@nimbus-sh/fabric 0.8.0 → 0.10.0

package/dist/timers.js

@@ -103,6 +103,7 @@ export class Timers {
             arms.push({ reason, whenMs });
             return Promise.resolve(true);
         }
+        const epoch = host._timerEpoch ?? 0;
         // Serialize every read-modify-write of the reasons map through one
         // per-instance chain: two schedulers firing back-to-back from one activity
         // hook would otherwise interleave their get→put cycles and silently drop
@@ -113,15 +114,21 @@ export class Timers {
                 if (typeof setAlarmFn !== 'function')
                     return false;
                 const existing = (await ctx.storage.get(TIMER_REASONS_KEY));
+                // Requested before a reset: it belongs to the timers the reset voided.
+                if ((host._timerEpoch ?? 0) !== epoch)
+                    return false;
                 const map = { ...(existing || {}) };
                 // Earliest-deadline-first: only update if new request is sooner or
                 // this reason has no pending entry.
+                let written;
                 if (!(reason in map) || whenMs < map[reason]) {
                     map[reason] = whenMs;
-                    await ctx.storage.put(TIMER_REASONS_KEY, map);
+                    written = ctx.storage.put(TIMER_REASONS_KEY, map);
                 }
-                const earliest = Math.min(...Object.values(map));
-                setAlarmFn.call(ctx.storage, earliest);
+                // Issued in the turn the epoch was checked in: a reset after this
+                // point wipes and disarms after these, never before.
+                setAlarmFn.call(ctx.storage, Math.min(...Object.values(map)));
+                await written;
                 return true;
             }
             catch (e) {
@@ -133,6 +140,17 @@ export class Timers {
         host._timerChain = chained;
         return chained;
     }
+    /**
+     * Void every timer of this instance: a schedule or dispatch already
+     * requested — still queued on the chain, or a dispatch whose handlers are
+     * running — writes no reason and arms no alarm from here on. For a
+     * deliberate end of the actor's state (a session destroy): call it before
+     * wiping storage and deleting the alarm, so nothing in flight writes the
+     * map back or re-arms after the wipe. Requests made after it proceed.
+     */
+    reset() {
+        this.host._timerEpoch = (this.host._timerEpoch ?? 0) + 1;
+    }
     /**
      * Multi-reason timer dispatcher. Called from the DO's `alarm()` handler
      * with the embedder's handler map.
@@ -155,14 +173,22 @@ export class Timers {
      */
     dispatch(handlers, onLegacyAlarm, alarmInfo) {
         const { host, ctx } = this;
+        const epoch = host._timerEpoch ?? 0;
+        const current = () => (host._timerEpoch ?? 0) === epoch;
         // Same serialization as schedule: the dispatcher's read→handlers→write
         // cycle must not interleave with an activity-hook schedule.
-        const chained = (host._timerChain ?? Promise.resolve()).then(() => dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo), () => dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo));
+        const chained = (host._timerChain ?? Promise.resolve()).then(() => dispatchBody(ctx, current, handlers, onLegacyAlarm, alarmInfo), () => dispatchBody(ctx, current, handlers, onLegacyAlarm, alarmInfo));
         host._timerChain = chained;
         return chained;
     }
 }
-async function dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo) {
+/**
+ * One dispatch. `current` answers whether the epoch it was requested in still
+ * stands: once a reset voids it, no further handler runs and nothing is
+ * written or armed — the reset's caller is wiping this state, and a write
+ * after the wipe would outlive it.
+ */
+async function dispatchBody(ctx, current, handlers, onLegacyAlarm, alarmInfo) {
     // Collect schedule requests made inside handler context (see
     // dispatchArms) and fold them into the map below, so an in-dispatch arm
     // neither deadlocks on the chain nor races the write.
@@ -170,6 +196,8 @@ async function dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo) {
     try {
         const now = Date.now();
         const existing = (await ctx?.storage?.get?.(TIMER_REASONS_KEY));
+        if (!current())
+            return;
         const map = { ...(existing || {}) };
         const hadMap = Object.keys(map).length > 0;
         if (!hadMap) {
@@ -185,6 +213,8 @@ async function dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo) {
                     fired.push(reason);
             }
             for (const reason of fired) {
+                if (!current())
+                    return;
                 delete map[reason];
                 const handler = handlers[reason];
                 // Unknown reasons silently dropped (forward-compat).
@@ -201,20 +231,25 @@ async function dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo) {
                 }
             }
         }
+        // A reset while the handlers ran: the map read above is gone, and
+        // writing it back — or arming for it — would revive what was ended.
+        if (!current())
+            return;
         // Fold the in-dispatch arms, earliest-deadline-first per reason.
         for (const arm of arms) {
             if (!(arm.reason in map) || arm.whenMs < map[arm.reason]) {
                 map[arm.reason] = arm.whenMs;
             }
         }
-        // Re-arm or clear.
+        // Re-arm or clear, issued in the turn the epoch was checked in: a reset
+        // after this point wipes and disarms after these, never before.
         const setAlarmFn = ctx?.storage?.setAlarm;
         if (Object.keys(map).length > 0) {
-            await ctx.storage.put(TIMER_REASONS_KEY, map);
-            const earliest = Math.min(...Object.values(map));
+            const written = ctx.storage.put(TIMER_REASONS_KEY, map);
             if (typeof setAlarmFn === 'function') {
-                setAlarmFn.call(ctx.storage, earliest);
+                setAlarmFn.call(ctx.storage, Math.min(...Object.values(map)));
             }
+            await written;
         }
         else if (hadMap) {
             try {

