CAAC,EAAE,MAAM,IAAI,GACzB,OAAO,CAAC,IAAI,CAAC,CASf;AAwDD,0EAA0E;AAC1E,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhG"}

package/dist/alarms.js

@@ -1,214 +0,0 @@
-/**
- * alarms.ts — Durable Object alarm multiplexing + isolate-generation
- * machinery, persisted across hibernation.
- *
- * Workerd hibernates Durable Objects between requests to free memory. On
- * wake, the new isolate must rebuild its in-memory state from SQL — but it
- * also needs to know "is this the same lifecycle as before, or did workerd
- * recycle me?" That distinction matters for recovery (warmJoin vs cold init)
- * and is captured by the isolate generation, a counter persisted across
- * hibernations.
- *
- * A Durable Object has ONE alarm, and a second `setAlarm()` silently
- * overwrites the first — so every alarm-driven subsystem coordinates through
- * a single reason→deadline map and one dispatcher. Reasons are plain strings
- * registered by the embedder: `scheduleAlarm` arms one, and `dispatchAlarm`
- * runs the embedder-supplied handler for every reason whose deadline has
- * passed.
- */
-import { errorText } from '@nimbus-sh/core/_shared/error-text.js';
-/**
- * Multi-reason alarm coordination map.
- *
- * JSON-serialised `Record<reason, deadlineMsEpoch>` where keys are the
- * embedder's canonical reason strings (e.g. 'w9-flush', 'log-janitor'). The
- * alarm() dispatcher reads this on fire, dispatches every reason whose
- * deadline has passed, and re-arms `ctx.storage.setAlarm` at the earliest
- * remaining deadline.
- *
- * Why a map (not a single nextAlarmAt + reason): two subsystems can have
- * distinct deadlines. Without the map, the later setAlarm() call would
- * overwrite the earlier reason silently, breaking whichever subsystem
- * expected its deadline.
- *
- * Forward-compat: the dispatcher silently drops unknown reasons so a
- * rollback from a future deploy that added new reasons doesn't leave the
- * alarm stuck.
- *
- * The VALUE is live production DO storage ('w1_next_alarm_reasons', from the
- * workstream that introduced it) and must never change — renaming a storage
- * key is a migration, and orphaned rows are the least of what it breaks.
- */
-export const ALARM_REASONS_KEY = 'w1_next_alarm_reasons';
-/**
- * Storage key for the isolate-generation counter (cold-start +
- * post-hibernation wake; one increment per fresh isolate).
- *
- * The VALUE is live production DO storage ('w9_isolate_gen') and must never
- * change, same contract as {@link ALARM_REASONS_KEY}.
- */
-export const ISOLATE_GEN_KEY = 'w9_isolate_gen';
-/**
- * Schedule (or re-schedule) an alarm reason. Coordinated via a single map in
- * DO storage so multiple subsystems don't clobber each other's `setAlarm()`
- * calls.
- *
- * Semantics:
- *   - Reads the existing reasons map.
- *   - Sets `map[reason] = whenMs` IF `whenMs` is sooner than the
- *     currently-pending deadline for that reason (or no entry exists).
- *     Later-than-pending requests are silently ignored — the existing
- *     alarm will fire and re-arm anyway.
- *   - Writes the map back and calls `ctx.storage.setAlarm(min(deadlines))`.
- *
- * Cost: 1 storage read + 1 storage write + 1 setAlarm per call. setAlarm
- * itself is billed as 1 row written per DO pricing. At a 60s janitor
- * cadence, this is ~$0.05/mo/session at scale — dwarfed by the
- * hibernation duration savings.
- *
- * Fail-soft: any throw is swallowed with a warn. On older runtimes /
- * wrangler-dev where setAlarm is unavailable, this is a no-op (the
- * subsystem's in-isolate setTimeout fallback continues to work).
- */
-export function scheduleAlarm(host, ctx, reason, whenMs) {
-    // Serialize every read-modify-write of the reasons map through one
-    // per-instance chain: two schedulers firing back-to-back from one activity
-    // hook would otherwise interleave their get→put cycles and silently drop
-    // whichever reason wrote first.
-    const run = async () => {
-        try {
-            const setAlarmFn = ctx?.storage?.setAlarm;
-            if (typeof setAlarmFn !== 'function')
-                return false;
-            const existing = (await ctx.storage.get(ALARM_REASONS_KEY));
-            const map = { ...(existing || {}) };
-            // Earliest-deadline-first: only update if new request is sooner or
-            // this reason has no pending entry.
-            if (!(reason in map) || whenMs < map[reason]) {
-                map[reason] = whenMs;
-                await ctx.storage.put(ALARM_REASONS_KEY, map);
-            }
-            const earliest = Math.min(...Object.values(map));
-            setAlarmFn.call(ctx.storage, earliest);
-            return true;
-        }
-        catch (e) {
-            console.warn('[nimbus/W1] scheduleAlarm threw:', errorText(e));
-            return false;
-        }
-    };
-    const chained = (host._alarmChain ?? Promise.resolve()).then(run, run);
-    host._alarmChain = chained;
-    return chained;
-}
-/**
