@weft-js/start 0.1.1 → 0.1.3

package/src/run.tsx

@@ -9,194 +9,66 @@
 // the cache). Redirects from loaders and server functions navigate (at most 5 in a row); a
 // mutation that invalidates a tag the current route's loaders read refetches the route data in place.
 
-import { drain, enter, hydrate, level as staticLevel, wake } from '@weft-js/core/dom'
-import { flush } from '@weft-js/core'
-import { setHead } from '@weft-js/core/head'
-import type { Held } from './boot'
-import { applyMatches, client, createRouteState, type Component, type Match, type NavigateOptions, type RoutePayload } from './router'
-import { App } from './view'
-import { ErrorPage, NotFoundPage } from './builtin'
+import { client, type Component } from './router'
+import { mount, prepare } from './run/boot'
+import { listeners } from './run/listeners'
+import { Navigation } from './run/navigation'
+import { prepareRouteShape } from './run/shape-preparation'
 
-type Hot = ImportMeta & { hot?: { on(event: string, on: (data: { queries: boolean }) => unknown): void } }
+type Hot = ImportMeta & {
+  hot?: { on(event: string, on: (data: { queries: boolean }) => unknown): void }
+}
+
+/**
+ * Synchronous shape metadata from separately compiled modules. CSS and emitted
+ * asset bytes are null until known; consumers must not treat them as available
+ * or free. cssText holds generated groups and resolved static entry and level
+ * styles, including tokens. cssStatus remains partial.
+ * Unavailable covers unproven overrides and unsupported route files.
+ */
+export type RouteShape =
+  | { kind: 'disabled'; css: string[] | null; bytes: number | null }
+  | {
+      kind: 'unavailable'
+      reason: 'unresolved-export' | 'unsupported-file' | 'missing-shape'
+      css: null
+      bytes: null
+    }
+  | {
+      kind: 'generated' | 'override'
+      component: Component
+      css: string[] | null
+      cssText: string[]
+      cssStatus: 'partial'
+      bytes: number | null
+      /** A generated shape with no structure of its own (`$weftShapeThin`): the router stands in for it. */
+      thin?: boolean
+    }
+
+/** Shape entries are keyed by level id, including layouts and error routes. */
+export type RouteShapes = Record<string, RouteShape>
 
 /** The client half of `virtual:weft/routes`: the page routes in match order, and a chunk loader per route id. */
 export interface ClientRoutes {
+  build?: string | null
   table: { id: string; pattern: string; layouts: string[] }[]
   load: Record<string, () => Promise<{ default?: Component }>>
+  /** Eager shape metadata, keyed by route or layout id. */
+  shapes?: RouteShapes
   /** Each island's code, by id: all a static level loads (PLAN §11). */
   islands?: Record<string, () => Promise<{ default: Component }>>
 }
 
 /** Hydrate the page in `#app` and take over its links. Resolves once hydrated. */
-const SLOW_FADE = 100 // ms from asking for a fade to it starting
-
 export async function start(routes: ClientRoutes, options: { container?: Element } = {}) {
-  const container = options.container ?? document.getElementById('app')!
-  const page: RoutePayload = JSON.parse(document.getElementById('weft-route')!.textContent)
-  const data = JSON.parse(document.getElementById('weft-data')?.textContent ?? 'null')
-  let tags = page.m.map(m => m.t ?? [])
-  const comps: Record<string, Component> = {}
-  // The built-in 404 and error pages stand in only when the app has no route file for them.
-  const builtin: Record<string, Component> = { 404: NotFoundPage, error: ErrorPage }
-  const chunk = (id: string) =>
-    comps[id] ? Promise.resolve()
-    : routes.load[id] ? routes.load[id]().then(m => { if (m.default) comps[id] = m.default })
-    : Promise.resolve(builtin[id] && (comps[id] = builtin[id]))
-  const islands: Record<string, Component> = {}
-  const island = (id: string) => islands[id] ? undefined : routes.islands![id]!().then(m => { islands[id] = m.default })
-  await Promise.all([...page.m.filter(m => !m.s).map(m => chunk(m.id)), ...(page.i ?? []).map(island)])
-  const route = createRouteState(page, comps)
-  let bag: RoutePayload['b']
-  route.mount = (html, depth, next) => staticLevel(html, depth, next, id => islands[id]! as never, bag ?? undefined, id => Promise.resolve(island(id)))
-  route.around = (_d, _id, body) => enter(body)
-  hydrate(() => <App route={route} />, container, { data })
-  client.route = route
-  const q = (window as Window & { __wq?: Held }).__wq
-  if (q) {
-    q.w = wake
-    if (q.l) wake(q.l)
-    drain()
-  }
-
-  let current: AbortController | undefined
-  let warm: { path: string; at: number; res: Promise<Response> } | undefined
-  // A fade pictures the whole page twice, and the picture holds up every frame. Where that's slow, the page just changes.