package/dist/vendor/types.d.ts

@@ -17,13 +17,19 @@ export interface JsonModule {
     json: unknown;
 }
 /**
- * A compiled WebAssembly module, importable from a facet by module name.
- * Nimbus ships these on every path — sql.js for node:sqlite, the interpreter
- * images for python and ruby — so the omission here was the type lagging the
- * API, not a kind the loader lacks.
+ * A WebAssembly module, importable from a facet by module name. Nimbus ships
+ * these on every path — sql.js for node:sqlite, the interpreter images for
+ * python and ruby — so the omission here was the type lagging the API, not a
+ * kind the loader lacks. The loader takes either the bytes, which it
+ * compiles, or a module the caller holds compiled already, whose compiled
+ * code the dynamic worker then shares (workerd src/workerd/api/
+ * worker-loader.c++, extractWasmModuleContent). A module handed over this
+ * way should be described with describeHostWasm (host-wasm.ts): the
+ * code-size budget and the loader cache key cannot read a Module's size or
+ * identity from JS.
  */
 export interface WasmModule {
-    wasm: ArrayBuffer;
+    wasm: ArrayBuffer | WebAssembly.Module;
 }
 /** Plain string = type inferred from file extension (.js or .py). */
 export type ModuleContent = string | JsModule | CjsModule | PyModule | TextModule | DataModule | JsonModule | WasmModule;

package/dist/vendor/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vendor/types.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE;AACxC,MAAM,WAAW,SAAS;IAAG,GAAG,EAAE,MAAM,CAAA;CAAE;AAC1C,MAAM,WAAW,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE;AACxC,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAA;CAAE;AAC5C,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,WAAW,CAAA;CAAE;AACjD,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,OAAO,CAAA;CAAE;AAC7C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,WAAW,CAAA;CAAE;AAEjD,qEAAqE;AACrE,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,CAAC;AAEf,MAAM,WAAW,UAAU;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,IAAI,cAAc,CAAC;IAChC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,cAAc,CAAC;CACvE;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,GAAG,UAAU,CAAC;CAC/D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vendor/types.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE;AACxC,MAAM,WAAW,SAAS;IAAG,GAAG,EAAE,MAAM,CAAA;CAAE;AAC1C,MAAM,WAAW,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE;AACxC,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAA;CAAE;AAC5C,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,WAAW,CAAA;CAAE;AACjD,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,OAAO,CAAA;CAAE;AAC7C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC,MAAM,CAAA;CAAE;AAEtE,qEAAqE;AACrE,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,CAAC;AAEf,MAAM,WAAW,UAAU;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,IAAI,cAAc,CAAC;IAChC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,cAAc,CAAC;CACvE;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,GAAG,UAAU,CAAC;CAC/D"}