- * Multi-reason alarm dispatcher. Called from the DO's `alarm()` handler with
- * the embedder's handler map.
- *
- * For each pending reason whose deadline has passed, run its handler.
- * Handlers are awaited in place: the alarm invocation is the fresh turn a
- * re-entering subsystem asked for, and it has to stay the one paying for the
- * work it just released.
- *
- * After running fireable reasons, re-arms `ctx.storage.setAlarm` at the
- * earliest remaining deadline. If no reasons remain, deletes the map key and
- * does NOT call setAlarm — the DO becomes hibernation-eligible after the 10s
- * idle window.
- *
- * Forward/back-compat: unknown reasons silently dropped. `onLegacyAlarm`
- * covers an alarm that fires with no map at all — a deploy from before the
- * map existed left a bare `setAlarm` behind, and the embedder decides what
- * that one-time fire means (one dispatch later the map is populated by the
- * next scheduleAlarm call).
- */
-export function dispatchAlarm(host, ctx, handlers, onLegacyAlarm) {
-    // Same serialization as scheduleAlarm: the dispatcher's read→handlers→write
-    // cycle must not interleave with an activity-hook scheduleAlarm.
-    const chained = (host._alarmChain ?? Promise.resolve()).then(() => dispatchAlarmBody(ctx, handlers, onLegacyAlarm), () => dispatchAlarmBody(ctx, handlers, onLegacyAlarm));
-    host._alarmChain = chained;
-    return chained;
-}
-async function dispatchAlarmBody(ctx, handlers, onLegacyAlarm) {
-    try {
-        const now = Date.now();
-        const existing = (await ctx?.storage?.get?.(ALARM_REASONS_KEY));
-        if (!existing || Object.keys(existing).length === 0) {
-            onLegacyAlarm?.();
-            return;
-        }
-        const map = { ...existing };
-        // Snapshot fireable reasons BEFORE running any of them, so a
-        // handler that schedules itself for the next cycle doesn't get
-        // immediately re-fired in the same dispatch.
-        const fired = [];
-        for (const [reason, when] of Object.entries(map)) {
-            if (when <= now)
-                fired.push(reason);
-        }
-        for (const reason of fired) {
-            delete map[reason];
-            const handler = handlers[reason];
-            // Unknown reasons silently dropped (forward-compat).
-            if (!handler)
-                continue;
-            try {
-                const result = await handler(now);
-                if (result && typeof result.rearmAt === 'number') {
-                    map[reason] = result.rearmAt;
-                }
-            }
-            catch (e) {
-                console.warn(`[nimbus/W1] dispatch ${reason} threw:`, errorText(e));
-            }
-        }
-        // Re-arm or clear.
-        const setAlarmFn = ctx?.storage?.setAlarm;
-        if (Object.keys(map).length > 0) {
-            await ctx.storage.put(ALARM_REASONS_KEY, map);
-            const earliest = Math.min(...Object.values(map));
-            if (typeof setAlarmFn === 'function') {
-                setAlarmFn.call(ctx.storage, earliest);
-            }
-        }
-        else {
-            try {
-                await ctx.storage.delete(ALARM_REASONS_KEY);
-            }
-            catch { }
-            // No remaining reasons → no setAlarm call → DO becomes
-            // hibernation-eligible after the 10s idle window.
-        }
-    }
-    catch (e) {
-        console.warn('[nimbus/W1] dispatchAlarm threw:', errorText(e));
-    }
-}
-/** Increment + persist the isolate-gen counter once per fresh isolate. */
-export async function maybeBumpIsolateGen(host, ctx) {
-    if (host._isolateGenPersisted)
-        return;
-    host._isolateGenPersisted = true;
-    try {
-        const prev = (await ctx.storage.get(ISOLATE_GEN_KEY));
-        // Adopt the persisted truth first, and adopt the bump only after the
-        // put resolves. An unpersisted `next` would be re-read as `prev` by the
-        // NEXT boot and re-issued — two instances sharing one generation is
-        // exactly the pid-aliasing this counter exists to prevent. Running on
-        // the previous persisted generation is the lesser lapse, and the
-        // put-failure case is replica-only in practice (replicas never spawn).
-        //
-        // What holds the guarantee is the output gate, not this await: measured,
-        // the block body resolves in 0 ms even with a confirmed put, because
-        // `await storage.put()` returns before durability. The gate is what
-        // keeps a pid from generation N from escaping before N is durable, which
-        // is why marking this put `allowUnconfirmed` is not a free speedup — see
-        // scratchpad/coldstart-s1.md.
-        host._isolateGen = typeof prev === 'number' ? prev : 0;
-        const next = host._isolateGen + 1;
-        await ctx.storage.put(ISOLATE_GEN_KEY, next);
-        host._isolateGen = next;
-    }
-    catch (e) {
-        console.warn('[nimbus/W9] isolate-gen bump failed:', errorText(e));
-    }
-}

