@nimbus-sh/platform 0.3.0 → 0.5.0

package/dist/heavy-alloc-coord.d.ts

@@ -13,6 +13,8 @@ export interface SupervisorAllocationBudgetStats {
     readonly current: number;
     readonly peak: number;
     readonly queued: number;
+    /** Credit held for an owner's whole lifetime; see `acquireResident`. */
+    readonly resident: number;
 }
 interface AllocationBudgetLifecycle {
     onActive?: () => void;
@@ -51,6 +53,12 @@ export declare class SupervisorAllocationBudget {
      * stops a large read overlapping a large write.
      */
     acquireWithoutLifecycle(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
+    /**
+     * Reserve bytes an owner holds for its whole lifetime, not for one
+     * operation. Recorded as a floor: a later claim larger than what remains
+     * around it is refused with both numbers rather than parked forever.
+     */
+    acquireResidentBytes(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
     private _acquire;
 }
 /**
@@ -83,6 +91,11 @@ export declare function acquireSupervisorAllocation(bytes: number, signal?: Abor
  * there to fill.
  */
 export declare function acquireSupervisorReadAllocation(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
+/**
+ * Reserve bytes for the whole life of the owner that takes them — an image
+ * a pool keeps until it is disposed. See `acquireResidentBytes`.
+ */
+export declare function acquireResidentSupervisorAllocation(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
 /**
  * Reserve the full budget for an allocation whose retained size is not known
  * accurately enough to overlap safely with other heavy work.

package/dist/heavy-alloc-coord.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heavy-alloc-coord.d.ts","sourceRoot":"","sources":["../src/heavy-alloc-coord.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,0BAA0B;IAWnC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAX5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,MAAM,CAAS;IACvB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAAK;gBAGlB,QAAQ,EAAE,MAAM,EACR,SAAS,GAAE,yBAA8B,EAC1D,OAAO,GAAE,yBAA8B;IAKzC,IAAI,KAAK,IAAI,+BAA+B,CAK3C;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI3E;;;;;;;;OAQG;IACH,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;YAI7E,QAAQ;CAmCvB;AAED;;;GAGG;AACH,UAAU,aAAa;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAWlE;AAqCD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAMjF;AAED,wBAAgB,8BAA8B,IAAI,+BAA+B,CAEhF"}
+{"version":3,"file":"heavy-alloc-coord.d.ts","sourceRoot":"","sources":["../src/heavy-alloc-coord.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,0BAA0B;IAWnC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAX5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,MAAM,CAAS;IACvB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAAK;gBAGlB,QAAQ,EAAE,MAAM,EACR,SAAS,GAAE,yBAA8B,EAC1D,OAAO,GAAE,yBAA8B;IAKzC,IAAI,KAAK,IAAI,+BAA+B,CAK3C;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI3E;;;;;;;;OAQG;IACH,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI3F;;;;OAIG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;YAI1E,QAAQ;CAsCvB;AAED;;;GAGG;AACH,UAAU,aAAa;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAWlE;AAqCD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAMjF;AAED,wBAAgB,8BAA8B,IAAI,+BAA+B,CAEhF"}

