@nimbus-sh/fabric 0.8.0 → 0.10.0

package/src/fanout.ts

@@ -1,22 +1,27 @@
 /**
  * Two-tier fan-out primitive for work that must execute in Worker Loader
- * facets without tripping workerd's per-DO dynamic-worker ceiling.
+ * isolates within the Durable Object's Dynamic Worker budget.
  *
- * A single Durable Object method can drive at most four concurrent
- * Worker Loader fetches before extra dispatches serialize or fail. Small
- * batches therefore run in the coordinator DO through IsolatePool.
- * Wider batches are sharded across sibling NimbusSession DOs, each of
- * which owns its own four-loader budget.
+ * A Durable Object may have `DO_DYNAMIC_WORKER_LIMIT` distinct Dynamic
+ * Workers with in-flight requests, shared across every concurrent request to
+ * it (budgets.ts). A batch the coordinator's remaining headroom can hold —
+ * the limit less the workers it already has in flight (resident processes,
+ * the esbuild facet, a git network op) and other fan-outs' claims — runs in
+ * the coordinator through IsolatePool, one Dynamic Worker per task. Only a
+ * batch wider than that headroom is sharded across sibling NimbusSession
+ * DOs, each of which spends its own budget.
  *
- * Routing is deterministic: each task has a stable key, and the key maps
- * to a sibling DO shard. There is no silent fallback to width-1 execution;
- * missing LOADER or NIMBUS_SESSION bindings fail loudly so install and
- * runtime operations do not appear successful after partial dispatch.
+ * Routing is deterministic for a given headroom: each task has a stable key,
+ * and the key maps to a sibling DO shard. There is no silent fallback to
+ * width-1 execution; missing LOADER or NIMBUS_SESSION bindings fail loudly so
+ * install and runtime operations do not appear successful after partial
+ * dispatch.
  */
 
 import { serializeFunction } from './vendor/serialize.js';
 import { BindingError } from './vendor/errors.js';
 import { IsolatePool, type FacetTaskFn } from './isolate-pool.js';
+import { claimDynamicWorkers, dynamicWorkerHeadroom, type DynamicWorkerClaim } from './budgets.js';
 import { hostRoute } from './composition.js';
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { classifyDoCall, describeError, isRetryableDoCall } from '@nimbus-sh/platform/oom-classify.js';
@@ -35,14 +40,17 @@ export interface FanoutEnv {
   NIMBUS_SESSION?: unknown;
 }
 
-/**
- * Threshold at which routing switches from coordinator-local loaders to
- * sibling Durable Objects.
- *
- * Set to **5** so the in-DO path stays below the V8 4-loaders-per-method
- * cap by construction. width < 5 stays local; width >= 5 uses sibling DOs.
- */
-export const IN_DO_THRESHOLD = 5;
+/** Where one `submitMany` ran. */
+export type FanoutTopology = 'in-do' | 'peer-do';
+
+/** The routing decision for one `submitMany`, as its caller may log it. */
+export interface FanoutRoute {
+  topology: FanoutTopology;
+  /** Tasks in the batch — the Dynamic Workers an in-DO run spends. */
+  tasks: number;
+  /** The coordinator's Dynamic Worker headroom when the batch was routed. */
+  headroom: number;
+}
 
 /**
  * Hard cap on concurrent peer DOs per single submitMany call. Throughput stays
@@ -153,12 +161,14 @@ export interface FanoutOptions {
    * Not called on the in-DO path, which has no phases.
    */
   onDispatchPhase?: (width: number, elapsedMs: number) => void;
+  /** Called once per non-empty submitMany with the route it took. */
+  onRoute?: (route: FanoutRoute) => void;
   /**
    * Cap on peer DOs this pool will spread one submitMany across. Defaults to
    * MAX_PEER_FANOUT. Tasks beyond the cap bucket into the peers that exist and
    * run through their in-peer pool, so lowering it trades peers for barriers
-   * without lowering total concurrency: each peer runs its bucket at
-   * concurrency 4, so N peers still resolve 4N tasks at once.
+   * without lowering total concurrency: each peer runs its bucket as wide as
+   * its own Dynamic Worker headroom allows.
    *
    * A caller sets this when its per-task work is small enough that a peer per
    * task buys nothing but round-trips — one task per peer costs ⌈tasks/
@@ -178,7 +188,7 @@ function isPeerResult<R>(value: Awaited<ReturnType<HostOpDispatch>>): value is F
 