-  let fades = !(navigator.hardwareConcurrency <= 4)
-  // A navigation before the first frame (a moved page's onMount) has no old picture to hold: Chrome aborts that
-  // transition and logs an InvalidStateError. Two frames in, the page has painted.
-  let painted = false
-  requestAnimationFrame(() => requestAnimationFrame(() => (painted = true)))
-  async function go(href: string, opts: NavigateOptions & { pop?: boolean; hops?: number } = {}): Promise<void> {
-    const url = new URL(href, location.href)
-    if (url.origin !== location.origin) return location.assign(url.href)
-    current?.abort()
-    const ctrl = (current = new AbortController())
-    const path = url.pathname + url.search
-    for (const id of guess(routes, url.pathname)) void chunk(id) // chunk loads start with the data fetch, not after it
-    let next: RoutePayload
-    try {
-      const held = warm?.path === path && performance.now() - warm.at < 10_000 ? warm.res : undefined
-      warm = undefined
-      next = await (held ?? ask(url, ctrl.signal)).then(r => r.clone().json())
-    } catch (e) {
-      if (ctrl.signal.aborted) return
-      return location.assign(url.href) // the data request failed: let the server render the page
-    }
-    if (next.r) {
-      const hops = (opts.hops ?? 0) + 1
-      return hops > 5 ? location.assign(next.r) : go(next.r, { replace: opts.pop || opts.replace, hops }) // a back/forward to a moved URL replaces its entry
-    }
-    await Promise.all([...next.m.map(m => chunk(m.id)), ...(next.i ?? []).map(island)])
-    if (ctrl.signal.aborted) return
-    if (!opts.pop) history[opts.replace ? 'replaceState' : 'pushState'](null, '', url.href)
-    at = path
-    if (next.c) client.seed ? client.seed(next.c) : (client.seeds ??= []).push(...next.c)
-    tags = next.m.map(m => m.t ?? [])
-    bag = next.b
-    const swap = () => {
-      applyMatches(route, next.m.map(revive), path, next.s)
-      if (next.m.some(m => m.s)) current_(url.pathname)
-      if (next.h) setHead(next.h, url.pathname)
-      flush()
-      if (opts.scroll !== false && !opts.pop) {
-        const target = url.hash && document.getElementById(decodeURIComponent(url.hash.slice(1)))
-        target ? target.scrollIntoView() : window.scrollTo(0, 0)
-      }
-    }
-    // The old page stays on screen, as a picture, until the new one is ready to fade in. `hidden`: nothing would show it.
-    if (fades && painted && document.startViewTransition && !document.hidden && !matchMedia('(prefers-reduced-motion: reduce)').matches) {
-      const started = performance.now()
-      const fade = document.startViewTransition(swap)
-      void fade.ready.then(() => { if (performance.now() - started > SLOW_FADE) fades = false }, () => {})
-      // a transition the browser aborts (a second navigation, a hidden tab) rejects `finished`: the page already swapped
-      void fade.finished.catch(() => {})
-      await fade.updateCallbackDone
-    }
-    else swap()
-  }
-  client.navigate = go
-  // Dev: server code changed under the page (vite.mjs). The route's data comes again, in place.
-  const refresh = async ({ queries }: { queries: boolean }) => {
-    const url = new URL(location.href)
-    const res = await ask(url)
-    // It doesn't load yet, and the error page would replace what's here: the next save asks again.
-    if (!res.ok || (await res.clone().json()).s >= 500) return
-    if (queries) client.refreshed?.()
-    warm = { path: url.pathname + url.search, at: performance.now(), res: Promise.resolve(res) }
-    await go(url.href, { pop: true })
-  }
-  if ((import.meta as Hot).hot) (import.meta as Hot).hot!.on('weft:refresh', changed => void refresh(changed))
-  // A mutation invalidated tags: when the route's loaders read one, refetch the route data (no history entry, no scroll).