package/dist/heavy-alloc-coord.js

@@ -55,8 +55,18 @@ export class SupervisorAllocationBudget {
     acquireWithoutLifecycle(bytes, signal) {
         return this._acquire(bytes, signal, false);
     }
-    async _acquire(bytes, signal, drivesLifecycle) {
-        const credit = await this.credits.acquire(bytes, signal);
+    /**
+     * Reserve bytes an owner holds for its whole lifetime, not for one
+     * operation. Recorded as a floor: a later claim larger than what remains
+     * around it is refused with both numbers rather than parked forever.
+     */
+    acquireResidentBytes(bytes, signal) {
+        return this._acquire(bytes, signal, true, true);
+    }
+    async _acquire(bytes, signal, drivesLifecycle, resident = false) {
+        const credit = resident
+            ? await this.credits.acquireResident(bytes, signal)
+            : await this.credits.acquire(bytes, signal);
         if (drivesLifecycle) {
             this.lifecycleHolders++;
             if (!this.active) {
@@ -168,6 +178,13 @@ export function acquireSupervisorAllocation(bytes, signal) {
 export function acquireSupervisorReadAllocation(bytes, signal) {
     return supervisorAllocationBudget.acquireWithoutLifecycle(bytes, signal);
 }
+/**
+ * Reserve bytes for the whole life of the owner that takes them — an image
+ * a pool keeps until it is disposed. See `acquireResidentBytes`.
+ */
+export function acquireResidentSupervisorAllocation(bytes, signal) {
+    return supervisorAllocationBudget.acquireResidentBytes(bytes, signal);
+}
 /**
  * Reserve the full budget for an allocation whose retained size is not known
  * accurately enough to overlap safely with other heavy work.

package/dist/limits.d.ts

@@ -18,6 +18,13 @@ export declare const CHUNK_SIZE = 65536;
 export declare const MAX_TX_BLOB_BYTES: number;
 export declare const MAX_TX_LOGICAL_ROWS = 256;
 export declare const MAX_TX_SQL_EXECS = 64;
+/**
+ * Bound parameters per SQL statement on Durable Objects SQLite. Measured
+ * 2026-09-21 on workerd: 100 bind, 101 fail as `too many SQL variables`
+ * (a 9-row insert of 12 columns fails, 8 rows succeed). Every IN-list and
+ * multi-row VALUES statement is sized from this.
+ */
+export declare const SQL_MAX_BOUND_PARAMETERS = 100;
 /**
  * Storage per SQLite-backed Durable Object: 10 decimal GB documented
  * (Workers Paid), shared by the root object, every facet beneath it, and

package/dist/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,QAAS,CAAC;AAEjC,eAAO,MAAM,iBAAiB,QAAkB,CAAC;AACjD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAInC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,cAAiB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAa,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAAY,CAAC;AAI9C;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAIlD;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAOhD,eAAO,MAAM,0BAA0B,QAAmB,CAAC;AA6B3D,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAO9D,eAAO,MAAM,4CAA4C,QAAmB,CAAC;AAY7E,eAAO,MAAM,6BAA6B,QAAc,CAAC;AAKzD,eAAO,MAAM,oCAAoC,QAAkB,CAAC;AAQpE,eAAO,MAAM,0BAA0B,QAA6B,CAAC;AACrE,eAAO,MAAM,sBAAsB,IAAI,CAAC"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,QAAS,CAAC;AAEjC,eAAO,MAAM,iBAAiB,QAAkB,CAAC;AACjD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAI5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,cAAiB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAa,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAAY,CAAC;AAI9C;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAIlD;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAOhD,eAAO,MAAM,0BAA0B,QAAmB,CAAC;AA6B3D,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAO9D,eAAO,MAAM,4CAA4C,QAAmB,CAAC;AAY7E,eAAO,MAAM,6BAA6B,QAAc,CAAC;AAKzD,eAAO,MAAM,oCAAoC,QAAkB,CAAC;AAQpE,eAAO,MAAM,0BAA0B,QAA6B,CAAC;AACrE,eAAO,MAAM,sBAAsB,IAAI,CAAC"}

package/dist/limits.js

@@ -24,6 +24,13 @@ export const CHUNK_SIZE = 65_536;
 export const MAX_TX_BLOB_BYTES = 1 * 1024 * 1024;
 export const MAX_TX_LOGICAL_ROWS = 256;
 export const MAX_TX_SQL_EXECS = 64;
+/**
+ * Bound parameters per SQL statement on Durable Objects SQLite. Measured
+ * 2026-09-21 on workerd: 100 bind, 101 fail as `too many SQL variables`
+ * (a 9-row insert of 12 columns fails, 8 rows succeed). Every IN-list and
+ * multi-row VALUES statement is sized from this.
+ */
+export const SQL_MAX_BOUND_PARAMETERS = 100;
 // ── SQLite storage walls ────────────────────────────────────────────────
 /**
  * Storage per SQLite-backed Durable Object: 10 decimal GB documented

