@nimbus-sh/fabric 0.2.0 → 0.3.0

package/dist/composition.d.ts

@@ -1,87 +1,3 @@
-/**
- * composition.ts — the ONE seam an embedder wires the fabric through.
- *
- * The fabric mints supervisor bindings and assembles staged boots for the
- * programs it hosts, but the entrypoint class that answers those bindings and
- * the artifact sources a stage names both belong to the embedder. The
- * embedder states them once, in its composition root, with one call:
- *
- *   composeFabric({
- *     supervisorEntrypoint: 'SupervisorRPC',
- *     stagedBootAssembler: (env, stage) => assembleConfig(env, stage),
- *   });
- *
- * First-write-wins, like every holder in this module: the composition root's
- * module scope runs once per isolate, before any request.
- *
- * `ctx.exports` is runtime state, not composition: workerd mints it per
- * instance, so the embedder captures it where the platform hands it over —
- * the first fetch, or the DO constructor — with {@link adoptCtxExports}.
- *
- * This module stays a leaf (no fabric imports) so helpers (notably
- * isolate-pool.ts) can read `ctx.exports` without transitively importing the
- * Durable Object classes, which is what lets the pool be unit-tested in a
- * plain Node/Bun process.
- */
-/**
- * One entry of `ctx.exports`: a top-level entrypoint's loopback factory, which
- * mints a Service Binding stub for that entrypoint when called with props.
- *
- * The stub's RPC surface belongs to the entrypoint CLASS, which this leaf
- * cannot see — `Cloudflare.Exports` is derived from the embedder's own main
- * module, so for a library it evaluates to `{}`. A caller that knows the class
- * names the surface it expects (`factory<MySupervisorRpc>({ props })`); one
- * that does not gets `unknown` and has to narrow, same as
- * `DurableObjectNamespace<T>` and `RpcStub<T>` in @cloudflare/workers-types.
- */
-export type EntrypointLoopbackFactory = <Stub = unknown>(options: {
-    props: object;
-}) => Stub;
-/**
- * `ctx.exports` itself — one factory per top-level entrypoint export, keyed by
- * export name. Absent names read as undefined, which is how a caller finds out
- * the embedder's entry module does not re-export the class it needs.
- */
-export type CtxExports = Record<string, EntrypointLoopbackFactory | undefined>;
-/**
- * Assemble a complete Worker Loader config from a staged-artifact spec. The
- * embedder supplies this: a stage names artifact sources only the embedder
- * knows how to fetch (Nimbus's largest staged artifact is a ~23 MB module map
- * from ASSETS), and the assembler runs inside the loader's cache-miss callback
- * so those sources are materialized only while the facet actually loads.
- * `env` is whichever hosting actor's env the facet is opened with.
- */
-export type StagedBootAssembler = (env: unknown, stage: unknown) => Promise<object>;
-/** What an embedder states about itself, once, in its composition root. */
-export interface FabricComposition {
-    /**
-     * The ctx.exports name of the embedder's supervisor WorkerEntrypoint. The
-     * fabric mints one supervisor binding per hosted program from it
-     * (`env.SUPERVISOR` inside the facet).
-     */
-    supervisorEntrypoint: string;
-    /** Only embedders that use 'staged' boot specs supply one. */
-    stagedBootAssembler?: StagedBootAssembler;
-}
-/** Register the embedder's composition. First-write-wins. */
-export declare function composeFabric(composition: FabricComposition): void;
-/**
- * Capture `ctx.exports` for the helpers that mint loopback bindings. The
- * embedder calls this where the platform hands the bag over — the first
- * fetch, or the DO constructor. First-write-wins.
- */
-export declare function adoptCtxExports(value: CtxExports): void;
-export declare function getCtxExports(): CtxExports | null;
-/**
- * Resolve the composed supervisor entrypoint on an exports object —
- * `exportsObj` when given (a WorkerEntrypoint reads its own ctx.exports),
- * the adopted ctx.exports otherwise. Calling the result with props mints one
- * supervisor binding (`env.SUPERVISOR`) for one hosted program. Null when
- * either half is missing; the caller decides whether that degrades or throws.
- */
-export declare function supervisorEntrypoint(exportsObj?: unknown): EntrypointLoopbackFactory | null;
-/** The composed name, for error messages that point at the missing export. */
-export declare function supervisorEntrypointName(): string | null;
-/** The composed assembler; a 'staged' boot spec cannot assemble without one. */
-export declare function stagedBootAssembler(): StagedBootAssembler;
+export { adoptCtxExports, composeFabric, getCtxExports, stagedBootAssembler, supervisorEntrypoint, supervisorEntrypointName, } from '@nimbus-sh/platform/composition.js';
+export type { CtxExports, EntrypointLoopbackFactory, FabricComposition, StagedBootAssembler, } from '@nimbus-sh/platform/composition.js';
 //# sourceMappingURL=composition.d.ts.map