-  client.invalidated = t => {
-    warm = undefined
-    if (tags.some(l => l.some(x => t.includes(x)))) void go(location.href, { pop: true })
-  }
-
-  document.addEventListener('click', e => {
-    if (e.defaultPrevented || e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return
-    const url = ours(e.target)
-    if (!url) return
-    e.preventDefault()
-    void go(url.href)
-  })
-  // A link the pointer rests on, or the keyboard lands on, has its chunks and data by the time it is pressed.
-  // `data-preload="off"` on a link opts out, and so does Save-Data.
-  let pending: ReturnType<typeof setTimeout> | undefined
-  const intent = (e: Event) => {
-    clearTimeout(pending)
-    const url = ours(e.target)
-    const path = url && url.pathname + url.search
-    if (!url || warm?.path === path || (e.target as Element).closest('[data-preload="off"]') || (navigator as Navigator & { connection?: { saveData?: boolean } }).connection?.saveData) return
-    pending = setTimeout(() => {
-      for (const id of guess(routes, url.pathname)) void chunk(id)
-      warm = { path: path!, at: performance.now(), res: ask(url) }
-      warm.res.catch(() => { warm = undefined })
-    }, e.type === 'focusin' ? 0 : 80)
-  }
-  document.addEventListener('pointerover', intent)
-  document.addEventListener('focusin', intent)
-  // An in-page anchor fires this too, and the page hasn't changed: re-rendering it would lose what's been scrolled to.
-  let at = location.pathname + location.search
-  addEventListener('popstate', () => {
-    if (location.pathname + location.search !== at) void go(location.href, { pop: true })
-  })
-  return route
-}
-
-const ask = (url: URL, signal?: AbortSignal) => fetch(`/_weft/data${url.pathname === '/' ? '' : url.pathname}${url.search}`, { signal: signal ?? null, headers: { accept: 'application/json' } })
-
-/** The URL a client navigation would take from this event's link, or nothing for a link the browser should follow. */
-function ours(target: EventTarget | null) {
-  const a = (target as Element | null)?.closest?.('a')
-  if (!a || (a.target && a.target !== '_self') || a.hasAttribute('download') || a.getAttribute('rel')?.includes('external')) return
-  const url = new URL(a.href, location.href)
-  if (url.origin !== location.origin || url.pathname.startsWith('/_weft/')) return
-  return url.pathname === location.pathname && url.search === location.search && url.hash ? undefined : url // not an in-page anchor
-}
-
-/** A kept static level has no binding for its links' current-page state: the same rule as `Link`, after the swap. */
-function current_(path: string) {
-  flush()
-  for (const a of document.querySelectorAll('a[aria-current="page"]')) if (a.getAttribute('href') !== path) a.removeAttribute('aria-current')
-  for (const a of document.querySelectorAll(`a[href="${CSS.escape(path)}"]:not([aria-current])`)) a.setAttribute('aria-current', 'page')
-}
-
-/** Deferred fields arrive resolved on navigation: they become settled promises again, so resources read them alike. */
-function revive(m: Match): Match {
-  if (!m.d?.length) return m
-  const data = { ...(m.data as Record<string, unknown>) }
-  for (const k of m.d) data[k] = Promise.resolve(data[k])
-  return { ...m, data }
-}
-
-/** The route ids `pathname` probably needs (its layouts and page), from the table; the server's answer decides. */
-function guess(routes: ClientRoutes, pathname: string): string[] {
-  const parts = pathname.split('/').filter(Boolean)
-  for (const r of routes.table) {
-    const segs = r.pattern.split('/').filter(Boolean)
-    const splat = segs.at(-1) === '$'
-    if (splat ? parts.length < segs.length - 1 : parts.length !== segs.length) continue
-    if (segs.every((s, i) => s === '$' || s.startsWith('$') || s === decodeURIComponent(parts[i] ?? ''))) return [...r.layouts, r.id]
-  }
-  return []
+  const prepared = prepare(routes, options)
+  await Promise.all(prepared.loads)
+  const page = mount(prepared)
+  page.route.prepareShape = (id) => prepareRouteShape(routes, id, document)
+  const navigation = new Navigation(routes, page)
+  client.navigate = navigation.go
+  listeners(navigation, () => (import.meta as Hot).hot)
+  // The router follows links from here: the browser's prefetching for full loads (capture.ts `speculate`) stops.