 /**
  * Two-tier fan-out pool. Constructed by the supervisor DO; routes
- * each `submitMany` call automatically based on width.
+ * each `submitMany` call on the coordinator's live Dynamic Worker headroom.
  *
  * Lifetime: cheap to construct (no async init). Multiple submitMany
  * calls share NO state — each is dispatched fresh. The class
@@ -216,16 +226,16 @@ export class Fanout {
    * Dispatch `tasks` across the appropriate topology and return
    * results in input order.
    *
-   * Routing:
-   *   tasks.length < 5   -> coordinator-local IsolatePool
-   *   tasks.length >= 5  -> sibling NimbusSession DOs
+   * Routing, against the coordinator's Dynamic Worker headroom at call time:
+   *   tasks.length <= headroom -> coordinator-local IsolatePool, one Dynamic
+   *                               Worker per task, the width claimed on the
+   *                               ledger until the batch settles
+   *   tasks.length >  headroom -> sibling NimbusSession DOs
    *
-   * Backpressure: if `tasks.length > MAX_PEER_FANOUT (32)`, tasks
-   * are sharded modulo `MAX_PEER_FANOUT` and each shard's bucket
-   * runs serially inside its assigned peer DO via the in-peer
-   * IsolatePool's concurrency (capped at 4 there too). A
-   * single submitMany call returns when ALL tasks complete (or any
-   * throws).
+   * Peer shards: tasks hash onto min(tasks, maxPeers ?? MAX_PEER_FANOUT)
+   * peers and each peer runs its bucket through its own IsolatePool, as
+   * wide as that peer's headroom allows. A single submitMany call returns
+   * when ALL tasks complete (or any throws).
    *
    * `fn` is the user function executed per task. It runs INSIDE a
    * Worker Loader isolate (in the in-DO path) or inside a peer DO's
@@ -239,16 +249,21 @@ export class Fanout {
   ): Promise<R[]> {
     if (tasks.length === 0) return [];
 
-    if (tasks.length < IN_DO_THRESHOLD) {
-      return this._dispatchInDo<A, R>(tasks, fn);
+    const headroom = dynamicWorkerHeadroom(this.ctx);
+    const claim = claimDynamicWorkers(this.ctx, tasks.length);
+    this.opts.onRoute?.({ topology: claim ? 'in-do' : 'peer-do', tasks: tasks.length, headroom });
+    if (!claim) return this._dispatchPeerDo<A, R>(tasks, fn);
+    try {
+      return await this._dispatchInDo<A, R>(tasks, fn, claim);
+    } finally {
+      claim.release();
     }
-    return this._dispatchPeerDo<A, R>(tasks, fn);
   }
 
-  /** Report which topology a task count uses without dispatching. */
-  topologyFor(taskCount: number): 'in-do' | 'peer-do' | 'empty' {
+  /** The topology a task count would take against the headroom right now. */
+  topologyFor(taskCount: number): FanoutTopology | 'empty' {
     if (taskCount === 0) return 'empty';
-    return taskCount < IN_DO_THRESHOLD ? 'in-do' : 'peer-do';
+    return taskCount <= dynamicWorkerHeadroom(this.ctx) ? 'in-do' : 'peer-do';
   }
 