package/dist/composition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../src/composition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAE7F;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,OAAO,KACX,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAID,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAGlE;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAGvD;AAED,wBAAgB,aAAa,IAAI,UAAU,GAAG,IAAI,CAEjD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,yBAAyB,GAAG,IAAI,CAO3F;AAED,8EAA8E;AAC9E,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAExD;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,IAAI,mBAAmB,CASzD"}
+{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../src/composition.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,YAAY,EACV,UAAU,EACV,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC"}

package/dist/composition.js

@@ -1,76 +1,2 @@
-/**
- * composition.ts — the ONE seam an embedder wires the fabric through.
- *
- * The fabric mints supervisor bindings and assembles staged boots for the
- * programs it hosts, but the entrypoint class that answers those bindings and
- * the artifact sources a stage names both belong to the embedder. The
- * embedder states them once, in its composition root, with one call:
- *
- *   composeFabric({
- *     supervisorEntrypoint: 'SupervisorRPC',
- *     stagedBootAssembler: (env, stage) => assembleConfig(env, stage),
- *   });
- *
- * First-write-wins, like every holder in this module: the composition root's
- * module scope runs once per isolate, before any request.
- *
- * `ctx.exports` is runtime state, not composition: workerd mints it per
- * instance, so the embedder captures it where the platform hands it over —
- * the first fetch, or the DO constructor — with {@link adoptCtxExports}.
- *
- * This module stays a leaf (no fabric imports) so helpers (notably
- * isolate-pool.ts) can read `ctx.exports` without transitively importing the
- * Durable Object classes, which is what lets the pool be unit-tested in a
- * plain Node/Bun process.
- */
-let _composition = null;
-/** Register the embedder's composition. First-write-wins. */
-export function composeFabric(composition) {
-    if (_composition)
-        return;
-    _composition = composition;
-}
-let _ctxExports = null;
-/**
- * Capture `ctx.exports` for the helpers that mint loopback bindings. The
- * embedder calls this where the platform hands the bag over — the first
- * fetch, or the DO constructor. First-write-wins.
- */
-export function adoptCtxExports(value) {
-    if (_ctxExports)
-        return;
-    _ctxExports = value;
-}
-export function getCtxExports() {
-    return _ctxExports;
-}
-/**
- * Resolve the composed supervisor entrypoint on an exports object —
- * `exportsObj` when given (a WorkerEntrypoint reads its own ctx.exports),
- * the adopted ctx.exports otherwise. Calling the result with props mints one
- * supervisor binding (`env.SUPERVISOR`) for one hosted program. Null when
- * either half is missing; the caller decides whether that degrades or throws.
- */
-export function supervisorEntrypoint(exportsObj) {
-    const exports = exportsObj ?? _ctxExports;
-    const name = _composition?.supervisorEntrypoint;
-    if (!name)
-        return null;
-    if ((typeof exports !== 'object' && typeof exports !== 'function') || exports === null)
-        return null;
-    const factory = exports[name];
-    return typeof factory === 'function' ? factory : null;
-}
-/** The composed name, for error messages that point at the missing export. */
-export function supervisorEntrypointName() {
-    return _composition?.supervisorEntrypoint ?? null;
-}
-/** The composed assembler; a 'staged' boot spec cannot assemble without one. */
-export function stagedBootAssembler() {
-    const assembler = _composition?.stagedBootAssembler;
-    if (!assembler) {
-        throw new Error('fabric: no staged-boot assembler composed; a \'staged\' boot spec '
-            + 'cannot be assembled without one (composeFabric)');
-    }
-    return assembler;
-}
+// Core and fabric share one holder without introducing a dependency cycle.
+export { adoptCtxExports, composeFabric, getCtxExports, stagedBootAssembler, supervisorEntrypoint, supervisorEntrypointName, } from '@nimbus-sh/platform/composition.js';