+  document.getElementById('weft-speculate')?.remove()
+  return page.route
 }

package/src/rust/common.ts

@@ -0,0 +1,163 @@
+import { raise, StartError, type Context, type Fn } from '../data'
+import type { Claims, RemoteResult } from '../rust'
+type User = Context extends { user: infer U } ? U | null : unknown
+
+export const DEFAULT_TIMEOUT = 10_000
+export const encoder = new TextEncoder()
+
+// An app's tsc may have no Node types, so what's read of `process` is named here.
+export const nodeHost = globalThis as unknown as {
+  process?: {
+    env: Record<string, string | undefined>
+    platform: string
+    arch: string
+    getBuiltinModule?(name: string): unknown
+    dlopen(mod: object, file: string): void
+  }
+}
+export const env = (name: string): string | undefined => nodeHost.process?.env?.[name] || undefined
+export const randomHex = (bytes: number) =>
+  Array.from(crypto.getRandomValues(new Uint8Array(bytes)), (x) =>
+    x.toString(16).padStart(2, '0'),
+  ).join('')
+
+export const defaultClaims = (user: User): Claims | null => {
+  const u = user as { id: unknown; roles?: string[]; role?: string; tenant?: string | null } | null
+  return (
+    u && {
+      id: String(u.id),
+      roles: u.roles ?? (u.role ? [u.role] : []),
+      ...(u.tenant != null && { tenant: u.tenant }),
+    }
+  )
+}
+
+const TRACEPARENT = /^00-(?!0{32})[0-9a-f]{32}-(?!0{16})[0-9a-f]{16}-[0-9a-f]{2}$/
+
+/** The caller's trace with a new span, or a new trace. */
+function traceparent(request: Request): string {
+  const inbound = request.headers.get('traceparent')
+  const trace = inbound && TRACEPARENT.test(inbound) ? inbound.split('-')[1] : randomHex(16)
+  return `00-${trace}-${randomHex(8)}-01`
+}
+
+/** The value as a sidecar reads it: what the schema parsed, encoded back to the wire shape (codecs, defaults filled). */
+export function wire(fn: Fn, input: unknown): unknown {
+  const schema = fn.def.input as { encodeAsync?: (value: unknown) => Promise<unknown> } | undefined
+  if (typeof schema?.encodeAsync === 'function') return schema.encodeAsync(input)
+  return input
+}
+
+async function checkedOutput(fn: Fn, value: unknown, validate: boolean): Promise<unknown> {
+  const schema = fn.def.output
+  if (!schema || !validate) return value
+  const r = await schema['~standard'].validate(value)
+  if (!r.issues) return r.value
+  const issues = r.issues
+    .map(
+      (i) =>
+        `${i.path?.map((p) => (typeof p === 'object' ? p.key : p)).join('.') ?? ''}: ${i.message}`,
+    )
+    .join('; ')
+  throw new StartError(
+    'R103',
+    `\`${fn.$id}\`'s sidecar returned a value its \`output\` schema rejects: ${issues}`,
+    'the sidecar was built from another contract, or sets a field the schema refuses: rebuild it, or fix the schema',
+    { status: 502 },
+  )
+}
+
+/** A declared error: its data checked like any output, with the status a client can act on. */
+async function declared(fn: Fn, error: { code: string; data?: unknown }): Promise<never> {
+  const schema = fn.def.errors?.[error.code]
+  if (!schema)
+    throw new StartError(
+      'R103',
+      `\`${fn.$id}\`'s sidecar answered with the undeclared error \`${error.code}\``,
+      'declare it in `errors`, or rebuild the sidecar from the current contract',
+      { status: 502 },
+    )
+  const r = await schema['~standard'].validate(error.data ?? null)
+  if (r.issues)
+    throw new StartError(
+      'R103',
+      `\`${fn.$id}\`'s sidecar sent \`${error.code}\` with data its schema rejects`,
+      'rebuild the sidecar from the current contract',
+      { status: 502 },
+    )
+  raise(error.code, r.value)
+}
+
+/** A shared value goes by no one's claims: the crate's `SharedCtx` has no user to read, and neither has the wire. */
+export function callContext(
+  fn: Fn,
+  ctx: Context,
+  request: Request,
+  timeout: number,
+  claims: (user: User) => Claims | null,
+) {
+  const shared = fn.def.cache && fn.def.cache.scope !== 'user'
+  return {
