@nimbus-sh/worker 0.2.3 → 0.3.0

package/dist/loaders/process-host.js

@@ -1,69 +1,9 @@
 /**
- * process-host.ts — the two substrates a resident process can run on, and the
- * one value that picks between them.
- *
- * `loaders/process-fabric.ts` owns what a resident process IS. This module
- * owns only where it lives, behind `ProcessHost`:
- *
- *   facet — the process is a named child actor of the user's own session DO.
- *   peer  — the process is a named child actor of a SIBLING session DO, and
- *           the coordinator reaches it over one held-open RPC.
- *
- * Both call the same `openResidentFacet`. The peer leg is not a second process
- * implementation; it is the same call made on a different actor, which is why
- * the runner, the boot spec, the class name, the writer handshake, the start
- * contract and the lifecycle are shared code rather than parallel paths.
- *
- * Choosing between them
- * ─────────────────────
- * `NIMBUS_PROCESS_HOST`, one var for the whole deployment. No spawn site
- * chooses; no program name, mode or payload size reaches the choice. If a
- * decision about a particular process ever appears here, the heavy/light
- * classifier has grown back and should be deleted again.
- *
- *   |          | spawn      | memory      | CPU        | SQLite |
- *   |----------|------------|-------------|------------|--------|
- *   | facet    | 8-16 ms    | independent | SHARED     | own    |
- *   | peer     | 242-359 ms | independent | independent| own    |
- *
- * Facet CPU is shared because facets are separate isolates inside ONE actor
- * thread: awaiting I/O yields it completely (measured 0 ms of sibling impact),
- * but a non-yielding loop stalls every sibling for its full duration
- * (measured 6,852 ms). A peer pays ~20x the spawn cost to buy that back.
- *
- * What the peer leg has to do differently, and why none of it reaches the
- * process
- * ────────────────────────────────────────────────────────────────────────
- *   payloads — a whole structured-clone RPC value is capped at 32 MiB, and
- *              pi's node snapshot alone serializes to 44,252,709 bytes. Boot
- *              specs name their large members BY PATH, so what crosses is a
- *              path and the host reads the bytes off the coordinator's disk in
- *              4 MiB ranges through the supervisor. Nothing large is ever an
- *              RPC argument, so nothing has to be streamed or replayed.
- *   requests — workerd refuses to transfer an object owned by a
- *              dynamically-loaded worker across a sibling-DO hop, so a request
- *              travels to the peer as PARTS and the response comes back as
- *              parts, both with plain `ReadableStream` bodies that RPC carries
- *              with flow control. A live SSE body still streams; nothing is
- *              buffered.
- *   liveness — the host leg is held open for the process's whole life, which
- *              is also what keeps the hosting DO resident. A peer therefore
- *              never outlives its coordinator: the coordinator dying cancels
- *              the inbound call and the facet dies with it. Nothing in this
- *              fabric arms an alarm, on either substrate.
- *
- * WebSockets are NOT in that list, because a resident process never receives
- * one. `RouteableFacetTarget` is `handleHttpRequest(Request): Promise<Response>`
- * and nothing else; no runner returns a 101 with a `webSocket` member; every
- * inbound socket Nimbus serves — the shell terminal, `/api/logs/<pid>`, vite
- * HMR — terminates on the session DO and reaches the process, if at all, as
- * events on a supervisor poll. That is substrate-independent by construction.
+ * process-host.ts — which substrate this deployment runs resident processes
+ * on. The substrates themselves live in `@nimbus-sh/fabric/process-host.js`;
+ * this module owns only the deployment config that picks between them.
  */
-import { disposeRpcResource } from '@nimbus-sh/core/_shared/rpc-dispose.js';
-import { isTransientDoReset } from '@nimbus-sh/core/observability/oom-classify.js';
-import { PEER_RETRY_BACKOFF_MS, PEER_TRANSIENT_RESET_RETRIES } from './fanout-pool.js';
-import { DYNAMIC_WORKER_CODE_LIMIT_BYTES, openResidentFacet, residentFacetName, runOneShotWorker, } from './workerd-facet-host.js';
-import { BindingError } from './vendor/errors.js';
+import { createProcessHost, } from '@nimbus-sh/fabric/process-host.js';
 /**
  * The var that picks the substrate, and the only place its name appears.
