@nimbus-sh/worker 0.9.0 → 0.10.0

package/scripts/bundle-esbuild-wasm.mjs

@@ -10,8 +10,10 @@
  * than the supervisor's. The facet needs two pieces of esbuild-wasm
  * at module-load time:
  *
- *   1. The JS adapter (`esbuild-wasm/esm/browser.js`) — small, stays
- *      in the worker bundle as a string constant.
+ *   1. The JS adapter (`esbuild-wasm/esm/browser.js`, ~117 KiB), rewritten
+ *      into a function body. The supervisor already imports the same
+ *      build as a module for its own transforms, so the adapter is staged
+ *      beside the wasm rather than embedded a second time as a string.
  *
  *   2. The wasm binary (`esbuild.wasm`) — 12 MiB. Lives in the
  *      static-assets layer (Workers ASSETS binding) at
@@ -48,11 +50,15 @@
  * Output:
  *   src/esbuild-wasm-bundle.generated.ts
  *     export const ESBUILD_WASM_VERSION: string;
+ *     export const ESBUILD_WASM_ASSET_PATH: string;  // /_assets/esbuild-<version>.wasm
+ *     export const ESBUILD_JS_ASSET_PATH: string;    // /_assets/esbuild-<version>.js
  *     export const ESBUILD_WASM_SHA256: string;      // staged wasm digest
- *     export const ESBUILD_WASM_JS_FN_BODY: string;  // ESM browser source
+ *     export const ESBUILD_JS_SHA256: string;        // staged adapter digest
  *
  *   public/_assets/esbuild-<version>.wasm
  *     The raw wasm, picked up by the wrangler ASSETS binding.
+ *   public/_assets/esbuild-<version>.js
+ *     The adapter as a function body, same binding.
  *
  * Run via:
  *   node scripts/bundle-esbuild-wasm.mjs
@@ -144,8 +150,8 @@ async function main() {
   // The ASSETS binding picks up everything under `assets.directory`
   // (./public per wrangler.jsonc). We version-name the file so a
   // future esbuild-wasm bump produces a different asset filename and
-  // forces a fresh fetch (no stale-cache risk; cf. ESBUILD_WASM_ASSET_PATH
-  // in src/esbuild-wasm-bytes.ts).
+  // forces a fresh fetch (no stale-cache risk; the generated module names
+  // the path and src/runtime/esbuild-wasm-bytes.ts reads it).
   await fs.mkdir(OUT_ASSETS_DIR, { recursive: true });
   const assetName = `esbuild-${version}.wasm`;
   const assetOut = path.join(OUT_ASSETS_DIR, assetName);
@@ -155,53 +161,48 @@ async function main() {
   console.log(
     `[bundle-esbuild-wasm] copied esbuild.wasm → ${path.relative(ROOT, assetOut)} (${(wasmBytes.length / (1024 * 1024)).toFixed(1)} MiB)`,
   );
+  // The JS adapter is staged the same way. Facets splice it into their
+  // source as a string; the supervisor imports esbuild-wasm as a module
+  // for its own transforms, so carrying the adapter inline as well
+  // shipped it twice in the Worker bundle.
+  const jsAssetName = `esbuild-${version}.js`;
+  const jsAssetOut = path.join(OUT_ASSETS_DIR, jsAssetName);
+  const jsBytes = Buffer.from(jsFn, 'utf8');
+  await fs.writeFile(jsAssetOut, jsBytes);
+  const jsSha256 = createHash('sha256').update(jsBytes).digest('hex');
+  console.log(
+    `[bundle-esbuild-wasm] wrote JS adapter → ${path.relative(ROOT, jsAssetOut)} (${(jsBytes.length / 1024).toFixed(1)} KiB)`,
+  );
 
   // ── 3. Clean up any stale-versioned wasm assets in public/_assets/ ──
   // Keeps the deploy lean: a developer who bumped the esbuild-wasm
   // version locally won't accidentally ship two copies.
   for (const entry of await fs.readdir(OUT_ASSETS_DIR)) {
-    if (entry.startsWith('esbuild-') && entry.endsWith('.wasm') && entry !== assetName) {
+    if (entry.startsWith('esbuild-') && (entry.endsWith('.wasm') || entry.endsWith('.js'))
+      && entry !== assetName && entry !== jsAssetName) {
       const stale = path.join(OUT_ASSETS_DIR, entry);
       await fs.unlink(stale);
       console.log(`[bundle-esbuild-wasm] removed stale asset: ${entry}`);
     }
   }
 