+    user: shared ? null : (claims((ctx as { user?: User }).user ?? null) ?? null),
+    requestId: randomHex(8),
+    deadlineMs: timeout,
+    traceparent: traceparent(request),
+  }
+}
+
+/** What a reply comes to: the same for a sidecar's body and an addon's string. */
+export async function settled(
+  fn: Fn,
+  reply: Reply | undefined,
+  target: string,
+  timeout: number,
+  validate: boolean,
+): Promise<RemoteResult> {
+  if (reply?.ok === true)
+    return {
+      value: await checkedOutput(fn, reply.value, validate),
+      tags: reply.tags ?? [],
+      touched: reply.touched ?? [],
+    }
+  const error = reply?.error
+  if (error?.code === 'Refused')
+    throw new StartError(
+      'R106',
+      `\`${target}\` refused \`${fn.$id}\`'s signature`,
+      '`WEFT_RUST_SECRET` must be the same on both sides, and the clocks within a minute',
+      { status: 503 },
+    )
+  if (error?.code === 'Deadline')
+    throw new StartError(
+      'R107',
+      `\`${fn.$id}\` ran past its ${timeout} ms`,
+      'raise `timeout`, or make the Rust answer sooner',
+      { status: 504 },
+    )
+  if (error?.code === 'Drift')
+    throw new StartError(
+      'R103',
+      `\`${fn.$id}\` doesn't match \`${target}\`: ${error.message}`,
+      'rebuild it from the current contract',
+      { status: 502 },
+    )
+  if (error?.code && error.code !== 'Internal')
+    await declared(fn, { code: error.code, data: error.data })
+  // The detail stays in a log, under this id: a sidecar's own, or this server's for what ran in this process.
+  if (error?.detail)
+    console.error(`[weft] \`${fn.$id}\` failed (request ${error.requestId}): ${error.detail}`)
+  throw new StartError(
+    'R108',
+    `\`${fn.$id}\` failed in \`${target}\` (request ${error?.requestId ?? 'unknown'})`,
+    "find the request id in the server's or the sidecar's log",
+    { status: 500 },
+  )
+}
+
+export interface Reply {
+  ok?: boolean
+  value?: unknown
+  tags?: string[]
+  touched?: string[]
+  error?: { code?: string; message?: string; detail?: string; requestId?: string; data?: unknown }
+}

package/src/rust/native.ts

@@ -0,0 +1,282 @@
+import { StartError } from '../data'
+import type { Native, NativeOptions } from '../rust'
+import {
+  DEFAULT_TIMEOUT,
+  callContext,
+  defaultClaims,
+  encoder,
+  env,
+  nodeHost,
+  settled,
+  wire,
+} from './common'
+
+const NAME = /^[a-z][a-z0-9_-]*$/
+
+// ---- native ---------------------------------------------------------------------------------------------------------
+
+/** The exports a `.wasm` built by the crate has. */
+interface Wasm {
+  memory: WebAssembly.Memory
+  weft_init: () => void
+  weft_free: (ptr: number, len: number) => void
+  weft_alloc: (len: number) => number
+  weft_contract: () => bigint
+  weft_call: (
+    ...args: [i: number, il: number, c: number, cl: number, b: number, bl: number]
+  ) => bigint
+}
+interface Engine {
+  kind: 'addon' | 'wasm'
+  call(id: string, ctx: string, body: string): Promise<string> | string
+}
+interface Entry {
+  kind?: string
+  hash: string
+  addon?: string
+  wasm?: string
+  failure?: string
+}
+
+interface ReadFile {
+  (file: string, encoding: 'utf8'): string
+  (file: string): Uint8Array<ArrayBuffer>
+}
+interface Builtins {
+  'node:fs': { existsSync(file: string): boolean; readFileSync: ReadFile }
+  'node:path': { dirname(path: string): string; join(...parts: string[]): string }
+  'node:url': { fileURLToPath(url: string): string }
+}
+const builtin = <K extends keyof Builtins>(name: K) =>
+  nodeHost.process?.getBuiltinModule?.(name) as Builtins[K] | undefined
+const platform = () => {
+  const p = nodeHost.process
+  return `${p?.platform}-${p?.arch}`
+}
+
+/** `.output/server/rust/` from wherever the bundle put this code. `WEFT_NATIVE_DIR` is `weft dev`'s, and `weft build`'s. */
+function nativeDir(origin: string): string | undefined {
+  const fs = builtin('node:fs'),
+    path = builtin('node:path')!,
+    url = builtin('node:url')!