package/dist/fenced-work.d.ts

@@ -131,13 +131,16 @@ export declare class FencedWork<R extends FencedWorkRecord> {
      * paying a storage delete for pids that never had a row.
      */
     private journalledPids;
+    /** Re-drives in flight, by journal key — recovery's un-awaited ones and a
+     *  caller-driven one share the same drive for the same row. */
+    private drives;
     /** Whether this instance has already read the journal a reset leaves behind. */
     private recovered;
     constructor(storage: FencedWorkStorage, host: FencedWorkHost<R>);
     /**
      * Record a launch as in flight, so an instance that replaces this one knows
-     * it never finished. Best-effort: a launch that cannot be journalled still
-     * runs, and a reset then costs exactly what it cost before the journal.
+     * it never finished. A launch that cannot be journalled does not start: the
+     * rejection reaches the caller, which reports it like any launch failure.
      *
      * Synced, not merely put: `await put()` resolves before durability, and the
      * reset this journal exists for destroys every write its turn still had
@@ -158,6 +161,28 @@ export declare class FencedWork<R extends FencedWorkRecord> {
      * resurrect a process the user watched end.
      */
     release(pid: number): Promise<void>;
+    /**
+     * Drop every row `predicate` claims, live-pid bookkeeping included, synced
+     * like {@link release}. The one bulk delete the journal admits: an owner
+     * that removes its durable application is owed no recovery, however many
+     * generations back its rows were written.
+     */
+    purgeWhere(predicate: (record: R) => boolean): Promise<number>;
+    /**
+     * Every journal row, storage-true — the rows this instance wrote and the
+     * ones a previous instance left behind. The one read surface a request-
+     * driven recovery needs to find the durable launch a port belongs to.
+     */
+    rows(): Promise<Map<string, R>>;
+    /**
+     * Re-drive one journal row — the awaited sibling of recovery's un-awaited
+     * re-drives, for a caller that must know whether the launch actually came
+     * back. Single-flight per row: a request-driven drive and recovery's own
+     * never boot the same launch twice. Resolves true only when the re-drive
+     * itself FAILED and the failure was reported; a settled drive supersedes
+     * the row the same way recovery's does.
+     */
+    drive(key: string, record: R): Promise<boolean>;
     /**
      * Re-drive the launches a previous instance was building when it was reset.
      *
@@ -167,8 +192,12 @@ export declare class FencedWork<R extends FencedWorkRecord> {
      * that replaces this one. So the first turn after a reset is already this
      * one.
      *
-     * Runs once per instance: the journal only changes when a launch of THIS
-     * instance starts or settles, and those are rows this instance wrote.
+     * Runs once per instance — re-calls in the same instance are no-ops — and
+     * re-drives every row whose pid is `> 0` and at or below `generationBase()`
+     * with `attempt < FENCED_WORK_MAX_ATTEMPT`; the rest are abandoned. What the
+     * re-drive resolver receives is the journalled recipe and nothing else:
+     * env and credentials are never written to storage, so the resolver's
+     * embedder re-resolves them rather than reading them back.
      */
     recoverInterrupted(): Promise<void>;
     /**

package/dist/fenced-work.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fenced-work.d.ts","sourceRoot":"","sources":["../src/fenced-work.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB;;4DAEwD;IACxD,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,gBAAgB;IACxD;;;;;;OAMG;IACH,cAAc,IAAI,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,mDAAmD;IACnD,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAC9B,kCAAkC;IAClC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU,CAAC,CAAC,SAAS,gBAAgB;IAW9C,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXvB;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAAqB;IAC3C,gFAAgF;IAChF,OAAO,CAAC,SAAS,CAAS;gBAGP,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAG1C;;;;;;;;;;;;;;OAcG;IACG,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,8DAA8D;IAC9D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB;;;;OAIG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC;;;;;;;;;;;OAWG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IA8CzC;;;;;OAKG;YACW,SAAS;CAQxB"}
+{"version":3,"file":"fenced-work.d.ts","sourceRoot":"","sources":["../src/fenced-work.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB;;4DAEwD;IACxD,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,gBAAgB;IACxD;;;;;;OAMG;IACH,cAAc,IAAI,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,mDAAmD;IACnD,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAC9B,kCAAkC;IAClC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU,CAAC,CAAC,SAAS,gBAAgB;IAc9C,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAdvB;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAAqB;IAC3C;mEAC+D;IAC/D,OAAO,CAAC,MAAM,CAAuC;IACrD,gFAAgF;IAChF,OAAO,CAAC,SAAS,CAAS;gBAGP,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAG1C;;;;;;;;;;;;;;OAcG;IACG,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,8DAA8D;IAC9D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB;;;;OAIG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzC;;;;;OAKG;IACG,UAAU,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAapE;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAIrC;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB/C;;;;;;;;;;;;;;;OAeG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IA0CzC;;;;;OAKG;YACW,SAAS;CAIxB"}