package/dist/ctx-exports.d.ts

@@ -1,47 +0,0 @@
-/**
- * ctx-exports.ts — leaf module holding the ctx.exports reference.
- *
- * Isolated from the embedder's entry module so helpers (notably
- * loader-pool.ts) can read `ctx.exports` without transitively importing the
- * Durable Object classes. Keeping this a leaf (no imports) lets the pool be
- * unit-tested in a plain Node/Bun process.
- *
- * The embedder's fetch handler calls `setCtxExports(ctx.exports)` on the
- * first request; callers like the loader pool read via `getCtxExports()`.
- * If the pool is constructed before the first fetch (unlikely) it just gets
- * null — the caller decides how to degrade.
- */
-/**
- * One entry of `ctx.exports`: a top-level entrypoint's loopback factory, which
- * mints a Service Binding stub for that entrypoint when called with props.
- *
- * The stub's RPC surface belongs to the entrypoint CLASS, which this leaf
- * cannot see — `Cloudflare.Exports` is derived from the embedder's own main
- * module, so for a library it evaluates to `{}`. A caller that knows the class
- * names the surface it expects (`factory<MySupervisorRpc>({ props })`); one
- * that does not gets `unknown` and has to narrow, same as
- * `DurableObjectNamespace<T>` and `RpcStub<T>` in @cloudflare/workers-types.
- */
-export type EntrypointLoopbackFactory = <Stub = unknown>(options: {
-    props: object;
-}) => Stub;
-/**
- * `ctx.exports` itself — one factory per top-level entrypoint export, keyed by
- * export name. Absent names read as undefined, which is how a caller finds out
- * the embedder's entry module does not re-export the class it needs.
- */
-export type CtxExports = Record<string, EntrypointLoopbackFactory | undefined>;
-export declare function setCtxExports(value: CtxExports): void;
-export declare function getCtxExports(): CtxExports | null;
-export declare function setSupervisorEntrypointName(name: string): void;
-/**
- * Resolve the registered supervisor entrypoint on an exports object —
- * `exportsObj` when given (a WorkerEntrypoint reads its own ctx.exports),
- * the held ctx.exports otherwise. Calling the result with props mints one
- * supervisor binding (`env.SUPERVISOR`) for one hosted program. Null when
- * either half is missing; the caller decides whether that degrades or throws.
- */
-export declare function supervisorEntrypoint(exportsObj?: unknown): EntrypointLoopbackFactory | null;
-/** The registered name, for error messages that point at the missing export. */
-export declare function supervisorEntrypointName(): string | null;
-//# sourceMappingURL=ctx-exports.d.ts.map