package/dist/w7-frame.js

@@ -77,7 +77,7 @@ export async function decodeWriteBatchStream(stream, options = {}) {
     catch {
         throw new Error('w7-frame: stream must be a byte-oriented ReadableStream');
     }
-    const buffer = new ExactByteReader(reader);
+    const buffer = new ExactByteReader(reader, options.signal);
     let handedOff = false;
     try {
         throwIfAborted(options.signal);
@@ -796,9 +796,24 @@ async function cancelReader(reader, reason) {
 }
 class ExactByteReader {
     reader;
+    signal;
     done = false;
-    constructor(reader) {
+    constructor(reader, signal) {
         this.reader = reader;
+        this.signal = signal;
+    }
+    async read(read, cancel) {
+        throwIfAborted(this.signal);
+        const abort = () => { void cancel().catch(() => { }); };
+        this.signal?.addEventListener('abort', abort, { once: true });
+        try {
+            const result = await read();
+            throwIfAborted(this.signal);
+            return result;
+        }
+        finally {
+            this.signal?.removeEventListener('abort', abort);
+        }
     }
     async readExact(length, label) {
         if (length === 0)
@@ -809,7 +824,7 @@ class ExactByteReader {
             if (this.done) {
                 throw new Error(`w7-frame: stream ended ${offset} bytes into expected ${length}-byte ${label}`);
             }
-            const next = await this.reader.read(new Uint8Array(length - offset));
+            const next = await this.read(() => this.reader.read(new Uint8Array(length - offset)), () => this.reader.cancel(this.signal?.reason));
             if (next.done)
                 this.done = true;
             else if (next.value.byteLength > 0) {
@@ -825,7 +840,7 @@ class ExactByteReader {
         this.reader.releaseLock();
         const reader = stream.getReader();
         try {
-            const next = await reader.read();
+            const next = await this.read(() => reader.read(), () => reader.cancel(this.signal?.reason));
             if (!next.done && next.value.byteLength > 0) {
                 await reader.cancel(new Error('w7-frame: trailing bytes after batch-end'));
                 throw new Error('w7-frame: trailing bytes after batch-end');

package/dist/weighted-credit-pool.d.ts

@@ -9,6 +9,11 @@ export interface WeightedCreditPoolStats {
     readonly current: number;
     readonly peak: number;
     readonly queued: number;
+    /**
+     * Credit held by owners that keep it for their whole lifetime rather than
+     * for one operation — the floor no waiter can ever expect to get back.
+     */
+    readonly resident: number;
 }
 export interface WeightedCreditPoolOptions {
     /**
@@ -56,6 +61,14 @@ export declare class WeightedCreditPool {
     private isSmall;
     tryAcquire(bytes: number): ResizableCreditLease | null;
     acquire(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
+    /**
+     * Take credit that will be held for the owner's whole lifetime rather than
+     * for one operation — the esbuild pool's wasm image is the case.
+     *
+     * Recorded as a floor so a later claim that could never fit around it is
+     * refused with both numbers instead of parking in the FIFO forever.
+     */
+    acquireResident(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
     private validateRequest;
 }
 //# sourceMappingURL=weighted-credit-pool.d.ts.map

package/dist/weighted-credit-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"weighted-credit-pool.d.ts","sourceRoot":"","sources":["../src/weighted-credit-pool.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAkHD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,kBAAkB;IAKjB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B;IAoB9E,IAAI,KAAK,IAAI,uBAAuB,CASnC;IAED,OAAO,CAAC,OAAO;IAIf,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAOtD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiB3E,OAAO,CAAC,eAAe;CAOxB"}
+{"version":3,"file":"weighted-credit-pool.d.ts","sourceRoot":"","sources":["../src/weighted-credit-pool.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAmJD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,kBAAkB;IAKjB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B;IAoB9E,IAAI,KAAK,IAAI,uBAAuB,CAUnC;IAED,OAAO,CAAC,OAAO;IAIf,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAOtD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiB3E;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IASnF,OAAO,CAAC,eAAe;CAOxB"}

