@nimbus-sh/platform 0.8.1 → 0.13.0

package/dist/weighted-credit-pool.d.ts

@@ -4,6 +4,11 @@ export interface CreditLease {
 }
 export interface ResizableCreditLease extends CreditLease {
     shrinkTo(bytes: number): void;
+    /**
+     * Holds `bytes` in all if the rest can be granted now, in its own lane, as
+     * tryAcquire would grant it; else holds what it held and answers false.
+     */
+    tryGrowTo(bytes: number): boolean;
 }
 export interface WeightedCreditPoolStats {
     readonly current: number;
@@ -23,6 +28,26 @@ export interface WeightedCreditPoolOptions {
      */
     readonly reserve?: number;
 }
+/**
+ * How long a waiter woken to its turn keeps it for its own continuation to
+ * take the credit. workerd cancels the continuations of a request that has
+ * completed or been canceled when another request's code resolves its
+ * promise (the cross-request promise rule, on by date since 2024-10-14), so
+ * a waiter whose request is gone is woken and never takes: its turn lapses
+ * and the next waiter's comes. A live continuation takes it in far less.
+ */
+export declare const CREDIT_TURN_MS = 1000;
+/**
+ * A place in a lane's queue. `woken` resolves when its turn comes; `take`,
+ * called from the waiter's own continuation, holds the credit then, or
+ * answers null when the turn lapsed, the credit no longer fits, or it was
+ * aborted, and the place waits again. `leave` gives up the place.
+ */
+export interface CreditTurn {
+    woken(): Promise<void>;
+    take(): ResizableCreditLease | null;
+    leave(): void;
+}
 /**
  * FIFO byte-credit pool shared by concurrent allocation owners.
  * Capacity is measured in retained bytes, not operation count.
@@ -55,6 +80,24 @@ export declare class WeightedCreditPool {
     get stats(): WeightedCreditPoolStats;
     private isSmall;
     tryAcquire(bytes: number): ResizableCreditLease | null;
+    /**
+     * A running program's ask (SupervisorAllocationBudget.acquireRunning),
+     * ahead of every ordinary ask: granted now if it fits beside what is held,
+     * whatever is queued (a small one in its reserve too), or else as soon as
+     * it fits in the shared capacity, the credit running work and reclaims
+     * free. It never waits on the reserve, which neither frees.
+     */
+    acquireAhead(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
+    /** Whether a running program's ask (acquireAhead) waits for credit no woken turn is taking (CreditLane.aheadStarved). */
+    get aheadStarved(): boolean;
+    /** acquireAhead's credit now, or null. */
+    tryAcquireAhead(bytes: number): ResizableCreditLease | null;
+    /**
+     * A place in line for `bytes`, in the lane it would wait in, for a caller
+     * that takes its turn itself (CreditTurn): what acquire does once nothing
+     * is free.
+     */
+    queue(bytes: number, signal?: AbortSignal): CreditTurn;
     acquire(bytes: number, signal?: AbortSignal): Promise<ResizableCreditLease>;
     private validateRequest;
 }

package/dist/weighted-credit-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"weighted-credit-pool.d.ts","sourceRoot":"","sources":["../src/weighted-credit-pool.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAkHD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,kBAAkB;IAKjB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B;IAoB9E,IAAI,KAAK,IAAI,uBAAuB,CASnC;IAED,OAAO,CAAC,OAAO;IAIf,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAOtD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiB3E,OAAO,CAAC,eAAe;CAOxB"}
+{"version":3,"file":"weighted-credit-pool.d.ts","sourceRoot":"","sources":["../src/weighted-credit-pool.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,oBAAoB,GAAG,IAAI,CAAC;IACpC,KAAK,IAAI,IAAI,CAAC;CACf;AA8PD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,kBAAkB;IAKjB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,yBAA8B;IAoB9E,IAAI,KAAK,IAAI,uBAAuB,CASnC;IAED,OAAO,CAAC,OAAO;IAIf,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAOtD;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMhF,yHAAyH;IACzH,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED,0CAA0C;IAC1C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAO3D;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,UAAU;IAKtD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmB3E,OAAO,CAAC,eAAe;CAOxB"}