package/dist/workerd-facet-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workerd-facet-host.d.ts","sourceRoot":"","sources":["../src/workerd-facet-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAqBH,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAK7B,+DAA+D;AAC/D,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,KAAK,EAAE;YACL,GAAG,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE,uBAAuB,CAAC;YACpC,KAAK,CAAC,EAAE,OAAO,CAAC;SACjB,CAAC;KACH,KAAK,0BAA0B,CAAC;CAClC;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,gBAAgB,EAC5B,UAAU,EAAE,uBAAuB,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,MAAM,GAAG,IAAW,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAerC;AA6BD,gDAAgD;AAChD,UAAU,gBAAgB;IACxB,aAAa,IAAI,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,UAAU,mBAAmB;IAC3B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,OAAO,GAAG;QAAE,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC9F,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD,GACA,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,cAAc,CAAC;AA4FrD,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExF;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI9E;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAEnF;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,gBAAgB;IAGxC,8EAA8E;IAC9E,KAAK,CACH,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,iBAAiB,GACxB,aAAa;IAIhB;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,CAAC,EACH,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,CAAC,CAAC;CAGd;AAgPD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAelC"}
+{"version":3,"file":"workerd-facet-host.d.ts","sourceRoot":"","sources":["../src/workerd-facet-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoBH,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAK7B,+DAA+D;AAC/D,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,KAAK,EAAE;YACL,GAAG,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE,uBAAuB,CAAC;YACpC,KAAK,CAAC,EAAE,OAAO,CAAC;SACjB,CAAC;KACH,KAAK,0BAA0B,CAAC;CAClC;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,gBAAgB,EAC5B,UAAU,EAAE,uBAAuB,EACnC,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,MAAM,GAAG,IAAW,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAerC;AA8BD,gDAAgD;AAChD,UAAU,gBAAgB;IACxB,aAAa,IAAI,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,UAAU,mBAAmB;IAC3B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,OAAO,GAAG;QAAE,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC9F,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD,GACA,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,iEAAiE;AACjE,eAAO,MAAM,yBAAyB,cAAc,CAAC;AA4FrD,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExF;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI9E;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAEnF;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,gBAAgB;IAGxC,8EAA8E;IAC9E,KAAK,CACH,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,iBAAiB,GACxB,aAAa;IAIhB;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,CAAC,EACH,UAAU,EAAE,uBAAuB,EACnC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,CAAC,CAAC;CAGd;AAqPD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,kBAAkB,EAC9B,UAAU,EAAE,uBAAuB,EACnC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAelC"}

