@nimbus-sh/worker 0.1.0

package/dist/loaders/npm-resolve-preamble.js

@@ -0,0 +1,237 @@
+/**
+ * npm-resolve-preamble.ts — preamble injected into NimbusLoaderPool isolates
+ * that run src/npm-resolve-facet.ts.
+ *
+ * NimbusLoaderPool serialises the user function via fn.toString() and runs
+ * it inside a dynamic worker. Names referenced by the function at module
+ * scope are NOT in that worker's lexical scope at runtime — they must be
+ * re-declared in the preamble.
+ *
+ * The resolver-facet references the following preamble symbols:
+ *   - SHOULD_SKIP_PACKAGE(name) → boolean
+ *   - SHOULD_SWAP(name)         → { from, to } | undefined           (W6)
+ *   - SHOULD_REJECT_FAIL(name)  → { from, reason, suggest? } | undefined (W6)
+ *   - SHOULD_WARN_SKIP_TRANSITIVE(name) → entry | undefined          (W6)
+ *   - PARSE_SEMVER(v) → [major, minor, patch] | null
+ *   - COMPARE_SEMVER(a, b) → number
+ *   - SATISFIES_RANGE(version, range) → boolean
+ *   - RESOLVE_VERSION(versions, range) → string | null
+ *
+ * All of these are pasted from src/npm-resolver.ts and src/wasm-swap-registry.ts
+ * and MUST stay byte-equivalent. Divergence between supervisor and facet
+ * resolution would mean the facet picks different versions / makes different
+ * swap-or-reject decisions than the legacy in-supervisor path, breaking
+ * both correctness and the NIMBUS_FACET_RESOLVER=0 fallback contract.
+ *
+ * The W6 registry data is duplicated below — gated by
+ * `audit/probes/w6/functional/preamble-parity.mjs`.
+ *
+ * Preamble bytes are part of the loader-cache key for NimbusLoaderPool —
+ * any edit invalidates the warm slot and forces a re-load on next
+ * dispatch. Acceptable cost for a one-shot resolver phase.
+ */
+export const NPM_RESOLVE_PREAMBLE = `
+// ── Skip list (mirrors src/npm-resolver.ts SKIP_PACKAGES, post-W6+W11) ──
+// W6: 'esbuild' migrated to WASM_SWAPS; 'fsevents' migrated to REJECT_INSTALL.
+// W11: vite is exempted when frameworkAware=true so framework CLIs can
+//      import('vite') from node_modules. See audit/sections/W11-plan.md §3.0.
+const __SKIP_PACKAGES = new Set([
+  // X.5-G: rollup migrated to WASM_SWAPS to own the rollup → @rollup/wasm-node swap.
+  'typescript', 'vite', 'webpack', 'parcel',
+  'postcss', 'autoprefixer', 'tailwindcss', 'cssnano',
+  'prettier', 'eslint', 'stylelint',
+  'chokidar', 'node-gyp', 'node-pre-gyp',
+  '@cloudflare/vite-plugin', '@cloudflare/workers-types', 'wrangler',
+  'husky', 'lint-staged', 'commitlint',
+]);
+const __FRAMEWORK_REQUIRED_PACKAGES = new Set([
+  'vite',
+]);
+const __SKIP_PREFIXES = [
+  '@types/',
+  '@eslint/',
+  '@typescript-eslint/',
+  'eslint-plugin-',
+  'eslint-config-',
+];
+function SHOULD_SKIP_PACKAGE(name, frameworkAware) {
+  if (frameworkAware && __FRAMEWORK_REQUIRED_PACKAGES.has(name)) return false;
+  if (__SKIP_PACKAGES.has(name)) return true;
+  for (const p of __SKIP_PREFIXES) if (name.startsWith(p)) return true;
+  return false;
+}
+
+// ── W6 swap / reject registry (mirrors src/wasm-swap-registry.ts) ─────
+// Gated by audit/probes/w6/functional/preamble-parity.mjs.
+const __WASM_SWAPS = new Map([
+  ['esbuild', { from: 'esbuild', to: 'esbuild-wasm' }],
+  // X.5-G G2: rollup → @rollup/wasm-node (drop-in WASM build).
+  // See src/wasm-swap-registry.ts:73 for full WASM_SWAPS canonical entry
