@nimbus-sh/worker 0.8.0 → 0.9.0

package/dist/session/supervisor-rpc.js

@@ -151,8 +151,8 @@ export class SupervisorRPC extends WorkerEntrypoint {
         // Uint8Array transparently; downstream _rpcWriteFile also accepts
         return this._call(this._fsOp('writeFile', [path, content]));
     }
-    async stat(path) {
-        return this._call(this._fsOp('stat', [path]));
+    async stat(path, options) {
+        return this._call(this._fsOp('stat', [path, options]));
     }
     async lstat(path) {
         return this._call(this._fsOp('lstat', [path]));
@@ -181,8 +181,8 @@ export class SupervisorRPC extends WorkerEntrypoint {
     async exists(path) {
         return this._call(this._fsOp('exists', [path]));
     }
-    async mkdir(path) {
-        return this._call(this._fsOp('mkdir', [path]));
+    async mkdir(path, options) {
+        return this._call(this._fsOp('mkdir', [path, options]));
     }
     async rmdir(path) {
         return this._call(this._fsOp('rmdir', [path]));
@@ -265,6 +265,51 @@ export class SupervisorRPC extends WorkerEntrypoint {
     async fsWrite(handleId, offset, bytes) {
         return this._call(this._fsOp('fsWrite', [handleId, offset, bytes]));
     }
+    async fsFstat(...args) {
+        return this._call(this._fsOp('fsFstat', args));
+    }
+    async fsDup(...args) {
+        return this._call(this._fsOp('fsDup', args));
+    }
+    async fsSeek(...args) {
+        return this._call(this._fsOp('fsSeek', args));
+    }
+    async fsSetStatus(...args) {
+        return this._call(this._fsOp('fsSetStatus', args));
+    }
+    async fsReaddirHandle(...args) {
+        return this._call(this._fsOp('fsReaddirHandle', args));
+    }
+    async fsFtruncate(...args) {
+        return this._call(this._fsOp('fsFtruncate', args));
+    }
+    async fsFchmod(...args) {
+        return this._call(this._fsOp('fsFchmod', args));
+    }
+    async fsFchown(...args) {
+        return this._call(this._fsOp('fsFchown', args));
+    }
+    async fsFutimes(...args) {
+        return this._call(this._fsOp('fsFutimes', args));
+    }
+    async fsSync(...args) {
+        return this._call(this._fsOp('fsSync', args));
+    }
+    async fsRealpath(...args) {
+        return this._call(this._fsOp('fsRealpath', args));
+    }
+    async fsRemove(...args) {
+        return this._call(this._fsOp('fsRemove', args));
+    }
+    async fsCopyFile(...args) {
+        return this._call(this._fsOp('fsCopyFile', args));
+    }
+    async fsAcquireExclusiveMutation(...args) {
+        return this._call(this._fsOp('fsAcquireExclusiveMutation', args));
+    }
+    async fsReleaseExclusiveMutation(...args) {
+        return this._call(this._fsOp('fsReleaseExclusiveMutation', args));
+    }
     async fsClose(handleId) {
         return this._call(this._fsOp('fsClose', [handleId]));
     }

package/dist/vfs/facet-resident-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facet-resident-store.d.ts","sourceRoot":"","sources":["../../src/vfs/facet-resident-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqLG;AAQH;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,UAAY,CAAC;AAE9C;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,OAA2B,CAAC;AAClE,eAAO,MAAM,yBAAyB,QAA8B,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,QAk3BhC,CAAC;AAET,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1D,KAAK,IAAI,IAAI,CAAC;IACd,KAAK,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}
+{"version":3,"file":"facet-resident-store.d.ts","sourceRoot":"","sources":["../../src/vfs/facet-resident-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqLG;AAQH;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,UAAY,CAAC;AAE9C;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,OAA2B,CAAC;AAClE,eAAO,MAAM,yBAAyB,QAA8B,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,QAo3BhC,CAAC;AAET,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1D,KAAK,IAAI,IAAI,CAAC;IACd,KAAK,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}

