@nimbus-sh/worker 0.1.0

package/dist/vfs/symlink-registry.d.ts

@@ -0,0 +1,64 @@
+/**
+ * symlink-registry.ts — virtual symlink table backed by a special
+ * JSON file in the SqliteVFS.
+ *
+ * SHELL-FOLLOWUPS-4 (2026-05-11): Real symlink support for `ln -s`
+ * + `readlink`. Pre-fix `ln -s` copied the file content into a new
+ * regular file; `readlink` returned empty.
+ *
+ * Why a registry (not VFS-schema change):
+ *   - SqliteVFS schema is anti-touch for surrounding waves.
+ *   - Symlinks have minimal storage requirement (path → target string).
+ *   - Persistence across reconnect/eviction is automatic because the
+ *     registry file lives in the same SqliteVFS that gets snapshotted.
+ *
+ * Storage: `/.nimbus-symlinks.json` with shape `{ [linkPath]: target }`.
+ * The registry is in-memory cached on first read; writes flush back
+ * to the file synchronously.
+ *
+ * Resolution: callers (`ls -la`, `cat`, `readlink`, `rm`) check the
+ * registry FIRST before treating a path as a regular file. This
+ * means symlinks transparently dereference for read but appear in
+ * `ls -la` with proper `lrwxrwxrwx` mode and `-> target` suffix.
+ *
+ * Loop guard: `resolveSymlinkChain` follows at most 40 hops (matches
+ * POSIX SYMLOOP_MAX).
+ */
+import type { SqliteVFS } from './sqlite-vfs.js';
+export declare class SymlinkRegistry {
+    private vfs;
+    private cache;
+    constructor(vfs: SqliteVFS);
+    /** Lazy-load + memoize the registry. */
+    private load;
+    /** Write the cache back to the registry file. */
+    private flush;
+    /** Normalize a path: strip leading slashes (VFS internal convention). */
+    private norm;
+    /** Create or replace a symlink. Target is stored verbatim (can be
+     *  absolute or relative — interpretation happens at resolve time). */
+    set(linkPath: string, target: string): void;
+    /** Remove a symlink. Returns true if it existed. */
+    delete(linkPath: string): boolean;
+    /** Check if `path` is registered as a symlink (no chain resolution). */
+    isSymlink(path: string): boolean;
+    /** Get the immediate target of a symlink. Returns null if not a symlink. */
+    readlink(path: string): string | null;
+    /**
+     * Follow a symlink chain until we hit a non-symlink (or run out of
+     * hops). Returns the resolved path (canonicalized to no-leading-slash).
+     * If the chain breaks (max-hops or missing target), returns the
+     * last-resolved path or null.
+     *
+     * `cwd` is used to resolve RELATIVE symlink targets (target without
+     * leading `/`). POSIX semantics: relative targets resolve from the
+     * symlink's directory, not the current cwd.
+     */
+    resolveChain(startPath: string): string | null;
+    /** List all currently-registered symlinks (debugging / ls -la support). */
+    list(): {
+        link: string;
+        target: string;
+    }[];
+}
+//# sourceMappingURL=symlink-registry.d.ts.map

package/dist/vfs/symlink-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"symlink-registry.d.ts","sourceRoot":"","sources":["../../src/vfs/symlink-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,KAAK,CAAoC;gBAErC,GAAG,EAAE,SAAS;IAI1B,wCAAwC;IACxC,OAAO,CAAC,IAAI;IAgBZ,iDAAiD;IACjD,OAAO,CAAC,KAAK;IASb,yEAAyE;IACzE,OAAO,CAAC,IAAI;IAIZ;0EACsE;IACtE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAM3C,oDAAoD;IACpD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAOjC,wEAAwE;IACxE,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKrC;;;;;;;;;OASG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAuB9C,2EAA2E;IAC3E,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE;CAO3C"}