package/dist/weighted-credit-pool.js

@@ -1,52 +1,193 @@
-/** One FIFO queue over one byte capacity. */
+/**
+ * How long a waiter woken to its turn keeps it for its own continuation to
+ * take the credit. workerd cancels the continuations of a request that has
+ * completed or been canceled when another request's code resolves its
+ * promise (the cross-request promise rule, on by date since 2024-10-14), so
+ * a waiter whose request is gone is woken and never takes: its turn lapses
+ * and the next waiter's comes. A live continuation takes it in far less.
+ */
+export const CREDIT_TURN_MS = 1000;
+/**
+ * An ask queued in a lane. `waiting` for its turn; `woken` to it at
+ * `wokenAt`, its credit free for it to take; `lapsed` when the turn passed
+ * untaken (out of the queue, back in at the end if it ever takes); `done`
+ * once it took its credit, left, or was aborted.
+ */
+class Turn {
+    lane;
+    bytes;
+    signal;
+    ahead;
+    state = 'waiting';
+    wokenAt = 0;
+    /** Its wait for the turn it is queued for, resolved as it is woken or aborted. */
+    turn;
+    wake = () => { };
+    /** Its look at the line every CREDIT_TURN_MS while it is queued. */
+    recheck = undefined;
+    constructor(lane, bytes, signal, ahead) {
+        this.lane = lane;
+        this.bytes = bytes;
+        this.signal = signal;
+        this.ahead = ahead;
+        this.turn = this.arm();
+    }
+    /** A fresh wait for its turn. */
+    arm() {
+        this.state = 'waiting';
+        this.turn = new Promise((resolve) => { this.wake = resolve; });
+        return this.turn;
+    }
+    woken() { return this.turn; }
+    take() { return this.lane.take(this); }
+    leave() { this.lane.leave(this); }
+    handleEvent() { this.lane.abandon(this); }
+}
+/**
+ * One byte capacity and its queues: FIFO, but for asks `ahead` of it (a
+ * running program's), which are served first, FIFO among themselves.
+ */
 class CreditLane {
     capacity;
+    largest;
     current = 0;
     peak = 0;
     waiters = [];
-    constructor(capacity) {
+    ahead = [];
+    /** `largest`: the most one lease of this lane may hold (a small request's bound, for the reserve). */
+    constructor(capacity, largest = capacity) {
         this.capacity = capacity;
+        this.largest = largest;
     }
     get stats() {
-        return { current: this.current, peak: this.peak, queued: this.waiters.length };
+        return { current: this.current, peak: this.peak, queued: this.waiters.length + this.ahead.length };
     }
-    tryAcquire(bytes) {
-        if (this.waiters.length > 0 || this.current + bytes > this.capacity)
+    /**
+     * Whether the asks ahead want more than is free: what reclaiming more is
+     * for. Each holds its bytes once its turn is taken, so they are counted
+     * together, a turn woken and not yet taken included.
+     */
+    get aheadStarved() {
+        return this.ahead.reduce((wanted, waiter) => wanted + waiter.bytes, this.current) > this.capacity;
+    }
+    /** Granted now, or null: an ask ahead waits only for asks ahead of it, any other for every ask queued. */
+    tryAcquire(bytes, ahead = false) {
+        if (this.ahead.length > 0 || (!ahead && this.waiters.length > 0) || this.current + bytes > this.capacity)
             return null;
         return this.grant(bytes);
     }
     acquire(bytes, signal) {
+        return this.wait(bytes, signal, false);
+    }
+    /** acquire, ahead of every ordinary ask: granted as soon as it fits, after only the asks ahead before it. */
+    acquireAhead(bytes, signal) {
+        return this.wait(bytes, signal, true);
+    }
+    wait(bytes, signal, ahead) {
         if (signal?.aborted)
             return Promise.reject(abortError(signal));
-        const immediate = this.tryAcquire(bytes);
-        if (immediate)
-            return Promise.resolve(immediate);
-        return new Promise((resolve, reject) => {
-            const waiter = {
-                bytes,
-                resolve,
-                reject,
-                signal,
-                onAbort: signal
-                    ? () => {
-                        const index = this.waiters.indexOf(waiter);
-                        if (index < 0)
-                            return;
-                        this.waiters.splice(index, 1);
-                        signal.removeEventListener('abort', waiter.onAbort);
-                        reject(abortError(signal));
-                        this.drain();
-                    }
-                    : undefined,
-            };
-            this.waiters.push(waiter);
-            signal?.addEventListener('abort', waiter.onAbort, { once: true });
-            if (signal?.aborted) {
-                waiter.onAbort();