  * Unset means `facet`; an unrecognized value is refused rather than defaulted,
@@ -80,346 +20,7 @@ export function processHostMode(env) {
         return 'peer';
     throw new Error(`Nimbus: NIMBUS_PROCESS_HOST must be 'facet' or 'peer' (got '${String(raw)}')`);
 }
-/**
- * The substrate for this deployment, resolved once. `disk` is the
- * coordinator's own filesystem reader; the peer host does not take it, because
- * a peer reads the same disk through the supervisor instead.
- */
+/** The substrate for this deployment, resolved once. */
 export function processHostFor(ctx, env, disk) {
-    return processHostMode(env) === 'peer'
-        ? new PeerProcessHost(ctx, env)
-        : new FacetProcessHost(ctx, env, disk);
-}
-// ── facet: the process is a child of the user's own session DO ──────────────
-class FacetProcessHost {
-    ctx;
-    disk;
-    /**
-     * The process shares its session's Durable Object, so the session's own
-     * store is reachable by copy-on-write — and its storage budget is the same
-     * budget. Both halves of that follow from the one fact, and neither is
-     * optional.
-     */
-    imageDelivery = {
-        reflink: 'same-object',
-        moduleCeilingBytes: DYNAMIC_WORKER_CODE_LIMIT_BYTES,
-        storageSharedWithSession: true,
-    };
-    env;
-    coordDoId;
-    constructor(ctx, env, disk) {
-        this.ctx = ctx;
-        this.disk = disk;
-        this.env = (env ?? {});
-        this.coordDoId = ctx.id.toString();
-    }
-    runOnce(params, consume) {
-        return runOneShotWorker(this.env, { doId: this.coordDoId, pid: params.pid, writerId: params.writerId }, params, consume);
-    }
-    async open(params) {
-        const supervisor = {
-            doId: this.coordDoId,
-            pid: params.pid,
-            writerId: params.writerId,
-        };
-        const { slot, ...facet } = openResidentFacet(this.ctx, this.env, this.disk, supervisor, params);
-        return {
-            ...facet,
-            describe: () => `facet '${residentFacetName(slot)}' (pid ${params.pid})`
-                + ` of session ${this.coordDoId.slice(-12)}`
-                + `; ${describeImageDelivery(this.imageDelivery)}`,
-        };
-    }
-}
-/**
- * The operator-facing half of the substrate difference, on the one line an
- * operator actually reads. A comment in this file would not have told anyone
- * who flipped the config that the image path changed under them.
- */
-function describeImageDelivery(delivery) {
-    return `fs image: reflink ${delivery.reflink}, module map ≤ ${delivery.moduleCeilingBytes}B, `
-        + `storage ${delivery.storageSharedWithSession ? 'shared with the session' : 'its own'}`;
-}
-// ── peer: the process is a child of a sibling session DO ────────────────────
-/**
- * How many sibling names to try before accepting one that co-located with a
- * process already running. Measured: 1 shared pair in 24 fresh peers.
- */
-const PEER_PLACEMENT_MAX_ATTEMPTS = 4;
-/**
- * This workerd process's identity. Module scope, so two Durable Objects
- * reporting the same token are in the same process — which is exactly the CPU
- * sharing a peer exists to avoid, and the only way to detect it.
- */
-let _isolateToken = null;
-export function isolateToken() {
-    if (!_isolateToken)
-        _isolateToken = crypto.randomUUID();
-    return _isolateToken;
-}
-/**
- * Every method a hosting sibling must answer. Checked as a set at first
- * contact: a stub that has the probe but not the router is a deployment skew,
- * and finding that out mid-process is finding it out too late.