package/dist/weighted-credit-pool.js

@@ -3,27 +3,52 @@ class CreditLane {
     capacity;
     current = 0;
     peak = 0;
+    resident = 0;
     waiters = [];
     constructor(capacity) {
         this.capacity = capacity;
     }
     get stats() {
-        return { current: this.current, peak: this.peak, queued: this.waiters.length };
+        return {
+            current: this.current, peak: this.peak, queued: this.waiters.length, resident: this.resident,
+        };
     }
     tryAcquire(bytes) {
         if (this.waiters.length > 0 || this.current + bytes > this.capacity)
             return null;
-        return this.grant(bytes);
+        return this.grant(bytes, false);
     }
-    acquire(bytes, signal) {
+    /**
+     * The largest claim this lane can ever grant: capacity less what resident
+     * owners hold for their whole lifetime. A claim above it cannot be
+     * satisfied by waiting, because nothing it is waiting for will be
+     * released.
+     */
+    get grantableCeiling() {
+        return this.capacity - this.resident;
+    }
+    acquire(bytes, signal, resident = false) {
         if (signal?.aborted)
             return Promise.reject(abortError(signal));
-        const immediate = this.tryAcquire(bytes);
+        // Refuse a claim no amount of waiting can satisfy, rather than parking it
+        // in the FIFO forever. A parked claim is indistinguishable from a caller
+        // that stopped: no error, no timeout, and — because the queue refuses
+        // everyone behind it — no further progress anywhere in the isolate. That
+        // is what a real-vite launch looked like for four rounds of debugging.
+        if (bytes > this.grantableCeiling) {
+            return Promise.reject(new RangeError(`weighted credit claim of ${bytes} bytes can never be granted: capacity is ${this.capacity} `
+                + `and ${this.resident} bytes are held by resident owners, leaving ${this.grantableCeiling}`));
+        }
+        const immediate = resident ? null : this.tryAcquire(bytes);
         if (immediate)
             return Promise.resolve(immediate);
+        if (resident && this.waiters.length === 0 && this.current + bytes <= this.capacity) {
+            return Promise.resolve(this.grant(bytes, true));
+        }
         return new Promise((resolve, reject) => {
             const waiter = {
                 bytes,
+                resident,
                 resolve,
                 reject,
                 signal,
@@ -48,8 +73,10 @@ class CreditLane {
             this.drain();
         });
     }
-    grant(bytes) {
+    grant(bytes, resident) {
         this.current += bytes;
+        if (resident)
+            this.resident += bytes;
         this.peak = Math.max(this.peak, this.current);
         let leasedBytes = bytes;
         let released = false;
@@ -67,6 +94,8 @@ class CreditLane {
                     throw new RangeError(`weighted credit lease can only shrink to a positive safe integer no larger than ${leasedBytes}: ${nextBytes}`);
                 }
                 this.current -= leasedBytes - nextBytes;
+                if (resident)
+                    this.resident -= leasedBytes - nextBytes;
                 leasedBytes = nextBytes;
                 this.drain();
             },
@@ -75,6 +104,8 @@ class CreditLane {
                     return;
                 released = true;
                 this.current -= leasedBytes;
+                if (resident)
+                    this.resident -= leasedBytes;
                 if (this.current < 0) {
                     throw new Error('weighted credit accounting underflow');
                 }
@@ -95,7 +126,7 @@ class CreditLane {
                 return;
             this.waiters.shift();
             waiter.signal?.removeEventListener('abort', waiter.onAbort);
-            waiter.resolve(this.grant(waiter.bytes));
+            waiter.resolve(this.grant(waiter.bytes, waiter.resident));
         }
     }
 }
@@ -154,6 +185,7 @@ export class WeightedCreditPool {
             current: general.current + small.current,
             peak: general.peak + small.peak,
             queued: general.queued + small.queued,
+            resident: general.resident + small.resident,
         };
     }
     isSmall(bytes) {
@@ -184,6 +216,22 @@ export class WeightedCreditPool {
         }
         return this.general.acquire(bytes, signal);
     }
+    /**
+     * Take credit that will be held for the owner's whole lifetime rather than
+     * for one operation — the esbuild pool's wasm image is the case.
+     *
+     * Recorded as a floor so a later claim that could never fit around it is
+     * refused with both numbers instead of parking in the FIFO forever.
+     */
+    acquireResident(bytes, signal) {
+        try {
+            this.validateRequest(bytes);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        return this.general.acquire(bytes, signal, true);
+    }
     validateRequest(bytes) {
         if (!Number.isSafeInteger(bytes) || bytes <= 0 || bytes > this.capacity) {
             throw new RangeError(`weighted credit request must be a positive safe integer no larger than ${this.capacity}: ${bytes}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/platform",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "The measured Cloudflare platform truths Nimbus is built on — error taxonomy, limits tables, budget coordination, and wire-format primitives, with zero runtime dependencies.",
   "keywords": [
     "cloudflare",