+  // and X5G-plan.md §3 for the npm 4828 / .node-can't-dlopen rationale.
+  ['rollup',  { from: 'rollup',  to: '@rollup/wasm-node' }],
+]);
+// Mirror of REJECT_INSTALL in src/wasm-swap-registry.ts. Entries with
+// transitive='warn' are tagged so the resolver can decide skip-vs-throw.
+const __REJECT_INSTALL = new Map([
+  ['sharp',                          { from: 'sharp',                          reason: 'Native libvips bindings; not portable to Workers.', transitive: 'fail' }],
+  ['sqlite3',                        { from: 'sqlite3',                        reason: 'Native sqlite3 .node binding.', transitive: 'fail' }],
+  ['better-sqlite3',                 { from: 'better-sqlite3',                 reason: 'Native sqlite .node binding.', transitive: 'fail' }],
+  ['canvas',                         { from: 'canvas',                         reason: 'Native Cairo bindings.', transitive: 'fail' }],
+  ['sodium-native',                  { from: 'sodium-native',                  reason: 'Native libsodium.', transitive: 'fail' }],
+  ['fsevents',                       { from: 'fsevents',                       reason: 'macOS-only filesystem watcher; never runs in Workers.', transitive: 'warn' }],
+  ['bufferutil',                     { from: 'bufferutil',                     reason: 'Native binding for ws speedups; install requires node-gyp.', transitive: 'warn' }],
+  ['utf-8-validate',                 { from: 'utf-8-validate',                 reason: 'Native binding for ws speedups; install requires node-gyp.', transitive: 'warn' }],
+  ['node-pty',                       { from: 'node-pty',                       reason: 'PTY syscalls unavailable in workerd.', transitive: 'fail' }],
+  ['robotjs',                        { from: 'robotjs',                        reason: 'Desktop automation; sandboxed Workers cannot access OS UI.', transitive: 'fail' }],
+  ['electron',                       { from: 'electron',                       reason: 'Embedded Chromium runtime; not applicable to Workers.', transitive: 'fail' }],
+  ['bcrypt',                         { from: 'bcrypt',                         reason: 'Native bcrypt; require() name differs from bcryptjs.', transitive: 'fail' }],
+  ['argon2',                         { from: 'argon2',                         reason: 'Native Argon2 C bindings.', transitive: 'fail' }],
+  ['node-sass',                      { from: 'node-sass',                      reason: 'Native libsass; deprecated upstream.', transitive: 'fail' }],
+  ['grpc',                           { from: 'grpc',                           reason: 'Deprecated native gRPC.', transitive: 'fail' }],
+  ['@swc/core',                      { from: '@swc/core',                      reason: 'Native Rust SWC.', transitive: 'fail' }],
+  ['prisma',                         { from: 'prisma',                         reason: 'Native query engine; not portable to Workers in this configuration.', transitive: 'fail' }],
+  ['@prisma/client',                 { from: '@prisma/client',                 reason: 'Native Prisma query engine.', transitive: 'fail' }],
+  ['node-gyp',                       { from: 'node-gyp',                       reason: 'Build-time native compiler; never runs in Workers.', transitive: 'warn' }],
