@nimbus-sh/worker 0.9.0 → 0.11.0

package/dist/runtime/staged-source.js

@@ -0,0 +1,113 @@
+/**
+ * staged-source.ts — the one supervisor-side read of a build artifact a bundle
+ * script staged under public/_assets/ instead of inlining it in the Worker
+ * bundle (wasm modules, facet source texts).
+ *
+ * The staging script pins each artifact by sha-256 in a `.generated.ts`. This
+ * module reads it through L2 (caches.default) under a key that changes with
+ * the bytes, with ASSETS as the source of truth, and hands out nothing that
+ * fails the pinned digest: a stale or partial asset never reaches workerd's
+ * loader or a facet. L2 is written only with verified bytes read from ASSETS.
+ *
+ * Artifacts differ only in what they name in errors and in what a bad L2 entry
+ * means to their caller (`poisonedCache`), so each passes those in.
+ */
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
+import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
+/** Fetch a staged artifact's bytes and verify them against its pinned digest. */
+export async function fetchStagedBytes(env, asset) {
+    if (!env.ASSETS)
+        throw new Error(asset.missingBinding);
+    // The colo cache, where the runtime has one: workerd does, a test harness may not.
+    const cache = typeof caches === 'undefined' ? undefined : caches.default;
+    if (cache) {
+        let cached = null;
+        try {
+            const hit = await cache.match(new Request(asset.l2Key));
+            if (hit && hit.ok)
+                cached = await hit.arrayBuffer();
+        }
+        catch { /* fall through to ASSETS */ }
+        if (cached !== null) {
+            const digest = await sha256Hex(cached);
+            if (digest === asset.sha256)
+                return cached;
+            if (asset.poisonedCache === 'reject')
+                throw new Error(asset.integrityFailed(digest, 'L2 cache'));
+            try {
+                await cache.delete(new Request(asset.l2Key));
+            }
+            catch { /* the ASSETS read below still decides */ }
+        }
+    }
+    // ASSETS routes by pathname only; `.invalid` (RFC 2606) marks the host as
+    // internal to the binding.
+    const res = await env.ASSETS.fetch(new Request(`https://nimbus-internal.invalid${asset.path}`));
+    let bytes;
+    try {
+        if (!res.ok)
+            throw new Error(asset.fetchFailed(res));
+        bytes = await res.arrayBuffer();
+    }
+    finally {
+        disposeRpcResource(res);
+    }
+    const digest = await sha256Hex(bytes);
+    if (digest !== asset.sha256)
+        throw new Error(asset.integrityFailed(digest, 'ASSETS'));
+    // Best-effort: ASSETS stays the source of truth. The cache copies the body
+    // at put time, so the caller's buffer is unaffected.
+    try {
+        if (cache) {
+            const headers = { 'Cache-Control': 'public, max-age=31536000, immutable' };
+            if (asset.contentType)
+                headers['Content-Type'] = asset.contentType;
+            await cache.put(new Request(asset.l2Key), new Response(new Uint8Array(bytes), { headers }));
+        }
+    }
+    catch { /* silent */ }
+    return bytes;
+}
+/** {@link fetchStagedBytes}, decoded as UTF-8. */
+export async function fetchStagedText(env, asset) {
+    return new TextDecoder().decode(await fetchStagedBytes(env, asset));
+}
+/**
+ * One load per isolate: every caller shares the first call's promise, and a
+ * rejected one is dropped so the next call loads again instead of pinning the
+ * error.
+ */
+export function memoizeUntilRejected(load) {
+    let memo = null;
+    return (arg) => {
+        if (!memo) {
+            const loading = load(arg);
+            memo = loading;
+            loading.catch(() => { if (memo === loading)
+                memo = null; });
+        }
+        return memo;
+    };
+}
+/**
+ * The `StagedAsset` of a facet source text staged under
+ * public/_assets/runtime/ by `stagedBy` and needed by `requiredBy`: a bad L2
+ * entry is replaced from ASSETS, since every later fetch in the colo for the
+ * build would otherwise fail on it.
+ */
+export function stagedRuntimeSource(source) {
+    return {
+        path: source.entry,
+        l2Key: `https://nimbus-cache.invalid${source.entry}?build=${source.buildId}`,
+        sha256: source.sha256,
+        poisonedCache: 'refetch',
+        missingBinding: `Nimbus: ${source.requiredBy} requires an env.ASSETS binding (serves the ` +
+            `staged ${source.label} source at ${source.entry}) — add the assets ` +
+            'binding from the embed config (see packages/worker README)',
+        fetchFailed: (res) => `${source.label} asset fetch failed: ${res.status} ${res.statusText} for ` +
+            `${source.entry} — deploy is missing the staged source (run ${source.stagedBy})`,
+        integrityFailed: (digest) => `${source.label} asset integrity mismatch for ${source.entry}: ` +
+            `expected ${source.sha256.slice(0, 16)}…, got ${digest.slice(0, 16)}… — ` +
+            `the staged asset is stale or corrupt; rerun ${source.stagedBy} and redeploy`,
+    };
+}