-                return;
+        const immediate = this.tryAcquire(bytes, ahead);
+        return immediate ? Promise.resolve(immediate) : this.takeInTurn(this.queue(bytes, signal, ahead), signal);
+    }
+    async takeInTurn(turn, signal) {
+        try {
+            for (;;) {
+                await turn.turn;
+                const lease = this.take(turn);
+                if (lease)
+                    return lease;
+                if (signal?.aborted)
+                    throw abortError(signal);
             }
+        }
+        finally {
+            this.leave(turn);
+        }
+    }
+    /**
+     * A place at the end of the queue for `bytes` (ahead of every ordinary ask,
+     * if `ahead`). While it is queued it looks at the line again every
+     * CREDIT_TURN_MS, so a turn another waiter never took lapses even when
+     * nothing else touches the lane. Asked with a signal already aborted, it
+     * is done at once, as it would be on the abort.
+     */
+    queue(bytes, signal, ahead) {
+        const turn = new Turn(this, bytes, signal, ahead);
+        signal?.addEventListener('abort', turn, { once: true });
+        this.place(turn);
+        if (signal?.aborted)
+            this.abandon(turn);
+        else
+            this.drain();
+        return turn;
+    }
+    place(turn) {
+        (turn.ahead ? this.ahead : this.waiters).push(turn);
+        if (turn.recheck !== undefined)
+            return;
+        const timer = setInterval(() => {
+            if (turn.state === 'waiting' || turn.state === 'woken')
+                this.drain();
+            else {
+                clearInterval(timer);
+                turn.recheck = undefined;
+            }
+        }, CREDIT_TURN_MS);
+        turn.recheck = timer;
+    }
+    remove(turn) {
+        const queue = turn.ahead ? this.ahead : this.waiters;
+        const index = queue.indexOf(turn);
+        if (index >= 0)
+            queue.splice(index, 1);
+    }
+    /** Its signal aborted: it is done, its wait ends, and the next turn may come. */
+    abandon(turn) {
+        if (turn.state === 'done')
+            return;
+        this.remove(turn);
+        turn.state = 'done';
+        turn.wake();
+        this.drain();
+    }
+    take(turn) {
+        if (turn.state === 'done')
+            return null;
+        // Taken past its turn: the turn passed, as if a look at the line had seen it first.
+        if (turn.state === 'woken' && Date.now() - turn.wokenAt >= CREDIT_TURN_MS) {
+            this.remove(turn);
+            turn.state = 'lapsed';
+            this.drain();
+        }
+        if (turn.state === 'lapsed') {
+            turn.arm();
+            this.place(turn);
             this.drain();
-        });
+            return null;
+        }
+        // Its turn, its credit still free, and no running ask before an ordinary one: its own now.
+        if (turn.state === 'woken' && this.current + turn.bytes <= this.capacity && (turn.ahead || this.ahead.length === 0)) {
+            this.remove(turn);
+            turn.state = 'done';
+            const lease = this.grant(turn.bytes);
+            this.drain();
+            return lease;
+        }
+        // Not its turn yet, or no longer room: it waits again, in its place.
+        if (turn.state === 'woken')
+            turn.arm();
+        return null;
+    }
+    leave(turn) {
+        turn.signal?.removeEventListener('abort', turn);
+        if (turn.recheck !== undefined)
+            clearInterval(turn.recheck);
+        turn.recheck = undefined;
+        if (turn.state !== 'done') {
+            this.remove(turn);
+            turn.state = 'done';
+        }
+        this.drain();
     }
     grant(bytes) {
         this.current += bytes;
@@ -70,6 +211,22 @@ class CreditLane {
                 leasedBytes = nextBytes;
                 this.drain();
             },
+            tryGrowTo: (nextBytes) => {
+                if (released) {
+                    throw new Error('cannot grow a released weighted credit lease');
+                }
+                if (!Number.isSafeInteger(nextBytes) || nextBytes < leasedBytes) {
+                    throw new RangeError(`weighted credit lease can only grow to a safe integer no smaller than ${leasedBytes}: ${nextBytes}`);
+                }
+                // Never ahead of a queued ask, as an ordinary tryAcquire.
+                if (nextBytes > this.largest || this.ahead.length > 0 || this.waiters.length > 0
+                    || this.current + nextBytes - leasedBytes > this.capacity)
+                    return false;
+                this.current += nextBytes - leasedBytes;
+                this.peak = Math.max(this.peak, this.current);
+                leasedBytes = nextBytes;