+  ['node-pre-gyp',                   { from: 'node-pre-gyp',                   reason: 'Build-time native compiler; never runs in Workers.', transitive: 'warn' }],
+  ['puppeteer',                      { from: 'puppeteer',                      reason: 'Bundled Chromium binary (~150 MB).', transitive: 'fail' }],
+  ['playwright',                     { from: 'playwright',                     reason: 'Bundled browsers (~300 MB).', transitive: 'fail' }],
+  ['sql.js',                         { from: 'sql.js',                         reason: 'Installs but fails at runtime: ENOENT on dist/sql-wasm.wasm — loader gap (W6.5.x).', transitive: 'fail' }],
+  ['@swc/wasm-web',                  { from: '@swc/wasm-web',                  reason: 'Installs but fails at runtime: workerd CSP-like new-Function block in node-shims.ts:2058 — loader gap (W6.5.x).', transitive: 'fail' }],
+  // W6.5 additions:
+  ['@img/sharp-wasm32',              { from: '@img/sharp-wasm32',              reason: 'WASM build of sharp; wasm32-cpu-only AND libvips initThreads() fails under workerd (no pthread).', transitive: 'fail' }],
+  ['@napi-rs/canvas',                { from: '@napi-rs/canvas',                reason: 'Native bindings only; no WASM build published.', transitive: 'fail' }],
+  ['@napi-rs/canvas-wasm32-wasi',    { from: '@napi-rs/canvas-wasm32-wasi',    reason: 'Package does not exist on npm (404); @napi-rs/canvas has no WASM/WASI build.', transitive: 'fail' }],
+  // X.5-26b additions: Tailwind v4 oxide + lightningcss native parents.
+  // Mirror of REJECT_INSTALL adds in src/wasm-swap-registry.ts.
+  ['@tailwindcss/oxide',             { from: '@tailwindcss/oxide',             reason: 'Native Rust Tailwind v4 oxide engine; only platform-specific .node bindings + wasm32-wasi shard; workerd has no node:wasi.', transitive: 'fail' }],
+  ['lightningcss',                   { from: 'lightningcss',                   reason: 'Native Rust CSS parser; .node bindings + wasm32-wasi-only WASM build; workerd has no node:wasi; detect-libc also fails.', transitive: 'fail' }],
+]);
+function SHOULD_SWAP(name) {
+  return __WASM_SWAPS.get(name);
+}
+function SHOULD_REJECT_FAIL(name) {
+  const r = __REJECT_INSTALL.get(name);
+  if (r && r.transitive === 'fail') return r;
+  return undefined;
+}
+function SHOULD_WARN_SKIP_TRANSITIVE(name) {
+  const r = __REJECT_INSTALL.get(name);
+  if (r && r.transitive === 'warn') return r;
+  return undefined;
+}
+
+// ── W6.5 telemetry: facet-side event collection ──────────────────────
+// The facet cannot import the registry's emitRegistryEvent (preamble has
+// no import surface). Instead, decision sites push into a shared
+// __pendingEvents array which resolveTreeInFacet returns inside
+// ResolveFacetResult.registryEvents. The supervisor drains it and
+// flushes via emitRegistryEvent (npm-installer.ts).
+//
+// Shape of each entry:
+//   { type: 'swap',            from, to,                     ctx: 'transitive' }
+//   { type: 'reject',          from, reason, suggest?,       ctx: 'transitive' }
+//   { type: 'transitive-skip', from, reason }
+//
+// Note: ctx is always 'transitive' from this path (the supervisor's
+// applyW6Registry handles 'top'-ctx events directly without the facet).
+const __pendingEvents = [];
+function __EMIT_EVENT(e) { __pendingEvents.push(e); }
+function __DRAIN_EVENTS() {