package/src/heavy-alloc-coord.ts

@@ -24,6 +24,8 @@ export interface SupervisorAllocationBudgetStats {
   readonly current: number;
   readonly peak: number;
   readonly queued: number;
+  /** Credit held for an owner's whole lifetime; see `acquireResident`. */
+  readonly resident: number;
 }
 
 interface AllocationBudgetLifecycle {
@@ -82,12 +84,24 @@ export class SupervisorAllocationBudget {
     return this._acquire(bytes, signal, false);
   }
 
+  /**
+   * Reserve bytes an owner holds for its whole lifetime, not for one
+   * operation. Recorded as a floor: a later claim larger than what remains
+   * around it is refused with both numbers rather than parked forever.
+   */
+  acquireResidentBytes(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease> {
+    return this._acquire(bytes, signal, true, true);
+  }
+
   private async _acquire(
     bytes: number,
     signal: AbortSignal | undefined,
     drivesLifecycle: boolean,
+    resident = false,
   ): Promise<ResizableCreditLease> {
-    const credit = await this.credits.acquire(bytes, signal);
+    const credit = resident
+      ? await this.credits.acquireResident(bytes, signal)
+      : await this.credits.acquire(bytes, signal);
     if (drivesLifecycle) {
       this.lifecycleHolders++;
       if (!this.active) {
@@ -224,6 +238,17 @@ export function acquireSupervisorReadAllocation(
   return supervisorAllocationBudget.acquireWithoutLifecycle(bytes, signal);
 }
 
+/**
+ * Reserve bytes for the whole life of the owner that takes them — an image
+ * a pool keeps until it is disposed. See `acquireResidentBytes`.
+ */
+export function acquireResidentSupervisorAllocation(
+  bytes: number,
+  signal?: AbortSignal,
+): Promise<ResizableCreditLease> {
+  return supervisorAllocationBudget.acquireResidentBytes(bytes, signal);
+}
+
 /**
  * Reserve the full budget for an allocation whose retained size is not known
  * accurately enough to overlap safely with other heavy work.

package/src/limits.ts

@@ -28,6 +28,14 @@ export const MAX_TX_BLOB_BYTES = 1 * 1024 * 1024;
 export const MAX_TX_LOGICAL_ROWS = 256;
 export const MAX_TX_SQL_EXECS = 64;
 
+/**
+ * Bound parameters per SQL statement on Durable Objects SQLite. Measured
+ * 2026-09-21 on workerd: 100 bind, 101 fail as `too many SQL variables`
+ * (a 9-row insert of 12 columns fails, 8 rows succeed). Every IN-list and
+ * multi-row VALUES statement is sized from this.
+ */
+export const SQL_MAX_BOUND_PARAMETERS = 100;
+
 // ── SQLite storage walls ────────────────────────────────────────────────
 
