@nimbus-sh/worker 0.1.2 → 0.1.4

package/dist/runtime/wasi-instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wasi-instance.d.ts","sourceRoot":"","sources":["../../src/runtime/wasi-instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqGG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,2koFAs2DtC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,yCAAyC;IACzC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mCAAmC;IACnC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kCAAkC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kCAAkC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,qCAAqC;IACrC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,oFAAoF;AACpF,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EA6B1C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,cAAc,mBAAiB,CAAC"}
+{"version":3,"file":"wasi-instance.d.ts","sourceRoot":"","sources":["../../src/runtime/wasi-instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqGG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,u0pFAk2DtC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,yCAAyC;IACzC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mCAAmC;IACnC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kCAAkC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kCAAkC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,gCAAgC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,wBAAwB;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EA2BhD,CAAC"}

package/dist/runtime/wasi-instance.js

@@ -1,7 +1,7 @@
 /**
- * wasi-instance.ts — WASI snapshot_preview1 shim for Nimbus (Wave-1 + Wave-2 + Stream-B).
+ * wasi-instance.ts — WASI snapshot_preview1 shim for Nimbus.
  *
- * Wave-1 surface (16 fns, kept verbatim):
+ * Core WASI surface:
  *   args_get / args_sizes_get / environ_get / environ_sizes_get
  *   fd_close / fd_write / fd_read / fd_seek / fd_tell
  *   fd_fdstat_get / fd_fdstat_set_flags
@@ -10,53 +10,53 @@
  *   random_get
  *   sched_yield
  *
- * Wave-2 additions (Wave-2; verbatim from wasi-w2 plan):
+ * Filesystem WASI additions:
  *   path_open
  *   path_create_directory / path_remove_directory
  *   path_unlink_file
- *   path_rename                         (uses Nimbus W-3 atomic rename)
- *   path_filestat_get / path_filestat_set_times (no-op times — UPGRADED in Stream-B B2)
+ *   path_rename
+ *   path_filestat_get / path_filestat_set_times
  *   fd_readdir                          (cookie-paginated)
  *   fd_filestat_get / fd_filestat_set_size
  *   fd_pread / fd_pwrite
  *   fd_prestat_get / fd_prestat_dir_name (real preopens, not EBADF)
  *
- * Stream-B additions (B1-B6, no-op stubs upgraded + new fns):
- *   B1: per-file mtime/atime/ctime tracking + in-memory symlink table
+ * Socket, polling, and metadata additions:
+ *   - per-file mtime/atime/ctime tracking + in-memory symlink table
  *       (additive — files Map shape unchanged; parallel times/symlinks Maps)
- *   B2: fd_filestat_set_times / path_filestat_set_times — REAL impls that
+ *   - fd_filestat_set_times / path_filestat_set_times — implementations that
  *       write mtime/atime; honor ATIM_NOW / MTIM_NOW flags via clock_realtime
- *   B3: path_symlink / path_readlink / path_link — REAL impls. Symlink
+ *   - path_symlink / path_readlink / path_link. Symlink
  *       resolution via __wasiResolvePathFull(baseFd, path, followFlag)
  *       with POSIX-style 40-deep loop detection (returns ELOOP).
- *   B4: fd_allocate — REAL impl (extends bytes to offset+len; zero-fill)
- *   B5: proc_raise(sig) — fixed: throws __WasiExit(128 + sig) per POSIX
- *       shell convention (SIGABRT=6 → 134, SIGTERM=15 → 143); was constant 128.
- *   B6: fd_fdstat_set_rights — REAL impl (tracks per-fd rights mask;
+ *   - fd_allocate extends bytes to offset+len and zero-fills.
+ *   - proc_raise(sig) throws __WasiExit(128 + sig) per POSIX shell convention
+ *       (SIGABRT=6 -> 134, SIGTERM=15 -> 143).
+ *   - fd_fdstat_set_rights tracks per-fd rights mask;
  *       fd_fdstat_get returns the tracked mask instead of wide-open).
  *
- * Stream-B P3 additions (sockets via cloudflare:sockets + JSPI):
- *   B7: sock_send / sock_recv / sock_shutdown — REAL impls via
+ * Socket support via cloudflare:sockets + JSPI:
+ *   - sock_send / sock_recv / sock_shutdown via
  *       WebAssembly.Suspending wrapping. path_open('/dev/tcp/<host>/<port>')
  *       synthetic-path triggers cloudflare:sockets connect().
  *
- * Stream-B P4 additions (poll_oneoff FULL via JSPI):
- *   B8: poll_oneoff — REAL impl. Handles ALL 3 subscription types in a
+ * Poll support via JSPI:
+ *   - poll_oneoff handles all three subscription types in a
  *       single Promise.race wrapped via WebAssembly.Suspending:
  *         CLOCK (REALTIME + MONOTONIC, relative + absolute deadlines via
- *           SUBSCRIPTION_CLOCK_ABSTIME flag) → setTimeout to deadline.
- *         FD_READ/FD_WRITE on file/dir/stdio/symlink → always-ready
+ *           SUBSCRIPTION_CLOCK_ABSTIME flag) -> setTimeout to deadline.
+ *         FD_READ/FD_WRITE on file/dir/stdio/symlink -> always-ready
  *           (POSIX: regular files never block).
- *         FD_READ on socket → real await on
+ *         FD_READ on socket -> real await on
  *           socket.readable.getReader().read(); data is stashed on
  *           entry.readBuf so subsequent sock_recv sees it pre-loaded.
- *         FD_WRITE on socket → always-ready (CF Workers writable
+ *         FD_WRITE on socket -> always-ready (CF Workers writable
  *           streams have unbounded queue from wasm-side perspective).
  *       Concurrent-ready drain: after first-promise resolution, probes
  *       each remaining promise against a microtask sentinel; collects
  *       all currently-resolved events into the output.
  *
- * Stream-B P4 / B9: wasi-threads honest assessment (hard limit):
+ * wasi-threads hard limit:
  *   wasi_thread_start is NOT exposed in this shim's import table.
  *   Workers facet isolates have no shared-linear-memory primitive
  *   across instances, so pthread semantics cannot be implemented
@@ -64,9 +64,9 @@
  *   "undefined symbol: thread_spawn" error at LINK time — a clear
  *   diagnostic instead of a runtime memory-corruption bug.
  *   Full rationale + workarounds-considered-and-rejected:
- *   docs/wasi-threads-infeasibility.md.
+ *   docs/wasi-threads.md.
  *
- * Architecture (Wave-2 strategy)
+ * Architecture (filesystem WASI strategy)
  * ──────────────────────────────
  *
  * Strategy: bulk-snapshot + flush. The supervisor snapshots the user's
@@ -107,7 +107,7 @@
  * when the user fn runs. Self-contained — no closure captures, no imports.
  */
 export const WASI_INSTANCE_PREAMBLE_SRC = `
-// ── BEGIN: wasi-instance preamble (Wave-1 + Wave-2) ─────────────────────
+// ── BEGIN: wasi-instance preamble (core WASI + filesystem WASI) ─────────────────────
 // Hand-written WASI snapshot_preview1 shim for Nimbus.
 // Source mirror: src/runtime/wasi-instance.ts. Keep in sync by hand.
 
