@nimbus-sh/worker 0.10.0 → 0.11.0

package/dist/runtime/runtime-catalog.js

@@ -46,11 +46,11 @@
  * makes a stale pin a cache miss rather than an outage.
  */
 import { z } from 'zod/v4';
-import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
+import { sha256Hex, sha256Incremental } from '@nimbus-sh/core/_shared/crypto.js';
 import { RUNTIME_CATALOG_SHA256 } from '../runtime-catalog.generated.js';
 import { HexSha256Schema, parseRuntimeManifest, } from '@nimbus-sh/core/runtime/runtime-manifest.js';
 import { runtimeEntrypoints } from '@nimbus-sh/core/runtime/installed-runtimes.js';
-import { splitRuntimeSpec, SUPERSEDED_RUNTIMES, } from '@nimbus-sh/core/runtime/runtime-package.js';
+import { blobPieces, RuntimeBlobDigestMismatch, splitRuntimeSpec, SUPERSEDED_RUNTIMES, } from '@nimbus-sh/core/runtime/runtime-package.js';
 import { NIMBUS_RUNTIME_ABIS, NATIVE_UNSUPPORTED_ABI, } from '@nimbus-sh/core/runtime/os-contracts.js';
 const CatalogVersionEntrySchema = z.object({
     manifest: z.string().min(1),
@@ -162,8 +162,14 @@ export async function fetchManifest(env, entry) {
     return parseRuntimeManifest(parseJsonBytes(bytes));
 }
 /**
- * Fetch the blob a manifest file entry points at, verified against the
- * digest that same entry carries.
+ * Stream the blob a manifest file entry points at, verified against the
+ * digest that same entry carries: from the colo cache when it has it, else
+ * from R2, read once either way. The stream errors at its end, rather than
+ * closing, with a {@link RuntimeBlobDigestMismatch} when its bytes do not
+ * hash to the digest; a colo-cache entry that fails is evicted and
+ * distrusted first, so the installer's second read of that blob comes from
+ * R2 whatever the cache holds by then. The installer commits
+ * a blob only after that clean close, so no step holds a blob whole.
  *
  * The digest is not optional and does not travel separately from the key:
  * a `ManifestFile` always has both, and it is the only thing this takes.
@@ -175,9 +181,15 @@ export async function fetchBlob(env, file) {
     if (!address) {
         throw new Error(`manifest entry ${file.path} has no usable sha256 (${file.sha256})`);
     }
-    const cached = await l2Get(address);
-    if (cached)
-        return cached;
+    const cached = l2Distrusted.has(address.sha256) ? null : await l2GetBody(address);
+    if (cached) {
+        return verifiedRead(address, cached, null, async (actual) => {
+            l2Distrusted.add(address.sha256);
+            await l2Evict(address);
+            return `sha256 mismatch for blob ${file.content}: manifest expects ${address.sha256}, `
+                + `the colo cache held ${actual} and was evicted`;
+        });
+    }
     const r2 = env.NIMBUS_RUNTIME_CACHE;
     if (!r2) {
         throw new Error('NIMBUS_RUNTIME_CACHE binding missing — blob cannot be fetched');
@@ -186,14 +198,59 @@ export async function fetchBlob(env, file) {
     if (!obj) {
         throw new Error(`blob ${file.content} not in R2 — manifest references a missing blob`);
     }
-    const bytes = new Uint8Array(await obj.arrayBuffer());
-    const verified = await verifyBytes(address, bytes);
-    if (!verified) {
-        throw new Error(`sha256 mismatch for blob ${file.content}: manifest expects ${address.sha256}, ` +
-            `R2 holds ${await sha256Hex(bytes)}`);
-    }
-    await l2Put(verified, 'application/octet-stream');
-    return verified.bytes;
+    return verifiedRead(address, obj.body, l2FillWriter(address), (actual) => `sha256 mismatch for blob ${file.content}: manifest expects ${address.sha256}, R2 holds ${actual}`);
+}
+/**
+ * `body` as a stream that errors at its end, with a
+ * {@link RuntimeBlobDigestMismatch}, rather than closing, unless it hashed to
+ * `address`. It is read once. When `fill` is given, the same read feeds L2:
+ * each piece reaches the cache before the consumer, and the cache entry is