- */
-const PROCESS_PEER_METHODS = [
-    '_rpcProcessHostProbe',
-    '_rpcHostProcess',
-    '_rpcAwaitHostedOpen',
-    '_rpcAwaitHostedBoot',
-    '_rpcRouteHostedHttp',
-    '_rpcCancelHostProcess',
-];
-function peerNamespace(env) {
-    const ns = (typeof env === 'object' || typeof env === 'function') && env !== null
-        ? Reflect.get(env, 'NIMBUS_SESSION')
-        : undefined;
-    if ((typeof ns !== 'object' && typeof ns !== 'function') || ns === null
-        || typeof Reflect.get(ns, 'idFromName') !== 'function'
-        || typeof Reflect.get(ns, 'get') !== 'function') {
-        throw new BindingError('ProcessFabric: env.NIMBUS_SESSION binding missing or invalid. '
-            + "NIMBUS_PROCESS_HOST='peer' hosts every resident process on a sibling "
-            + 'Durable Object; add the binding via durable_objects.bindings in wrangler.jsonc.');
-    }
-    return ns;
-}
-function processPeerStub(value, peerName) {
-    if ((typeof value !== 'object' && typeof value !== 'function') || value === null) {
-        throw new BindingError(`ProcessFabric: NIMBUS_SESSION.get() returned no stub for peer '${peerName}'.`);
-    }
-    for (const method of PROCESS_PEER_METHODS) {
-        if (typeof Reflect.get(value, method) !== 'function') {
-            throw new BindingError(`ProcessFabric: peer '${peerName}' does not expose ${method}(). `
-                + 'A sibling that answers some of the host-process surface and not the rest '
-                + 'would fail somewhere inside a running process instead of here.');
-        }
-    }
-    return value;
-}
-class PeerProcessHost {
-    ctx;
-    /**
-     * A peer buys independent CPU and its own storage budget, and pays for both
-     * with the image path: nothing crosses a Durable Object boundary by
-     * reference, so the whole session filesystem has to travel as bytes.
-     */
-    imageDelivery = {
-        reflink: 'impossible',
-        moduleCeilingBytes: DYNAMIC_WORKER_CODE_LIMIT_BYTES,
-        storageSharedWithSession: false,
-    };
-    ns;
-    env;
-    coordDoId;
-    /** pid → the isolate token of the peer currently hosting that process. */
-    tokensInUse = new Map();
-    constructor(ctx, env) {
-        this.ctx = ctx;
-        this.ns = peerNamespace(env);
-        this.env = (env ?? {});
-        this.coordDoId = ctx.id.toString();
-    }
-    /**
-     * Not placed on a sibling, and that is not a gap in this substrate.
-     * `peer` exists to buy a resident process independent CPU; a program that
-     * ends with the call it was started by has no residency to place, and its
-     * map is fully inline — so a hop would meet the RPC ceiling that by-path
-     * boot specs exist to avoid while buying nothing. It runs as a dynamic
-     * worker of the coordinator here exactly as it does on `facet`.
-     */
-    runOnce(params, consume) {
-        return runOneShotWorker(this.env, { doId: this.coordDoId, pid: params.pid, writerId: params.writerId }, params, consume);
-    }
-    async open(params) {
-        const placement = await this._place(params.pid);
-        this.tokensInUse.set(params.pid, placement.isolateToken);
-        // Held open for the process's whole life: it is the lifecycle, and it is
-        // also what keeps the hosting DO resident. It settles when a `lifetime`
-        // runner exits or when a `boot` runner's host is cancelled, and rejects if
-        // the peer dies under either.
-        const hostLeg = placement.stub._rpcHostProcess(params.boot, {
-            coordinatorDoId: this.coordDoId,
-            pid: params.pid,
-            writerId: params.writerId,
-            workerKey: params.workerKey,
-            startArgs: params.startArgs,
-        });
-        hostLeg.catch(() => { });
-        // The peer starts the runner as part of hosting it; this reads back that
-        // one boot payload without re-running anything, so `started` means exactly
-        // what it means on a facet. Racing the host leg is what turns a peer that
-        // died before the boot landed into a rejection rather than a hang — the
-        // peer that would have answered is the thing that is gone.
-        const booted = placement.stub._rpcAwaitHostedBoot(params.workerKey).then((r) => r.payload);
-        booted.catch(() => { });
-        const started = Promise.race([booted, hostLeg.then(() => booted)]);
-        started.catch(() => { });
-        // Do not return a handle for a process that was never opened. Opening a
-        // facet of one's own DO either throws or does not, before any handle
-        // exists; this is that same moment, one hop away.
-        try {
-            await Promise.race([
-                placement.stub._rpcAwaitHostedOpen(params.workerKey),
-                hostLeg.then(() => ({ ok: true })),
-            ]);
-        }
-        catch (error) {
-            this.tokensInUse.delete(params.pid);
-            // Awaited, not fired off: a spawn that rejects must mean nothing was
-            // left running, which is what a throw from `openResidentFacet` means on
-            // the other substrate.