+  // Hand ownership to caller; reset for next run (defensive — facet
+  // function bodies are re-instantiated per run anyway).
+  const out = __pendingEvents.slice();
+  __pendingEvents.length = 0;
+  return out;
+}
+
+// ── Semver helpers (pasted from src/npm-resolver.ts:83-202) ─────────────
+function PARSE_SEMVER(v) {
+  const m = v.replace(/^v/, '').match(/^(\\d+)\\.(\\d+)\\.(\\d+)/);
+  return m ? [parseInt(m[1]), parseInt(m[2]), parseInt(m[3])] : null;
+}
+
+function COMPARE_SEMVER(a, b) {
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+
+function __SATISFIES_COMPARATOR(version, comparator) {
+  const comp = comparator.trim();
+  if (!comp || comp === '*' || comp === 'latest' || comp === '' || comp === 'x') return true;
+  let op = '';
+  let rangeStr = comp;
+  const prefixMatch = comp.match(/^([~^]|>=|<=|>|<|=)\\s*/);
+  if (prefixMatch) {
+    op = prefixMatch[1];
+    rangeStr = comp.slice(prefixMatch[0].length);
+  }
+  rangeStr = rangeStr.replace(/\\.x/g, '.0');
+  if (rangeStr.match(/^\\d+$/)) rangeStr += '.0.0';
+  else if (rangeStr.match(/^\\d+\\.\\d+$/)) rangeStr += '.0';
+  const vParts = PARSE_SEMVER(version);
+  const rParts = PARSE_SEMVER(rangeStr);
+  if (!vParts || !rParts) return false;
+  const cmp = COMPARE_SEMVER(vParts, rParts);
+  switch (op) {
+    case '^': {
+      if (rParts[0] > 0) {
+        return vParts[0] === rParts[0] && cmp >= 0;
+      }
+      if (rParts[1] > 0) {
+        return vParts[0] === 0 && vParts[1] === rParts[1] && cmp >= 0;
+      }
+      return vParts[0] === 0 && vParts[1] === 0 && vParts[2] === rParts[2];
+    }
+    case '~': {
+      return vParts[0] === rParts[0] && vParts[1] === rParts[1] && vParts[2] >= rParts[2];
+    }
+    case '>=': return cmp >= 0;
+    case '>':  return cmp > 0;
+    case '<=': return cmp <= 0;
+    case '<':  return cmp < 0;
+    case '=':  return cmp === 0;
+    default: {
+      if (comp.match(/^\\d/)) {
+        return cmp === 0;
+      }
+      return cmp === 0;
+    }
+  }
+}
+
+function SATISFIES_RANGE(version, range) {
+  const trimmed = range.trim();
+  if (!trimmed || trimmed === '*' || trimmed === 'latest' || trimmed === '') return true;
+  const orParts = trimmed.split(/\\s*\\|\\|\\s*/);
+  for (const orPart of orParts) {
+    const hyphen = orPart.match(/^(\\S+)\\s+-\\s+(\\S+)$/);
+    if (hyphen) {
+      if (__SATISFIES_COMPARATOR(version, '>=' + hyphen[1]) &&
+          __SATISFIES_COMPARATOR(version, '<=' + hyphen[2])) {
+        return true;
+      }
+      continue;
+    }
+    const andParts = orPart.trim().split(/\\s+/);
+    const allMatch = andParts.every((part) => __SATISFIES_COMPARATOR(version, part));
+    if (allMatch) return true;
+  }
+  return false;
+}
+
+function RESOLVE_VERSION(versions, range) {
+  if (!range || range === 'latest' || range === '*' || range === '') return null;
+  const matching = versions.filter((v) => {
+    if (v.includes('-') && !range.includes('-')) return false;
+    return SATISFIES_RANGE(v, range);
+  });
+  if (matching.length === 0) return null;
+  matching.sort((a, b) => {
+    const ap = PARSE_SEMVER(a);
+    const bp = PARSE_SEMVER(b);
+    if (!ap || !bp) return 0;
+    return COMPARE_SEMVER(bp, ap);
+  });
+  return matching[0];
+}
+// ── end npm-resolve preamble ────────────────────────────────────────────
+`;

