beam.com 0.1.0-rc.1 → 0.1.0-rc.3

package/README.md

@@ -20,10 +20,10 @@ With `beam.com` you can:
 - **Use Elixir and its tools** from one file: `mix.com`, `iex.com`,
   `elixir.com`. A Phoenix app with SQLite and `phx.gen.auth` runs from
   its source, with no C compiler.
-- **Deploy to Cloudflare Workers, Deno Deploy or a web page**:
-  `beam.com INPUT -o DIR --target wasm32` makes one directory that runs
-  the same program on all three, with a second runtime: ERTS compiled to
-  WebAssembly.
+- **Run the same file on Cloudflare Workers, Deno Deploy or a web page**:
+  the `app.com` of `beam.com INPUT -o app.com` also runs there, with a
+  second runtime: ERTS compiled to WebAssembly, in the npm package
+  `beam.com`.
 
 The file has the compiler, `crypto` and `ssl` (with OpenSSL), SQLite, and
 a WebAssembly runtime (WAMR). It is about 50 MB.
@@ -118,29 +118,81 @@ cd hello && ../mix.com deps.get && ../mix.com ecto.migrate
 ../iex.com -S mix phx.server                     # http://localhost:4000
 ```
 
-Make Cloudflare Workers of a program. The same directory runs on Deno:
-
-```sh
-beam.com examples/worker -o worker --target wasm32
-cd worker
-npx workerd serve worker.capnp                   # test on this computer (Workers)
-deno serve -A deno.js                            # or on Deno
-```
-
 One file runs natively and in the WebAssembly runtime. Each executable of
-`-o` also has its edge part, of 40 to 180 KB (`--no-edge` leaves it out).
+`-o` also has its edge part, of 40 to 180 KB (`--no-edge` leaves it out,
+and `--target wasm32 -o FILE.com` writes only the edge part, with no native
+program).
 A release directory of `mix release` is an input too:
 
 ```sh
 beam.com _build/prod/rel/my_app -o my_app.com     # a Phoenix app
 PHX_SERVER=true ./my_app.com                     # natively
-cd worker && BEAM_APP=../my_app.com deno serve -A deno.js   # the same file on Deno
 ```
 
-The npm package `beam.com` has the runtime for Node.js, and `npx
-beam.com` (see [npm](#npm)).
+The npm package `beam.com` runs the same file on Cloudflare Workers, on
+Deno Deploy, in a web page and in Node.js. See [Deploy to the
+edge](#deploy-to-the-edge).
+
+## Deploy to the edge
+
+A project deploys its `app.com` to Cloudflare Workers and to Deno Deploy
+at each git push, with four small files and the npm package `beam.com`.
+The files do not change from one app to another:
+
+| File | What |
+|---|---|
+| `package.json` | The dev dependencies `beam.com` and `wrangler`, the script `build` (it makes `app.com` with `npx beam.com`), and the script `deploy` (`wrangler deploy`). |
+| `worker.js` | The entry, the same on both hosts. |
+| `wrangler.jsonc` | The name of the Worker, the Data rule for `*.com`, and for a stateful app the Durable Object. |
+| `deno.json` | The `deploy` key of Deno Deploy: `npm install`, `npm run build`, and the entrypoint `worker.js`. |
+
+The entry:
+
+```js
+import app from './app.com' with { type: 'bytes' };
+import { serve } from 'beam.com';
+export { Beam } from 'beam.com';   // stateful only
+
+const beam = serve(app);
+
+export default {
+  fetch(request, env, ctx) {
+    return beam.fetch(request, env, ctx);
+  },
+};
+```
+
+With the Durable Object `Beam` and its binding, the app is stateful: one
+VM serves all the requests, its timers run between requests, and its
+SQLite storage keeps the database. With no binding, it is stateless:
+each isolate runs its own VM. A Phoenix app needs no secret and no
+variable: the VM makes `SECRET_KEY_BASE` one time and keeps it, and
+`PHX_HOST` is the host of the first request.
+
+Test on this computer:
+
+```sh
+npm install && npm run build
+npx wrangler dev                 # Cloudflare Workers, in workerd
+npx deno serve -A worker.js      # Deno
+```
+
+[`examples/phoenix_demo`](examples/phoenix_demo) (stateful) and
+[`examples/worker`](examples/worker) (stateless) are such projects, with
+one-click buttons for both hosts. Copy one to start. See "Deploy at each
+git push" in [`docs/WORKERS.md`](docs/WORKERS.md).
+
+The program does not change. Its HTTP server (Bandit or Cowboy) listens
+with `gen_tcp`, and all of OTP is there. Outgoing HTTP goes through
+`fetch()` of the host, and other TCP through `connect()`. Give the build
+`--cacerts FILE` for HTTPS: the runtime has no root certificates of its
+own.
 
-See "One file, natively and at the edge" in [`docs/WORKERS.md`](docs/WORKERS.md).
+A Worker makes a snapshot of its booted VM at its first boot, and the
+next isolates restore it. For the shortest cold start, the build can
+also make one, and a stateless Worker then restores its VM before the
+first request: see "The snapshot of the build" in
+[`docs/WORKERS.md`](docs/WORKERS.md).
 
 ## Publish on GitHub Pages
 
@@ -166,14 +218,14 @@ jobs:
 ```
 