+ * closed only after the digest matched; a mismatch, a failed read or an
+ * abandoned stream aborts it, and an aborted body stores nothing. The
+ * cache's own pace bounds the pair, so neither side buffers what the other
+ * lags by.
+ */
+function verifiedRead(address, body, fill, mismatch) {
+    const pieces = blobPieces(body);
+    const digest = sha256Incremental();
+    const drop = (reason) => {
+        fill?.abort(reason).catch(() => { });
+        fill = null;
+    };
+    return new ReadableStream({
+        async pull(controller) {
+            try {
+                const next = await pieces.next();
+                if (next.done) {
+                    const actual = await digest.hex();
+                    if (actual !== address.sha256)
+                        throw new RuntimeBlobDigestMismatch(await mismatch(actual));
+                    fill?.close().catch(() => { });
+                    controller.close();
+                    return;
+                }
+                await digest.update(next.value);
+                if (fill) {
+                    try {
+                        await fill.ready;
+                        fill.write(next.value).catch(() => { });
+                    }
+                    catch (error) {
+                        drop(error);
+                    }
+                }
+                controller.enqueue(next.value);
+            }
+            catch (error) {
+                drop(error);
+                throw error;
+            }
+        },
+        async cancel(reason) {
+            drop(reason);
+            await pieces.return(undefined);
+        },
+    }, { highWaterMark: 0 });
 }
 // ── RuntimeSource ────────────────────────────────────────────────────
 export function runtimeAbiForCatalogName(name) {
@@ -314,6 +371,59 @@ async function l2Put(verified, contentType) {
     }
     catch { /* best-effort */ }
 }
+/**
+ * The body of the blob entry at `address`, or null on a miss or a stripped
+ * Cache API. Unverified: served only through {@link verifiedRead}, whose
+ * mismatch evicts it and sends later reads of that blob to R2. Hashing an entry before serving it would read every
+ * blob from the cache twice, which was most of an install's time.
+ */
+async function l2GetBody(address) {
+    try {
+        const caches = globalThis.caches;
+        if (!caches?.default)
+            return null;
+        const hit = await caches.default.match(new Request(l2Url(address)));
+        return hit?.ok && hit.body ? hit.body : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Blob digests whose colo-cache entry failed verification in this isolate.
+ * Their reads go to R2 from then on: a purge lands some time after it is
+ * asked for, and a shared cache can be poisoned again, so the installer's
+ * second read of a failed blob must not depend on either.
+ */
+const l2Distrusted = new Set();
+/** Drop the entry at `address` from the colo cache for other isolates. */
+async function l2Evict(address) {
+    try {
+        await globalThis.caches?.default?.delete(new Request(l2Url(address)));
+    }
+    catch { /* best-effort */ }
+}
+/** A writer whose bytes become the L2 entry at `address` when it closes;
+ *  aborting it stores nothing. Null where there is no cache. */
+function l2FillWriter(address) {
+    try {
+        const caches = globalThis.caches;
+        if (!caches?.default)
+            return null;
+        const { readable, writable } = new TransformStream();
+        const resp = new Response(readable, {
+            headers: {
+                'Content-Type': 'application/octet-stream',
+                'Cache-Control': 'public, max-age=31536000, immutable',
+            },
+        });
+        caches.default.put(new Request(l2Url(address)), resp).catch(() => { });
+        return writable.getWriter();
+    }
+    catch {
+        return null;
+    }
+}
 function l2Url(address) {
     return `${L2_NS}/${address.scope}/${address.sha256}`;
 }