@@ -162,25 +162,24 @@ const __WASI_PREOPENTYPE_DIR = 0;
 const __WASI_SYMLOOP_MAX = 40;
 // Default per-fd rights mask (wide-open).
 const __WASI_RIGHTS_ALL = 0xFFFFFFFFFFFFFFFFn;
-// Stream-B B7: sock_shutdown SD flags.
+// WASI socket and polling support B7: sock_shutdown SD flags.
 const __WASI_SDFLAGS_RD = 1;
 const __WASI_SDFLAGS_WR = 2;
-// Stream-B B8: poll_oneoff subscription / event types.
+// WASI socket and polling support B8: poll_oneoff subscription / event types.
 const __WASI_EVENTTYPE_CLOCK    = 0;
 const __WASI_EVENTTYPE_FD_READ  = 1;
 const __WASI_EVENTTYPE_FD_WRITE = 2;
 const __WASI_SUBCLOCKFLAGS_ABSTIME = 1;  // SUBSCRIPTION_CLOCK_ABSTIME
-// Stream-B B7: synthetic-path prefix recognised by path_open as a request
+// WASI socket and polling support B7: synthetic-path prefix recognised by path_open as a request
 // to open a TCP socket. Mirrors bash's /dev/tcp/<host>/<port> convention
 // (https://www.gnu.org/software/bash/manual/html_node/Redirections.html).
 const __WASI_TCP_PATH_PREFIX = '/dev/tcp/';
 