package/dist/ctx-exports.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ctx-exports.d.ts","sourceRoot":"","sources":["../src/ctx-exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAE7F;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC;AAI/E,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAGrD;AAED,wBAAgB,aAAa,IAAI,UAAU,GAAG,IAAI,CAEjD;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG9D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,yBAAyB,GAAG,IAAI,CAM3F;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAExD"}

package/dist/ctx-exports.js

@@ -1,54 +0,0 @@
-/**
- * ctx-exports.ts — leaf module holding the ctx.exports reference.
- *
- * Isolated from the embedder's entry module so helpers (notably
- * loader-pool.ts) can read `ctx.exports` without transitively importing the
- * Durable Object classes. Keeping this a leaf (no imports) lets the pool be
- * unit-tested in a plain Node/Bun process.
- *
- * The embedder's fetch handler calls `setCtxExports(ctx.exports)` on the
- * first request; callers like the loader pool read via `getCtxExports()`.
- * If the pool is constructed before the first fetch (unlikely) it just gets
- * null — the caller decides how to degrade.
- */
-let _ctxExports = null;
-export function setCtxExports(value) {
-    if (_ctxExports)
-        return; // first-write-wins, same as the prior inline impl
-    _ctxExports = value;
-}
-export function getCtxExports() {
-    return _ctxExports;
-}
-/**
- * The fabric mints supervisor bindings for the programs it hosts, but the
- * entrypoint class that answers them belongs to the embedder, so its
- * ctx.exports name is registered once at composition time rather than
- * hardcoded here. First-write-wins, same as the ctx.exports holder above.
- */
-let _supervisorEntrypointName = null;
-export function setSupervisorEntrypointName(name) {
-    if (_supervisorEntrypointName)
-        return;
-    _supervisorEntrypointName = name;
-}
-/**
- * Resolve the registered supervisor entrypoint on an exports object —
- * `exportsObj` when given (a WorkerEntrypoint reads its own ctx.exports),
- * the held ctx.exports otherwise. Calling the result with props mints one
- * supervisor binding (`env.SUPERVISOR`) for one hosted program. Null when
- * either half is missing; the caller decides whether that degrades or throws.
- */
-export function supervisorEntrypoint(exportsObj) {
-    const exports = exportsObj ?? _ctxExports;
-    if (!_supervisorEntrypointName)
-        return null;
-    if ((typeof exports !== 'object' && typeof exports !== 'function') || exports === null)
-        return null;
-    const factory = exports[_supervisorEntrypointName];
-    return typeof factory === 'function' ? factory : null;
-}
-/** The registered name, for error messages that point at the missing export. */
-export function supervisorEntrypointName() {
-    return _supervisorEntrypointName;
-}

package/dist/facet-image-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"facet-image-store.d.ts","sourceRoot":"","sources":["../src/facet-image-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,QAA0D,CAAC;AAErG;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,wEAAwE;IACxE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACjD,kDAAkD;IAClD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAClE,2EAA2E;IAC3E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,qDAAqD;IACrD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,eAAe;IAaxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAbzB,8EAA8E;IAC9E,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;OAMG;gBAEgB,KAAK,EAAE,MAAM,mBAAmB,EAChC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO;IAGnD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;OAMG;IACG,WAAW,CACf,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAoDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,KAAK;CAgBd"}

package/dist/fanout-pool.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fanout-pool.d.ts","sourceRoot":"","sources":["../src/fanout-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;GAGG;AACH,UAAU,oBAAoB;IAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC;CACnC;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC;;;GAGG;AACH,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,qBAAqB,UAAmB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,UAAqB,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,uCAAuC;AACvC,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,IAAI,EAAE,CAAC,CAAC;CACT;AAED,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA4BD;;;;;;;;GAQG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB;IAoB7E;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CAAC,CAAC,EAAE,CAAC,EACnB,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,EACtB,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,EAAE,CAAC;IASf,mEAAmE;IACnE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO;IAK7D;;;;;;OAMG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;YAOvC,aAAa;YAoCb,eAAe;CA2J9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAUrE"}