   /**
@@ -268,14 +283,13 @@ export class Fanout {
   private async _dispatchInDo<A, R>(
     tasks: FanoutTask<A>[],
     fn: FacetTaskFn<A, R>,
+    claim: DynamicWorkerClaim,
   ): Promise<R[]> {
-    // Use the existing IsolatePool. Concurrency = task count
-    // (capped at 4 by constructor — tasks.length is already < 5
-    // here, so the cap won't bite). Each task = one pool.submit;
-    // pool.map runs them with stable-slot reuse.
-    const concurrency = Math.min(tasks.length, IN_DO_THRESHOLD - 1);
+    // One slot — one Dynamic Worker — per task; submitMany has claimed
+    // that width on the ledger, and the pool's dispatches are held inside it.
     const pool = new IsolatePool(this.env, this.ctx, {
-      concurrency,
+      concurrency: tasks.length,
+      claim,
       timeoutMs: this.opts.timeoutMs,
       tag: this.opts.tag,
       preamble: this.opts.preamble,
@@ -285,9 +299,6 @@ export class Fanout {
       supervisorPid: this.opts.supervisorPid,
     });
     try {
-      // pool.map runs the function over `items` with concurrency-bounded
-      // slot reuse. Each slot is one warm loader isolate; we get exactly
-      // `concurrency` loader isolates total — well under the 4-cap.
       const items = tasks.map((t) => t.args);
       const results = await pool.map<A, R>(fn, items);
       // pool.map returns Array<R | null> (null on per-item failure with
@@ -316,10 +327,9 @@ export class Fanout {
     // identical fns.
     const fnSource = serializeFunction(fn);
 
-    // Cap peer count at MAX_PEER_FANOUT. Tasks beyond N=32 are
-    // bucketed into existing shards — each shard's peer DO then
-    // runs its bucket through its in-DO IsolatePool.map
-    // (concurrency capped at 4 there).
+    // Cap peer count at maxPeers (default MAX_PEER_FANOUT). Tasks beyond
+    // it bucket into existing shards; each peer runs its bucket through
+    // its own IsolatePool, as wide as its own headroom allows.
     const peerCount = Math.min(tasks.length, this.opts.maxPeers ?? MAX_PEER_FANOUT);
     // Group tasks by deterministic shard. Same key → same shard, so
     // tests can predict which peer handles which task.
@@ -360,10 +370,9 @@ export class Fanout {
           const peerStub = ns.get(id);
           try {
             const dispatch = hostOpDispatch(peerStub, `Fanout peer ${siblingName}`);
-            // Each peer DO RPC call uses ONE LOADER worker on its side.
-            // Supervisor → peer DO is a stub.fetch / RPC method call,
-            // NOT an env.LOADER.get(); that's the cap-sidestep that
-            // makes peer-DO fanout work.
+            // A peer DO call is a Durable Object RPC, not a Dynamic Worker:
+            // it spends none of this coordinator's budget, and the peer
+            // spends its own.
             const rpcResp = await dispatch({
               op: 'fanoutExecute',
               args: [

package/src/fenced-work.ts

@@ -262,9 +262,9 @@ export class FencedWork<R extends FencedWorkRecord> {
    * Runs once per instance — re-calls in the same instance are no-ops — and
    * re-drives every row whose pid is `> 0` and at or below `generationBase()`
    * with `attempt < FENCED_WORK_MAX_ATTEMPT`; the rest are abandoned. What the
-   * re-drive resolver receives is the journalled recipe and nothing else:
-   * env and credentials are never written to storage, so the resolver's
-   * embedder re-resolves them rather than reading them back.
+   * re-drive resolver receives is the journalled record and nothing else: a
+   * host keeps env and secrets out of it, so the resolver's embedder
+   * re-resolves them rather than reading them back.
    */
   async recoverInterrupted(): Promise<void> {
     if (this.recovered) return;