-  // ── 4. Emit the JS-only generated TS module ──────────────────────────
-  // No ESBUILD_WASM_BASE64 export. The base64 string was 16 MiB and
-  // sat in supervisor module scope for the isolate's lifetime; A'.5
-  // moved the bytes to env.ASSETS to drop that residency.
+  // ── 4. Emit the generated TS module: versions and digests only ──────
+  // Neither artifact is inline. The base64 wasm string was 16 MiB and
+  // sat in supervisor module scope for the isolate's lifetime (A'.5
+  // moved it to env.ASSETS); the JS adapter followed so the bundle
+  // carries esbuild-wasm once, as the module the supervisor imports.
   const header = `/**
  * esbuild-wasm-bundle.generated.ts — AUTO-GENERATED by scripts/bundle-esbuild-wasm.mjs
  * DO NOT EDIT.
  *
- * Bundled esbuild-wasm ${version} adapter for use inside NimbusIsolatePool
- * isolates. Only the JS adapter is bundled here (~117 KiB); the wasm
- * binary itself lives in the static-assets layer at
- * public/_assets/esbuild-${version}.wasm and is fetched on demand by
- * src/esbuild-wasm-bytes.ts.
+ * Digests of the staged esbuild-wasm ${version} artifacts. Both live in
+ * the static-assets layer, public/_assets/esbuild-${version}.{wasm,js},
+ * and are fetched on demand and verified by src/runtime/esbuild-wasm-bytes.ts.
  *
- * Phase 2 A'.5 moved the base64 wasm string OUT of the supervisor
- * bundle (was 16 MiB UTF-8 → 21 MiB UTF-16 in JS string overhead).
- * If you're reading this and wondering where the bytes are: env.ASSETS.
- */
-
-export const ESBUILD_WASM_VERSION: string = ${JSON.stringify(version)};
-
-/**
- * SHA-256 of the staged public/_assets/esbuild-${version}.wasm bytes.
- * src/runtime/esbuild-wasm-bytes.ts verifies every fetch against it — the L2
- * (caches.default) tier included — before the bytes reach workerd's loader.
- */
-export const ESBUILD_WASM_SHA256: string = ${JSON.stringify(wasmSha256)};
-
-/**
- * Function body that, when wrapped in \`new Function(...)()\`, returns
- * the esbuild-wasm namespace (build, transform, initialize, ...).
- *
- * Source: node_modules/esbuild-wasm/esm/browser.js with the trailing
- * \`export { ... }\` rewritten to \`return { ... };\`. Why the browser
- * build:
+ * The JS adapter is node_modules/esbuild-wasm/esm/browser.js with the
+ * trailing \`export { ... }\` rewritten to \`return { ... };\`, so that
+ * \`new Function(body)()\` yields the esbuild namespace inside a facet.
+ * Why the browser build:
  *   - Pure ESM with no \`createRequire\`, no \`require("fs")\`, and
  *     no \`process.binding\` — safe to evaluate inside a workerd
  *     dynamic-worker isolate.
@@ -219,13 +220,28 @@ export const ESBUILD_WASM_SHA256: string = ${JSON.stringify(wasmSha256)};
  * patterns (createRequire / dynamic node-builtin require / process.binding)
  * and bails loud if a future release reintroduces them.
  */
-export const ESBUILD_WASM_JS_FN_BODY: string = ${JSON.stringify(jsFn)};
+export const ESBUILD_WASM_VERSION: string = ${JSON.stringify(version)};
+/**
+ * Where the artifacts live inside env.ASSETS. Version-named, so a bump
+ * lands under a new name and never serves a stale cache entry. Naming them
+ * here is what puts them under scripts/dist-integrity.mjs's staged-asset
+ * check, which discovers asset paths by value in generated modules.
+ */
+export const ESBUILD_WASM_ASSET_PATH: string = ${JSON.stringify('/_assets/' + assetName)};
+export const ESBUILD_JS_ASSET_PATH: string = ${JSON.stringify('/_assets/' + jsAssetName)};
+/**
+ * SHA-256 of the staged public/_assets/esbuild-${version}.wasm bytes.
+ * src/runtime/esbuild-wasm-bytes.ts verifies every fetch against it — the L2
+ * (caches.default) tier included — before the bytes reach workerd's loader.
+ */
+export const ESBUILD_WASM_SHA256: string = ${JSON.stringify(wasmSha256)};
+/** SHA-256 of the staged public/_assets/esbuild-${version}.js adapter, checked the same way. */
+export const ESBUILD_JS_SHA256: string = ${JSON.stringify(jsSha256)};
 `;
-
   await fs.writeFile(OUT_TS, header, 'utf8');
   const stat = await fs.stat(OUT_TS);
   console.log(
-    `[bundle-esbuild-wasm] wrote ${path.relative(ROOT, OUT_TS)} (${(stat.size / 1024).toFixed(1)} KiB — JS adapter only)`,
+    `[bundle-esbuild-wasm] wrote ${path.relative(ROOT, OUT_TS)} (${(stat.size / 1024).toFixed(1)} KiB — digests only)`,
   );
 }
 

package/scripts/bundle-facet-workers.mjs

@@ -47,12 +47,53 @@ import { build } from 'esbuild';
 import { writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+// core's own parser dependency, reached through the workspace hoist; the
+// script runs under plain node at postinstall, so nothing here is TypeScript.
+import { parse } from 'acorn';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const root = join(__dirname, '..');
 const coreRoot = join(root, '..', 'core');
 const platformRoot = join(root, '..', 'platform');
 