package/dist/runtime/sqlite-wasm-bytes.d.ts

@@ -10,10 +10,10 @@
  * via its `instantiateWasm` hook with that pre-compiled module —
  * request-time WebAssembly.compile(bytes) is blocked inside facets.
  *
- * Mirrors esbuild-wasm-bytes.ts: NO module-scope cache (no supervisor
- * residency), L2 colo cache via caches.default keyed by the version-pinned
- * asset URL, ASSETS as the source of truth, and a sha-256 integrity check on
- * both tiers so a stale or tampered asset never gets compiled.
+ * NO module-scope cache (no supervisor residency). The read itself is
+ * runtime/staged-source.ts: L2 keyed by the version-pinned asset URL, ASSETS
+ * as the source of truth, and a sha-256 check on both tiers so a stale or
+ * tampered asset never gets compiled.
  */
 /**
  * Path inside env.ASSETS where the sql.js wasm binary lives. Versioned so

package/dist/runtime/sqlite-wasm-bytes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/sqlite-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,+BAAyC,CAAC;AAE7E,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,2DAAqE,CAAC;AAErG;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwDxF"}
+{"version":3,"file":"sqlite-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/sqlite-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,+BAAyC,CAAC;AAE7E,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,2DAAqE,CAAC;AAErG;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAElF"}

package/dist/runtime/sqlite-wasm-bytes.js

@@ -10,15 +10,14 @@
  * via its `instantiateWasm` hook with that pre-compiled module —
  * request-time WebAssembly.compile(bytes) is blocked inside facets.
  *
- * Mirrors esbuild-wasm-bytes.ts: NO module-scope cache (no supervisor
- * residency), L2 colo cache via caches.default keyed by the version-pinned
- * asset URL, ASSETS as the source of truth, and a sha-256 integrity check on
- * both tiers so a stale or tampered asset never gets compiled.
+ * NO module-scope cache (no supervisor residency). The read itself is
+ * runtime/staged-source.ts: L2 keyed by the version-pinned asset URL, ASSETS
+ * as the source of truth, and a sha-256 check on both tiers so a stale or
+ * tampered asset never gets compiled.
  */
 import { SQLJS_VERSION } from '@nimbus-sh/core/constants.js';
 import { SQLITE_WASM_SHA256 } from '../sqlite-wasm-bundle.generated.js';
-import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
-import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
+import { fetchStagedBytes } from './staged-source.js';
 /**
  * Path inside env.ASSETS where the sql.js wasm binary lives. Versioned so
  * a future sql.js bump produces a different asset name and forces a fresh
@@ -38,55 +37,20 @@ export const SQLITE_WASM_L2_KEY = `https://nimbus-cache.invalid/_assets/sqljs-${
  * failures are silent — ASSETS is always the source of truth. A non-200
  * from ASSETS, or a digest mismatch on either tier, throws.
  */
-export async function fetchSqliteWasmBytes(env) {
-    const caches = globalThis.caches;
-    // ── L2 fast path ────────────────────────────────────────────────
-    let ab = null;
-    try {
-        if (caches?.default) {
-            const hit = await caches.default.match(new Request(SQLITE_WASM_L2_KEY));
-            if (hit && hit.ok)
-                ab = await hit.arrayBuffer();
-        }
-    }
-    catch { /* fall through to ASSETS */ }
-    const fromCache = ab !== null;
-    if (!ab) {
-        // ── ASSETS path ───────────────────────────────────────────────
-        const url = `https://nimbus-internal.invalid${SQLITE_WASM_ASSET_PATH}`;
-        const res = await env.ASSETS.fetch(new Request(url));
-        try {
-            if (!res.ok) {
-                throw new Error(`sql.js wasm asset fetch failed: ${res.status} ${res.statusText} ` +
-                    `for ${SQLITE_WASM_ASSET_PATH} — deploy is missing the wasm asset`);
-            }
-            ab = await res.arrayBuffer();
-        }
-        finally {
-            disposeRpcResource(res);
-        }
-    }
-    const digest = await sha256Hex(ab);
-    if (digest !== SQLITE_WASM_SHA256) {
-        throw new Error(`sql.js wasm integrity check failed: expected ${SQLITE_WASM_SHA256}, got ` +
-            `${digest} (${fromCache ? 'L2 cache' : 'ASSETS'}) for ${SQLITE_WASM_ASSET_PATH} — ` +
-            'the staged asset is corrupt or out of sync; rerun ' +
-            'scripts/bundle-sqlite-wasm.mjs and redeploy');
-    }
-    // ── L2 write-back (best-effort) ─────────────────────────────────
-    if (!fromCache) {
-        try {
-            if (caches?.default) {
-                const writeBack = new Response(new Uint8Array(ab), {
-                    headers: {
-                        'Content-Type': 'application/wasm',
-                        'Cache-Control': 'public, max-age=31536000, immutable',
-                    },
-                });
-                await caches.default.put(new Request(SQLITE_WASM_L2_KEY), writeBack);
-            }
-        }
-        catch { /* silent */ }
-    }
-    return ab;
+export function fetchSqliteWasmBytes(env) {
+    return fetchStagedBytes(env, SQLITE_WASM_ASSET);
 }
+const SQLITE_WASM_ASSET = {
+    path: SQLITE_WASM_ASSET_PATH,
+    l2Key: SQLITE_WASM_L2_KEY,
+    sha256: SQLITE_WASM_SHA256,
+    contentType: 'application/wasm',
+    poisonedCache: 'reject',
+    missingBinding: `Nimbus: node:sqlite requires an env.ASSETS binding (serves ${SQLITE_WASM_ASSET_PATH})`,
+    fetchFailed: (res) => `sql.js wasm asset fetch failed: ${res.status} ${res.statusText} ` +
+        `for ${SQLITE_WASM_ASSET_PATH} — deploy is missing the wasm asset`,
+    integrityFailed: (digest, from) => `sql.js wasm integrity check failed: expected ${SQLITE_WASM_SHA256}, got ` +
+        `${digest} (${from}) for ${SQLITE_WASM_ASSET_PATH} — ` +
+        'the staged asset is corrupt or out of sync; rerun ' +
+        'scripts/bundle-sqlite-wasm.mjs and redeploy',
+};