package/dist/workerd-facet-host.js

@@ -15,7 +15,7 @@
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { StorageLedger, forgetFacetStorage } from '@nimbus-sh/core/runtime/storage-ledger.js';
 import { getCtxExports, stagedBootAssembler, supervisorEntrypoint, supervisorEntrypointName, } from './composition.js';
-import { assertModuleMapWithinCodeLimit, beginLoaderFetch, facetNameCount, facetNameCountDurable, recordFacetNameMinted, recordLoaderId, withDynamicWorkerCapNamed, withFacetBudgetNamed, } from './budgets.js';
+import { assertModuleMapWithinCodeLimit, beginLoaderFetch, facetNameCount, facetNameCountDurable, recordFacetNameMinted, withDynamicWorkerCapNamed, withFacetBudgetNamed, } from './budgets.js';
 import { RESIDENT_PROCESS_CLASS, residentLoaderConfig, } from './process-fabric.js';
 import { supervisorLoaderKey } from './supervisor-props.js';
 export function getNimbusCtxExports() {
@@ -87,7 +87,7 @@ export async function cloneStorage(ctx, clone) {
     const facets = facetContainer(ctx);
     if (typeof facets.clone !== 'function') {
         throw new Error('Nimbus: ctx.facets.clone is unavailable in this runtime; the reflink image '
-            + 'path needs deployed Cloudflare workerd (local workerd <= 1.20260603.1 lacks it)');
+            + 'path needs workerd 1.20260926.1 or later, or deployed Cloudflare workerd');
     }
     const { src, dst } = clone;
     if (!(await clone.populated(src))) {
@@ -292,10 +292,13 @@ function spawnResident(ctx, env, disk, supervisor, params) {
                 + 'it is not restarted');
         }
         evaluated = true;
-        return { class: residentProcessClass(ctx, env, disk, supervisor, params) };
+        return { class: residentProcessClass(env, disk, supervisor, params, loaderKey) };
     };
     const book = slotBook(ctx);
     const ledger = sessionLedger(ctx);
+    // A warm worker keeps the SUPERVISOR binding it was built with, and the
+    // loader outlives this instance.
+    const loaderKey = supervisorLoaderKey(params.workerKey, supervisor);
     let facet;
     try {
         // N18: the fill is admitted, and recorded under the facet's name, before
@@ -315,6 +318,12 @@ function spawnResident(ctx, env, disk, supervisor, params) {
     }
     if (explicit)
         book.live.add(name);
+    // The facet's worker is one Dynamic Worker in flight for as long as the
+    // process is resident, not only while a call is open: its WebSockets and
+    // streamed responses outlive the calls the ledger could bracket, and a
+    // request can reach it at any moment. Held from here to `release`, so no
+    // fan-out spends the slot a running process needs.
+    const endResidency = beginLoaderFetch(ctx, loaderKey);
     facetOfPid(ctx).set(params.pid, name);
     let disposed = false;
     const release = async () => {
@@ -323,6 +332,7 @@ function spawnResident(ctx, env, disk, supervisor, params) {
         disposed = true;
         released = true;
         facetOfPid(ctx).delete(params.pid);
+        endResidency();
         try {
             facets.abort(name, new Error('Nimbus: resident process released'));
         }
@@ -396,25 +406,15 @@ function spawnResident(ctx, env, disk, supervisor, params) {
  * assembles its module map at most once and the bytes never stay resident in
  * the hosting DO's heap.
  */
-function residentProcessClass(ctx, env, disk, supervisor, params) {
+function residentProcessClass(env, disk, supervisor, params, loaderKey) {
     const loader = env.LOADER;
     if (!loader || typeof loader.get !== 'function') {
         throw new Error('Nimbus: env.LOADER binding missing or invalid. Resident processes require '
             + 'the Worker Loader binding; add it via worker_loaders in wrangler.jsonc.');
     }
-    // A warm worker keeps the SUPERVISOR binding it was built with, and the
-    // loader outlives this instance.
-    const loaderKey = supervisorLoaderKey(params.workerKey, supervisor);
-    try {
-        const worker = loader
-            .get(loaderKey, () => residentWorkerConfig(env, disk, supervisor, params.boot))
-            .getDurableObjectClass(RESIDENT_PROCESS_CLASS);
-        recordLoaderId(ctx, loaderKey);
-        return worker;
-    }
-    catch (error) {
-        throw withDynamicWorkerCapNamed(ctx, error);
-    }
+    return loader
+        .get(loaderKey, () => residentWorkerConfig(env, disk, supervisor, params.boot))
+        .getDurableObjectClass(RESIDENT_PROCESS_CLASS);
 }
 async function runOneShot(ctx, env, supervisor, params, consume) {
     const loader = env.LOADER;
@@ -455,23 +455,28 @@ async function runOneShot(ctx, env, supervisor, params, consume) {
             throw new Error('Nimbus: one-shot runtime entrypoint has no fetch method');
         }
         params.onLoaded?.();
-        // The unkeyed worker is a live dynamic worker for exactly this call, so
-        // the run is a Loader fetch on the hosting actor's ledger — bracketed,
-        // never wrapped: see beginLoaderFetch for the measured DO-poisoning
-        // hazard, and the pipelined-`fetch.call` note above for its sibling.
-        const endFetch = beginLoaderFetch(ctx);
-        let response;
+        // The unkeyed worker is one distinct dynamic worker in flight until its
+        // response is consumed (the body streams from it), keyed by this run's
+        // writer id — bracketed, never wrapped: see beginLoaderFetch for the
+        // measured DO-poisoning hazard, and the pipelined-`fetch.call` note above
+        // for its sibling.
+        const endFetch = beginLoaderFetch(ctx, `one-shot:${params.writerId}`);
         try {
-            response = await ep.fetch(params.request);
-        }
-        finally {
-            endFetch();
+            const response = await ep.fetch(params.request);
+            try {
+                return await consume(response);
+            }
+            finally {
+                disposeRpcResource(response);
+            }
         }
-        try {
-            return await consume(response);
+        catch (error) {
+            // A limit refusal pauses the ledger's admissions (beginLoaderFetchWhenFree).
+            endFetch(error);
+            throw error;
         }
         finally {
-            disposeRpcResource(response);
+            endFetch();
         }
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/fabric",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "The Cloudflare half of Nimbus \u2014 Durable Object facet hosting, dynamic-worker loader pools, the resident-process fabric, and DO alarm/hibernation machinery.",
   "keywords": [
     "cloudflare",
@@ -50,12 +50,12 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@nimbus-sh/core": "^0.13.0",
-    "@nimbus-sh/platform": "^0.6.0",
+    "@nimbus-sh/core": "^0.15.0",
+    "@nimbus-sh/platform": "^0.7.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20250327.0",
+    "@cloudflare/workers-types": "^5.20260928.1",
     "typescript": "^5.7.0"
   },
   "publishConfig": {