+                return true;
+            },
             release: () => {
                 if (released)
                     return;
@@ -82,20 +239,32 @@ class CreditLane {
             },
         };
     }
-    drain() {
-        while (this.waiters.length > 0) {
-            const waiter = this.waiters[0];
-            if (waiter.signal?.aborted) {
-                this.waiters.shift();
-                waiter.signal.removeEventListener('abort', waiter.onAbort);
-                waiter.reject(abortError(waiter.signal));
-                continue;
-            }
-            if (this.current + waiter.bytes > this.capacity)
+    /**
+     * Wake the first waiter whose credit is free to its turn, asks ahead first;
+     * the ordinary queue only once none is waiting. The credit is never handed
+     * over: the waiter takes it in its own continuation (CreditTurn.take), so
+     * one whose continuation never runs holds nothing. A woken turn holds its
+     * queue until it is taken or lapses (CREDIT_TURN_MS), one turn at a time.
+     */
+    drain(now) {
+        for (const queue of [this.ahead, this.waiters]) {
+            for (let waiter = queue[0]; waiter !== undefined; waiter = queue[0]) {
+                if (waiter.state === 'woken') {
+                    now ??= Date.now();
+                    if (now - waiter.wokenAt < CREDIT_TURN_MS)
+                        return;
+                    // Never taken: its continuation is gone, or late and back at the end of the line if it ever takes.
+                    queue.shift();
+                    waiter.state = 'lapsed';
+                    continue;
+                }
+                if (this.current + waiter.bytes > this.capacity)
+                    return;
+                waiter.state = 'woken';
+                waiter.wokenAt = now ?? Date.now();
+                waiter.wake();
                 return;
-            this.waiters.shift();
-            waiter.signal?.removeEventListener('abort', waiter.onAbort);
-            waiter.resolve(this.grant(waiter.bytes));
+            }
         }
     }
 }
@@ -143,7 +312,7 @@ export class WeightedCreditPool {
         }
         this.general = new CreditLane(capacity);
         this.smallRequestBytes = smallRequestBytes;
-        this.small = smallRequestBytes > 0 ? new CreditLane(reserve) : null;
+        this.small = smallRequestBytes > 0 ? new CreditLane(reserve, smallRequestBytes) : null;
     }
     get stats() {
         const general = this.general.stats;
@@ -166,6 +335,38 @@ export class WeightedCreditPool {
             return shared;
         return this.small.tryAcquire(bytes);
     }
+    /**
+     * A running program's ask (SupervisorAllocationBudget.acquireRunning),
+     * ahead of every ordinary ask: granted now if it fits beside what is held,
+     * whatever is queued (a small one in its reserve too), or else as soon as
+     * it fits in the shared capacity, the credit running work and reclaims
+     * free. It never waits on the reserve, which neither frees.
+     */
+    acquireAhead(bytes, signal) {
+        this.validateRequest(bytes);
+        const now = signal?.aborted ? null : this.tryAcquireAhead(bytes);
+        return now ? Promise.resolve(now) : this.general.acquireAhead(bytes, signal);
+    }
+    /** Whether a running program's ask (acquireAhead) waits for credit no woken turn is taking (CreditLane.aheadStarved). */
+    get aheadStarved() {
+        return this.general.aheadStarved;
+    }
+    /** acquireAhead's credit now, or null. */
+    tryAcquireAhead(bytes) {
+        this.validateRequest(bytes);
+        const shared = this.general.tryAcquire(bytes, true);
+        const small = this.isSmall(bytes) ? this.small : null;
+        return shared ?? small?.tryAcquire(bytes, true) ?? null;
+    }
+    /**
+     * A place in line for `bytes`, in the lane it would wait in, for a caller
+     * that takes its turn itself (CreditTurn): what acquire does once nothing
+     * is free.
+     */
+    queue(bytes, signal) {
+        this.validateRequest(bytes);
+        return (this.small !== null && this.isSmall(bytes) ? this.small : this.general).queue(bytes, signal, false);
+    }
     acquire(bytes, signal) {
         try {
             this.validateRequest(bytes);
@@ -173,6 +374,9 @@ export class WeightedCreditPool {
         catch (error) {
             return Promise.reject(error);
         }
+        // Refused before any lane is asked, whichever would have granted it.
+        if (signal?.aborted)
+            return Promise.reject(abortError(signal));
         if (this.isSmall(bytes)) {
             // Shared capacity while it is free — a small request should get the
             // same concurrency as any other when nothing is contending. It never