package/dist/runtime/staged-source.d.ts

@@ -0,0 +1,67 @@
+/**
+ * staged-source.ts — the one supervisor-side read of a build artifact a bundle
+ * script staged under public/_assets/ instead of inlining it in the Worker
+ * bundle (wasm modules, facet source texts).
+ *
+ * The staging script pins each artifact by sha-256 in a `.generated.ts`. This
+ * module reads it through L2 (caches.default) under a key that changes with
+ * the bytes, with ASSETS as the source of truth, and hands out nothing that
+ * fails the pinned digest: a stale or partial asset never reaches workerd's
+ * loader or a facet. L2 is written only with verified bytes read from ASSETS.
+ *
+ * Artifacts differ only in what they name in errors and in what a bad L2 entry
+ * means to their caller (`poisonedCache`), so each passes those in.
+ */
+/** Minimal env shape — any env with an ASSETS Fetcher binding. */
+export interface StagedSourceEnv {
+    ASSETS?: {
+        fetch(req: Request): Promise<Response>;
+    };
+}
+/** One staged artifact, as its `.generated.ts` pins it. */
+export interface StagedAsset {
+    /** Asset path ASSETS serves, e.g. `/_assets/runtime/node-shims-<buildId>.js`. */
+    path: string;
+    /** L2 key; carries the build id or version, so it changes with the bytes. */
+    l2Key: string;
+    /** Full digest the bytes must match. */
+    sha256: string;
+    /** Content-Type of the L2 copy, where the artifact has one. */
+    contentType?: string;
+    /**
+     * An L2 entry that fails the digest: `reject` throws, `refetch` deletes the
+     * entry and reads ASSETS instead (whose bytes then replace it).
+     */
+    poisonedCache: 'reject' | 'refetch';
+    /** Message for a deploy with no ASSETS binding. */
+    missingBinding: string;
+    /** Message for a non-OK ASSETS response. */
+    fetchFailed(res: Response): string;
+    /** Message for bytes that do not match `sha256`. */
+    integrityFailed(digest: string, from: 'L2 cache' | 'ASSETS'): string;
+}
+/** Fetch a staged artifact's bytes and verify them against its pinned digest. */
+export declare function fetchStagedBytes(env: StagedSourceEnv, asset: StagedAsset): Promise<ArrayBuffer>;
+/** {@link fetchStagedBytes}, decoded as UTF-8. */
+export declare function fetchStagedText(env: StagedSourceEnv, asset: StagedAsset): Promise<string>;
+/**
+ * One load per isolate: every caller shares the first call's promise, and a
+ * rejected one is dropped so the next call loads again instead of pinning the
+ * error.
+ */
+export declare function memoizeUntilRejected<A, T>(load: (arg: A) => Promise<T>): (arg: A) => Promise<T>;
+/**
+ * The `StagedAsset` of a facet source text staged under
+ * public/_assets/runtime/ by `stagedBy` and needed by `requiredBy`: a bad L2
+ * entry is replaced from ASSETS, since every later fetch in the colo for the
+ * build would otherwise fail on it.
+ */
+export declare function stagedRuntimeSource(source: {
+    label: string;
+    entry: string;
+    buildId: string;
+    sha256: string;
+    stagedBy: string;
+    requiredBy: string;
+}): StagedAsset;
+//# sourceMappingURL=staged-source.d.ts.map