package/dist/fenced-work.js

@@ -56,6 +56,9 @@ export class FencedWork {
      * paying a storage delete for pids that never had a row.
      */
     journalledPids = new Set();
+    /** Re-drives in flight, by journal key — recovery's un-awaited ones and a
+     *  caller-driven one share the same drive for the same row. */
+    drives = new Map();
     /** Whether this instance has already read the journal a reset leaves behind. */
     recovered = false;
     constructor(storage, host) {
@@ -64,8 +67,8 @@ export class FencedWork {
     }
     /**
      * Record a launch as in flight, so an instance that replaces this one knows
-     * it never finished. Best-effort: a launch that cannot be journalled still
-     * runs, and a reset then costs exactly what it cost before the journal.
+     * it never finished. A launch that cannot be journalled does not start: the
+     * rejection reaches the caller, which reports it like any launch failure.
      *
      * Synced, not merely put: `await put()` resolves before durability, and the
      * reset this journal exists for destroys every write its turn still had
@@ -78,13 +81,13 @@ export class FencedWork {
      * losing its row costs a retype, not a recovery.
      */
     async journal(record) {
+        this.journalledPids.add(record.pid);
         try {
-            this.journalledPids.add(record.pid);
             await this.storage.put(`${FENCED_WORK_KEY_PREFIX}${record.pid}`, record);
             await this.storage.sync();
         }
-        catch (e) {
-            console.warn('[nimbus] resident launch journal write failed:', errorMessage(e));
+        catch (cause) {
+            throw new Error('resident launch journal write failed', { cause });
         }
     }
     /** True while this instance holds a journal row for `pid`. */
@@ -99,13 +102,69 @@ export class FencedWork {
     async release(pid) {
         if (!this.journalledPids.delete(pid))
             return;
-        try {
-            await this.storage.delete(`${FENCED_WORK_KEY_PREFIX}${pid}`);
-            await this.storage.sync();
+        await this.storage.delete(`${FENCED_WORK_KEY_PREFIX}${pid}`);
+        await this.storage.sync();
+    }
+    /**
+     * Drop every row `predicate` claims, live-pid bookkeeping included, synced
+     * like {@link release}. The one bulk delete the journal admits: an owner
+     * that removes its durable application is owed no recovery, however many
+     * generations back its rows were written.
+     */
+    async purgeWhere(predicate) {
+        const rows = await this.storage.list({ prefix: FENCED_WORK_KEY_PREFIX });
+        let purged = 0;
+        for (const [key, record] of rows) {
+            if (!predicate(record))
+                continue;
+            this.journalledPids.delete(record.pid);
+            await this.storage.delete(key);
+            purged += 1;
         }
-        catch (e) {
-            console.warn('[nimbus] resident launch journal delete failed:', errorMessage(e));
+        if (purged > 0)
+            await this.storage.sync();
+        return purged;
+    }
+    /**
+     * Every journal row, storage-true — the rows this instance wrote and the
+     * ones a previous instance left behind. The one read surface a request-
+     * driven recovery needs to find the durable launch a port belongs to.
+     */
+    async rows() {
+        return this.storage.list({ prefix: FENCED_WORK_KEY_PREFIX });
+    }
+    /**
+     * Re-drive one journal row — the awaited sibling of recovery's un-awaited
+     * re-drives, for a caller that must know whether the launch actually came
+     * back. Single-flight per row: a request-driven drive and recovery's own
+     * never boot the same launch twice. Resolves true only when the re-drive
+     * itself FAILED and the failure was reported; a settled drive supersedes
+     * the row the same way recovery's does.
+     */
+    drive(key, record) {
+        let inflight = this.drives.get(key);
+        if (inflight === undefined) {
+            inflight = (async () => {
+                let failed = false;
+                try {
+                    await this.host.redrive(record, record.attempt + 1);
+                }
+                catch (e) {
+                    this.host.onRedriveFailed?.(record, e);
+                    failed = true;
+                }
+                // A reported failure is settled business — supersede either way, so
+                // the row never re-surfaces on the next recovery.
+                await this.supersede(key);
+                return failed;
+            })();
+            this.drives.set(key, inflight);
+            inflight.finally(() => {
+                if (this.drives.get(key) === inflight)
+                    this.drives.delete(key);
+            });
         }
+        return inflight;
     }
     /**
      * Re-drive the launches a previous instance was building when it was reset.
@@ -116,8 +175,12 @@ export class FencedWork {
      * that replaces this one. So the first turn after a reset is already this
      * one.
      *
-     * Runs once per instance: the journal only changes when a launch of THIS
-     * instance starts or settles, and those are rows this instance wrote.
+     * Runs once per instance — re-calls in the same instance are no-ops — and
+     * re-drives every row whose pid is `> 0` and at or below `generationBase()`
+     * with `attempt < FENCED_WORK_MAX_ATTEMPT`; the rest are abandoned. What the
+     * re-drive resolver receives is the journalled recipe and nothing else:
+     * env and credentials are never written to storage, so the resolver's
+     * embedder re-resolves them rather than reading them back.
      */
     async recoverInterrupted() {
         if (this.recovered)
@@ -159,12 +222,10 @@ export class FencedWork {
             // Not awaited: this call is running inside the alarm that granted the
             // turn, and the launch it starts asks for turns of its own through that
             // same alarm — awaiting it here would be waiting on an alarm that cannot
-            // be scheduled until this one returns.
-            this.host.waitUntil(this.host.redrive(record, record.attempt + 1)
-                .catch((e) => {
-                this.host.onRedriveFailed?.(record, e);
-            })
-                .then(() => this.supersede(key)));
+            // be scheduled until this one returns. `drive` single-flights it: a
+            // request that arrives mid-launch waits on this same drive rather than
+            // booting a second process.
+            this.host.waitUntil(this.drive(key, record));
         }
     }
     /**
@@ -174,15 +235,7 @@ export class FencedWork {
      * a previous generation the terminal hook will never fire for.
      */
     async supersede(key) {
-        try {
-            await this.storage.delete(key);
-            await this.storage.sync();
-        }
-        catch (e) {
-            console.warn('[nimbus] resident launch journal supersede failed:', errorMessage(e));
-        }
+        await this.storage.delete(key);
+        await this.storage.sync();
     }
 }
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/process-fabric.d.ts