package/dist/runtime/wasi/preamble.d.ts

@@ -1,28 +1,6 @@
 import type { FdEntry, WasiInitOptions, WasiInstanceBundle, WasiMakeImportsOptions, WasiRunResult, WasiStartInstance, WasiSupervisorStub } from '@nimbus-sh/core/runtime/wasi/types.js';
 export declare function __wasiAdoptSupervisor(sup: WasiSupervisorStub | null): void;
-/**
- * Re-sync the cache with the session VFS. A resident process (a server) must
- * see files that other processes created or changed after it spawned, so the
- * cached content is dropped and metadata re-read on next access.
- */
-export declare function __wasiRevalidateFS(): Promise<string[]>;
-/**
- * Await every queued mutation. Callers drain before returning a result to the
- * supervisor and before any live read, so the supervisor's view always
- * includes this process's own writes.
- */
-export declare function __wasiDrainPersist(): Promise<void>;
 export declare function __wasiInitFS(opts: WasiInitOptions): void;
-/**
- * Read named files back out as base64.
- *
- * A process with a supervisor has already written everything through as it
- * happened and never calls this. A SEALED one — no supervisor, by design,
- * because it must not be able to reach the session VFS at all — has no other
- * channel, so its caller names the paths it wants and gets exactly those.
- * A path with no file is simply absent from the result.
- */
-export declare function __wasiReadFilesB64(paths: string[]): Record<string, string>;
 export declare const fdTable: Map<number, FdEntry>;
 export declare function __wasiMakeImports(opts: WasiMakeImportsOptions): WasiInstanceBundle;
 export declare function __wasiRunStart(instance: WasiStartInstance, ctx?: unknown): WasiRunResult;

package/dist/runtime/wasi/preamble.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preamble.d.ts","sourceRoot":"","sources":["../../../src/runtime/wasi/preamble.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAGV,OAAO,EAOP,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EAGtB,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAInB,MAAM,uCAAuC,CAAC;AAkL/C,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAsHD;;;;GAIG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAgB5D;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOxD;AA+CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAqGxD;AAgPD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAc1E;AAeD,eAAO,MAAM,OAAO,sBAA6B,CAAC;AAqMlD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,GAAG,kBAAkB,CA8xDlF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,aAAa,CAcxF;AAeD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB5G"}
+{"version":3,"file":"preamble.d.ts","sourceRoot":"","sources":["../../../src/runtime/wasi/preamble.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAEV,OAAO,EAMP,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EAGtB,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAInB,MAAM,uCAAuC,CAAC;AAmJ/C,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAiBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA0BxD;AAwOD,eAAO,MAAM,OAAO,sBAA6B,CAAC;AAsElD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,GAAG,kBAAkB,CA4iClF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,aAAa,CAcxF;AAeD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB5G"}