-            try {
-                await this._cancel(params.workerKey, placement.peerName);
-            }
-            finally {
-                disposeRpcResource(placement.stub);
-            }
-            throw error;
-        }
-        let released = false;
-        return {
-            started,
-            // The held leg IS the process's residency here. It settles cleanly when
-            // the coordinator releases; anything else is the host going away under a
-            // process that was up, and the fabric ends the process on it.
-            lost: hostLeg.then(() => new Promise(() => { })),
-            handleHttpRequest: (request) => routeThroughPeer(placement.stub, params.workerKey, request),
-            release: async () => {
-                if (released)
-                    return;
-                released = true;
-                this.tokensInUse.delete(params.pid);
-                try {
-                    await this._cancel(params.workerKey, placement.peerName);
-                }
-                finally {
-                    disposeRpcResource(placement.stub);
-                }
-            },
-            describe: () => `peer '${placement.peerName}' (isolate ${placement.isolateToken.slice(0, 8)})`
-                + `; ${describeImageDelivery(this.imageDelivery)}`,
-        };
-    }
-    /**
-     * Probe successive sibling names until one reports an isolate token distinct
-     * from this coordinator's and from every peer already hosting a process. A
-     * peer that co-located bought nothing — it shares the CPU it was chosen to
-     * escape — so placement verifies rather than assumes.
-     */
-    async _place(pid) {
-        const denied = new Set([isolateToken(), ...this.tokensInUse.values()]);
-        for (let attempt = 0; attempt < PEER_PLACEMENT_MAX_ATTEMPTS - 1; attempt++) {
-            const candidate = await this._probePlacement(pid, attempt);
-            if (!denied.has(candidate.isolateToken))
-                return candidate;
-            disposeRpcResource(candidate.stub);
-        }
-        // Every attempt co-located, which happens in single-process topologies. Use
-        // the last one anyway: it runs the process correctly, it just shares the
-        // CPU it was chosen to escape, and the placement line names the isolate it
-        // landed in so that is visible rather than assumed.
-        return this._probePlacement(pid, PEER_PLACEMENT_MAX_ATTEMPTS - 1);
-    }
-    /** One sibling name, resolved and probed. Leaks nothing on failure. */
-    async _probePlacement(pid, attempt) {
-        const peerName = `${this.coordDoId}:proc:${pid}:${attempt}`;
-        let resource;
-        try {
-            resource = this.ns.get(this.ns.idFromName(peerName));
-            const stub = processPeerStub(resource, peerName);
-            const probe = await this._probe(stub, peerName);
-            return { stub, peerName, isolateToken: probe.isolateToken };
-        }
-        catch (error) {
-            disposeRpcResource(resource);
-            throw error;
-        }
-    }
-    /**
-     * First contact with a possibly-cold sibling DO: retry transient platform
-     * resets with the same bounded policy the fanout peers ship. Non-transient
-     * failures propagate on the first hit.
-     */
-    async _probe(stub, peerName) {
-        for (let attempt = 0;; attempt++) {
-            try {
-                const probe = await stub._rpcProcessHostProbe();
-                if (!probe || typeof probe.isolateToken !== 'string' || probe.isolateToken.length === 0) {
-                    throw new Error(`ProcessFabric: peer '${peerName}' returned no isolate token`);
-                }
-                return probe;
-            }
-            catch (err) {
-                if (attempt < PEER_TRANSIENT_RESET_RETRIES && isTransientDoReset(err)) {
-                    await new Promise((r) => setTimeout(r, PEER_RETRY_BACKOFF_MS[Math.min(attempt, PEER_RETRY_BACKOFF_MS.length - 1)]));
-                    continue;
-                }
-                throw err;
-            }
-        }
-    }
-    /**
-     * A fresh stub to the hosting peer fires `_rpcCancelHostProcess`, which
-     * releases the peer's facet — the exact teardown a local facet gets — and
-     * only answers once it has. Awaiting it is what makes "released" mean the
-     * same thing on both substrates, so the writer identity is retired at the
-     * same point in the process's life either way. Also handed to `waitUntil`,
-     * so a kill nobody awaited still completes.