-// Stream-B B7: resolved at preamble module-init via dynamic import.
+// WASI socket and polling support B7: resolved at preamble module-init via dynamic import.
 // CF docs: "TCP sockets cannot be created in global scope and shared
 // across requests" — so we only IMPORT the module here (cheap symbol
 // resolution); the actual connect() call lives inside path_open which
 // runs at facet-handler time (i.e., within WorkerEntrypoint.execute()).
-// See /workspace/.seal-internal/2026-05-11-stream-b/p3-spike.md §2.
 let __cfSocketConnect = null;
 // Top-level await is supported in workerd ES modules at module-init.
 // If import fails (no cloudflare:sockets binding, or running under a
@@ -199,17 +198,17 @@ class __WasiExit { constructor(code) { this.code = code | 0; } }
 //
 // __wasiInitFS({ root, preopens, files, dirs, times?, symlinks? }) —
 // install a per-call FS:
-//   root      string  — canonical session root, e.g. 'home/user/wasi-w2'.
+//   root      string  — canonical session root, e.g. 'home/user/wasi-files'.
 //   preopens  Array<{ wasiPath, vfsPath }> — fd>=3 preopens (in order).
 //   files     Record<vfsPath, base64 string> — initial file contents.
 //   dirs      Array<vfsPath> — initial directory list.
 //   times     Record<vfsPath, {mtime, atime, ctime}> | undefined
-//               — per-path nanosecond timestamps (Stream-B B1). Optional;
+//               — per-path nanosecond timestamps (WASI socket and polling support B1). Optional;
 //               paths without entries default to "now" at init time.
 //               Values are decimal strings to survive JSON.serialize
 //               (BigInt is not JSON-safe); converted to BigInt internally.
 //   symlinks  Record<vfsPath, targetPath> | undefined
-//               — Stream-B B3 in-memory symlink table. Optional; defaults
+//               — WASI socket and polling support B3 in-memory symlink table. Optional; defaults
 //               to empty. Target paths are canonicalized at insertion.
 //
 // After _start returns, __wasiSnapshotFS() extracts:
@@ -257,7 +256,7 @@ function __wasiNowNs() {
 function __wasiInitFS(opts) {
   const files = new Map();   // canonicalVfsPath → Uint8Array
   const dirs  = new Set();   // canonicalVfsPath
-  // Stream-B B1: parallel timestamp + symlink maps.
+  // WASI socket and polling support B1: parallel timestamp + symlink maps.
   const times    = new Map();   // canonicalVfsPath → {mtime: BigInt, atime: BigInt, ctime: BigInt}
   const symlinks = new Map();   // canonicalVfsPath → targetPath (canonical)
   // mirror originals for diff at flush time
@@ -288,7 +287,7 @@ function __wasiInitFS(opts) {
       origTimes.set(canon, { mtime: t.mtime, atime: t.atime, ctime: t.ctime });
     }
   }
-  // Stream-B B1: load explicit per-path timestamps if supervisor provided them.
+  // WASI socket and polling support B1: load explicit per-path timestamps if supervisor provided them.
   // Values arrive as decimal strings (BigInt → JSON.stringify safe) or numbers.
   for (const [path, t] of Object.entries(opts.times || {})) {
     const canon = __wasiCanonicalize(path);
@@ -300,7 +299,7 @@ function __wasiInitFS(opts) {
     times.set(canon, { mtime, atime, ctime });
     origTimes.set(canon, { mtime, atime, ctime });
   }
-  // Stream-B B3: load explicit symlinks if supervisor provided them.
+  // WASI socket and polling support B3: load explicit symlinks if supervisor provided them.
   for (const [path, target] of Object.entries(opts.symlinks || {})) {
     const canon = __wasiCanonicalize(path);
     symlinks.set(canon, String(target));
@@ -332,7 +331,7 @@ function __wasiInitFS(opts) {
   }
 }
 
-// Stream-B B7 helper: open a TCP socket via cloudflare:sockets when
+// WASI socket and polling support B7 helper: open a TCP socket via cloudflare:sockets when
 // path_open is invoked on a /dev/tcp/<host>/<port> synthetic path.
 // Returns a WASI errno. Allocates a new fd of kind:'socket' on success
 // and writes it to fdOutPtr.
@@ -390,7 +389,7 @@ function __wasiOpenTcpSocket(pathArg, fdflags, fdOutPtr, writeU32LE) {
   return __WASI_ESUCCESS;
 }
 
-// Stream-B B1+B2 helpers: update tracked timestamps for a path. Idempotent.
+// WASI socket and polling support B1+B2 helpers: update tracked timestamps for a path. Idempotent.
 // Caller passes nanosecond BigInt(s); pass null for fields to keep unchanged.
 function __wasiTouchTimes(canonPath, mtimeNs, atimeNs, ctimeNs) {
   if (!__wasiFS) return;
@@ -420,9 +419,9 @@ function __wasiSnapshotFS() {
   const filesDeleted = [];
   const dirsCreated  = [];
   const dirsDeleted  = [];
-  const timesChanged    = {};   // Stream-B B1: mtime/atime/ctime diffs
-  const symlinksCreated = {};   // Stream-B B3: new symlinks
-  const symlinksDeleted = [];   // Stream-B B3: removed symlinks
+  const timesChanged    = {};   // WASI socket and polling support B1: mtime/atime/ctime diffs
+  const symlinksCreated = {};   // WASI socket and polling support B3: new symlinks
+  const symlinksDeleted = [];   // WASI socket and polling support B3: removed symlinks
   // files: anything in __wasiFS.files not in orig, or whose bytes differ.
   for (const [path, bytes] of __wasiFS.files) {
     const orig = __wasiFS.origFiles.get(path);
@@ -450,7 +449,7 @@ function __wasiSnapshotFS() {
   for (const path of __wasiFS.origDirs) {
     if (!__wasiFS.dirs.has(path)) dirsDeleted.push(path);
   }
-  // Stream-B B1: times diff. BigInt → decimal string (JSON.stringify-safe).
+  // WASI socket and polling support B1: times diff. BigInt → decimal string (JSON.stringify-safe).
   for (const [path, t] of __wasiFS.times) {
     const orig = __wasiFS.origTimes.get(path);
     if (!orig || orig.mtime !== t.mtime || orig.atime !== t.atime || orig.ctime !== t.ctime) {
@@ -461,7 +460,7 @@ function __wasiSnapshotFS() {
       };
     }
   }
-  // Stream-B B3: symlink diff.
+  // WASI socket and polling support B3: symlink diff.
   for (const [path, target] of __wasiFS.symlinks) {
     if (__wasiFS.origSymlinks.get(path) !== target) {
       symlinksCreated[path] = target;
@@ -483,9 +482,9 @@ function __wasiSnapshotFS() {
 //   { kind: 'preopen', wasiPath, vfsPath, rights? }
 //   { kind: 'file',    vfsPath, offset, oflags, fdflags, rights? }
 //   { kind: 'dir',     vfsPath, readdirEntries: null | Array, cookie, rights? }
-//   { kind: 'symlink', vfsPath, target, rights? }   // Stream-B B3 (only when O_NOFOLLOW)
+//   { kind: 'symlink', vfsPath, target, rights? }   // WASI socket and polling support B3 (only when O_NOFOLLOW)
 //
-// Stream-B B6: 'rights' is an optional BigInt mask. When set, fd_fdstat_get
+// WASI socket and polling support B6: 'rights' is an optional BigInt mask. When set, fd_fdstat_get
 // returns it (instead of the wide-open default). fd_fdstat_set_rights
 // writes to it. The mask is advisory in this shim (we don't enforce per-fn
 // rights checks in v1 — single-tenant facet, no untrusted callers).
@@ -493,7 +492,7 @@ const fdTable = new Map();
 let nextFd = 3;
 