package/dist/loaders/pre-bundle-preamble.d.ts

@@ -0,0 +1,41 @@
+/**
+ * pre-bundle-preamble.ts — preamble injected into NimbusLoaderPool isolates
+ * that run src/pre-bundle-facet.ts.
+ *
+ * NimbusLoaderPool serialises the user function via fn.toString() and runs
+ * it inside a dynamic worker built from inline modules. Names referenced
+ * by the function at the module-top-level scope are NOT in that worker's
+ * lexical scope at runtime — they must be re-declared in the preamble.
+ *
+ * Specifically prebundleOne references:
+ *   - ESBUILD_WASM_JS_FN_BODY — function-body string (~117 KiB) that,
+ *                               when run via new Function(...)(), returns
+ *                               the esbuild namespace. SMALL — kept inline.
+ *   - resolvePackageEntry     — the npm-resolver helper used by the
+ *                               bare-specifier resolver
+ *
+ * NOT in the preamble:
+ *   - ESBUILD_WASM_BASE64 / wasm BYTES — the wasm Module is shipped via
+ *     NimbusLoaderPool's `wasmModules` option (LOADER `modules` map
+ *     entry shape `{ wasm: ArrayBuffer }`). Workerd compiles it at
+ *     module-load (startup phase) and the pool's generated worker.js
+ *     exposes the resulting WebAssembly.Module on
+ *     globalThis.__NIMBUS_WASM['esbuild.wasm']. The pre-bundle facet
+ *     reads it at request time and passes to esb.initialize().
+ *
+ * resolvePackageEntry is a pure-JS function from src/npm-resolver.ts;
+ * we inline its source here so the facet doesn't need to fault back
+ * to the supervisor for it.
+ *
+ * Preamble bytes are part of the loader-cache key for NimbusLoaderPool.
+ * Changing this file invalidates all warm slots in the pre-bundle pool;
+ * fine — esbuild boot is the dominant cost and re-paying it once on a
+ * deploy is acceptable.
+ */
+/**
+ * Preamble string injected ahead of the prebundleOne function in every
+ * pre-bundle facet isolate. Must be passed via NimbusLoaderPool's
+ * `preamble` option.
+ */
+export declare const PRE_BUNDLE_PREAMBLE: string;
+//# sourceMappingURL=pre-bundle-preamble.d.ts.map

package/dist/loaders/pre-bundle-preamble.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-bundle-preamble.d.ts","sourceRoot":"","sources":["../../src/loaders/pre-bundle-preamble.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA4CH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAqCjC,CAAC"}