package/src/bindings.ts

@@ -29,6 +29,7 @@ import { disposeRpcResource, useRpcResource } from '@nimbus-sh/platform/rpc-disp
 import { hostNamespace, supervisorEntrypoint, supervisorEntrypointName, stagedBootAssembler } from './composition.js';
 import type { HostRoute } from './composition.js';
 import { hostNamespaceBinding, hostOpDispatch, type HostOpDispatch } from './host-dispatch.js';
+import { innerDoIdFromName } from './inner-do-env.js';
 import { assertModuleMapWithinCodeLimit } from './budgets.js';
 import type { EntrypointLoopbackFactory } from './composition.js';
 import type { WorkerCode } from './vendor/types.js';
@@ -708,46 +709,23 @@ interface NimbusDoNamespaceProps {
 }
 
 /**
- * `env.MY_DO` shim — a DurableObjectNamespace-like WorkerEntrypoint.
+ * The binding the loader passes for `env.MY_DO` (a WorkerEntrypoint of the
+ * session's isolate). The inner Worker does not use it as its namespace: a
+ * DurableObjectNamespace's API is synchronous, and this one's answers are
+ * RpcPromises, which cannot travel as arguments. The inner Worker replaces it
+ * with a local namespace (inner-do-env.ts, innerWorkerModules) that makes ids
+ * and stubs itself, and relays each member a stub's caller reaches, its
+ * fetch included, to `callOn` or `getOn`.
  *
- * Usage from inner Worker:
- *   const id   = await env.MY_DO.idFromName('x');   // AWAIT required
- *   const stub = env.MY_DO.get(id);
- *   await stub.fetch(request);
- *
- * IMPORTANT: unlike the real DurableObjectNamespace, idFromName /
- * newUniqueId / idFromString here return **Promises**, because they're
- * RPC-backed WorkerEntrypoint methods. The inner caller MUST `await`
- * them before passing the result to `.get()`. Workers RPC pipelining
- * does not currently allow passing an RpcPromise as a method argument
- * — the no-await form fails with:
- *     "Could not serialize object of type \"RpcPromise\"."
- *
- * Typical real-Worker code written for Cloudflare's synchronous
- * DurableObjectNamespace needs a one-word change (add `await`).
- *
- * idFromName produces prefix `name:` (deterministic FNV-style hash);
- * newUniqueId uses `uniq:` (random). The prefixes keep the two id
- * spaces distinct so a name-derived id can't collide with a random
- * one.
+ * `idFromName`, `newUniqueId`, `idFromString` and `get` answer as before, for
+ * a caller that awaits them. idFromName produces prefix `name:` (a
+ * deterministic hash, innerDoIdFromName); newUniqueId uses `uniq:`; the
+ * prefixes keep the two id spaces distinct.
  */
-export class NimbusDurableObjectNamespace extends WorkerEntrypoint<unknown, NimbusDoNamespaceProps> {
+export class NimbusDurableObjectNamespace extends WorkerEntrypoint<object, NimbusDoNamespaceProps> {
   /** Stable string id derived from a name. Hash is deterministic. */
   idFromName(name: string): string {
-    // Simple 64-bit-ish FNV-style hash → hex. Stable across runs;
-    // distinct names → distinct strings; same name → same string.
-    let h1 = 0xdeadbeef ^ name.length;
-    let h2 = 0x41c6ce57 ^ name.length;
-    for (let i = 0; i < name.length; i++) {
-      const ch = name.charCodeAt(i);
-      h1 = Math.imul(h1 ^ ch, 2654435761);
-      h2 = Math.imul(h2 ^ ch, 1597334677);
-    }
-    h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
-    h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
-    const high = (h1 >>> 0).toString(16).padStart(8, '0');
-    const low = (h2 >>> 0).toString(16).padStart(8, '0');
-    return 'name:' + high + low;
+    return innerDoIdFromName(name);
   }
 