 // Resolve a WASI path against a preopen fd; returns the canonical VFS path
-// WITHOUT following symlinks. Stream-B kept this name compatible with all
+// WITHOUT following symlinks. WASI socket and polling support kept this name compatible with all
 // existing call sites (~10 of them inside the imports object).
 //
 // wasi-path-fix: a single preopen { wasiPath: '/', vfsPath: 'home/user' }
@@ -539,7 +538,7 @@ function __wasiResolvePath(baseFd, pathStr) {
   return __wasiCanonicalize(baseVfs + '/' + trimmed);
 }
 
-// Stream-B B3: resolve a path WITH optional symlink-follow + POSIX loop
+// WASI socket and polling support B3: resolve a path WITH optional symlink-follow + POSIX loop
 // detection. Returns {path: canonical, isSymlink: bool, err?: errno}.
 // - If followFlag is true (default — matches LOOKUPFLAGS_SYMLINK_FOLLOW),
 //   walks the symlink chain up to __WASI_SYMLOOP_MAX depth. ELOOP if exceeded.
@@ -632,7 +631,7 @@ function __wasiMakeImports(opts) {
   }
   function setFile(vfsPath, bytes) {
     __wasiFS.files.set(vfsPath, bytes);
-    // Stream-B B1: bump mtime+ctime on every write. atime stays as-is
+    // WASI socket and polling support B1: bump mtime+ctime on every write. atime stays as-is
     // (read paths bump atime explicitly via touchAccess()).
     __wasiBumpMtime(vfsPath);
   }
@@ -641,7 +640,7 @@ function __wasiMakeImports(opts) {
     __wasiFS.times.delete(vfsPath);
   }
   function touchAccess(vfsPath) {
-    // Stream-B B1: bump atime on a read. mtime/ctime unchanged.
+    // WASI socket and polling support B1: bump atime on a read. mtime/ctime unchanged.
     if (!__wasiFS) return;
     const cur = __wasiFS.times.get(vfsPath);
     if (cur) cur.atime = __wasiNowNs();
@@ -655,7 +654,7 @@ function __wasiMakeImports(opts) {
     for (let i = 0; i < parts.length - 1; i++) {
       p = p ? (p + '/' + parts[i]) : parts[i];
       __wasiFS.dirs.add(p);
-      // Stream-B B1: ensure ancestor dirs have a times entry.
+      // WASI socket and polling support B1: ensure ancestor dirs have a times entry.
       if (!__wasiFS.times.has(p)) {
         const now = __wasiNowNs();
         __wasiFS.times.set(p, { mtime: now, atime: now, ctime: now });
@@ -734,7 +733,7 @@ function __wasiMakeImports(opts) {
       // Don't delete preopens — they're meant to persist for the program lifetime.
       const entry = fdTable.get(fd);
       if (entry.kind === 'preopen') return __WASI_ESUCCESS;
-      // Stream-B B7: best-effort close of socket streams. The actual
+      // WASI socket and polling support B7: best-effort close of socket streams. The actual
       // socket.close() is fire-and-forget (sync return per WASI) — if
       // the program wants to await closure it should sock_shutdown
       // first. We DO drop the fd-table entry so subsequent ops on this
@@ -813,9 +812,9 @@ function __wasiMakeImports(opts) {
     },
 