 /**

package/src/w7-frame.ts

@@ -220,7 +220,7 @@ export async function decodeWriteBatchStream(
   } catch {
     throw new Error('w7-frame: stream must be a byte-oriented ReadableStream');
   }
-  const buffer = new ExactByteReader(reader);
+  const buffer = new ExactByteReader(reader, options.signal);
   let handedOff = false;
   try {
     throwIfAborted(options.signal);
@@ -1006,7 +1006,20 @@ async function cancelReader(
 class ExactByteReader {
   private done = false;
 
-  constructor(private readonly reader: ReadableStreamBYOBReader) {}
+  constructor(private readonly reader: ReadableStreamBYOBReader, private readonly signal?: AbortSignal) {}
+
+  private async read<T>(read: () => Promise<T>, cancel: () => Promise<void>): Promise<T> {
+    throwIfAborted(this.signal);
+    const abort = () => { void cancel().catch(() => {}); };
+    this.signal?.addEventListener('abort', abort, { once: true });
+    try {
+      const result = await read();
+      throwIfAborted(this.signal);
+      return result;
+    } finally {
+      this.signal?.removeEventListener('abort', abort);
+    }
+  }
 
   async readExact(length: number, label: string): Promise<Uint8Array> {
     if (length === 0) return new Uint8Array(0);
@@ -1018,7 +1031,10 @@ class ExactByteReader {
           `w7-frame: stream ended ${offset} bytes into expected ${length}-byte ${label}`,
         );
       }
-      const next = await this.reader.read(new Uint8Array(length - offset));
+      const next = await this.read(
+        () => this.reader.read(new Uint8Array(length - offset)),
+        () => this.reader.cancel(this.signal?.reason),
+      );
       if (next.done) this.done = true;
       else if (next.value.byteLength > 0) {
         output.set(next.value, offset);
@@ -1033,7 +1049,7 @@ class ExactByteReader {
     this.reader.releaseLock();
     const reader = stream.getReader();
     try {
-      const next = await reader.read();
+      const next = await this.read(() => reader.read(), () => reader.cancel(this.signal?.reason));
       if (!next.done && next.value.byteLength > 0) {
         await reader.cancel(new Error('w7-frame: trailing bytes after batch-end'));
         throw new Error('w7-frame: trailing bytes after batch-end');

package/src/weighted-credit-pool.ts

@@ -11,6 +11,11 @@ export interface WeightedCreditPoolStats {
   readonly current: number;
   readonly peak: number;
   readonly queued: number;
+  /**
+   * Credit held by owners that keep it for their whole lifetime rather than
+   * for one operation — the floor no waiter can ever expect to get back.
+   */
+  readonly resident: number;
 }
 
 export interface WeightedCreditPoolOptions {
@@ -29,6 +34,8 @@ export interface WeightedCreditPoolOptions {
 
 interface CreditWaiter {
   readonly bytes: number;
+  /** Whether the granted lease counts toward the resident floor. */
+  readonly resident: boolean;
   readonly resolve: (lease: ResizableCreditLease) => void;
   readonly reject: (error: Error) => void;
   readonly signal?: AbortSignal;
@@ -39,27 +46,55 @@ interface CreditWaiter {
 class CreditLane {
   private current = 0;
   private peak = 0;
+  private resident = 0;
   private readonly waiters: CreditWaiter[] = [];
 
   constructor(readonly capacity: number) {}
 
   get stats(): WeightedCreditPoolStats {
-    return { current: this.current, peak: this.peak, queued: this.waiters.length };
+    return {
+      current: this.current, peak: this.peak, queued: this.waiters.length, resident: this.resident,
+    };
   }
 
   tryAcquire(bytes: number): ResizableCreditLease | null {
     if (this.waiters.length > 0 || this.current + bytes > this.capacity) return null;
-    return this.grant(bytes);
+    return this.grant(bytes, false);
   }
 