package/dist/runtime/staged-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staged-source.d.ts","sourceRoot":"","sources":["../../src/runtime/staged-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACrD;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,EAAE,QAAQ,GAAG,SAAS,CAAC;IACpC,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAAC;IACnC,oDAAoD;IACpD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtE;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CA2CrG;AAED,kDAAkD;AAClD,wBAAsB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/F;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAU/F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,WAAW,CAkBd"}

package/dist/runtime/staged-source.js

@@ -0,0 +1,113 @@
+/**
+ * staged-source.ts — the one supervisor-side read of a build artifact a bundle
+ * script staged under public/_assets/ instead of inlining it in the Worker
+ * bundle (wasm modules, facet source texts).
+ *
+ * The staging script pins each artifact by sha-256 in a `.generated.ts`. This
+ * module reads it through L2 (caches.default) under a key that changes with
+ * the bytes, with ASSETS as the source of truth, and hands out nothing that
+ * fails the pinned digest: a stale or partial asset never reaches workerd's
+ * loader or a facet. L2 is written only with verified bytes read from ASSETS.
+ *
+ * Artifacts differ only in what they name in errors and in what a bad L2 entry
+ * means to their caller (`poisonedCache`), so each passes those in.
+ */
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
+import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
+/** Fetch a staged artifact's bytes and verify them against its pinned digest. */
+export async function fetchStagedBytes(env, asset) {
+    if (!env.ASSETS)
+        throw new Error(asset.missingBinding);
+    // The colo cache, where the runtime has one: workerd does, a test harness may not.
+    const cache = typeof caches === 'undefined' ? undefined : caches.default;
+    if (cache) {
+        let cached = null;
+        try {
+            const hit = await cache.match(new Request(asset.l2Key));
+            if (hit && hit.ok)
+                cached = await hit.arrayBuffer();
+        }
+        catch { /* fall through to ASSETS */ }
+        if (cached !== null) {
+            const digest = await sha256Hex(cached);
+            if (digest === asset.sha256)
+                return cached;
+            if (asset.poisonedCache === 'reject')
+                throw new Error(asset.integrityFailed(digest, 'L2 cache'));
+            try {
+                await cache.delete(new Request(asset.l2Key));
+            }
+            catch { /* the ASSETS read below still decides */ }
+        }
+    }
+    // ASSETS routes by pathname only; `.invalid` (RFC 2606) marks the host as
+    // internal to the binding.
+    const res = await env.ASSETS.fetch(new Request(`https://nimbus-internal.invalid${asset.path}`));
+    let bytes;
+    try {
+        if (!res.ok)
+            throw new Error(asset.fetchFailed(res));
+        bytes = await res.arrayBuffer();
+    }
+    finally {
+        disposeRpcResource(res);
+    }
+    const digest = await sha256Hex(bytes);
+    if (digest !== asset.sha256)
+        throw new Error(asset.integrityFailed(digest, 'ASSETS'));
+    // Best-effort: ASSETS stays the source of truth. The cache copies the body
+    // at put time, so the caller's buffer is unaffected.
+    try {
+        if (cache) {
+            const headers = { 'Cache-Control': 'public, max-age=31536000, immutable' };