package/dist/vfs/facet-resident-store.js

@@ -795,7 +795,7 @@ async function __residentEnumerate(supervisor) {
       if (!Number.isSafeInteger(size) || size < 0 || !Number.isSafeInteger(rev) || rev < 0) {
         throw new Error("Nimbus: fsList returned unusable metadata for '" + path + "'");
       }
-      entries.push({ path, size, rev });
+      entries.push({ path, size, rev, epoch: cursor.epoch });
     }
     if (listed.next === null || listed.next === undefined) {
       return { entries, cursor, complete: true, reason: null };
@@ -844,6 +844,7 @@ async function __residentFetchFiles(supervisor, files) {
       ranges.push({
         path: file.path,
         rev: file.rev,
+        epoch: file.epoch,
         part,
         parts,
         offset,
@@ -874,7 +875,7 @@ async function __residentFetchFiles(supervisor, files) {
     let results;
     try {
       results = await supervisor.fsReadBatch(
-        batch.map((r) => ({ path: r.path, offset: r.offset, length: r.length }))
+        batch.map((r) => ({ path: r.path, offset: r.offset, length: r.length, expectedEpoch: r.epoch, expectedRevision: r.rev }))
       );
     } catch {
       for (const r of batch) failedPaths.add(r.path);
@@ -896,6 +897,7 @@ async function __residentFetchFiles(supervisor, files) {
       }
       if (entry.bytes === null || entry.bytes === undefined) { failedPaths.add(range.path); continue; }
       const chunk = __residentBytes(entry.bytes);
+      if (chunk.byteLength !== range.length) { failedPaths.add(range.path); continue; }
       fetchedBytes += chunk.byteLength;
       __residentPutChunk(__residentSql, range.path, range.part, chunk);
       const seen = (landed.get(range.path) || 0) + 1;

package/dist/workspace-host.d.ts

@@ -1,4 +1,5 @@
-export { composeFacetManager, type FacetManagerDeps, type ComposedFacetManager } from './facets/compose.js';
+export { composeFacetManager, type FacetManagerDeps, type FacetManagerHostHooks, type ComposedFacetManager } from './facets/compose.js';
+export type { WorkerRecipe, ResolvedWorkerLaunch } from './facets/manager.js';
 export { composeHostedRuntime, type HostedRuntime, type HostedRuntimeOptions, type HostedRuntimeLifecycle, type HostedRuntimeTask, type RuntimeFiles } from './hosted/runtime.js';
 export { runtimeCatalogSource } from './runtime/runtime-catalog.js';
 export { SupervisorRPC } from './session/supervisor-rpc.js';

package/dist/workspace-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-host.d.ts","sourceRoot":"","sources":["../src/workspace-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClL,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"workspace-host.d.ts","sourceRoot":"","sources":["../src/workspace-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACxI,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClL,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/worker",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Nimbus runtime package for Cloudflare Workers, re-exported publicly through @nimbus-sh/sdk/worker.",
   "keywords": [
     "cloudflare",
@@ -109,9 +109,9 @@
   },
   "dependencies": {
     "@ai-sdk/openai-compatible": "^2.0.41",
-    "@nimbus-sh/core": "^0.10.0",
-    "@nimbus-sh/fabric": "^0.6.0",
-    "@nimbus-sh/platform": "^0.4.0",
+    "@nimbus-sh/core": "^0.11.0",
+    "@nimbus-sh/fabric": "^0.7.0",
+    "@nimbus-sh/platform": "^0.5.0",
     "@renovatebot/pep440": "^5.0.0",
     "ai": "^6.0.182",
     "clean-git-ref": "^2.0.1",

package/public/_assets/runtime/{node-shims-8f8c64edd2a1f0f5.js → node-shims-acaa037e6d26ec0d.js}