package/dist/vfs/symlink-registry.js

@@ -0,0 +1,137 @@
+/**
+ * symlink-registry.ts — virtual symlink table backed by a special
+ * JSON file in the SqliteVFS.
+ *
+ * SHELL-FOLLOWUPS-4 (2026-05-11): Real symlink support for `ln -s`
+ * + `readlink`. Pre-fix `ln -s` copied the file content into a new
+ * regular file; `readlink` returned empty.
+ *
+ * Why a registry (not VFS-schema change):
+ *   - SqliteVFS schema is anti-touch for surrounding waves.
+ *   - Symlinks have minimal storage requirement (path → target string).
+ *   - Persistence across reconnect/eviction is automatic because the
+ *     registry file lives in the same SqliteVFS that gets snapshotted.
+ *
+ * Storage: `/.nimbus-symlinks.json` with shape `{ [linkPath]: target }`.
+ * The registry is in-memory cached on first read; writes flush back
+ * to the file synchronously.
+ *
+ * Resolution: callers (`ls -la`, `cat`, `readlink`, `rm`) check the
+ * registry FIRST before treating a path as a regular file. This
+ * means symlinks transparently dereference for read but appear in
+ * `ls -la` with proper `lrwxrwxrwx` mode and `-> target` suffix.
+ *
+ * Loop guard: `resolveSymlinkChain` follows at most 40 hops (matches
+ * POSIX SYMLOOP_MAX).
+ */
+const REGISTRY_PATH = '.nimbus-symlinks.json';
+export class SymlinkRegistry {
+    vfs;
+    cache = null;
+    constructor(vfs) {
+        this.vfs = vfs;
+    }
+    /** Lazy-load + memoize the registry. */
+    load() {
+        if (this.cache)
+            return this.cache;
+        try {
+            if (this.vfs.exists(REGISTRY_PATH)) {
+                const raw = this.vfs.readFileString(REGISTRY_PATH);
+                const obj = JSON.parse(raw);
+                this.cache = new Map(Object.entries(obj));
+            }
+            else {
+                this.cache = new Map();
+            }
+        }
+        catch {
+            this.cache = new Map();
+        }
+        return this.cache;
+    }
+    /** Write the cache back to the registry file. */
+    flush() {
+        if (!this.cache)
+            return;
+        const obj = {};
+        for (const [k, v] of this.cache)
+            obj[k] = v;
+        try {
+            this.vfs.writeFile(REGISTRY_PATH, JSON.stringify(obj));
+        }
+        catch { /* fail-soft */ }
+    }
+    /** Normalize a path: strip leading slashes (VFS internal convention). */
+    norm(p) {
+        return p.replace(/^\/+/, '').replace(/\/+$/, '');
+    }
+    /** Create or replace a symlink. Target is stored verbatim (can be
+     *  absolute or relative — interpretation happens at resolve time). */
+    set(linkPath, target) {
+        const cache = this.load();
+        cache.set(this.norm(linkPath), target);
+        this.flush();
+    }
+    /** Remove a symlink. Returns true if it existed. */
+    delete(linkPath) {
+        const cache = this.load();
+        const ok = cache.delete(this.norm(linkPath));
+        if (ok)
+            this.flush();
+        return ok;
+    }
+    /** Check if `path` is registered as a symlink (no chain resolution). */
+    isSymlink(path) {
+        return this.load().has(this.norm(path));
+    }
+    /** Get the immediate target of a symlink. Returns null if not a symlink. */
+    readlink(path) {
+        const v = this.load().get(this.norm(path));
+        return v === undefined ? null : v;
+    }
+    /**
+     * Follow a symlink chain until we hit a non-symlink (or run out of
+     * hops). Returns the resolved path (canonicalized to no-leading-slash).
+     * If the chain breaks (max-hops or missing target), returns the
+     * last-resolved path or null.
+     *
+     * `cwd` is used to resolve RELATIVE symlink targets (target without
+     * leading `/`). POSIX semantics: relative targets resolve from the
+     * symlink's directory, not the current cwd.
+     */
+    resolveChain(startPath) {
+        let cur = this.norm(startPath);
+        for (let hops = 0; hops < 40; hops++) {
+            const target = this.load().get(cur);
+            if (target === undefined)
+                return cur; // not a symlink — done
+            if (target.startsWith('/')) {
+                cur = this.norm(target);
+            }
+            else {
+                // Relative target: resolve from symlink's parent dir.
+                const parent = cur.includes('/') ? cur.substring(0, cur.lastIndexOf('/')) : '';
+                const parts = (parent + '/' + target).split('/');
+                const out = [];
+                for (const s of parts) {
+                    if (s === '..')
+                        out.pop();
+                    else if (s !== '.' && s !== '')
+                        out.push(s);
+                }
+                cur = out.join('/');
+            }
+        }
+        // ELOOP
+        return null;
+    }
+    /** List all currently-registered symlinks (debugging / ls -la support). */
+    list() {
+        const out = [];
+        for (const [k, v] of this.load()) {
+            out.push({ link: k, target: v });
+        }
+        return out;
+    }
+}