@@ -75,6 +75,7 @@
  */
 import { z } from 'zod/v4';
 import type { RouteableFacetTarget } from '@nimbus-sh/core/runtime/os-contracts.js';
+import type { ServiceStub } from './vendor/types.js';
 /**
  * The class every generated resident runner exports. One name for every
  * runtime: the fabric names it unconditionally, so nothing about which program
@@ -107,6 +108,8 @@ export declare const ResidentCodeSpecSchema: z.ZodObject<{
     }, z.core.$strip>]>>;
     vfsWasmModules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     vfsTextModules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    globalOutbound: z.ZodOptional<z.ZodNullable<z.ZodCustom<ServiceStub, ServiceStub>>>;
 }, z.core.$strip>;
 export type ResidentCodeSpec = z.infer<typeof ResidentCodeSpecSchema>;
 /**
@@ -132,6 +135,8 @@ export declare function residentBootSpecSchema<Stage extends z.ZodType>(stageSch
         }, z.core.$strip>]>>;
         vfsWasmModules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         vfsTextModules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        globalOutbound: z.ZodOptional<z.ZodNullable<z.ZodCustom<ServiceStub, ServiceStub>>>;
     }, z.core.$strip>;
 }, z.core.$strip>], "kind">;
 export type ResidentBootSpec = {
@@ -201,6 +206,11 @@ export interface ResidentDiskReader {
  * path, verifying each generated image against the digest its own path claims.
  * Runs inside the loader's cache-miss callback, so the bytes exist only for
  * the duration of the load.
+ *
+ * The spec's isolation posture rides along verbatim: an explicit `env` is
+ * the isolate's whole env (loopback stubs by reference, never cloned or
+ * re-minted). An absent env stays absent
+ * so the worker config can tell "embedder takes the env" from the default.
  */
 export declare function residentLoaderConfig(spec: ResidentCodeSpec, disk: ResidentDiskReader): Promise<Record<string, unknown>>;
 /**
@@ -225,6 +235,17 @@ export interface ProcessHostParams {
     writerId: string;
     /** Forwarded verbatim to the runner's startProcess. */
     startArgs: unknown;
+    /**
+     * Set only by the coordinator's durable-application path: an explicit facet
+     * name (`app-slot-<n>`) allocated from DO storage, plus the release split
+     * that keeps its SQLite across aborts. Absent, the host allocates an
+     * ephemeral `proc-slot-<n>` name from its in-memory free list and deletes
+     * the store on release.
+     */
+    facet?: {
+        name: string;
+        durable: boolean;
+    };
 }
 /**
  * One resident process, as its coordinator sees it. Identical in meaning on
@@ -483,10 +504,19 @@ export interface ResidentProcessSpawn {
     pid: number;
     /** Keyed dynamic-worker identity (`nimbus-process:${doId}:${pid}`). */
     workerKey: string;
-    /** What the facet boots from. */
+    /** What the process boots from. */
     boot: ResidentBootSpec;
     /** Forwarded verbatim to the runner's startProcess. */
     startArgs?: unknown;
+    /**
+     * A durable application's explicit facet name (`app-slot-<n>`) and the
+     * release split that keeps its SQLite. Coordinator-allocated; absent for an
+     * ephemeral process, which takes a `proc-slot-<n>` name from the book.
+     */
+    facet?: {
+        name: string;
+        durable: boolean;
+    };
     /**
      * Called before any concrete host capability can expose this writer.
      * A spawn must not proceed unless the supervisor accepts the authority.