+            if (asset.contentType)
+                headers['Content-Type'] = asset.contentType;
+            await cache.put(new Request(asset.l2Key), new Response(new Uint8Array(bytes), { headers }));
+        }
+    }
+    catch { /* silent */ }
+    return bytes;
+}
+/** {@link fetchStagedBytes}, decoded as UTF-8. */
+export async function fetchStagedText(env, asset) {
+    return new TextDecoder().decode(await fetchStagedBytes(env, asset));
+}
+/**
+ * One load per isolate: every caller shares the first call's promise, and a
+ * rejected one is dropped so the next call loads again instead of pinning the
+ * error.
+ */
+export function memoizeUntilRejected(load) {
+    let memo = null;
+    return (arg) => {
+        if (!memo) {
+            const loading = load(arg);
+            memo = loading;
+            loading.catch(() => { if (memo === loading)
+                memo = null; });
+        }
+        return memo;
+    };
+}
+/**
+ * The `StagedAsset` of a facet source text staged under
+ * public/_assets/runtime/ by `stagedBy` and needed by `requiredBy`: a bad L2
+ * entry is replaced from ASSETS, since every later fetch in the colo for the
+ * build would otherwise fail on it.
+ */
+export function stagedRuntimeSource(source) {
+    return {
+        path: source.entry,
+        l2Key: `https://nimbus-cache.invalid${source.entry}?build=${source.buildId}`,
+        sha256: source.sha256,
+        poisonedCache: 'refetch',
+        missingBinding: `Nimbus: ${source.requiredBy} requires an env.ASSETS binding (serves the ` +
+            `staged ${source.label} source at ${source.entry}) — add the assets ` +
+            'binding from the embed config (see packages/worker README)',
+        fetchFailed: (res) => `${source.label} asset fetch failed: ${res.status} ${res.statusText} for ` +
+            `${source.entry} — deploy is missing the staged source (run ${source.stagedBy})`,
+        integrityFailed: (digest) => `${source.label} asset integrity mismatch for ${source.entry}: ` +
+            `expected ${source.sha256.slice(0, 16)}…, got ${digest.slice(0, 16)}… — ` +
+            `the staged asset is stale or corrupt; rerun ${source.stagedBy} and redeploy`,
+    };
+}

package/dist/runtime/wasi/preamble.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preamble.d.ts","sourceRoot":"","sources":["../../../src/runtime/wasi/preamble.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAEV,OAAO,EAMP,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EAGtB,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAInB,MAAM,uCAAuC,CAAC;AAmJ/C,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAiBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA0BxD;AAwOD,eAAO,MAAM,OAAO,sBAA6B,CAAC;AAsElD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,GAAG,kBAAkB,CAikClF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,aAAa,CAcxF;AAeD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB5G"}
+{"version":3,"file":"preamble.d.ts","sourceRoot":"","sources":["../../../src/runtime/wasi/preamble.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAEV,OAAO,EAMP,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EAGtB,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAInB,MAAM,uCAAuC,CAAC;AAmJ/C,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAiBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA0BxD;AAwOD,eAAO,MAAM,OAAO,sBAA6B,CAAC;AAsElD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,GAAG,kBAAkB,CA4iClF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,aAAa,CAcxF;AAeD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB5G"}