package/dist/loaders/pre-bundle-preamble.js

@@ -0,0 +1,114 @@
+/**
+ * pre-bundle-preamble.ts — preamble injected into NimbusLoaderPool isolates
+ * that run src/pre-bundle-facet.ts.
+ *
+ * NimbusLoaderPool serialises the user function via fn.toString() and runs
+ * it inside a dynamic worker built from inline modules. Names referenced
+ * by the function at the module-top-level scope are NOT in that worker's
+ * lexical scope at runtime — they must be re-declared in the preamble.
+ *
+ * Specifically prebundleOne references:
+ *   - ESBUILD_WASM_JS_FN_BODY — function-body string (~117 KiB) that,
+ *                               when run via new Function(...)(), returns
+ *                               the esbuild namespace. SMALL — kept inline.
+ *   - resolvePackageEntry     — the npm-resolver helper used by the
+ *                               bare-specifier resolver
+ *
+ * NOT in the preamble:
+ *   - ESBUILD_WASM_BASE64 / wasm BYTES — the wasm Module is shipped via
+ *     NimbusLoaderPool's `wasmModules` option (LOADER `modules` map
+ *     entry shape `{ wasm: ArrayBuffer }`). Workerd compiles it at
+ *     module-load (startup phase) and the pool's generated worker.js
+ *     exposes the resulting WebAssembly.Module on
+ *     globalThis.__NIMBUS_WASM['esbuild.wasm']. The pre-bundle facet
+ *     reads it at request time and passes to esb.initialize().
+ *
+ * resolvePackageEntry is a pure-JS function from src/npm-resolver.ts;
+ * we inline its source here so the facet doesn't need to fault back
+ * to the supervisor for it.
+ *
+ * Preamble bytes are part of the loader-cache key for NimbusLoaderPool.
+ * Changing this file invalidates all warm slots in the pre-bundle pool;
+ * fine — esbuild boot is the dominant cost and re-paying it once on a
+ * deploy is acceptable.
+ */
+import { ESBUILD_WASM_JS_FN_BODY, ESBUILD_WASM_VERSION, } from '../esbuild-wasm-bundle.generated.js';
+import { getExportsResolverJS } from '../_shared/exports-resolver.js';
+// NOTE: wasm BYTES deliberately NOT in this preamble. They live in
+// env.ASSETS at /_assets/esbuild-<version>.wasm and are fetched by
+// the supervisor at pool-construction time
+// (src/esbuild-wasm-bytes.ts), then handed to NimbusLoaderPool's
+// `wasmModules` option which registers them in the LOADER `modules`
+// map as `{ wasm: ArrayBuffer }`. workerd compiles during the
+// worker's module-load phase (where wasm code generation is
+// permitted) and exposes the resulting WebAssembly.Module via the
+// standard ESM import the pool prepends to worker.js.
+//
+// Earlier approaches that DIDN'T work (history kept for context):
+//   1. Inline the ~16 MiB base64 in this preamble — workerd allocates
+//      a 16 MiB module-source string per pool.submit dispatch which
+//      combined with post-install supervisor heap state OOM-killed
+//      the DO on entry to the pre-bundle phase (verified on prod).
+//   2. WebAssembly.compile() in the facet at request time — workerd's
+//      deployed config disallows wasm code generation at request time
+//      ("Wasm code generation disallowed by embedder").
+//   3. RPC of a pre-compiled WebAssembly.Module from supervisor —
+//      workerd's structured-clone refuses Module transfer in this
+//      deploy ("Unable to deserialize cloned data").
+//
+// Phase 2 A'.5 also moved the bytes OUT of the supervisor module
+// bundle (was a 16 MiB base64 string in the generated TS file → 21
+// MiB UTF-16 in supervisor module scope). Now they only live where
+// they're needed: in the LOADER cache after pool construction, and
+// in env.ASSETS at rest.
+/**
+ * Resolver helpers, sourced from src/_shared/exports-resolver.ts via
+ * getExportsResolverJS(). Single source of truth — see
+ * audit/sections/03-resolver-gaps.md §3.1 for the prior 3-copy drift this
+ * consolidates. The pre-bundle facet uses `resolvePackageEntry` (line 492
+ * of src/pre-bundle-facet.ts).
+ */
+const RESOLVER_HELPERS_SRC = getExportsResolverJS();
+/**
+ * Preamble string injected ahead of the prebundleOne function in every
+ * pre-bundle facet isolate. Must be passed via NimbusLoaderPool's
+ * `preamble` option.
+ */
+export const PRE_BUNDLE_PREAMBLE = `
+// ── pre-bundle facet preamble (auto-generated) ──────────────────────────
+// Esbuild JS helpers (small ~117 KiB). The wasm BYTES are NOT here —
+// they're fetched at facet boot via env.SUPERVISOR.getEsbuildWasm() to
+// keep the per-dispatch worker module source under ~120 KiB instead of
+// ~16 MiB. See src/parallel/pre-bundle-preamble.ts header for why.
+const ESBUILD_WASM_VERSION = ${JSON.stringify(ESBUILD_WASM_VERSION)};
+const ESBUILD_WASM_JS_FN_BODY = ${JSON.stringify(ESBUILD_WASM_JS_FN_BODY)};
+
+// ── Materialise esbuild namespace at MODULE STARTUP ─────────────────────
+// workerd's deployed config disallows \"Code generation from strings\" at
+// request time inside dynamic workers (verified via prod repro: pre-bundle
+// fn body called \`new Function(jsBody)()\` and got
+// \"Code generation from strings disallowed for this context\" for every
+// spec). The codebase already documents this constraint at
+// src/node-shims.ts:1006-1015.
+//
+// Workaround: run \`new Function(...)()\` here in the preamble — preambles
+// execute at module-load time (the worker's startup phase) where eval IS
+// permitted. We capture the resulting esbuild namespace in a module-scope
+// const that the user fn references at request time. Same pattern as
+// src/facet-manager.ts:176 (USER_CODE is compiled in the generated module
+// scope, not inside the request handler).
+//
+// Fail-safe: if even startup-time eval is blocked, set the cache to a
+// sentinel object that the user fn detects and surfaces as a loud error
+// (rather than passing undefined and crashing on .initialize).
+let __NIMBUS_ESBUILD_NS = null;
+let __NIMBUS_ESBUILD_INIT_ERR = null;
+try {
+  __NIMBUS_ESBUILD_NS = (new Function(ESBUILD_WASM_JS_FN_BODY))();
+} catch (e) {
+  __NIMBUS_ESBUILD_INIT_ERR = String((e && e.message) || e);
+}
+
+${RESOLVER_HELPERS_SRC}
+// ── end pre-bundle facet preamble ───────────────────────────────────────
+`;