package/dist/wrangler/nimbus-wrangler.d.ts

@@ -0,0 +1,157 @@
+/**
+ * nimbus-wrangler.ts — Lightweight wrangler dev replacement for Nimbus.
+ *
+ * Architecture (from spec §8):
+ *   nimbus-wrangler dev:
+ *     1. Reads wrangler.jsonc/toml from VFS
+ *     2. Bundles user's Worker code via EsbuildService
+ *     3. Creates a dynamic worker via LOADER.load() with the bundled code
+ *     4. Routes /worker/* requests to the dynamic worker's fetch()
+ *     5. On VFS file change: re-bundles and recreates the dynamic worker
+ *     6. Simulates KV via the worker's own storage
+ *
+ * The dynamic worker IS the user's Worker — running on the actual
+ * Cloudflare Workers runtime, not a simulation.
+ */
+import type { SqliteVFS } from '../vfs/sqlite-vfs.js';
+import type { EsbuildService } from '../runtime/esbuild-service.js';
+export interface NimbusWranglerOptions {
+    vfs: SqliteVFS;
+    esbuild: EsbuildService;
+    env: any;
+    /**
+     * Supervisor DO's DurableObjectState. Required for ctx.facets.get()
+     * when synthesizing durable_objects bindings (Phase 3). Also used for
+     * ctx.exports loopback bindings when synthesizing assets / loaders.
+     */
+    ctx?: any;
+    root: string;
+    onLog: (msg: string) => void;
+    onHmrMessage: (msg: any) => void;
+}
+/**
+ * Rewrite a Location header emitted by the inner Worker so that, when
+ * the browser follows it, the browser hits the outer-prefixed URL.
+ *
+ * Cases handled:
+ *   - Same-origin absolute URL (http://localhost:.../s/foo/)
+ *       → prepend outerWorkerBase to the pathname
+ *   - Origin-relative (/s/foo/, /new)
+ *       → prepend outerWorkerBase
+ *   - Path-relative (foo/bar)
+ *       → leave untouched (browser resolves against current URL, which
+ *         is already outer-prefixed)
+ *   - Cross-origin absolute URL (https://example.com/...)
+ *       → leave untouched
+ *   - Malformed / non-URL strings
+ *       → leave untouched
+ *
+ * The outerWorkerBase is the full path prefix (e.g.
+ * "/s/nimble-otter-4271/worker"); do not include a trailing slash.
+ */
+export declare function rewriteLocationForOuter(location: string, outerWorkerBase: string, currentRequestUrl: string): string;
+export declare class NimbusWrangler {
+    private vfs;
+    private esbuild;
+    private loaderEnv;
+    private supervisorCtx;
+    private root;
+    private onLog;
+    private onHmrMessage;
+    private running;
+    private config;
+    private workerStub;
+    private buildVersion;
+    private unsubVfs;
+    private rebuildTimer;
+    /** DO class map: binding name → DurableObjectClass from the inner worker. */
+    private doClassMap;
+    /** Facet names we've created via ctx.facets.get — aborted on rebuild / stop. */
+    private doFacetNames;
+    constructor(opts: NimbusWranglerOptions);
+    /** Start the wrangler dev server. */
+    start(): Promise<boolean>;
+    /** Stop the wrangler dev server. */
+    stop(): void;
+    get isRunning(): boolean;
+    private readConfig;
+    /** Minimal TOML parser — handles key = "value" and main/name/compatibility_date. */
+    private parseMinimalToml;
+    /**
+     * Resolve the user's `main:` entry to a canonical VFS-key path.
+     *
+     * The wrangler.jsonc `main` field is user-controlled and templates
+     * commonly emit any of:
+     *   - "src/index.ts"     — clean relative
+     *   - "./src/index.ts"   — npm-style with leading dot
+     *   - "/src/index.ts"    — workspace-absolute mistake
+     *   - "src//index.ts"    — accidental double-slash
+     *
+     * Naive `this.root + '/' + main` concatenation produced a malformed
+     * VFS key for every shape except the first, so vfs.exists() returned
+     * false even when the file was present at the canonical location.
+     *
+     * normalizeVfsPath collapses '.', '..', '//' runs and strips leading
+     * slashes — exactly the canonicalization SqliteVFS expects (every
+     * inode key in the live store is no-leading-slash, no internal
+     * doubles; src/vfs/sqlite-vfs.ts:_mkdirSingle uses the same
+     * `path.split('/').filter(Boolean)` shape via `normalizePath`).
+     */
+    private resolveEntryPath;
+    private buildAndLoad;
+    private buildInnerEnv;
+    private handleVfsEvents;
+    /**
+     * Forward a request to the user's Worker.
+     * Called from the DO's fetch() handler for /worker/* paths.
+     *
+     * Three things this proxy does besides a raw fetch:
+     *  1. Buffers the request body to an ArrayBuffer before forwarding.
+     *     The inner Worker can legitimately respond with a 302 (e.g.
+     *     Nimbus-in-Nimbus: POST /new → 302 /s/<id>/). Workerd's `fetch`
+     *     defaults to follow-redirects which requires replaying the body;
+     *     a stream body can only be read once. Buffering first sidesteps
+     *     the "one-time-use body encountered a redirect" error. POSTs to
+     *     Nimbus's own /new endpoint are typically empty, but KV/D1 sims
+     *     and user workers may send non-trivial bodies.
+     *  2. Uses `redirect: 'manual'` so the inner's Location header comes
+     *     back unchanged. We rewrite it below to prepend the outer worker
+     *     prefix — otherwise the browser follows a bare `/s/<id>/` URL,
+     *     which is an OUTER route and spawns a different session, not
+     *     what the user wanted.
+     *  3. Replaces a "Not found" 404 at the inner root with a small
+     *     landing page. Nimbus itself (the likely inner worker) has no
+     *     route for `/` when loaded without an ASSETS binding — users
+     *     hitting `/s/<outer>/worker/` directly would otherwise see a
+     *     bare 9-byte "Not found" response and think the whole thing
+     *     broke. The landing page explains the Worker is running and
+     *     points them at `/worker/new` / their own routes.
+     */
+    handleRequest(request: Request, pathname: string, 
+    /**
+     * Outer-facing prefix of this proxy (e.g. "/s/nimble-otter-4271/worker").
+     * Used to rewrite inner-emitted Location headers that reference
+     * their own origin-relative paths. When absent, Location headers
+     * are passed through unchanged.
+     */
+    outerWorkerBase?: string): Promise<Response>;
+    get stats(): {
+        running: boolean;
+        name: string;
+        main: string;
+        root: string;
+        buildVersion: number;
+    };
+    /** @internal — test seam: parse the wrangler config and store it. Returns true on success. */
+    _readConfigForTest(): boolean;
+    /** @internal — test seam: invoke buildInnerEnv() without a probe-load pass. */
+    _buildInnerEnvForTest(): Record<string, any>;
+    /** @internal — test seam: install the VFS file-watch listener and the
+     * mock-rebuild path (esbuild.build() is called, but the real
+     * buildAndLoad() pipeline is bypassed in favour of just calling
+     * esbuild). Used for hot-reload latency + nimbus-paths-not-watched
+     * probes. Production calls start() which installs the watcher AND the
+     * full rebuild pipeline. */
+    _installWatchersForTest(): void;
+}
+//# sourceMappingURL=nimbus-wrangler.d.ts.map