@@ -7712,7 +7712,20 @@ builtins.tty = {
 // core and must not be reported as such — a package that sniffs this list
 // would otherwise conclude e.g. undici ships with node.
 const __nimbusFacetProvidedPackages = new Set(["undici"]);
-	builtins.module = { get builtinModules() { return Object.keys(builtins).filter((n) => !__nimbusFacetProvidedPackages.has(n)); }, createRequire: (specifier) => __makeRequire(__requireBaseDir(specifier)), _resolveFilename: (id) => id, _cache: {} };
+	builtins.module = {
+	  get builtinModules() { return Object.keys(builtins).filter((n) => !__nimbusFacetProvidedPackages.has(n)); },
+	  createRequire: (specifier) => __makeRequire(__requireBaseDir(specifier)),
+	  isBuiltin: (specifier) => Object.hasOwn(builtins, String(specifier).replace(/^node:/, '')) && !__nimbusFacetProvidedPackages.has(String(specifier).replace(/^node:/, '')),
+	  // Node 22.1's on-disk compile cache. There is no disk to cache into and
+	  // nothing to compile ahead: callers (pi's CLI entry calls it
+	  // unconditionally) get Node's own answer for a cache that is off.
+	  enableCompileCache: () => ({ status: 3, message: 'compile cache is not available in this runtime' }),
+	  getCompileCacheDir: () => undefined,
+	  flushCompileCache: () => {},
+	  constants: { compileCacheStatus: { FAILED: 0, ENABLED: 1, ALREADY_ENABLED: 2, DISABLED: 3 } },
+	  _resolveFilename: (id) => id,
+	  _cache: {},
+	};
 // Bind to globalThis: workerd's timer globals throw "Illegal invocation"
 // when called with a receiver other than globalThis (i.e. as
 // timers.setInterval(...)), which clack's spinner — used by

package/scripts/bundle-runtime.mjs

@@ -7,7 +7,7 @@
  *   node scripts/bundle-runtime.mjs clang binji-2020 [--bucket nimbus-runtime-cache]
  *   node scripts/bundle-runtime.mjs python 0.29.4 [--bucket nimbus-runtime-cache]
  *   node scripts/bundle-runtime.mjs --pin-catalog        (read-only; publishes nothing)
- *   node scripts/bundle-runtime.mjs bash 5.2.37 --npm-package <dir>   (local; no R2)
+ *   node scripts/bundle-runtime.mjs bash 5.2.37-2 --npm-package <dir>   (local; no R2)
  *
  * `--npm-package` is the SECOND publisher for the same artifacts: it stages
  * exactly what the R2 path stages, composes the same manifest bytes, and lays
@@ -50,6 +50,7 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync, openSync, c
 import { execFileSync, execSync, spawnSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
+import { BASH_RUNNER } from '@nimbus-sh/core/runtime/os-contracts.js';
 
 const ACCOUNT = process.env.CLOUDFLARE_ACCOUNT_ID;
 // Resolve the wrangler bin from either the package-local or the
@@ -64,9 +65,14 @@ const PYODIDE_WORKERD_ADAPTER = JSON.parse(
 );
 
 const USAGE =
-  'usage: bundle-runtime.mjs <name> <version> [--bucket <bucket>]\n' +
+  'usage: bundle-runtime.mjs <name> <version> [--bucket <bucket>] [--keep-default]\n' +
   '       bundle-runtime.mjs <name> <version> --npm-package <dir>\n' +
-  '       bundle-runtime.mjs --pin-catalog [--bucket <bucket>]';
+  '       bundle-runtime.mjs --pin-catalog [--bucket <bucket>]\n' +
+  '\n' +
+  '  --keep-default  add the version to the catalog without making it the\n' +
+  '                  default: for a build whose runner contract a deployment\n' +
+  '                  still reading the catalog cannot bind yet. Re-run without\n' +
+  '                  the flag once every deployment can; the re-run is idempotent.';
 