package/src/host-wasm.ts

@@ -0,0 +1,41 @@
+/**
+ * host-wasm.ts — what the fabric knows about a WebAssembly.Module a host
+ * hands a dynamic worker already compiled.
+ *
+ * workerd accepts a compiled module in a Worker Loader module map and lets
+ * the dynamic worker share its compiled code (src/workerd/api/
+ * worker-loader.c++, extractWasmModuleContent), so a host that bundles a
+ * fixed wasm (esbuild's, say) hands that module over instead of fetching a
+ * second copy of the bytes and having the guest compile them again. Two
+ * things the fabric needs about a member are unreadable from JS for a
+ * Module:
+ *   - its size: the module's wire bytes still count toward the 64 MiB
+ *     dynamic-worker code limit (worker-loader.c++ sums every member), and
+ *     assertModuleMapWithinCodeLimit must count them;
+ *   - its identity: a pool folds its wasm into the loader cache key, and a
+ *     Module has no bytes to fingerprint.
+ * The host that owns the module states both once, here.
+ */
+
+export interface HostWasmIdentity {
+  /** A stable name for the module's content, e.g. `esbuild@0.24.2`. */
+  readonly id: string;
+  /** The module's wire bytes: what it costs the dynamic-worker code budget. */
+  readonly bytes: number;
+}
+
+const described = new WeakMap<WebAssembly.Module, HostWasmIdentity>();
+
+/** Record what `module` is, and return it. */
+export function describeHostWasm(module: WebAssembly.Module, identity: HostWasmIdentity): WebAssembly.Module {
+  if (!Number.isSafeInteger(identity.bytes) || identity.bytes <= 0) {
+    throw new RangeError(`describeHostWasm: '${identity.id}' needs its wire size in bytes, got ${identity.bytes}`);
+  }
+  described.set(module, identity);
+  return module;
+}
+
+/** What a host said `module` is, or undefined for a module nobody described. */
+export function hostWasmIdentity(module: WebAssembly.Module): HostWasmIdentity | undefined {
+  return described.get(module);
+}

package/src/image-store.ts

@@ -122,7 +122,7 @@ export class ImageStore {
    */
   async materialize(
     pid: number,
-    images: AsyncIterable<readonly [string, string]> | Iterable<readonly [string, string]>,
+    images: AsyncIterable<readonly [string, string | readonly string[]]> | Iterable<readonly [string, string | readonly string[]]>,
     pacer: TurnBudget,
   ): Promise<Record<string, string>> {
     const fs = this.blobs();
@@ -138,7 +138,7 @@ export class ImageStore {
     fs.mkdirp(FACET_IMAGE_DIR);
     let count = 0;
     for await (const [moduleName, source] of images) {
-      const bytes = new TextEncoder().encode(source);
+      const bytes = typeof source === 'string' ? new TextEncoder().encode(source) : encodeParts(source);
       const path = facetImagePath(await facetImageDigest(bytes));
       paths[moduleName] = path;
       rooted.push(path);
@@ -207,3 +207,30 @@ export class ImageStore {
     }
   }
 }
+
+/**
+ * UTF-8 bytes of an image given as ordered parts, encoded into one buffer a
+ * part at a time: joining the parts first would hold the whole image twice as
+ * text.
+ */
+function encodeParts(parts: readonly string[]): Uint8Array {
+  let length = 0;
+  for (const part of parts) {
+    for (let i = 0; i < part.length; i++) {
+      const code = part.charCodeAt(i);
+      if (code < 0x80) length += 1;
+      else if (code < 0x800) length += 2;
+      else if (code >= 0xd800 && code <= 0xdbff && (part.charCodeAt(i + 1) & 0xfc00) === 0xdc00) { length += 4; i++; }
+      else length += 3;
+    }
+  }
+  const bytes = new Uint8Array(length);
+  const encoder = new TextEncoder();
+  let offset = 0;
+  for (const part of parts) {
+    const encoded = encoder.encode(part);
+    bytes.set(encoded, offset);
+    offset += encoded.byteLength;
+  }
+  return bytes;
+}