+  if (!fs) return undefined
+  const set = env('WEFT_NATIVE_DIR')
+  if (set) return set
+  let dir = path.dirname(url.fileURLToPath(origin))
+  for (let i = 0; i < 6; i++, dir = path.dirname(dir))
+    if (fs.existsSync(path.join(dir, 'rust', 'manifest.json'))) return path.join(dir, 'rust')
+  return undefined
+}
+
+function addonEngine(file: string, hash: string, target: string): Engine {
+  const mod = { exports: {} as { contract: () => string; call: Engine['call'] } }
+  nodeHost.process!.dlopen(mod, file)
+  const built = JSON.parse(mod.exports.contract())
+  if (built.hash !== hash)
+    throw new StartError(
+      'R103',
+      `\`${target}\`'s library was built from contract ${built.hash}, and this app's is ${hash}`,
+      'rebuild it: `weft build`',
+      { status: 502 },
+    )
+  return { kind: 'addon', call: mod.exports.call }
+}
+
+/**
+ * The same functions as a `.wasm`, on this thread. A panic traps, which ends an instance: what it said arrives first,
+ * and the next call gets a new one, as a sidecar's crash gets a restart.
+ */
+async function wasmEngine(file: string, hash: string, target: string): Promise<Engine> {
+  const module = await WebAssembly.compile(builtin('node:fs')!.readFileSync(file))
+  const decoder = new TextDecoder()
+  let said = ''
+  let x: Wasm | undefined
+  const text = (ptr: number, len: number) =>
+    decoder.decode(new Uint8Array(x!.memory.buffer, ptr, len))
+  const fresh = () => {
+    x = new WebAssembly.Instance(module, {
+      weft: {
+        now: () => performance.now(),
+        panicked: (ptr: number, len: number) => {
+          said = text(ptr, len)
+        },
+      },
+    }).exports as unknown as Wasm
+    x.weft_init()
+  }
+  const taken = (packed: bigint) => {
+    const ptr = Number(packed >> 32n),
+      len = Number(packed & 0xffffffffn)
+    const out = text(ptr, len)
+    x!.weft_free(ptr, len)
+    return out
+  }
+  const put = (s: string): [number, number] => {
+    const bytes = encoder.encode(s)
+    const ptr = x!.weft_alloc(bytes.length)
+    new Uint8Array(x!.memory.buffer, ptr, bytes.length).set(bytes)
+    return [ptr, bytes.length]
+  }
+  fresh()
+  const built = JSON.parse(taken(x!.weft_contract()))
+  if (built.hash !== hash)
+    throw new StartError(
+      'R103',
+      `\`${target}\`'s library was built from contract ${built.hash}, and this app's is ${hash}`,
+      'rebuild it: `weft build`',
+      { status: 502 },
+    )
+  return {
+    kind: 'wasm',
+    call(id, ctx, body) {
+      if (!x) fresh()
+      const [i, il] = put(id),
+        [c, cl] = put(ctx),
+        [b, bl] = put(body)
+      try {
+        const reply = taken(x!.weft_call(i, il, c, cl, b, bl))
+        x!.weft_free(i, il)
+        x!.weft_free(c, cl)
+        return reply
+      } catch (e) {
+        if (!(e instanceof WebAssembly.RuntimeError)) throw e
+        x = undefined
+        return JSON.stringify({
+          ok: false,
+          error: {
+            code: 'Internal',
+            requestId: JSON.parse(ctx).requestId,
+            detail: said || e.message,
+          },
+        })
+      }
+    },
+  }
+}
+
+async function load(dir: string, entry: Entry, target: string): Promise<Engine> {
+  const fs = builtin('node:fs')!,
+    path = builtin('node:path')!