+/**
+ * The bundle without its comments. esbuild keeps every comment that sits
+ * inside an expression or object literal, plus its own `// path` module
+ * markers, and nothing reads any of them: the strings are evaluated, never
+ * shown, mapped or `toString()`ed. The comment ranges come from a real
+ * parse of the output, so a `//` inside a string, template or regex is
+ * untouched; only comments go, and a line that held nothing but a comment
+ * goes with it. Every other character, identifier and line stays put.
+ */
+function withoutComments(text) {
+  const comments = [];
+  parse(text, { ecmaVersion: 'latest', sourceType: 'module', allowAwaitOutsideFunction: true, onComment: comments });
+  let out = '';
+  let cursor = 0;
+  for (const { start, end } of comments) {
+    if (start < cursor) continue;
+    const lineStart = text.lastIndexOf('\n', start - 1) + 1;
+    const lineEndAt = text.indexOf('\n', end);
+    const lineEnd = lineEndAt < 0 ? text.length : lineEndAt;
+    const leading = text.slice(lineStart, start);
+    const trailing = text.slice(end, lineEnd);
+    if (leading.trim() === '' && trailing.trim() === '') {
+      // The comment is the whole line (or lines): drop them, newline included.
+      out += text.slice(cursor, lineStart);
+      cursor = lineEndAt < 0 ? text.length : lineEnd + 1;
+    } else if (trailing.trim() === '') {
+      // Trailing comment: drop it and the blank that led to it.
+      out += text.slice(cursor, start).replace(/[ \t]+$/, '');
+      cursor = end;
+    } else {
+      // Mid-line block comment: one space keeps the tokens on either side apart.
+      out += `${text.slice(cursor, start)} `;
+      cursor = end;
+    }
+  }
+  return out + text.slice(cursor);
+}
+
 /**
  * Bundle one TS source into a self-contained ESM string suitable for
  * inlining as a facet preamble. Strips the leading `export` on
@@ -76,7 +117,7 @@ async function bundleAsPreamble(entryPath, label) {
   if (!result.outputFiles || result.outputFiles.length === 0) {
     throw new Error(`[bundle-facet-workers/${label}] esbuild produced no output`);
   }
-  let stripped = result.outputFiles[0].text;
+  let stripped = withoutComments(result.outputFiles[0].text);
   stripped = stripped.replace(/^export\s+(async\s+function|function|const|class)\b/gm, '$1');
   stripped = stripped.replace(/\n?export\s*\{[^}]*\}\s*;\s*$/g, '');
   return stripped;
@@ -112,7 +153,7 @@ async function bundleVirtualSocketKernel() {
   if (!result.outputFiles || result.outputFiles.length === 0) {
     throw new Error('[bundle-facet-workers/virtual-socket-kernel] esbuild produced no output');
   }
-  return result.outputFiles[0].text;
+  return withoutComments(result.outputFiles[0].text);
 }
 
 /**
@@ -126,10 +167,7 @@ const WASI_REQUIRED_TOP_LEVEL = [
   '__wasiMakeImports',
   '__wasiRunStart',
   '__wasiRunStartAsync',
-  '__wasiReadFilesB64',
   '__wasiAdoptSupervisor',
-  '__wasiDrainPersist',
-  '__wasiRevalidateFS',
   'fdTable',
 ];
 
@@ -168,7 +206,7 @@ async function bundleWasiInstance() {
   if (!result.outputFiles || result.outputFiles.length === 0) {
     throw new Error('[bundle-facet-workers/wasi-instance] esbuild produced no output');
   }
-  let src = result.outputFiles[0].text;
+  let src = withoutComments(result.outputFiles[0].text);
   // The body is spliced into another module; a re-export block there is a
   // syntax error, and callers append their own `export { … }`.
   src = src.replace(/^export\s+(async\s+function|function|const|let|var|class)\b/gm, '$1');
@@ -233,7 +271,7 @@ async function bundleBashRunner() {
   if (!result.outputFiles || result.outputFiles.length === 0) {
     throw new Error('[bundle-facet-workers/bash-runner] esbuild produced no output');
   }
-  const src = result.outputFiles[0].text;
+  const src = withoutComments(result.outputFiles[0].text);
   for (const name of ['__bashBoot', '__bashFeed']) {
     if (!new RegExp(`^\\s*globalThis\\.${name}\\s*=`, 'm').test(src)) {
       throw new Error(