package/src/inner-do-env.ts

@@ -0,0 +1,213 @@
+/**
+ * inner-do-env.ts — a classic Durable Object binding inside an inner Worker.
+ *
+ * `nimbus wrangler dev` loads the user's Worker as a dynamic worker, and its
+ * Durable Object bindings run as facets of the session Durable Object. The
+ * binding the loader passes (`NimbusDurableObjectNamespace`, an entrypoint of
+ * the session's isolate) answers RPC, so it cannot be the inner Worker's
+ * namespace: a DurableObjectNamespace's API is synchronous (`env.P.get(
+ * env.P.idFromName('x'))` takes no await), and an RpcPromise cannot travel as
+ * an argument ("Could not serialize object of type RpcPromise").
+ *
+ * So a module the inner Worker runs before any of its own code (its main
+ * module's first import, `innerWorkerModules`) replaces each such binding in
+ * the isolate's env, which every handler, entrypoint and Durable Object of the
+ * isolate sees, with a local namespace. Ids are made locally, and `get`
+ * answers at once an RPC stub (`new RpcStub(target)`) of a local target that
+ * relays each member the stub's caller reaches (a call, a read, or a path
+ * through members, fetch included) to the binding's `callOn` or `getOn`,
+ * which the session runs on the object's facet. An RPC stub is what a
+ * Durable Object stub is to the runtime: callable by any method name, read by
+ * any property name, pipelined, bound to its request, and transferable, as an
+ * argument or an answer, where an entrypoint of a dynamically-loaded Worker
+ * is not. Arguments and answers cross natively, stubs, functions and streams
+ * included.
+ *
+ * Its prototype is not RpcStub's but one shaped as a Durable Object stub's:
+ * its constructor is a class `DurableObject` that cannot be constructed, its
+ * tag is 'DurableObject', and it has no `dup` or Symbol.dispose of its own,
+ * so `dup` is a member, which the runtime refuses as on Cloudflare. It
+ * differs from a Durable Object stub in two ways the runtime fixes. `typeof`
+ * is 'function'. And it is not persistent, so a Worker Loader env cannot carry
+ * it ("RpcStub cannot be serialized in this context because it is not a
+ * persistent stub"): the loader shim (NimbusLoaderRPC) keeps a child's code
+ * and loads it again in each later request, so the child's env can carry
+ * nothing made in one request, the session's own stubs included.
+ */
+
+import type { RpcStub, WorkerEntrypoint } from 'cloudflare:workers';
+import { ESBUILD_NAME_MODULE_SHIM } from '@nimbus-sh/core/_shared/esbuild-facet-shim.js';
+
+/**
+ * The id string a name gives: deterministic (FNV-style, 64-bit hex), with the
+ * prefix `name:` so it never collides with a `uniq:` id. Self-contained: its
+ * source also runs in the inner isolate (innerDoAdapter).
+ */
+export function innerDoIdFromName(name: string): string {
+  let h1 = 0xdeadbeef ^ name.length;
+  let h2 = 0x41c6ce57 ^ name.length;
+  for (let i = 0; i < name.length; i++) {
+    const ch = name.charCodeAt(i);
+    h1 = Math.imul(h1 ^ ch, 2654435761);
+    h2 = Math.imul(h2 ^ ch, 1597334677);
+  }
+  h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
+  h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
+  return 'name:' + (h1 >>> 0).toString(16).padStart(8, '0') + (h2 >>> 0).toString(16).padStart(8, '0');
+}
+
+/** What the binding the loader passes answers: one access to one object. */
+export interface InnerDoRemote {
+  /** The member of object `id` at `path` (names from the object down), called with `args`. */
+  callOn(id: string, path: string[], args: unknown[]): Promise<unknown>;
+  /** The member of object `id` at `path`, read. */
+  getOn(id: string, path: string[]): Promise<unknown>;
+}
+