package/dist/process-fabric.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-fabric.d.ts","sourceRoot":"","sources":["../src/process-fabric.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,MAAM,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;iBA6BjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK;;;;;;;;;;;;;;;4BAKjF;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAU7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,gCAAgC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGtE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAID;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC1D;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiBlC;AA2BD;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,uDAAuD;IACvD,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,uEAAuE;IACvE,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;CAC5C;AAED;;;;GAIG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;CACzD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACjC,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C;;;;;;;;;OASG;IACH,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,KAC3B,WAAW,CAAC;AAIjB;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAqB;;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;gBAM/B,IAAI,EAAE;QAChB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,WAAW,EAAE,oBAAoB,CAAC;QAClC,IAAI,EAAE,MAAM,IAAI,CAAC;QACjB,QAAQ,EAAE,MAAM,MAAM,CAAC;KACxB;IAcD;;;;OAIG;IACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1B,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,uEAAuE;IACvE,iBAAiB,IAAI,MAAM;IAI3B,2DAA2D;IAC3D,IAAI,IAAI,IAAI;CAKb;AAID,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,aAAa,EAAE,aAAa,CAAC;IAC7B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C;AASD,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAE9C;;;;;;;;OAQG;IACG,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAwDxF"}
+{"version":3,"file":"process-fabric.d.ts","sourceRoot":"","sources":["../src/process-fabric.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,MAAM,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;iBA0CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK;;;;;;;;;;;;;;;;;4BAKjF;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAU7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,gCAAgC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGtE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAID;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmBlC;AA2BD;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,uDAAuD;IACvD,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,uEAAuE;IACvE,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;CAC5C;AAED;;;;GAIG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;CACzD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACjC,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C;;;;;;;;;OASG;IACH,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,KAC3B,WAAW,CAAC;AAIjB;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAqB;;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;gBAM/B,IAAI,EAAE;QAChB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,WAAW,EAAE,oBAAoB,CAAC;QAClC,IAAI,EAAE,MAAM,IAAI,CAAC;QACjB,QAAQ,EAAE,MAAM,MAAM,CAAC;KACxB;IAcD;;;;OAIG;IACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1B,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,uEAAuE;IACvE,iBAAiB,IAAI,MAAM;IAI3B,2DAA2D;IAC3D,IAAI,IAAI,IAAI;CAKb;AAID,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,aAAa,EAAE,aAAa,CAAC;IAC7B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C;AASD,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAE9C;;;;;;;;OAQG;IACG,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAyDxF"}