     fd_seek(fd, offsetArg, whence, newOffsetPtr) {
-      // WASI/V8 passes i64 args as BigInt. Wave-1 mistakenly assumed
+      // WASI/V8 passes i64 args as BigInt. core WASI mistakenly assumed
       // (lo, hi) i32 pairs; that worked only because hello-world never
-      // exercised seek. Wave-2: accept BigInt directly.
+      // exercised seek. filesystem WASI: accept BigInt directly.
       if (fd === 0 || fd === 1 || fd === 2) {
         writeU64LE(newOffsetPtr, 0n);
         return __WASI_ESUCCESS;
@@ -862,13 +861,13 @@ function __wasiMakeImports(opts) {
       } else if (entry.kind === 'symlink') {
         ftype = __WASI_FT_SYMBOLIC_LINK;
       } else if (entry.kind === 'socket') {
-        ftype = __WASI_FT_SOCKET_STREAM;  // Stream-B B7
+        ftype = __WASI_FT_SOCKET_STREAM;  // WASI socket and polling support B7
       }
       dv.setUint8(statPtr, ftype);
       dv.setUint8(statPtr + 1, 0);
       dv.setUint16(statPtr + 2, (entry.fdflags || 0) & 0xFFFF, true);
       dv.setUint32(statPtr + 4, 0, true);
-      // Stream-B B6: honor entry.rights when set, else wide-open default.
+      // WASI socket and polling support B6: honor entry.rights when set, else wide-open default.
       // The legacy '0x3FFFFFFFn' was a 30-bit truncation of the actual
       // 64-bit rights field; modern wasi-libc probes specific bits so we
       // now publish full 64-bit __WASI_RIGHTS_ALL.
@@ -886,7 +885,7 @@ function __wasiMakeImports(opts) {
       return __WASI_ESUCCESS;
     },
 
-    // Stream-B B6: track per-fd rights mask. Callers narrow their own caps;
+    // WASI socket and polling support B6: track per-fd rights mask. Callers narrow their own caps;
     // we record but don't enforce in v1 (single-tenant facet). The narrow
     // is visible to subsequent fd_fdstat_get calls, satisfying capability-
     // tightening probes that round-trip the mask.
@@ -930,16 +929,15 @@ function __wasiMakeImports(opts) {
     path_open(baseFd, dirflags, pathPtr, pathLen, oflags, _rightsBase, _rightsInheriting, fdflags, fdOutPtr) {
       const pathArg = readPath(pathPtr, pathLen);
 
-      // Stream-B B7: synthetic /dev/tcp/<host>/<port> path — open a TCP
+      // WASI socket and polling support B7: synthetic /dev/tcp/<host>/<port> path — open a TCP
       // socket via cloudflare:sockets. Bash-like convention; matches
-      // /workspace/.seal-internal/2026-05-11-stream-b/p3-spike.md §2.
       // Intercept BEFORE resolution because /dev/tcp/* doesn't exist in
       // the in-memory FS — __wasiResolvePath would canonicalize it but
       // not find any entry.
       if (pathArg.startsWith(__WASI_TCP_PATH_PREFIX)) {
         return __wasiOpenTcpSocket(pathArg, fdflags, fdOutPtr, writeU32LE);
       }
-      // Stream-B B3: honor LOOKUPFLAGS_SYMLINK_FOLLOW (default behavior
+      // WASI socket and polling support B3: honor LOOKUPFLAGS_SYMLINK_FOLLOW (default behavior
       // when bit is set or dirflags omitted). When NOT set, surface the
       // symlink itself as a 'symlink' fd kind so readlink can introspect.
       const follow = (dirflags & __WASI_LOOKUPFLAGS_SYMLINK_FOLLOW) !== 0 || dirflags === 0;
@@ -1001,7 +999,7 @@ function __wasiMakeImports(opts) {
       if (__wasiFS.files.has(resolved)) return __WASI_EEXIST;
       ensureParentDirs(resolved);
       __wasiFS.dirs.add(resolved);
-      // Stream-B B1: seed times for the new dir.
+      // WASI socket and polling support B1: seed times for the new dir.
       const now = __wasiNowNs();
       __wasiFS.times.set(resolved, { mtime: now, atime: now, ctime: now });
       return __WASI_ESUCCESS;
@@ -1024,7 +1022,7 @@ function __wasiMakeImports(opts) {
       const resolved = __wasiResolvePath(baseFd, path);
       if (resolved === null) return __WASI_EBADF;
       if (__wasiFS.dirs.has(resolved)) return __WASI_EISDIR;
-      // Stream-B B3: unlink also removes a symlink at this path. We
+      // WASI socket and polling support B3: unlink also removes a symlink at this path. We
       // operate on the unfollowed path (POSIX unlink semantics — removes
       // the directory entry itself, not the symlink target).
       if (__wasiFS.symlinks.has(resolved)) {
@@ -1085,7 +1083,7 @@ function __wasiMakeImports(opts) {
     // ── path_filestat_get ──
     path_filestat_get(baseFd, lookupflags, pathPtr, pathLen, statPtr) {
       const path = readPath(pathPtr, pathLen);
-      // Stream-B B3: follow symlinks unless explicitly told not to.
+      // WASI socket and polling support B3: follow symlinks unless explicitly told not to.
       const follow = (lookupflags & __WASI_LOOKUPFLAGS_SYMLINK_FOLLOW) !== 0 || lookupflags === 0;
       const rp = __wasiResolvePathFull(baseFd, path, follow);
       if (rp.err === __WASI_EBADF) return __WASI_EBADF;
@@ -1104,7 +1102,7 @@ function __wasiMakeImports(opts) {
       } else {
         return __WASI_ENOENT;
       }
-      // Stream-B B1: emit real timestamps.
+      // WASI socket and polling support B1: emit real timestamps.
       const t = __wasiFS.times.get(resolved) || { mtime: 0n, atime: 0n, ctime: 0n };
       const dv = view();
       // filestat_t layout (WASI preview1):
@@ -1122,7 +1120,7 @@ function __wasiMakeImports(opts) {
       return __WASI_ESUCCESS;
     },
 