+/** What the adapter runs over: the inner isolate's `cloudflare:workers`. */
+export interface InnerDoRuntime {
+  env: object;
+  WorkerEntrypoint: typeof WorkerEntrypoint;
+  RpcStub: typeof RpcStub;
+}
+
+/** The entrypoint a build asks which Durable Object classes are missing, unless the bundle spells it. */
+const CLASSES_ENTRYPOINT = 'NimbusDurableObjectClasses';
+/**
+ * The adapter, as it runs in the inner isolate: it replaces each of `names`
+ * in `runtime.env` that holds the binding with a local DurableObjectNamespace,
+ * and answers the class check the main module exports. `main` is the main
+ * module's namespace. Self-contained (serialized with toString): it reaches
+ * nothing outside itself but its arguments.
+ */
+export function innerDoAdapter(
+  idFromName: (name: string) => string,
+  names: readonly string[],
+  main: object,
+  runtime: InnerDoRuntime,
+): { NimbusDurableObjectClasses: unknown } {
+  /** A Durable Object id: its string, and the name it was made from. */
+  class DurableObjectId {
+    readonly name?: string;
+    readonly #id: string;
+    constructor(id: string, name?: string) {
+      this.#id = id;
+      if (name !== undefined) this.name = name;
+    }
+    toString(): string { return this.#id; }
+    equals(other: unknown): boolean { return other instanceof DurableObjectId && String(other) === this.#id; }
+  }
+
+  /** Whether `value` is the binding the loader passes (an RPC stub's methods are its properties). */
+  function isRemote(value: unknown): value is InnerDoRemote {
+    return value !== null && (typeof value === 'object' || typeof value === 'function')
+      && typeof Reflect.get(value, 'callOn') === 'function' && typeof Reflect.get(value, 'getOn') === 'function';
+  }
+
+  /**
+   * The member of object `id` at `path`, as the runtime reaches it in an RPC
+   * to the stub: called, read (it is thenable, and the runtime awaits what a
+   * read answers), or walked through to one of its own members (the runtime
+   * walks a path through own properties only, so every name is reported as
+   * one). At the empty path it is the stub's target.
+   */
+  function member(remote: InnerDoRemote, id: string, path: readonly string[]): (...args: unknown[]) => unknown {
+    const next = (name: string) => member(remote, id, [...path, name]);
+    return new Proxy((..._args: unknown[]): unknown => undefined, {
+      apply: (_target, _self, args: unknown[]) => remote.callOn(id, [...path], args),
+      get: (target, name) => {
+        if (name === 'then') {
+          return (resolve: (value: unknown) => unknown, reject: (reason: unknown) => unknown) => remote.getOn(id, [...path]).then(resolve, reject);
+        }
+        return typeof name === 'string' ? next(name) : Reflect.get(target, name);
+      },
+      getOwnPropertyDescriptor: (target, name) => (typeof name === 'string' && name !== 'then'
+        ? { value: next(name), writable: true, enumerable: true, configurable: true }
+        : Reflect.getOwnPropertyDescriptor(target, name)),
+    });
+  }
+
+  /**
+   * A stub's prototype, as a Durable Object stub's shows: its constructor
+   * cannot be called or constructed, and it is tagged 'DurableObject'.
+   */
+  const stubPrototype: object = Object.create(Object.prototype, {
+    constructor: {
+      value: function DurableObject(): never { throw new TypeError('Illegal constructor'); },
+      writable: true,
+      configurable: true,
+    },
+    [Symbol.toStringTag]: { value: 'DurableObject', configurable: true },
+  });
+
+  /** Asked once by a build: which classes the main module does not export. */
+  class NimbusDurableObjectClasses extends runtime.WorkerEntrypoint {