package/dist/loaders/vendor/codegen.d.ts

@@ -0,0 +1,24 @@
+import type { WorkerCode } from './types.js';
+export interface GenerateSourceOptions {
+    /**
+     * Key/value pairs injected as module-level `const` declarations,
+     * so the function body can reference them as if they were in closure scope.
+     * Values must be JSON-serializable.
+     */
+    context?: Record<string, unknown>;
+    /** When true, appends `this.env` as the last argument to the user function. */
+    passEnv?: boolean;
+}
+export declare function generateWorkerSource(fnSource: string, opts?: GenerateSourceOptions): string;
+export interface WorkerCodeOptions {
+    compatibilityDate?: string;
+    compatibilityFlags?: string[];
+    env?: Record<string, unknown>;
+    /**
+     * Network access: `null` (default) = sandboxed, `undefined` = inherit parent,
+     * or a service stub to redirect outbound through.
+     */
+    globalOutbound?: WorkerCode['globalOutbound'];
+}
+export declare function buildWorkerCode(fnSource: string, opts?: WorkerCodeOptions, sourceOpts?: GenerateSourceOptions): WorkerCode;
+//# sourceMappingURL=codegen.d.ts.map

package/dist/loaders/vendor/codegen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../../../src/loaders/vendor/codegen.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,qBAAqB,GAC3B,MAAM,CAkCR;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;CAC/C;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,iBAAiB,EACxB,UAAU,CAAC,EAAE,qBAAqB,GACjC,UAAU,CAyBZ"}

package/dist/loaders/vendor/codegen.js

@@ -0,0 +1,44 @@
+const DEFAULT_COMPAT_DATE = '2025-06-01';
+export function generateWorkerSource(fnSource, opts) {
+    const lines = [
+        'import { WorkerEntrypoint } from "cloudflare:workers";',
+        '',
+    ];
+    if (opts?.context) {
+        for (const [key, value] of Object.entries(opts.context)) {
+            lines.push(`const ${key} = ${JSON.stringify(value)};`);
+        }
+        lines.push('');
+    }
+    lines.push(`const __fn__ = ${fnSource};`);
+    lines.push('');
+    const callExpr = opts?.passEnv
+        ? '__fn__(...args, this.env)'
+        : '__fn__(...args)';
+    lines.push('export default class extends WorkerEntrypoint {', '  execute(...args) {', `    const result = ${callExpr};`, '    // Transparently await async/promise-returning functions.', '    if (result instanceof Promise) {', '      return result;', '    }', '    return result;', '  }', '}');
+    return lines.join('\n');
+}
+export function buildWorkerCode(fnSource, opts, sourceOpts) {
+    const moduleSource = generateWorkerSource(fnSource, sourceOpts);
+    const code = {
+        compatibilityDate: opts?.compatibilityDate ?? DEFAULT_COMPAT_DATE,
+        compatibilityFlags: opts?.compatibilityFlags,
+        mainModule: 'worker.js',
+        modules: {
+            'worker.js': moduleSource,
+        },
+        env: opts?.env,
+    };
+    // WorkerCode.globalOutbound: omitted = inherit, null = sandboxed, ServiceStub = redirect.
+    // Distinguish explicit `{ globalOutbound: undefined }` (inherit) from key-absent (sandbox).
+    if (opts && 'globalOutbound' in opts) {
+        if (opts.globalOutbound !== undefined) {
+            code.globalOutbound = opts.globalOutbound;
+        }
+        // else: explicitly undefined — omit key to inherit parent network
+    }
+    else {
+        code.globalOutbound = null;
+    }
+    return code;
+}