 /** The bucket the deployed Worker's NIMBUS_RUNTIME_CACHE binding points at.
  *  Only a publish to THIS bucket may rewrite the catalog pin: the pin
@@ -78,6 +84,7 @@ const rawArgs = process.argv.slice(2);
 const positionalArgs = [];
 let BUCKET = process.env.NIMBUS_RUNTIME_BUCKET || PRODUCTION_BUCKET;
 let PIN_ONLY = false;
+let KEEP_DEFAULT = false;
 let NPM_OUT_DIR = null;
 for (let i = 0; i < rawArgs.length; i++) {
   const arg = rawArgs[i];
@@ -85,6 +92,10 @@ for (let i = 0; i < rawArgs.length; i++) {
     PIN_ONLY = true;
     continue;
   }
+  if (arg === '--keep-default') {
+    KEEP_DEFAULT = true;
+    continue;
+  }
   if (arg === '--npm-package') {
     NPM_OUT_DIR = rawArgs[++i];
     if (!NPM_OUT_DIR) {
@@ -226,10 +237,16 @@ const SPECS = {
   // `local_base`. The bash-runner aliases every applet name in
   // busybox.applets onto the busybox module so bash's PATH lookup finds
   // them in /bin and /usr/bin.
-  'bash/5.2.37': {
+  //
+  // The version is `<upstream>-<build>`: the build number advances with
+  // every rebuild, and the entrypoint names the runner contract the build
+  // was made for (BASH_RUNNER), so a deployment whose preamble predates it
+  // never binds it. 5.2.37 is build 1, published under `bash-runner`.
+  'bash/5.2.37-2': {
     license: 'GPL-3.0-or-later AND GPL-2.0-only',
     wasi_namespace: 'wasi_snapshot_preview1',
     local_base: '../wasm/bash',
+    auxiliary_bins: 'coreutils/busybox.applets',
     npm: {
       name: '@nimbus-sh/runtime-bash',
       summary: 'GNU bash 5.2.37 and BusyBox 1.37.0, cross-compiled to wasm32-wasi',
@@ -238,7 +255,7 @@ const SPECS = {
       { src: 'bash.async.wasm',           vfs: 'share/bash/bash.async.wasm' },
       { src: 'coreutils/busybox.wasm',    vfs: 'share/bash/coreutils/busybox.wasm' },
       { src: 'coreutils/busybox.applets', vfs: 'share/bash/coreutils/busybox.applets' },
-      { src: 'BIN_MARKER', vfs: 'bin/bash', mode: 'exec', runner: 'bash-runner', binName: 'bash' },
+      { src: 'BIN_MARKER', vfs: 'bin/bash', mode: 'exec', runner: BASH_RUNNER, binName: 'bash' },
     ],
     synthetic_files: {
       'BIN_MARKER': Buffer.from(
@@ -427,6 +444,15 @@ if (!spec) {
   console.error(`known: ${Object.keys(SPECS).join(', ')}`);
   process.exit(2);
 }
+if (spec.auxiliary_bins) {
+  const list = new URL(`${spec.local_base}/${spec.auxiliary_bins}`, import.meta.url);
+  const names = readFileSync(list, 'utf8').split('\n').filter(Boolean);
+  spec.synthetic_files.NIMBUS_AUX_BIN = Buffer.from('Nimbus WASI multicall entry\n');
+  for (const name of names) {
+    if (name.includes('/') || name === '.' || name === '..') throw new Error(`Invalid multicall entry: ${name}`);
+    spec.files.push({ src: 'NIMBUS_AUX_BIN', vfs: `bin/${name}`, mode: 'exec' });
+  }
+}
 // Checked before anything is staged: which runtimes we publish to npm is a
 // decision, and a spec that has not made it should cost nothing to find out.
 if (NPM_OUT_DIR) {
@@ -617,8 +643,9 @@ if (spec.ingest_only) {
     license: spec.license,
   };
   // Update default to the just-uploaded version (idempotent — if it was
-  // already the default, no-op).
-  catalog.runtimes[RUNTIME].default = VERSION;
+  // already the default, no-op), unless the publisher asked to hold it for
+  // deployments that cannot bind this build yet.
+  if (!KEEP_DEFAULT) catalog.runtimes[RUNTIME].default = VERSION;
 
   // The catalog indexes every runtime, so an update that drops one is a
   // publish that unregisters somebody else's. Cheap to assert, and it catches
@@ -644,7 +671,7 @@ if (spec.ingest_only) {
   console.log(`\n[bundle-runtime] DONE`);
   console.log(`[bundle-runtime] uploaded ${downloaded.length} files (${totalMb} MiB) for ${RUNTIME}@${VERSION}`);
   console.log(`[bundle-runtime] manifest:  r2://${BUCKET}/${manifestR2Key}`);
-  console.log(`[bundle-runtime] catalog:   r2://${BUCKET}/${catalogR2Key}`);
+  console.log(`[bundle-runtime] catalog:   r2://${BUCKET}/${catalogR2Key} (default ${catalog.runtimes[RUNTIME].default})`);
 }
 
 /**