-    // Stream-B B2: real path_filestat_set_times. Honors ATIM/ATIM_NOW/
+    // WASI socket and polling support B2: real path_filestat_set_times. Honors ATIM/ATIM_NOW/
     // MTIM/MTIM_NOW flags. Spec: atim_ns and mtim_ns are absolute
     // nanosecond timestamps; flags select which fields to update + whether
     // to clamp to "now". ENOENT if path doesn't exist.
@@ -1151,7 +1149,7 @@ function __wasiMakeImports(opts) {
       return __WASI_ESUCCESS;
     },
 
-    // Stream-B B3: read the target string of a symlink. Spec:
+    // WASI socket and polling support B3: read the target string of a symlink. Spec:
     //   path_readlink(fd, path, path_len, buf, buf_len, *bufused)
     // Truncates to buf_len; writes actual bytes to *bufused.
     path_readlink(baseFd, pathPtr, pathLen, bufPtr, bufLen, bufUsedPtr) {
@@ -1174,7 +1172,7 @@ function __wasiMakeImports(opts) {
       return __WASI_ESUCCESS;
     },
 
-    // Stream-B B3: create a symlink. Spec:
+    // WASI socket and polling support B3: create a symlink. Spec:
     //   path_symlink(old_path, fd, new_path)
     // old_path is the symlink's TARGET (stored verbatim); fd+new_path
     // is the location where the symlink itself is created.
@@ -1195,7 +1193,7 @@ function __wasiMakeImports(opts) {
       return __WASI_ESUCCESS;
     },
 
-    // Stream-B B3: hardlink. Spec:
+    // WASI socket and polling support B3: hardlink. Spec:
     //   path_link(old_fd, old_flags, old_path, new_fd, new_path)
     // Implements as a shared-buffer alias. POSIX semantics: both names
     // point at the same inode, so writes through either are visible to
@@ -1271,7 +1269,7 @@ function __wasiMakeImports(opts) {
       setFile(entry.vfsPath, next);
       return __WASI_ESUCCESS;
     },
-    // Stream-B B2: real fd_filestat_set_times.
+    // WASI socket and polling support B2: real fd_filestat_set_times.
     fd_filestat_set_times(fd, atimArg, mtimArg, fstflags) {
       const entry = fdTable.get(fd);
       if (!entry) return __WASI_EBADF;
@@ -1403,7 +1401,7 @@ function __wasiMakeImports(opts) {
     },
 
     fd_advise()     { return __WASI_ESUCCESS; },
-    // Stream-B B4: real fd_allocate. Extends the file's byte buffer with
+    // WASI socket and polling support B4: real fd_allocate. Extends the file's byte buffer with
     // zeros so [offset, offset+len) is allocated. POSIX posix_fallocate
     // semantics. ENOSPC is not reachable in our in-memory FS (the
     // 32 MiB snapshot cap is enforced at supervisor level; in-call we
@@ -1433,7 +1431,7 @@ function __wasiMakeImports(opts) {
 
     // ── proc_exit ──
     proc_exit(code) { throw new __WasiExit(code | 0); },
-    // Stream-B B5: proc_raise(sig) — POSIX shell convention encodes a
+    // WASI socket and polling support B5: proc_raise(sig) — POSIX shell convention encodes a
     // signal-terminated process as exit-status 128+sig. SIGABRT=6 → 134,
     // SIGTERM=15 → 143, SIGKILL=9 → 137. Returns errno (never actually;
     // throws via __WasiExit). The legacy 'throw new __WasiExit(128)' was
@@ -1481,7 +1479,7 @@ function __wasiMakeImports(opts) {
 
     sched_yield()   { return __WASI_ESUCCESS; },
 
-    // ── Stream-B B8: poll_oneoff FULL ────────────────────────────────
+    // ── WASI socket and polling support B8: poll_oneoff FULL ────────────────────────────────
     //
     // Spec: WASI preview1 poll_oneoff(in_subscriptions, out_events,
     // nsubscriptions, *retNevents) blocks until at least one event fires,
@@ -1748,7 +1746,7 @@ function __wasiMakeImports(opts) {
       return __WASI_ESUCCESS;
     },
 