package/dist/wrangler/nimbus-wrangler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nimbus-wrangler.d.ts","sourceRoot":"","sources":["../../src/wrangler/nimbus-wrangler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAqDpE,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,SAAS,CAAC;IACf,OAAO,EAAE,cAAc,CAAC;IACxB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CAClC;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,iBAAiB,EAAE,MAAM,GACxB,MAAM,CA+BR;AAyDD,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAAwB;IACrC,OAAO,CAAC,YAAY,CAAqB;IAEzC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,YAAY,CAAa;IACjC,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAA+B;IACjD,gFAAgF;IAChF,OAAO,CAAC,YAAY,CAA0B;gBAElC,IAAI,EAAE,qBAAqB;IAUvC,qCAAqC;IAC/B,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAqB/B,oCAAoC;IACpC,IAAI,IAAI,IAAI;IAgBZ,IAAI,SAAS,YAA2B;IAIxC,OAAO,CAAC,UAAU;IAiDlB,oFAAoF;IACpF,OAAO,CAAC,gBAAgB;IAqBxB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,gBAAgB;YAIV,YAAY;IA6L1B,OAAO,CAAC,aAAa;IAiOrB,OAAO,CAAC,eAAe;IAkCvB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,CAAC;IAsFpB,IAAI,KAAK;;;;;;MAQR;IAYD,8FAA8F;IAC9F,kBAAkB,IAAI,OAAO;IAK7B,+EAA+E;IAC/E,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAI5C;;;;;gCAK4B;IAC5B,uBAAuB,IAAI,IAAI;CA4BhC"}