package/dist/worker-code.d.ts

@@ -0,0 +1,48 @@
+export interface JsModule {
+    js: string;
+}
+export interface CjsModule {
+    cjs: string;
+}
+export interface PyModule {
+    py: string;
+}
+export interface TextModule {
+    text: string;
+}
+export interface DataModule {
+    data: ArrayBuffer;
+}
+export interface JsonModule {
+    json: unknown;
+}
+export interface WasmModule {
+    wasm: ArrayBuffer | WebAssembly.Module;
+}
+/**
+ * `bytes` as the ArrayBuffer a `{ wasm }` or `{ data }` member carries: their
+ * own buffer when they span all of it, and only otherwise a copy of them, so
+ * an image read whole for a load is never held twice.
+ */
+export declare function memberBuffer(bytes: Uint8Array): ArrayBuffer;
+/** Plain strings use the module name's extension. */
+export type ModuleContent = string | JsModule | CjsModule | PyModule | TextModule | DataModule | JsonModule | WasmModule;
+export interface ServiceStub {
+    fetch(input: RequestInfo, init?: RequestInit): Promise<Response>;
+}
+/** The shared Worker Loader contract, including staged resident assemblies. */
+export interface WorkerCode {
+    compatibilityDate: string;
+    compatibilityFlags?: string[];
+    allowExperimental?: boolean;
+    limits?: {
+        cpuMs?: number;
+        subRequests?: number;
+    };
+    mainModule: string;
+    modules: Record<string, ModuleContent>;
+    env?: Record<string, unknown>;
+    globalOutbound?: ServiceStub | null;
+    tails?: ServiceStub[];
+}
+//# sourceMappingURL=worker-code.d.ts.map

package/dist/worker-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-code.d.ts","sourceRoot":"","sources":["../src/worker-code.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE;AACxC,MAAM,WAAW,SAAS;IAAG,GAAG,EAAE,MAAM,CAAA;CAAE;AAC1C,MAAM,WAAW,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAA;CAAE;AACxC,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAA;CAAE;AAC5C,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,WAAW,CAAA;CAAE;AACjD,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,OAAO,CAAA;CAAE;AAC7C,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC,MAAM,CAAA;CAAE;AAEtE;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAI3D;AAED,qDAAqD;AACrD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEzH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClE;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,cAAc,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB"}