package/dist/launch-journal.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"launch-journal.d.ts","sourceRoot":"","sources":["../src/launch-journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAE7D,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB;;4DAEwD;IACxD,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,oBAAoB;IAC/D;;;;;;OAMG;IACH,cAAc,IAAI,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,mDAAmD;IACnD,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAC9B,kCAAkC;IAClC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB,CAAC,CAAC,SAAS,oBAAoB;IAW7D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXvB;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAAqB;IAC3C,gFAAgF;IAChF,OAAO,CAAC,SAAS,CAAS;gBAGP,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAG7C;;;;;;;;;;;;;;OAcG;IACG,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,8DAA8D;IAC9D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB;;;;OAIG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC;;;;;;;;;;;OAWG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;CA6B1C"}

package/dist/launch-journal.js

@@ -1,154 +0,0 @@
-/**
- * launch-journal.ts — durable record of the resident launches a Durable Object
- * owes, and their recovery after an instance reset.
- *
- * The platform resets a session Durable Object over what one turn has
- * outstanding in storage ("Internal error in Durable Object storage caused
- * object to be reset"), and a resident launch is the largest writer a session
- * has. Everything a launch holds is in memory, so the process it is building
- * and the terminal watching it both go with the instance — the journal is what
- * a LATER instance reads to know that happened, and this module is the whole
- * of that mechanism: the put→sync durability barrier on the way in, the
- * delete→sync release on the way out, and the once-per-instance recovery pump
- * that re-drives what a previous generation left behind.
- *
- * What a launch IS stays the embedder's: the journal stores the record it is
- * given and hands it back on recovery. The mechanism reads only the fields in
- * {@link ResidentLaunchRecord}; everything else in the record rides through
- * opaquely.
- */
-/**
- * Prefix for the resident-process journal: one row per resident this session
- * owes the user, keyed by the pid it was built for.
- *
- * A resident holds its state in memory — the process table entry, the facet
- * handle, the terminal — so an instance reset destroys it silently. The row
- * is what a LATER instance reads to know a resident ended that way rather
- * than on purpose: a pid at or below the reader's own pid base was allocated
- * by a previous generation (PID_GEN_STRIDE, core's process-table). Written
- * (and synced) before the launch's first byte of work, rewritten as `running`
- * when the launch settles, and released only when the PROCESS ends — because
- * the resets this row survives strike after the launch as often as during it
- * (measured live, staging 2026-08-13: every observed reset landed seconds
- * AFTER settle).
- *
- * The VALUE is live production DO storage and must never change — renaming a
- * storage key is a migration, and orphaned rows are the least of what it
- * breaks.
- */
-export const RESIDENT_LAUNCH_KEY_PREFIX = 'resident-launch:';
-/** A launch is re-driven once. A reset that recurs is not the transient one. */
-export const RESIDENT_LAUNCH_MAX_ATTEMPT = 1;
-/**
- * The resident-launch journal of one Durable Object instance.
- *
- * In-memory state here is per-instance on purpose: `journalledPids` tracks the
- * rows THIS instance wrote, and `recovered` whether this instance has already
- * read the journal a reset leaves behind. Rows from a previous instance are
- * recovery's to consume, never the release path's.
- */
-export class ResidentLaunchJournal {
-    storage;
-    host;
-    /**
-     * Pids THIS instance holds journal rows for. What keeps the terminal hook —
-     * which fires for every process, shells and one-shots included — from
-     * paying a storage delete for pids that never had a row.
-     */
-    journalledPids = new Set();
-    /** Whether this instance has already read the journal a reset leaves behind. */
-    recovered = false;
-    constructor(storage, host) {
-        this.storage = storage;
-        this.host = host;
-    }
-    /**
-     * Record a launch as in flight, so an instance that replaces this one knows
-     * it never finished. Best-effort: a launch that cannot be journalled still
-     * runs, and a reset then costs exactly what it cost before the journal.
-     *
-     * Synced, not merely put: `await put()` resolves before durability, and the
-     * reset this journal exists for destroys every write its turn still had
-     * outstanding — measured live, a launch killed in its first chunks left NO