package/dist/loaders/vendor/errors.d.ts

@@ -0,0 +1,24 @@
+export declare class ParallelError extends Error {
+    constructor(message: string);
+}
+export declare class SerializationError extends ParallelError {
+    constructor(message: string);
+}
+export declare class ExecutionError extends ParallelError {
+    readonly remoteMessage: string;
+    readonly remoteStack?: string;
+    constructor(message: string, remoteStack?: string);
+}
+export declare class TimeoutError extends ParallelError {
+    readonly deadlineMs: number;
+    constructor(deadlineMs: number);
+}
+export declare class RetryExhaustedError extends ParallelError {
+    readonly lastError: Error;
+    readonly attempts: number;
+    constructor(attempts: number, lastError: Error);
+}
+export declare class BindingError extends ParallelError {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/loaders/vendor/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/loaders/vendor/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,aAAa;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,cAAe,SAAQ,aAAa;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;CAMlD;AAED,qBAAa,YAAa,SAAQ,aAAa;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,UAAU,EAAE,MAAM;CAK/B;AAED,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK;CAQ/C;AAED,qBAAa,YAAa,SAAQ,aAAa;gBACjC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/loaders/vendor/errors.js

@@ -0,0 +1,46 @@
+export class ParallelError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ParallelError';
+    }
+}
+export class SerializationError extends ParallelError {
+    constructor(message) {
+        super(message);
+        this.name = 'SerializationError';
+    }
+}
+export class ExecutionError extends ParallelError {
+    remoteMessage;
+    remoteStack;
+    constructor(message, remoteStack) {
+        super(message);
+        this.name = 'ExecutionError';
+        this.remoteMessage = message;
+        this.remoteStack = remoteStack;
+    }
+}
+export class TimeoutError extends ParallelError {
+    deadlineMs;
+    constructor(deadlineMs) {
+        super(`Task exceeded ${deadlineMs}ms deadline`);
+        this.name = 'TimeoutError';
+        this.deadlineMs = deadlineMs;
+    }
+}
+export class RetryExhaustedError extends ParallelError {
+    lastError;
+    attempts;
+    constructor(attempts, lastError) {
+        super(`Task failed after ${attempts} attempt(s): ${lastError.message}`);
+        this.name = 'RetryExhaustedError';
+        this.attempts = attempts;
+        this.lastError = lastError;
+    }
+}
+export class BindingError extends ParallelError {
+    constructor(message) {
+        super(message);
+        this.name = 'BindingError';
+    }
+}

package/dist/loaders/vendor/index.d.ts

@@ -0,0 +1,16 @@
+export { WorkerPool } from './pool.js';
+export type { PoolOptions, MapOptions, PmapOptions, SubmitOptions, StreamOptions, StreamResult, ScatterOptions, ResilienceOptions, OnErrorStrategy, } from './pool.js';
+export { pure, isPure, constant } from './primitives.js';
+export type { Pure } from './primitives.js';
+export { serializeFunction, hashSource } from './serialize.js';
+export { generateWorkerSource, buildWorkerCode } from './codegen.js';
+export type { WorkerCodeOptions, GenerateSourceOptions } from './codegen.js';
+export { ParallelError, SerializationError, ExecutionError, TimeoutError, RetryExhaustedError, BindingError, } from './errors.js';
+export type { WorkerLoader, WorkerCode, WorkerStub, EntrypointStub, EntrypointOptions, GetCodeCallback, ServiceStub, ModuleContent, } from './types.js';
+import { WorkerPool } from './pool.js';
+import type { PoolOptions } from './pool.js';
+import type { WorkerLoader } from './types.js';
+export declare const Parallel: {
+    readonly pool: (loader: WorkerLoader, opts?: PoolOptions) => WorkerPool;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/loaders/vendor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/loaders/vendor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,YAAY,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE7E,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,eAAO,MAAM,QAAQ;4BACN,YAAY,SAAS,WAAW,KAAG,UAAU;CAGlD,CAAC"}

package/dist/loaders/vendor/index.js

@@ -0,0 +1,11 @@
+export { WorkerPool } from './pool.js';
+export { pure, isPure, constant } from './primitives.js';
+export { serializeFunction, hashSource } from './serialize.js';
+export { generateWorkerSource, buildWorkerCode } from './codegen.js';
+export { ParallelError, SerializationError, ExecutionError, TimeoutError, RetryExhaustedError, BindingError, } from './errors.js';
+import { WorkerPool } from './pool.js';
+export const Parallel = {
+    pool(loader, opts) {
+        return new WorkerPool(loader, opts);
+    },
+};