package/dist/process-fabric.js

@@ -115,6 +115,17 @@ export const ResidentCodeSpecSchema = z.object({
      * image store below and the spec names it.
      */
     vfsTextModules: z.record(z.string(), z.string()).optional(),
+    /**
+     * The isolate's exact `env`: one entry per binding the embedder minted,
+     * carried by reference so loopback stubs survive untouched. Defined —
+     * even as `{}` — means the embedder takes the whole env and no
+     * SUPERVISOR binding is injected; absent keeps the default (a SUPERVISOR
+     * minted from the composed supervisor entrypoint).
+     */
+    env: z.record(z.string(), z.unknown()).optional(),
+    /** Absent inherits outbound, null denies it, a binding mediates it by reference. */
+    globalOutbound: z.custom((value) => value !== null && (typeof value === 'object' || typeof value === 'function')
+        && 'fetch' in value && typeof value.fetch === 'function').nullable().optional(),
 });
 /**
  * The boot-spec union, with the staged arm's payload validated by the
@@ -191,6 +202,11 @@ export function facetImagePathDigest(path) {
  * path, verifying each generated image against the digest its own path claims.
  * Runs inside the loader's cache-miss callback, so the bytes exist only for
  * the duration of the load.
+ *
+ * The spec's isolation posture rides along verbatim: an explicit `env` is
+ * the isolate's whole env (loopback stubs by reference, never cloned or
+ * re-minted). An absent env stays absent
+ * so the worker config can tell "embedder takes the env" from the default.
  */
 export async function residentLoaderConfig(spec, disk) {
     const resolved = {};
@@ -208,6 +224,8 @@ export async function residentLoaderConfig(spec, disk) {
         compatibilityFlags: spec.compatibilityFlags,
         mainModule: spec.mainModule,
         modules: { ...spec.modules, ...resolved },
+        ...(spec.env !== undefined ? { env: spec.env } : {}),
+        ...(spec.globalOutbound !== undefined ? { globalOutbound: spec.globalOutbound } : {}),
     };
 }
 /**
@@ -331,6 +349,7 @@ export class ProcessFabric {
                 boot: spawn.boot,
                 writerId,
                 startArgs: spawn.startArgs,
+                ...(spawn.facet !== undefined ? { facet: spawn.facet } : {}),
             });
         }
         catch (error) {

package/dist/process-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-host.d.ts","sourceRoot":"","sources":["../src/process-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAKH,OAAO,EAGL,KAAK,WAAW,EAIhB,KAAK,kBAAkB,EAExB,MAAM,qBAAqB,CAAC;AAS7B,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,GAC7B,WAAW,CAIb;AA8ED,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AA2BD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AACvE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAwRzF;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAWhE"}
+{"version":3,"file":"process-host.d.ts","sourceRoot":"","sources":["../src/process-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAKH,OAAO,EAGL,KAAK,WAAW,EAIhB,KAAK,kBAAkB,EAExB,MAAM,qBAAqB,CAAC;AAQ7B,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,GAC7B,WAAW,CAIb;AA8ED,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AA2BD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AACvE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAgSzF;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAWhE"}