-     */
-    _cancel(workerKey, peerName) {
-        let stub;
-        try {
-            stub = processPeerStub(this.ns.get(this.ns.idFromName(peerName)), peerName);
-        }
-        catch {
-            return Promise.resolve();
-        }
-        const cancelled = Promise.resolve(stub._rpcCancelHostProcess(workerKey))
-            .then(() => undefined)
-            .catch(() => { })
-            .finally(() => disposeRpcResource(stub));
-        this.ctx.waitUntil(cancelled);
-        return cancelled;
-    }
-}
-async function routeThroughPeer(stub, workerKey, request) {
-    const result = await stub._rpcRouteHostedHttp(workerKey, {
-        method: request.method,
-        url: request.url,
-        headers: headerPairs(request.headers),
-        body: request.method === 'GET' || request.method === 'HEAD' ? null : request.body,
-    });
-    const responseHeaders = new Headers();
-    for (const [key, value] of result.headers)
-        responseHeaders.append(key, value);
-    return new Response(result.body, {
-        status: result.status,
-        statusText: result.statusText,
-        headers: responseHeaders,
-    });
-}
-/**
- * Headers as pairs, with every `Set-Cookie` kept separate.
- *
- * Iterating a `Headers` combines same-named fields into one comma-joined
- * value, and for `Set-Cookie` that is not reversible — `append` cannot split
- * `a=1; Path=/, b=2; Path=/` back into two cookies, and a browser reading the
- * merged form sets one malformed cookie instead of two. Every other field
- * combines by comma legally, so only this one needs the separate accessor.
- * A user's server setting two cookies must not depend on which substrate its
- * process happened to run on.
- */
-export function headerPairs(headers) {
-    const pairs = [];
-    headers.forEach((value, key) => {
-        if (key.toLowerCase() !== 'set-cookie')
-            pairs.push([key, value]);
-    });
-    const getSetCookie = headers.getSetCookie;
-    const cookies = typeof getSetCookie === 'function'
-        ? getSetCookie.call(headers)
-        : (headers.get('set-cookie') ? [headers.get('set-cookie')] : []);
-    for (const cookie of cookies)
-        pairs.push(['set-cookie', cookie]);
-    return pairs;
+    return createProcessHost(processHostMode(env), ctx, env, disk);
 }

package/dist/npm/install-batch-facet.js

@@ -38,7 +38,7 @@
  */
 // ── Facet function ──────────────────────────────────────────────────────
 //
-// Runs inside a NimbusLoaderPool isolate. Serialised via fn.toString();
+// Runs inside a LoaderPool isolate. Serialised via fn.toString();
 // the helpers it references at top-level scope (streamTarEntries,
 // readableStreamToAsyncIterable, MAX_FILE_BYTES) are NOT in the facet's
 // lexical scope — the pool injects them via the preamble. No static

package/dist/npm/installer.d.ts

@@ -91,7 +91,7 @@ export declare class NpmInstaller {
     /**
      * F-2 frontier-coordinator path. Replaces the single-resolve-facet
      * dispatch with a per-package fanout: each BFS layer becomes ONE
-     * `NimbusFanoutPool.submitMany` call, layer N+1 builds from the
+     * `FanoutPool.submitMany` call, layer N+1 builds from the
      * resolved metadata of layer N.
      *
      * Topology auto-routes per layer:
@@ -115,12 +115,12 @@ export declare class NpmInstaller {
      */
     private resolveTreeViaFanout;
     /**
-     * Batch install via two-tier fan-out (NimbusFanoutPool).
+     * Batch install via two-tier fan-out (FanoutPool).
      *
      * Shard count is `min(specs.length, INSTALL_PEER_CAP)`, and the topology
      * follows from it:
      *   shardCount <  IN_DO_THRESHOLD (5)  → in-DO fanout in-DO
-     *     1 NimbusLoaderPool with concurrency = shardCount, capped at
+     *     1 LoaderPool with concurrency = shardCount, capped at
      *     4 by V8 invariant. Each shard is one facet running its own
      *     installPackagesInFacet.
      *   shardCount >= IN_DO_THRESHOLD       → peer-DO fanout peer-DO
@@ -132,7 +132,7 @@ export declare class NpmInstaller {
      *   `shard-${i}` task key deterministically (tests can predict
      *   placement).