   /** Fresh random id (matches DurableObjectNamespace.newUniqueId()). */
@@ -774,6 +752,19 @@ export class NimbusDurableObjectNamespace extends WorkerEntrypoint<unknown, Nimb
       },
     });
   }
+
+  /**
+   * The member of object `id` at `path` (names from the object down), called
+   * with `args`: its answer, or what it throws, as the object gave it.
+   */
+  callOn(id: string, path: string[], args: unknown[]): Promise<unknown> {
+    return innerDoMember(this.env, { ...(this.ctx.props || {}), id: String(id) }, path, args);
+  }
+
+  /** The member of object `id` at `path`, read. */
+  getOn(id: string, path: string[]): Promise<unknown> {
+    return innerDoMember(this.env, { ...(this.ctx.props || {}), id: String(id) }, path, null);
+  }
 }
 
 /** Props the DO stub carries: which binding, which supervisor, which id. */
@@ -782,70 +773,102 @@ interface NimbusDoStubProps extends NimbusDoNamespaceProps {
 }
 
 /**
- * A Durable-Object-namespace-stub for a specific id. Exposes fetch()
- * and will, if we later need it, forward RPC method calls through a
- * dispatch helper. The important invariant: EVERY call resolves the
- * inner DO class via getInnerDoClass() (./inner-do-registry.js) and
- * spins up / attaches to a facet via the supervisor's ctx.facets in
- * the SAME outer request context — never reusing stubs across requests.
+ * The session Durable Object, through the composed host namespace, and its
+ * one supervisorOp entrypoint: a host forwards envelopes, not private _rpc*
+ * methods. Throws when the binding cannot reach it; `release` drops the stub.
  */
-export class NimbusDOStub extends WorkerEntrypoint<object, NimbusDoStubProps> {
-  /**
-   * Resolve the supervisor DO through the composed host namespace and
-   * dispatch the innerDoFetch op through its one supervisorOp entrypoint —
-   * a host forwards envelopes, not private _rpc* methods.
-   */
-  async fetch(request: Request): Promise<Response> {
-    const props: NimbusDoStubProps = this.ctx.props || {};
-    const supervisorDoId = String(props.supervisorDoId || '');
-    if (!supervisorDoId) return new Response('Nimbus: supervisorDoId missing', { status: 500 });
-    const bindingName = String(props.bindingName || '');
-    const id = String(props.id || '');
-    let stub: DurableObjectStub | null = null;
-    let dispatch: HostOpDispatch;
-    try {
-      const ns = hostNamespaceBinding(this.env ?? {}, 'NimbusDOStub', props.route);
-      stub = ns.get(ns.idFromString(supervisorDoId));
-      dispatch = hostOpDispatch(stub, 'NimbusDOStub', props.route);
-    } catch (e) {
-      disposeRpcResource(stub);
-      return new Response(`Nimbus: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
-    }
-    // Forward the full request (method, body, headers preserved) by
-    // serializing what's needed and reconstructing on the other side.
-    // The supervisor reconstitutes the Request from these fields and
-    // invokes the facet.
-    const body = request.method !== 'GET' && request.method !== 'HEAD'
-      ? await request.arrayBuffer()
-      : null;
+function supervisorOf(env: object | undefined, props: NimbusDoStubProps): { dispatch: HostOpDispatch; release(): void } {
+  const supervisorDoId = String(props.supervisorDoId || '');
+  if (!supervisorDoId) throw new Error('supervisorDoId missing');
+  let stub: DurableObjectStub | null = null;
+  try {
+    const ns = hostNamespaceBinding(env ?? {}, 'NimbusDOStub', props.route);
+    stub = ns.get(ns.idFromString(supervisorDoId));
+    const held = stub;
+    return { dispatch: hostOpDispatch(stub, 'NimbusDOStub', props.route), release: () => disposeRpcResource(held) };
+  } catch (e) {
+    disposeRpcResource(stub);
+    throw e;
+  }
+}
+
+/** What the session's innerDoFetch answers: the object's response, as fields. */
+export interface InnerDoFetchAnswer {
+  status: number;
+  statusText: string;
+  headers: [string, string][];