-    // Stream-B B7: sockets via cloudflare:sockets connect() + JSPI.
+    // WASI socket and polling support B7: sockets via cloudflare:sockets connect() + JSPI.
     //
     // sock_send/sock_recv/sock_shutdown are ASYNC fns. They await on
     // ReadableStream/WritableStream readers/writers, which means the
@@ -1883,7 +1881,7 @@ function __wasiMakeImports(opts) {
         // writer.close() may tear down the underlying connection in
         // ways that prevent further reads, even with allowHalfOpen=true.
         //
-        // Empirically observed on prod (sock-shutdown-write probe RED
+        // Empirically observed on prod (sock-shutdown-write probe failing
         // after writer.close() with allowHalfOpen=true): subsequent
         // sock_recv returns 0 bytes because the readable side stops
         // delivering once the writer closes.
@@ -1898,7 +1896,7 @@ function __wasiMakeImports(opts) {
         // peer expects EOF to know when the request is done) for
         // server-echo-protocol correctness (where the peer streams
         // back regardless). The probe is the latter case; documented
-        // limit for the former: see docs/wasi-threads-infeasibility.md
+        // limit for the former: see docs/wasi-threads.md
         // and surrounding sock_* commentary.
         if (wantWr && !entry.halfClosedWr) {
           entry.halfClosedWr = true;
@@ -1919,10 +1917,9 @@ function __wasiMakeImports(opts) {
     },
   };
 
-  // Stream-B B7: wrap the async socket imports in WebAssembly.Suspending
+  // WASI socket and polling support B7: wrap the async socket imports in WebAssembly.Suspending
   // so the wasm caller can use sync-shape calls that yield to the JS
   // event loop. Requires V8 14.2+ (workerd Oct 2025+) — see
-  // /workspace/.seal-internal/2026-05-11-jspi-spike/findings.md.
   // If Suspending isn't available (older runtime), socket imports remain
   // async fns that the wasm boundary will reject with a trap — caller
   // sees a clean failure via __wasiRunStartAsync's catch block.
@@ -1930,7 +1927,7 @@ function __wasiMakeImports(opts) {
     imports.sock_send     = new WebAssembly.Suspending(imports.sock_send);
     imports.sock_recv     = new WebAssembly.Suspending(imports.sock_recv);
     imports.sock_shutdown = new WebAssembly.Suspending(imports.sock_shutdown);
-    // Stream-B B8: poll_oneoff also needs JSPI to support CLOCK
+    // WASI socket and polling support B8: poll_oneoff also needs JSPI to support CLOCK
     // subscriptions (await setTimeout) and socket-fd readiness
     // (await reader.read()). Same Suspending shape as sock_*.
     imports.poll_oneoff   = new WebAssembly.Suspending(imports.poll_oneoff);
@@ -1959,7 +1956,7 @@ function __wasiRunStart(instance, ctx) {
   }
 }
 