      *
-     * Pre-fix lineage: this site previously ran ONE NimbusLoaderPool
+     * Pre-fix lineage: this site previously ran ONE LoaderPool
      *   with concurrency=1, internal pLimit(3) — the explicit "collapses
      *   what was 4 concurrent dynamic workers (pool.map slots) into 1"
      *   Two-tier topology re-expands the fan-out without re-introducing

package/dist/npm/installer.js

@@ -28,8 +28,8 @@ import { npmAddedLine, npmHttpCacheLine, npmHttpFetchLine, npmTitleLine, } from
 import { applySwaps, findRejects, lookupSwap, lookupReject, shouldSkipPackage, shouldWarnSkipTransitive, isOptionalNativeBinding, formatSwapNotice, RegistryRejectError, emitRegistryEvent, } from '../facets/wasm-swap-registry.js';
 import { resolvePackageEntry } from '@nimbus-sh/core/_shared/exports-resolver.js';
 import { encodeWriteBatchStream } from '@nimbus-sh/core/_shared/w7-frame.js';
-import { NimbusLoaderPool } from '../loaders/loader-pool.js';
-import { NimbusFanoutPool, IN_DO_THRESHOLD } from '../loaders/fanout-pool.js';
+import { LoaderPool } from '@nimbus-sh/fabric/loader-pool.js';
+import { FanoutPool, IN_DO_THRESHOLD } from '@nimbus-sh/fabric/fanout-pool.js';
 import { TAR_STREAM_PREAMBLE, W7_FRAME_PREAMBLE } from '../loaders/generated-workers.js';
 import { installPackagesInFacet, } from './install-batch-facet.js';
 import { setInstallPhase, recordInstallFacetCounters, recordPreBundleSummary, recordR2RaceCounters, recordCacheStatEvents, readDiagCounters, } from '@nimbus-sh/core/observability/diag-counters.js';
@@ -146,7 +146,7 @@ export class NpmInstaller {
             phases['lock-check'] = Date.now() - phaseStart;
             // ── Phase 1: Resolve ──────────────────────────────────────────
             // Frontier-coordinator path. Each BFS layer dispatches to
-            // NimbusFanoutPool.submitMany — width <5 in-DO (in-DO fanout),
+            // FanoutPool.submitMany — width <5 in-DO (in-DO fanout),
             // width ≥5 peer-DO (peer-DO fanout). Per-package task body is
             // self-contained (resolveOnePackumentInFacet), supervisor builds
             // layer N+1 from layer N's edges. Missing env.LOADER throws at
@@ -222,7 +222,7 @@ export class NpmInstaller {
         setInstallPhase('fetch');
         // Fetch + extract + write new packages.
         //
-        // Single fetch path: one NimbusLoaderPool isolate (the batch facet)
+        // Single fetch path: one LoaderPool isolate (the batch facet)
         // runs the entire install. The facet streams tarballs through gunzip+tar
         // and coalesces package-owned paths into shared writeBatchStream waves;
         // every owner awaits each wave it contributed to.
@@ -419,7 +419,7 @@ export class NpmInstaller {
     /**
      * F-2 frontier-coordinator path. Replaces the single-resolve-facet
      * dispatch with a per-package fanout: each BFS layer becomes ONE
-     * `NimbusFanoutPool.submitMany` call, layer N+1 builds from the
+     * `FanoutPool.submitMany` call, layer N+1 builds from the
      * resolved metadata of layer N.
      *
      * Topology auto-routes per layer:
@@ -486,7 +486,7 @@ export class NpmInstaller {
         const RESOLVE_PEER_CAP = 8;
         // F-2 fanout pool. One construction reused across every layer; the
         // pool is stateless across submitMany calls.
-        const fanoutPool = new NimbusFanoutPool(this.env, this.ctx, {
+        const fanoutPool = new FanoutPool(this.env, this.ctx, {
             tag: 'npm-resolve-fanout',
             // 5 minutes per layer is generous; typical layers complete in
             // 1-3 s. Per-task this gates each packument fetch + R2 race.