-     * row for the replacement instance to find, which is how the recovery this
-     * feeds sat inert while its own test stayed green. `sync()` is the storage
-     * layer's durability barrier: the row is on disk before the launch performs
-     * its first byte of real work. What remains is a reset between the put and
-     * the sync's completion — and a launch that dies there has not started, so
-     * losing its row costs a retype, not a recovery.
-     */
-    async journal(record) {
-        try {
-            this.journalledPids.add(record.pid);
-            await this.storage.put(`${RESIDENT_LAUNCH_KEY_PREFIX}${record.pid}`, record);
-            await this.storage.sync();
-        }
-        catch (e) {
-            console.warn('[nimbus] resident launch journal write failed:', errorMessage(e));
-        }
-    }
-    /** True while this instance holds a journal row for `pid`. */
-    has(pid) {
-        return this.journalledPids.has(pid);
-    }
-    /**
-     * The journal row's one release: the process is over, nothing is owed.
-     * Synced so an instance reset moments later cannot roll the delete back and
-     * resurrect a process the user watched end.
-     */
-    async release(pid) {
-        if (!this.journalledPids.delete(pid))
-            return;
-        try {
-            await this.storage.delete(`${RESIDENT_LAUNCH_KEY_PREFIX}${pid}`);
-            await this.storage.sync();
-        }
-        catch (e) {
-            console.warn('[nimbus] resident launch journal delete failed:', errorMessage(e));
-        }
-    }
-    /**
-     * Re-drive the launches a previous instance was building when it was reset.
-     *
-     * Sited on the launch-turn pump because the pump is what an alarm calls, and
-     * a launch that was suspended has an alarm armed for it — a reset during a
-     * chunk fails that alarm, and the platform re-delivers it to the instance
-     * that replaces this one. So the first turn after a reset is already this
-     * one.
-     *
-     * Runs once per instance: the journal only changes when a launch of THIS
-     * instance starts or settles, and those are rows this instance wrote.
-     */
-    async recoverInterrupted() {
-        if (this.recovered)
-            return;
-        this.recovered = true;
-        const journal = await this.storage.list({ prefix: RESIDENT_LAUNCH_KEY_PREFIX });
-        const base = this.host.generationBase();
-        for (const [key, record] of journal) {
-            // A pid at or below this instance's base was allocated by a PREVIOUS one
-            // (process-table.ts, PID_GEN_STRIDE), so its launch never finished; above
-            // the base is this instance's own, still running. Same predicate as
-            // `session/rpc.ts` uses to attribute a prior generation's pid.
-            if (!(record.pid > 0 && record.pid <= base))
-                continue;
-            await this.storage.delete(key);
-            if (record.attempt >= RESIDENT_LAUNCH_MAX_ATTEMPT) {
-                this.host.onAbandoned?.(record);
-                continue;
-            }
-            this.host.onRedrive?.(record);
-            // Not awaited: this call is running inside the alarm that granted the
-            // turn, and the launch it starts asks for turns of its own through that
-            // same alarm — awaiting it here would be waiting on an alarm that cannot
-            // be scheduled until this one returns.
-            this.host.waitUntil(this.host.redrive(record, record.attempt + 1)
-                .catch((e) => {
-                this.host.onRedriveFailed?.(record, e);
-            }));
-        }
-    }
-}
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/launch-pacer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"launch-pacer.d.ts","sourceRoot":"","sources":["../src/launch-pacer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,qEAAqE;AACrE,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD;;;;;;;;;GASG;AACH,qBAAa,WAAW;IAkBpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAnB/B,qEAAqE;IACrE,MAAM,SAAK;IACX,iDAAiD;IACjD,KAAK,SAAK;IAEV,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,UAAU,CAA8D;IAEhF;;;;;;;OAOG;gBAEgB,SAAS,EAAE,mBAAmB,EAC9B,aAAa,GAAE,MAA+B,EAC9C,WAAW,CAAC,GAAE,MAAM,IAAI,aAAA;IAG3C;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczC;;;;OAIG;IACH,MAAM,IAAI,IAAI;CAIf;AAQD,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED;;;GAGG;AACH,qBAAa,cAAe,YAAW,mBAAmB;IAa5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZjC;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO,CAAgE;gBAElD,IAAI,EAAE,kBAAkB;IAErD;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD;;;;;;;OAOG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,0DAA0D;IAC1D,IAAI,UAAU,IAAI,OAAO,CAExB;CACF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMxD"}