-// Stream-B (P3/P4 forward-decl): async variant of runStart. Wraps _start
+// WASI socket and polling support (P3/P4 forward-decl): async variant of runStart. Wraps _start
 // with WebAssembly.promising so suspending imports (sock_send, sock_recv,
 // poll_oneoff) can await Promises and have V8 suspend+resume the wasm
 // stack. Returns the SAME shape as __wasiRunStart but in a Promise.
@@ -1981,7 +1978,6 @@ async function __wasiRunStartAsync(instance, ctx) {
     // WebAssembly.promising wraps the export so it returns a Promise<void>
     // that resolves when the (potentially-suspending) wasm computation
     // completes. Available since V8 14.2 (workerd Oct 2025) — see
-    // /workspace/.seal-internal/2026-05-11-jspi-spike/findings.md.
     //
     // If promising isn't available (older runtimes), fall through to a
     // direct call — fully spec-compatible for non-suspending _start.
@@ -2001,14 +1997,9 @@ async function __wasiRunStartAsync(instance, ctx) {
 }
 // ── END: wasi-instance preamble ─────────────────────────────────────────
 `;
-/** Total count of functionally-implemented WASI fns (Wave-1 + Wave-2 + Stream-B P2 + P3 + P4). */
-export const WASI_WAVE2_FN_COUNT = 30;
-export const WASI_STREAM_B_P2_FN_COUNT = 36; // +6: B2 (real ×2), B3 (×3), B4, B6
-export const WASI_STREAM_B_P3_FN_COUNT = 39; // +3: B7 sock_send/sock_recv/sock_shutdown
-export const WASI_STREAM_B_P4_FN_COUNT = 40; // +1: B8 poll_oneoff
-/** Names of the Wave-1 + Wave-2 + Stream-B P2 functionally-implemented WASI fns. */
-export const WASI_WAVE2_FNS = Object.freeze([
-    // Wave-1
+/** Names of the WASI imports implemented by this shim. */
+export const WASI_IMPLEMENTED_FNS = Object.freeze([
+    // core WASI
     'args_get', 'args_sizes_get',
     'environ_get', 'environ_sizes_get',
     'fd_close', 'fd_read', 'fd_write', 'fd_seek', 'fd_tell',
@@ -2017,28 +2008,21 @@ export const WASI_WAVE2_FNS = Object.freeze([
     'clock_time_get', 'clock_res_get',
     'random_get',
     'sched_yield',
-    // Wave-2
+    // filesystem WASI
     'fd_prestat_get', 'fd_prestat_dir_name',
     'path_open',
     'path_create_directory', 'path_remove_directory',
     'path_unlink_file',
     'path_rename',
-    'path_filestat_get', 'path_filestat_set_times', // B2 upgraded to real
-    'fd_filestat_get', 'fd_filestat_set_size', 'fd_filestat_set_times', // B2 upgraded to real
+    'path_filestat_get', 'path_filestat_set_times',
+    'fd_filestat_get', 'fd_filestat_set_size', 'fd_filestat_set_times',
     'fd_pread', 'fd_pwrite',
     'fd_readdir',
     'fd_renumber',
-    // Stream-B P2 additions
-    'path_symlink', 'path_readlink', 'path_link', // B3
-    'fd_allocate', // B4
-    'fd_fdstat_set_rights', // B6
-    // Stream-B P3 additions
-    'sock_send', 'sock_recv', 'sock_shutdown', // B7 — via WebAssembly.Suspending
-    // Stream-B P4 additions
-    'poll_oneoff', // B8 — via WebAssembly.Suspending
+    // symlinks, rights, sockets, and polling
+    'path_symlink', 'path_readlink', 'path_link',
+    'fd_allocate',
+    'fd_fdstat_set_rights',
+    'sock_send', 'sock_recv', 'sock_shutdown',
+    'poll_oneoff',
 ]);
-/**
- * Backwards-compat alias kept for any caller still importing the Wave-1
- * symbol names. The Wave-2 module now subsumes Wave-1's count.
- */
-export const WASI_WAVE1_FNS = WASI_WAVE2_FNS;

package/dist/runtime/wasm-runner.d.ts

@@ -1,21 +1,15 @@
 /**
  * wasm-runner.ts — native-WASM runner via the LOADER-modules transport.
  *
- * Re-introduced after the multi-runtime wave's revert. The previous
- * version relied on direct `WebAssembly.instantiate(bytes)` at request
- * time — workerd's CSP blocks that path inside both the supervisor
- * and facet isolates (verified in the multi-runtime feasibility
- * memo). The new version routes through the LOADER's modules map:
+ * Direct `WebAssembly.instantiate(bytes)` is blocked by workerd CSP at
+ * request time in both the supervisor and facet isolates. This runner routes
+ * through the LOADER modules map:
  * bytes ride INSIDE the worker code blob, workerd compiles them
  * during the inner worker's MODULE-LOAD phase (the one phase where
  * wasm code generation IS allowed), and the resulting
  * WebAssembly.Module is exposed to the user fn via the
  * NimbusLoaderPool's `globalThis.__NIMBUS_WASM[<name>]` table.
  *
- * The validation that this works on the deployed Cloudflare fleet
- * lives at /workspace/.seal-internal/2026-05-10-wasm-csp/findings.md
- * (`add(3,4) === 7` returned in 11ms warm, 113ms cold).
- *
  * Shell command shape
  * ───────────────────
  *
@@ -45,14 +39,14 @@
  *   - WASI imports are NOT provided. Modules expecting wasi_snapshot
  *     won't instantiate (fail at the in-facet instantiate step).
  *
- * Anti-requirements
- * ─────────────────
- *   - NO setTimeout / NO retry / NO defensive-catch in the dispatch
- *     path. The pool's resilience options handle retries.
+ * Dispatch constraints
+ * ────────────────────
+ *   - No sleeps, caller-side retries, or catch-and-continue around loader
+ *     failures. The pool's resilience options own retry behavior.
  *   - The try/catch around vfs.readFile is a legitimate I/O boundary;
  *     the diagnostic propagates as exitCode 1 + stderr line.
  *   - NO direct WebAssembly.instantiate(bytes) at request time —
- *     that's the architectural mistake from the prior wave.
+ *     workerd CSP rejects that path.
  */
 import type { RuntimeRunOpts, RuntimeRunResult } from './runtime-registry.js';
 export declare const WASM_RUNNER_VERSION = "0.3.0";
@@ -63,7 +57,7 @@ export declare const WASM_RUNNER_HELP: string;
  * is part of `src/runtime/`, importing supervisor-specific types
  * would create a cycle.
  *
- * Wave-2: extended for WASI file-IO. The snapshot path uses readdir +
+ * filesystem WASI: extended for WASI file-IO. The snapshot path uses readdir +
  * isDirectory + stat to traverse the user's session subtree; the
  * flush path uses writeFile + mkdir + unlink + rmdir.
  */