@@ -561,8 +561,8 @@ export class NpmInstaller {
                 };
                 return { key: name, args: taskSpec };
             });
-            // Dispatch the layer. NimbusFanoutPool routes:
-            //   <5 → in-DO fanout in-DO (NimbusLoaderPool), concurrency = layer.length (capped at 4)
+            // Dispatch the layer. FanoutPool routes:
+            //   <5 → in-DO fanout in-DO (LoaderPool), concurrency = layer.length (capped at 4)
             //   ≥5 → peer-DO fanout peer-DO, N peers = min(layer.length, 32)
             let results;
             const layerT0 = Date.now();
@@ -769,12 +769,12 @@ export class NpmInstaller {
         return { resolved, unresolved };
     }
     /**
-     * Batch install via two-tier fan-out (NimbusFanoutPool).
+     * Batch install via two-tier fan-out (FanoutPool).
      *
      * Shard count is `min(specs.length, INSTALL_PEER_CAP)`, and the topology
      * follows from it:
      *   shardCount <  IN_DO_THRESHOLD (5)  → in-DO fanout in-DO
-     *     1 NimbusLoaderPool with concurrency = shardCount, capped at
+     *     1 LoaderPool with concurrency = shardCount, capped at
      *     4 by V8 invariant. Each shard is one facet running its own
      *     installPackagesInFacet.
      *   shardCount >= IN_DO_THRESHOLD       → peer-DO fanout peer-DO
@@ -786,7 +786,7 @@ export class NpmInstaller {
      *   `shard-${i}` task key deterministically (tests can predict
      *   placement).
      *
-     * Pre-fix lineage: this site previously ran ONE NimbusLoaderPool
+     * Pre-fix lineage: this site previously ran ONE LoaderPool
      *   with concurrency=1, internal pLimit(3) — the explicit "collapses
      *   what was 4 concurrent dynamic workers (pool.map slots) into 1"
      *   Two-tier topology re-expands the fan-out without re-introducing
@@ -851,7 +851,7 @@ export class NpmInstaller {
         // Peer shards dispatch in bounded phases and each phase is a barrier, so
         // the phase profile is what distinguishes shard work from barrier count.
         const phaseProfile = [];
-        const fanoutPool = new NimbusFanoutPool(this.env, this.ctx, {
+        const fanoutPool = new FanoutPool(this.env, this.ctx, {
             tag: 'npm-install-batch',
             // Whole-batch timeout. With per-shard parallelism of N=8 peer
             // DOs each running pLimit(3), Mossaic-class 456 packages
@@ -869,7 +869,7 @@ export class NpmInstaller {
         });
         const tasks = nonEmptyShards.map((shardSpecs, shardIdx) => ({
             // Stable-id router key. Same shardIdx → same peer DO across
-            // runs. Tests can predict placement via NimbusFanoutPool's
+            // runs. Tests can predict placement via FanoutPool's
             // `peerSiblingId(key, peerCount)` helper.
             key: `shard-${shardIdx}`,
             args: { packages: shardSpecs, concurrency: 3 },
@@ -974,7 +974,7 @@ export class NpmInstaller {
         }
         catch (e) {
             // Final catch — preserved from the pre-fix shape so the error
-            // log line shape stays consistent. NimbusFanoutPool's internal
+            // log line shape stays consistent. FanoutPool's internal
             // pools dispose themselves at the end of each submitMany call,
             // so no explicit dispose() is needed here.
             // The earlier inner-catch already logged + threw; if we reach
@@ -1304,7 +1304,7 @@ export class NpmInstaller {
      * JSX elements get rejected as "alien" — silent render failure.
      */
     async prebundleUsedModules(projDir, installed) {
-        // Pre-bundle now runs in NimbusLoaderPool isolates (src/pre-bundle-facet.ts);
+        // Pre-bundle now runs in LoaderPool isolates (src/pre-bundle-facet.ts);
         // each facet ships its own bundled esbuild-wasm via the preamble. The
         // supervisor's EsbuildService is no longer on the bundle path — it
         // still serves the transform path (TS/JSX → JS) which is small and
@@ -1515,7 +1515,7 @@ export class NpmInstaller {
         // (where it should live). No supervisor-side caching — see
         // src/esbuild-wasm-bytes.ts for the full architectural rationale.