-  acquire(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease> {
+  /**
+   * The largest claim this lane can ever grant: capacity less what resident
+   * owners hold for their whole lifetime. A claim above it cannot be
+   * satisfied by waiting, because nothing it is waiting for will be
+   * released.
+   */
+  get grantableCeiling(): number {
+    return this.capacity - this.resident;
+  }
+
+  acquire(bytes: number, signal?: AbortSignal, resident = false): Promise<ResizableCreditLease> {
     if (signal?.aborted) return Promise.reject(abortError(signal));
-    const immediate = this.tryAcquire(bytes);
+    // Refuse a claim no amount of waiting can satisfy, rather than parking it
+    // in the FIFO forever. A parked claim is indistinguishable from a caller
+    // that stopped: no error, no timeout, and — because the queue refuses
+    // everyone behind it — no further progress anywhere in the isolate. That
+    // is what a real-vite launch looked like for four rounds of debugging.
+    if (bytes > this.grantableCeiling) {
+      return Promise.reject(new RangeError(
+        `weighted credit claim of ${bytes} bytes can never be granted: capacity is ${this.capacity} `
+        + `and ${this.resident} bytes are held by resident owners, leaving ${this.grantableCeiling}`,
+      ));
+    }
+    const immediate = resident ? null : this.tryAcquire(bytes);
     if (immediate) return Promise.resolve(immediate);
+    if (resident && this.waiters.length === 0 && this.current + bytes <= this.capacity) {
+      return Promise.resolve(this.grant(bytes, true));
+    }
 
     return new Promise<ResizableCreditLease>((resolve, reject) => {
       const waiter: CreditWaiter = {
         bytes,
+        resident,
         resolve,
         reject,
         signal,
@@ -84,8 +119,9 @@ class CreditLane {
     });
   }
 
-  private grant(bytes: number): ResizableCreditLease {
+  private grant(bytes: number, resident: boolean): ResizableCreditLease {
     this.current += bytes;
+    if (resident) this.resident += bytes;
     this.peak = Math.max(this.peak, this.current);
     let leasedBytes = bytes;
     let released = false;
@@ -107,6 +143,7 @@ class CreditLane {
           );
         }
         this.current -= leasedBytes - nextBytes;
+        if (resident) this.resident -= leasedBytes - nextBytes;
         leasedBytes = nextBytes;
         this.drain();
       },
@@ -114,6 +151,7 @@ class CreditLane {
         if (released) return;
         released = true;
         this.current -= leasedBytes;
+        if (resident) this.resident -= leasedBytes;
         if (this.current < 0) {
           throw new Error('weighted credit accounting underflow');
         }
@@ -134,7 +172,7 @@ class CreditLane {
       if (this.current + waiter.bytes > this.capacity) return;
       this.waiters.shift();
       waiter.signal?.removeEventListener('abort', waiter.onAbort!);
-      waiter.resolve(this.grant(waiter.bytes));
+      waiter.resolve(this.grant(waiter.bytes, waiter.resident));
     }
   }
 }
@@ -195,6 +233,7 @@ export class WeightedCreditPool {
       current: general.current + small.current,
       peak: general.peak + small.peak,
       queued: general.queued + small.queued,
+      resident: general.resident + small.resident,
     };
   }
 
@@ -226,6 +265,22 @@ export class WeightedCreditPool {
     return this.general.acquire(bytes, signal);
   }
 
+  /**
+   * Take credit that will be held for the owner's whole lifetime rather than
+   * for one operation — the esbuild pool's wasm image is the case.
+   *
+   * Recorded as a floor so a later claim that could never fit around it is
+   * refused with both numbers instead of parking in the FIFO forever.
+   */
+  acquireResident(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease> {
+    try {
+      this.validateRequest(bytes);
+    } catch (error) {
+      return Promise.reject(error as Error);
+    }
+    return this.general.acquire(bytes, signal, true);
+  }
+
   private validateRequest(bytes: number): void {
     if (!Number.isSafeInteger(bytes) || bytes <= 0 || bytes > this.capacity) {
       throw new RangeError(