package/dist/runtime/wasi/preamble.js

@@ -549,30 +549,6 @@ export function __wasiMakeImports(opts) {
                 stderrBuf += s;
         }
     }
-    /** Scatter the given bytes across the iovec list; returns bytes consumed. */
-    function scatterIovs(bytes, iovsPtr, iovsLen, dv, memU8) {
-        let done = 0;
-        for (let i = 0; i < iovsLen && done < bytes.length; i++) {
-            const iov = iovsPtr + i * 8;
-            const bufPtr = dv.getUint32(iov, true);
-            const bufLen = dv.getUint32(iov + 4, true);
-            const n = Math.min(bufLen, bytes.length - done);
-            if (n <= 0)
-                break;
-            memU8.set(bytes.subarray(done, done + n), bufPtr);
-            done += n;
-            if (n < bufLen)
-                break;
-        }
-        return done;
-    }
-    /** Total capacity of an iovec list. */
-    function iovsCapacity(iovsPtr, iovsLen, dv) {
-        let total = 0;
-        for (let i = 0; i < iovsLen; i++)
-            total += dv.getUint32(iovsPtr + i * 8 + 4, true);
-        return total;
-    }
     const imports = {
         // ── args / env ──
         args_get(argvPtr, argvBufPtr) {

package/dist/runtime-catalog.generated.js

@@ -24,4 +24,4 @@
  * The empty string means "not pinned yet" — the catalog stays out of L2 and
  * the supervisor warns once per isolate.
  */
-export const RUNTIME_CATALOG_SHA256 = "9cdc9cc0d96667234c6fed2adc81e7890fef96b3afe5bd80dd80612e822d3d3a";
+export const RUNTIME_CATALOG_SHA256 = "2827a7f7245403cb7644c27f0075423dd1ba00313b8c40f70f4dfa5bcd097ed0";

package/dist/session/agent.d.ts

@@ -13,13 +13,25 @@ interface Host extends ProgrammaticHost, SessionAiHost {
     ctx: ProgrammaticHost['ctx'];
     env: ProgrammaticHost['env'] & Record<string, unknown>;
 }
-interface OAuthStatePayload {
+export interface OAuthStatePayload {
     v: 1;
     nonce: string;
     sessionId: string;
     tenantSegment: string;
+    /** Expiry (ms since the epoch), signed with the rest. */
+    exp: number;
 }
 export declare function handleAgentRequest(self: Host, request: Request, url: URL): Promise<Response>;
-export declare function parseAgentOAuthStateParam(state: string | null): OAuthStatePayload | null;
+/**
+ * The OAuth `state` a callback carries, if this deployment signed it. The
+ * router routes a callback by the session and tenant segment in `state`, so an
+ * unsigned one would let any client wake or create a Durable Object under any
+ * tenant segment; the signature (HMAC-SHA256 under the agent cookie secret)
+ * makes the router refuse it before routing. An expired one (its signed `exp`
+ * at or before `now`) is refused the same way. Null for anything else.
+ */
+export declare function parseAgentOAuthStateParam(state: string | null, env: Record<string, unknown>, now?: number): Promise<OAuthStatePayload | null>;
+/** The `state` an OAuth flow carries: `<payload>.<signature>`, both base64url. */
+export declare function signAgentOAuthState(payload: OAuthStatePayload, env: Record<string, unknown>): Promise<string>;
 export {};
 //# sourceMappingURL=agent.d.ts.map

package/dist/session/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/session/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EASL,KAAK,aAAa,EACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAYL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAkB3B,UAAU,IAAK,SAAQ,gBAAgB,EAAE,aAAa;IACpD,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7B,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxD;AAED,UAAU,iBAAiB;IACzB,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AA2BD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2ClG;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,IAAI,CAQxF"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/session/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkCH,OAAO,EASL,KAAK,aAAa,EACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAYL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAkB3B,UAAU,IAAK,SAAQ,gBAAgB,EAAE,aAAa;IACpD,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7B,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,iBAAiB;IAChC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;CACb;AA0BD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2ClG;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,SAAa,GACf,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAWnC;AAs/BD,kFAAkF;AAClF,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAKnH"}