         //
-        // Bytes are shipped into each facet via NimbusLoaderPool's
+        // Bytes are shipped into each facet via LoaderPool's
         // `wasmModules` option which workerd registers in the LOADER
         // `modules` map as `{ wasm: ArrayBuffer }`. Workerd compiles at
         // module-load (startup phase, where wasm code generation is
@@ -1562,12 +1562,12 @@ export class NpmInstaller {
             if (wasmBytes.byteLength > maxRetainedWasmBytes) {
                 throw new RangeError(`pre-bundle wasm payload ${wasmBytes.byteLength} exceeds the ${maxRetainedWasmBytes}-byte retained budget`);
             }
-            // NimbusLoaderPool keeps the constructor-time module bytes until
+            // LoaderPool keeps the constructor-time module bytes until
             // dispose(), so retain their exact credit rather than treating
             // construction as a handoff that immediately frees the ArrayBuffer.
             setupAllocation.shrinkTo(wasmBytes.byteLength);
             try {
-                pool = new NimbusLoaderPool(this.env, this.ctx, {
+                pool = new LoaderPool(this.env, this.ctx, {
                     concurrency: PRE_BUNDLE_CONCURRENCY,
                     timeoutMs: 60_000,
                     retries: 0,

package/dist/npm/pre-bundle-facet.d.ts

@@ -1,5 +1,5 @@
 /**
- * pre-bundle-facet.ts — NimbusLoaderPool entry for esbuild pre-bundling.
+ * pre-bundle-facet.ts — LoaderPool entry for esbuild pre-bundling.
  *
  * Why this exists
  * ───────────────
@@ -14,7 +14,7 @@
  * the previous isolate.
  *
  * The fix is to dispatch each per-specifier `esbuild.build` to a
- * NimbusLoaderPool isolate. Each facet has its own 128 MB budget and
+ * LoaderPool isolate. Each facet has its own 128 MB budget and
  * stable-slot reuse keeps the warm-up cost amortized across the 8
  * concurrent specs of a typical install. The install-batch facet uses
  * the same isolate boundary for tarball extraction.

package/dist/npm/pre-bundle-facet.js

@@ -1,5 +1,5 @@
 /**
- * pre-bundle-facet.ts — NimbusLoaderPool entry for esbuild pre-bundling.
+ * pre-bundle-facet.ts — LoaderPool entry for esbuild pre-bundling.
  *
  * Why this exists
  * ───────────────
@@ -14,7 +14,7 @@
  * the previous isolate.
  *
  * The fix is to dispatch each per-specifier `esbuild.build` to a
- * NimbusLoaderPool isolate. Each facet has its own 128 MB budget and
+ * LoaderPool isolate. Each facet has its own 128 MB budget and
  * stable-slot reuse keeps the warm-up cost amortized across the 8
  * concurrent specs of a typical install. The install-batch facet uses
  * the same isolate boundary for tarball extraction.
@@ -181,7 +181,7 @@ export function externalsForSpecifier(specifier) {
 }
 // ── Facet function ──────────────────────────────────────────────────────
 //
-// `prebundleOne` runs inside a NimbusLoaderPool isolate. cloudflare-parallel
+// `prebundleOne` runs inside a LoaderPool isolate. cloudflare-parallel
 // serialises it via fn.toString(); the helpers it references at module
 // scope (ESBUILD_WASM_JS_FN_BODY, resolvePackageEntry) are NOT in the
 // facet's lexical scope at runtime. Instead they're injected by the
@@ -250,7 +250,7 @@ export const prebundleOne = async function prebundleOne(spec, _env) {
     //    runs that at module-load time (where eval is permitted) and
     //    stashes the result on the module-scope const __NIMBUS_ESBUILD_NS.
     //
-    //    The WASM module is shipped into the facet via NimbusLoaderPool's
+    //    The WASM module is shipped into the facet via LoaderPool's
     //    `wasmModules` option, registered in the LOADER's modules map as
     //    { wasm: ArrayBuffer }. Workerd compiles it during the worker's
     //    module-load phase (eval permitted there), and the pool's
@@ -285,7 +285,7 @@ export const prebundleOne = async function prebundleOne(spec, _env) {
     if (!initPromise) {
         initPromise = (async () => {
             // Read the WebAssembly.Module the pool registered. The key matches
-            // the name passed to NimbusLoaderPool's `wasmModules` option (see
+            // the name passed to LoaderPool's `wasmModules` option (see
             // src/npm-installer.ts:prebundleUsedModules dispatch site).
             const wasmRegistry = globalThis.__NIMBUS_WASM;
             const wasmModule = wasmRegistry && wasmRegistry['esbuild.wasm'];