+  const addon = entry.addon && path.join(dir, entry.addon)
+  if (addon && fs.existsSync(addon)) {
+    try {
+      return addonEngine(addon, entry.hash, target)
+    } catch (e) {
+      if (e instanceof StartError) throw e
+      console.warn(
+        `[weft] ${target}: the addon didn't load here (${String((e as { message?: unknown }).message).split('\n')[0]})${entry.wasm ? ': using its WASM' : ''}`,
+      )
+    }
+  }
+  if (entry.wasm) return wasmEngine(path.join(dir, entry.wasm), entry.hash, target)
+  throw new StartError(
+    'R104',
+    `\`${target}\` has no addon for ${platform()} and no WASM`,
+    'build on this platform, drop `wasm: false` from `rust.services`, or use `remote()`',
+    { status: 503 },
+  )
+}
+
+function engineFor(name: string, target: string, origin: string) {
+  let loaded: Promise<Engine> | undefined, stamp: string | undefined
+
+  /** The engine for now. Under `weft dev` a rebuild is a new file: the next call loads it, and calls on the old one finish. */
+  function engine(): Promise<Engine> {
+    const fs = builtin('node:fs')!,
+      path = builtin('node:path')!
+    const dir = nativeDir(origin)
+    if (!dir)
+      throw new StartError(
+        'R104',
+        `\`${target}\` has nothing to load here`,
+        'this runtime has no file system, or the build has no `rust/` folder: use `remote()`, or run `weft build`',
+        { status: 503 },
+      )
+    const file = path.join(dir, 'manifest.json')
+    const watching = !!env('WEFT_NATIVE_DIR')
+    // Its text, not its mtime: two writes can land in one tick of a coarse clock.
+    const text: string | undefined =
+      watching && fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : undefined
+    if (loaded && text === stamp) return loaded
+    const entry: Entry | undefined = fs.existsSync(file)
+      ? JSON.parse(text ?? fs.readFileSync(file, 'utf8'))[name]
+      : undefined
+    if (!entry)
+      throw new StartError(
+        'R104',
+        `\`${target}\` isn't in this build`,
+        'run `weft build`, or check `crates/' + name + '`',
+        { status: 503 },
+      )
+    if (entry.failure)
+      throw new StartError(
+        'R103',
+        `\`${target}\` didn't build: ${entry.failure}`,
+        'fix the crate: `weft dev` retries on every edit',
+        { status: 503 },
+      )
+    stamp = text
+    const held = loaded
+    const next = load(dir, entry, target)
+    // A bad build keeps what was serving, as a sidecar's does.
+    loaded = next.catch((e) => {
+      if (held) {
+        loaded = held
+        return held
+      }
+      loaded = undefined
+      throw e
+    })
+    return loaded
+  }
+
+  return engine
+}
+
+/**
+ * A Rust library implementing the functions that point at it, in this process, as `impl: media`. An addon runs each call
+ * on the worker pool, so the event loop stays free; where one can't load, its `.wasm` runs them on this thread. Either
+ * way the declaration, the client and the caches are the same as for `run`.
+ */
+export function createNative(name: string, options: NativeOptions, origin: string): Native {
+  if (!NAME.test(name))
+    throw new StartError(
+      'R104',
+      `\`native('${name}')\` isn't a service name`,
+      "`native('media')`, for the crate at `crates/media`",
+    )
+  const { timeout = DEFAULT_TIMEOUT, claims = defaultClaims, validate = true } = options
+  const target = `native('${name}')`
+  // Before the pool's first use: its default of 4 is a ceiling on calls at once that an app would never think to raise.
+  const proc = nodeHost.process
+  if (proc?.env && !proc.env.UV_THREADPOOL_SIZE)
+    proc.env.UV_THREADPOOL_SIZE = String(
+      Math.max(4, globalThis.navigator?.hardwareConcurrency ?? 4),
+    )
+
+  const engine = engineFor(name, target, origin)
+
+  return {
+    kind: 'native',
+    target: `native://${name}`,
+    service: name,
+    engine: async () => (await engine()).kind,
+    async call({ fn, input, ctx, request }) {
+      const context = JSON.stringify(callContext(fn, ctx, request, timeout, claims))
+      const body = JSON.stringify({ input: (await wire(fn, input)) ?? null })
+      const running = (await engine()).call(fn.$id, context, body)
+      let timer: ReturnType<typeof setTimeout> | undefined
+      const reply =
+        typeof running === 'string'
+          ? running
+          : await Promise.race([
+              running,
+              new Promise<string>((ok) => {
+                timer = setTimeout(ok, timeout, '{"ok":false,"error":{"code":"Deadline"}}')
+              }),
+            ])
+      clearTimeout(timer)
+      return settled(fn, JSON.parse(reply), target, timeout, validate)
+    },
+  }
+}