package/dist/process-host.js

@@ -67,8 +67,8 @@ import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { isTransientDoReset } from '@nimbus-sh/platform/oom-classify.js';
 import { PEER_RETRY_BACKOFF_MS, PEER_TRANSIENT_RESET_RETRIES } from './fanout.js';
 import { DYNAMIC_WORKER_CODE_LIMIT_BYTES } from './budgets.js';
-import { processes, residentFacetName, } from './workerd-facet-host.js';
 import { BindingError } from './vendor/errors.js';
+import { processes, } from './workerd-facet-host.js';
 /**
  * The substrate for this deployment, resolved once. The mode arrives already
  * decided — the embedder owns the config var that picks it, and refuses an
@@ -114,10 +114,10 @@ class FacetProcessHost {
             pid: params.pid,
             writerId: params.writerId,
         };
-        const { slot, ...facet } = processes(this.ctx, this.env).spawn(this.disk, supervisor, params);
+        const { name, ...facet } = processes(this.ctx, this.env).spawn(this.disk, supervisor, params);
         return {
             ...facet,
-            describe: () => `facet '${residentFacetName(slot)}' (pid ${params.pid})`
+            describe: () => `facet '${name}' (pid ${params.pid})`
                 + ` of session ${this.coordDoId.slice(-12)}`
                 + `; ${describeImageDelivery(this.imageDelivery)}`,
         };
@@ -235,8 +235,15 @@ class PeerProcessHost {
         return processes(this.ctx, this.env).run({ doId: this.coordDoId, pid: params.pid, writerId: params.writerId }, params, consume);
     }
     async open(params) {
+        if (params.facet) {
+            // A durable application's facet must be a child of the COORDINATOR's
+            // Durable Object — its `app-slot-<n>` row and retained SQLite live in
+            // that DO's storage. A sibling host would own storage the coordinator's
+            // durable-slot book and removeDurableApp cannot reach.
+            throw new Error('Nimbus: a durable spawn must be facet-hosted on its own coordinator; '
+                + 'the peer substrate cannot serve one');
+        }
         const placement = await this._place(params.pid);
-        this.tokensInUse.set(params.pid, placement.isolateToken);
         // Minted per open, held only by this coordinator and the peer that hosts
         // the process. The workerKey is derivable from a pid; this is not.
         const webSocketCapability = crypto.randomUUID();

package/dist/turn-budget.d.ts

@@ -97,6 +97,11 @@ export declare class TurnBudget {
      */
     settle(): void;
 }
+/** `Promise.withResolvers` for the runtime the project targets. */
+export declare function withResolvers<T = void>(): {
+    promise: Promise<T>;
+    resolve: (value: T | PromiseLike<T>) => void;
+};
 /** What {@link PacedWork} needs from the Durable Object hosting it. */
 export interface PacedWorkHost {
     /**

package/dist/turn-budget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"turn-budget.d.ts","sourceRoot":"","sources":["../src/turn-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,UAAY,CAAC;AAE9C;;;;;;;;;GASG;AACH,qBAAa,UAAU;IAkBnB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAnB/B,qEAAqE;IACrE,MAAM,SAAK;IACX,iDAAiD;IACjD,KAAK,SAAK;IAEV,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,UAAU,CAA8D;IAEhF;;;;;;;OAOG;gBAEgB,SAAS,EAAE,aAAa,EACxB,aAAa,GAAE,MAA6B,EAC5C,WAAW,CAAC,GAAE,MAAM,IAAI,aAAA;IAG3C;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczC;;;;OAIG;IACH,MAAM,IAAI,IAAI;CAIf;AAQD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,qBAAa,SAAU,YAAW,aAAa;IAkB3C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAlBvB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO,CAAgE;IAE/E;;;OAGG;gBAEgB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,aAAa;IAGtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD;;;;;;;OAOG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,0DAA0D;IAC1D,IAAI,UAAU,IAAI,OAAO,CAExB;CACF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMtD"}
+{"version":3,"file":"turn-budget.d.ts","sourceRoot":"","sources":["../src/turn-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,UAAY,CAAC;AAE9C;;;;;;;;;GASG;AACH,qBAAa,UAAU;IAkBnB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAnB/B,qEAAqE;IACrE,MAAM,SAAK;IACX,iDAAiD;IACjD,KAAK,SAAK;IAEV,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,UAAU,CAA8D;IAEhF;;;;;;;OAOG;gBAEgB,SAAS,EAAE,aAAa,EACxB,aAAa,GAAE,MAA6B,EAC5C,WAAW,CAAC,GAAE,MAAM,IAAI,aAAA;IAG3C;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczC;;;;OAIG;IACH,MAAM,IAAI,IAAI;CAIf;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,CAAC,GAAG,IAAI,KAAK;IAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;CAAE,CAI/G;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,qBAAa,SAAU,YAAW,aAAa;IAkB3C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAlBvB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO,CAAgE;IAE/E;;;OAGG;gBAEgB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,aAAa;IAGtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD;;;;;;;OAOG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,0DAA0D;IAC1D,IAAI,UAAU,IAAI,OAAO,CAExB;CACF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMtD"}

package/dist/turn-budget.js

@@ -106,7 +106,8 @@ export class TurnBudget {
         this.chunkEnded = undefined;
     }
 }
-function withResolvers() {
+/** `Promise.withResolvers` for the runtime the project targets. */
+export function withResolvers() {
     let resolve;
     const promise = new Promise((r) => { resolve = r; });
     return { promise, resolve };