+    missing(classNames: string[]): string[] {
+      return classNames.filter((name) => typeof Reflect.get(main, name) !== 'function');
+    }
+  }
+
+  /** env.MY_DO: the namespace, made locally; its stubs relay to `remote`. */
+  class DurableObjectNamespace {
+    readonly #remote: InnerDoRemote;
+    constructor(remote: InnerDoRemote) { this.#remote = remote; }
+    idFromName(name: string): DurableObjectId { return new DurableObjectId(idFromName(String(name)), String(name)); }
+    newUniqueId(): DurableObjectId { return new DurableObjectId('uniq:' + crypto.randomUUID().replaceAll('-', '')); }
+    idFromString(id: string): DurableObjectId { return new DurableObjectId(String(id)); }
+    get(id: DurableObjectId | string): object {
+      const at = id instanceof DurableObjectId ? id : new DurableObjectId(String(id));
+      const stub = Object.setPrototypeOf(new runtime.RpcStub(member(this.#remote, String(at), [])), stubPrototype);
+      // As a Durable Object stub has them: its own, enumerable, in this order.
+      return Object.defineProperties(stub, {
+        name: { value: at.name, enumerable: true },
+        id: { value: at, enumerable: true },
+      });
+    }
+    getByName(name: string): object { return this.get(this.idFromName(name)); }
+    jurisdiction(): DurableObjectNamespace { return this; }
+  }
+
+  for (const name of names) {
+    const remote: unknown = Reflect.get(runtime.env, name);
+    if (isRemote(remote)) Reflect.set(runtime.env, name, new DurableObjectNamespace(remote));
+  }
+  return { NimbusDurableObjectClasses };
+}
+
+/** The inner Worker's own module, as bundled, and the adapter's. */
+const MAIN_MODULE = 'worker.js';
+const ADAPTER_MODULE = 'nimbus-do-env.js';
+
+/**
+ * The modules an inner Worker runs with Durable Object bindings `names`: its
+ * bundle as the main module, whose first import is the adapter (so the
+ * adapter has run before any of the Worker's code) and which exports the
+ * class check as `classesEntrypoint`, and the adapter. The import shares the
+ * bundle's first line, so line numbers stay the bundle's. A Worker with no
+ * such binding runs its bundle as it is, and has no class check (null).
+ *
+ * `classesEntrypoint` is a name the bundle never spells, so it exports no
+ * such name itself (a bundler prints an ASCII name as it is).
+ */
+export function innerWorkerModules(bundle: string, names: readonly string[]): {
+  mainModule: string;
+  modules: Record<string, string>;
+  classesEntrypoint: string | null;
+} {
+  if (names.length === 0) return { mainModule: MAIN_MODULE, modules: { [MAIN_MODULE]: bundle }, classesEntrypoint: null };
+  let classesEntrypoint = CLASSES_ENTRYPOINT;
+  for (let n = 2; bundle.includes(classesEntrypoint); n++) classesEntrypoint = `${CLASSES_ENTRYPOINT}_${n}`;
+  const head = `export { ${CLASSES_ENTRYPOINT} as ${classesEntrypoint} } from './${ADAPTER_MODULE}';`;
+  // A hashbang must stay first.
+  const at = bundle.startsWith('#!') ? bundle.indexOf('\n') + 1 : 0;
+  const main = bundle.slice(0, at) + head + bundle.slice(at);
+  const adapter = [
+    "import { env, RpcStub, WorkerEntrypoint } from 'cloudflare:workers';",
+    `import * as main from './${MAIN_MODULE}';`,
+    // The functions below are serialized from the bundled worker, which wraps them in __name.
+    ESBUILD_NAME_MODULE_SHIM,
+    `const { ${CLASSES_ENTRYPOINT} } = (${innerDoAdapter.toString()})(${innerDoIdFromName.toString()}, ${JSON.stringify(names)}, main, { env, RpcStub, WorkerEntrypoint });`,
+    `export { ${CLASSES_ENTRYPOINT} };`,
+  ].join('\n');
+  return { mainModule: MAIN_MODULE, modules: { [MAIN_MODULE]: main, [ADAPTER_MODULE]: adapter }, classesEntrypoint };
+}