package/dist/worker-code.js

@@ -0,0 +1,10 @@
+/**
+ * `bytes` as the ArrayBuffer a `{ wasm }` or `{ data }` member carries: their
+ * own buffer when they span all of it, and only otherwise a copy of them, so
+ * an image read whole for a load is never held twice.
+ */
+export function memberBuffer(bytes) {
+    return bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength && bytes.buffer instanceof ArrayBuffer
+        ? bytes.buffer
+        : bytes.slice().buffer;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/platform",
-  "version": "0.8.1",
+  "version": "0.13.0",
   "description": "The measured Cloudflare platform truths Nimbus is built on \u2014 error taxonomy, limits tables, budget coordination, and wire-format primitives, with zero runtime dependencies.",
   "keywords": [
     "cloudflare",

package/src/composition.ts

@@ -33,9 +33,11 @@
  * the Durable Object classes, which is what lets the pool be unit-tested
  * in a plain Node/Bun process.
  */
+import type { WorkerCode } from './worker-code.js';
+
 export type EntrypointLoopbackFactory = <Stub = unknown>(options: { props: object }) => Stub;
 export type CtxExports = Record<string, EntrypointLoopbackFactory | undefined>;
-export type StagedBootAssembler = (env: unknown, stage: unknown) => Promise<object>;
+export type StagedBootAssembler = (env: unknown, stage: unknown) => Promise<WorkerCode>;
 
 export interface FabricComposition {
   supervisorEntrypoint: string;
@@ -67,11 +69,17 @@ let composition: FabricComposition | null = null;
 let ctxExports: CtxExports | null = null;
 
 /**
- * A program's filesystem errors reach it across workerd RPC, from the host
- * that answers its supervisor binding, and the program branches on the POSIX
- * `code` each one carries. workerd carries an error's own properties across
- * RPC only when the sending AND the receiving isolate have
- * `enhanced_error_serialization`, on by compatibility date from 2026-04-21:
+ * The compatibility flags a host composes the fabric under, refused without.
+ * Composing refuses wherever it composes (module scope: the Worker fails at
+ * startup; NimbusWorkspace.create: that call throws), naming the fix. Off
+ * workerd (bun, node) there is no `Cloudflare` global to read, and neither
+ * flag has anything to act on.
+ *
+ * `enhanced_error_serialization`: a program's filesystem errors reach it
+ * across workerd RPC, from the host that answers its supervisor binding, and
+ * the program branches on the POSIX `code` each one carries. workerd carries
+ * an error's own properties across RPC only when the sending AND the
+ * receiving isolate have the flag, on by compatibility date from 2026-04-21:
  * the serializer writes a native error as a host object with its own
  * properties only under the flag (src/workerd/jsg/ser.c++,
  * Serializer::IsHostObject), and the receiver reads that detail back only
@@ -79,22 +87,34 @@ let ctxExports: CtxExports | null = null;
  * https://developers.cloudflare.com/workers/runtime-apis/rpc/error-handling/.
  * Programs load at CF_COMPAT_DATE, past it. The host runs at its embedder's
  * date, and below it every ENOENT would reach every program as a bare message
- * it maps to EIO. So composing refuses such a host, wherever it composes
- * (module scope: the Worker fails at startup; NimbusWorkspace.create: that
- * call throws), and names both fixes: the flag alone keeps
- * every other behavior of the embedder's date. Off workerd (bun, node) there
- * is no RPC hop and no `Cloudflare` global to read.
+ * it maps to EIO. The flag alone keeps every other behavior of that date.
+ *
+ * `enable_request_signal`, which no compatibility date enables: a process
+ * owns work for a response until its client is done with it, and a client
+ * that goes away is seen only as the incoming request's `signal` aborting
+ * (src/workerd/io/worker-entrypoint.c++, "The client has disconnected").
+ * Without it a response whose client left keeps its process's work, and the
+ * host that runs it, held until the process writes again, or for good.
  */
-function requireEnhancedErrorSerialization(): void {
+function requireHostFlags(): void {
   // `typeof` of an undeclared global is 'undefined', not a ReferenceError.
   if (typeof Cloudflare === 'undefined') return;
-  if (Cloudflare.compatibilityFlags.enhanced_error_serialization === true) return;
-  throw new Error(
-    'fabric: this Worker runs without the enhanced_error_serialization compatibility flag, so the '
-      + "code on a program's filesystem error (ENOENT, EEXIST, ...) would not survive the RPC back "
-      + 'to it. Add "enhanced_error_serialization" to compatibility_flags in your wrangler config, '
-      + 'or set compatibility_date to 2026-04-21 or later.',
-  );
+  if (Cloudflare.compatibilityFlags.enhanced_error_serialization !== true) {
+    throw new Error(
+      'fabric: this Worker runs without the enhanced_error_serialization compatibility flag, so the '
+        + "code on a program's filesystem error (ENOENT, EEXIST, ...) would not survive the RPC back "
+        + 'to it. Add "enhanced_error_serialization" to compatibility_flags in your wrangler config, '
+        + 'or set compatibility_date to 2026-04-21 or later.',
+    );
+  }
+  if (Cloudflare.compatibilityFlags.enable_request_signal !== true) {
+    throw new Error(
+      'fabric: this Worker runs without the enable_request_signal compatibility flag, so a process '
+        + 'cannot see a client leave the response it is serving, and keeps that work held. Add '
+        + '"enable_request_signal" to compatibility_flags in your wrangler config; no compatibility '
+        + 'date enables it.',
+    );
+  }
 }
 