+  body: ArrayBuffer | null;
+}
+
+function isInnerDoFetchAnswer(value: unknown): value is InnerDoFetchAnswer {
+  return value !== null && typeof value === 'object'
+    && 'status' in value && typeof value.status === 'number'
+    && 'statusText' in value && typeof value.statusText === 'string'
+    && 'headers' in value && Array.isArray(value.headers)
+    && 'body' in value && (value.body === null || value.body instanceof ArrayBuffer);
+}
+
+/**
+ * The inner object's fetch: the request forwarded whole (method, body,
+ * headers) as fields the session reconstructs, and its response rebuilt here
+ * from the fields the session answers. A binding that cannot reach the
+ * session answers 500.
+ */
+async function innerDoFetch(env: object | undefined, props: NimbusDoStubProps, request: Request): Promise<Response> {
+  let supervisor: ReturnType<typeof supervisorOf>;
+  try {
+    supervisor = supervisorOf(env, props);
+  } catch (e) {
+    return new Response(`Nimbus: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+  }
+  try {
+    const body = request.method !== 'GET' && request.method !== 'HEAD' ? await request.arrayBuffer() : null;
     const headerList: [string, string][] = [];
     request.headers.forEach((v, k) => { headerList.push([k, v]); });
-    try {
-      return await useRpcResource(
-        dispatch({
-          op: 'innerDoFetch',
-          args: [{
-            bindingName,
-            id,
-            method: request.method,
-            url: request.url,
-            headers: headerList,
-            body,
-          }],
-        }),
-        (res) => {
-          if (!(res instanceof Response)) {
-            return new Response('Nimbus: innerDoFetch returned an invalid result', { status: 502 });
-          }
-          return new Response(res.body, {
-            status: res.status,
-            statusText: res.statusText,
-            headers: res.headers,
-          });
-        },
-      );
-    } finally {
-      disposeRpcResource(stub);
-    }
+    return await useRpcResource(
+      supervisor.dispatch({
+        op: 'innerDoFetch',
+        args: [{ bindingName: String(props.bindingName || ''), id: String(props.id || ''), method: request.method, url: request.url, headers: headerList, body }],
+      }),
+      (res) => {
+        if (!isInnerDoFetchAnswer(res)) {
+          return new Response('Nimbus: innerDoFetch returned an invalid result', { status: 502 });
+        }
+        return new Response(res.body, { status: res.status, statusText: res.statusText, headers: res.headers });
+      },
+    );
+  } finally {
+    supervisor.release();
+  }
+}
+
+/**
+ * A member of the inner object, called with `args` or read (`args` null): the
+ * session reaches it on the object's facet and answers what it answered (a
+ * stub, function or stream travels as one) or rejects with what it threw,
+ * type and message kept.
+ */
+async function innerDoMember(env: object | undefined, props: NimbusDoStubProps, path: string[], args: unknown[] | null): Promise<unknown> {
+  const supervisor = supervisorOf(env, props);
+  try {
+    return await supervisor.dispatch({
+      op: 'innerDoCall',
+      args: [{ bindingName: String(props.bindingName || ''), id: String(props.id || ''), path, args }],
+    });
+  } finally {
+    supervisor.release();
+  }
+}
+
+/**
+ * A Durable-Object-namespace-stub for a specific id, for a caller of the
+ * binding's own `get`: its fetch. The important invariant: EVERY call
+ * resolves the inner DO class via getInnerDoClass() (./inner-do-registry.js)
+ * and spins up / attaches to a facet via the supervisor's ctx.facets in the
+ * SAME outer request context — never reusing stubs across requests.
+ */
+export class NimbusDOStub extends WorkerEntrypoint<object, NimbusDoStubProps> {
+  async fetch(request: Request): Promise<Response> {
+    return innerDoFetch(this.env, this.ctx.props || {}, request);
   }
 }