 /**
@@ -102,10 +122,10 @@ function requireEnhancedErrorSerialization(): void {
  * a second call with different values throws, naming both, so an embedder
  * whose composition lost to an earlier import learns it at startup rather
  * than from a facet that reached the wrong host. A host without
- * `enhanced_error_serialization` is refused.
+ * `enhanced_error_serialization` or `enable_request_signal` is refused.
  */
 export function composeFabric(value: FabricComposition): void {
-  requireEnhancedErrorSerialization();
+  requireHostFlags();
   if (!composition) {
     composition = value;
     return;

package/src/crc32.ts

@@ -9,26 +9,23 @@
  * Measured 2026-09-24 (5k files x 2 KiB; 64 MiB in 1 MiB buffers):
  * node:zlib's crc32 is 5-40x faster than any JavaScript loop in bun, node and
  * workerd (compat 2026-04-01, nodejs_compat), but each call costs ~0.14 us in
- * workerd, so below 128 bytes the table loop wins there. It is reached through
- * `process.getBuiltinModule`, like core's incremental SHA-256, so this module
- * imports nothing and still loads where node:zlib is absent (a browser,
- * workerd without nodejs_compat). The JavaScript path is slicing-by-8: 2-3x
- * the byte-at-a-time table loop in bun and node, and level with it in workerd.
+ * workerd, so below 128 bytes the table loop wins there. It is the realm's
+ * own (realmBuiltin), like core's incremental SHA-256's, so this module still
+ * loads where node:zlib is absent (a browser, workerd without nodejs_compat).
+ * The JavaScript path is slicing-by-8: 2-3x the byte-at-a-time table loop in
+ * bun and node, and level with it in workerd.
  */
 
+import { realmBuiltin } from './realm-builtin.js';
+
 type NodeZlib = { crc32?(data: Uint8Array, value?: number): number };
-type BuiltinModules = { process?: { getBuiltinModule?(id: 'node:zlib'): NodeZlib | undefined } };
 
 /** Below this many bytes the native call's overhead exceeds the JavaScript loop's work (workerd). */
 const CRC_NATIVE_MIN_BYTES = 128;
 
 const nativeCrc32 = (() => {
-  try {
-    const crc32 = (globalThis as BuiltinModules).process?.getBuiltinModule?.('node:zlib')?.crc32;
-    return typeof crc32 === 'function' ? crc32 : null;
-  } catch {
-    return null;
-  }
+  const crc32 = realmBuiltin<NodeZlib>('node:zlib')?.crc32;
+  return typeof crc32 === 'function' ? crc32 : null;
 })();
 
 /** Eight 256-entry tables: table k maps a byte to its CRC after k further zero bytes. */