 Then turn on Pages one time: Settings, Pages, Source "GitHub Actions". The
-`GITHUB_TOKEN` cannot do this step. Until the first release (`v0.1.0`),
-use `@main` in place of `@v0.1.0`: the workflow then uses the `edge`
-build of `beam.com`.
+`GITHUB_TOKEN` cannot do this step. Until the release `v0.1.0`, use the
+release candidate `@v0.1.0-rc.3` in place of `@v0.1.0`. With `@main`, the
+workflow uses the `edge` build of `beam.com`.
 
 The workflow ([`pages-app.yml`](.github/workflows/pages-app.yml)) builds
-the app with `beam.com --target wasm32`, and publishes the static site
-`DIR/page/`. A Mix project with Phoenix becomes a release first
-(`mix.com release`). Its inputs:
+the app with `beam.com INPUT -o DIR --page`, and publishes the static site
+`DIR`: the native file `app.com` and the page that runs it. A Mix project
+with Phoenix becomes a release first (`mix.com release`). Its inputs:
 
 | Input | Default | What |
 |---|---|---|
@@ -201,8 +253,8 @@ NIFs of the WebAssembly runtime. The limits:
   site closes, the data goes, and the next visit starts from the snapshot
   of the boot.
 - No outgoing TCP: a connection of Erlang gets `econnrefused`.
-- The first visit downloads `beam.wasm` (about 6.5 MB) and `release.bin`
-  (3.5 to 14 MB for a Phoenix app).
+- The first visit downloads `beam.wasm` (about 6.5 MB) and the parts of
+  `app.com` that the release needs (about 13 MB for a Phoenix app).
 - The browser needs JSPI: Chrome and Edge 137 or later, or Firefox 153
   or later.
 
@@ -230,6 +282,13 @@ release, and checks its SHA-256 against the value that the package
 holds. Then the file stays in the cache (`~/.cache/beam.com/npm/`). A
 host that only uses the runtime never downloads it.
 
+Each GitHub release from 0.1.0-rc.2 also holds the package, the same
+file as on npm. npm installs it with no registry:
+
+```sh
+npm install https://github.com/sntran/BEAM.com/releases/download/v0.1.0-rc.3/beam.com-0.1.0-rc.3.tgz
+```
+
 - `BEAM_COM`: the path of a `beam.com` to use. Then nothing is
   downloaded.
 - `BEAM_COM_DOWNLOAD`: the URL of a directory with the file `beam.com`,
@@ -268,34 +327,9 @@ The other modules of the package:
 | `beam.com/worker` | The runtime (`worker.js` of Cloudflare Workers). |
 | `beam.com/beam.wasm` | The VM: ERTS built for WebAssembly. |
 
-The same `app.com` runs on Cloudflare Workers, on Deno Deploy and in a
-web page, with the runtime of the package. One entry runs on both hosts:
-
-```js
-import app from './app.com' with { type: 'bytes' };
-import { serve } from 'beam.com';
-export { Beam } from 'beam.com';   // stateful only
-
-const beam = serve(app);
-
-export default {
-  fetch(request, env, ctx) {
-    return beam.fetch(request, env, ctx);
-  },
-};
-```
-
-With the Durable Object `Beam` and its binding, the app is stateful: one
-VM serves all the requests, its timers run between requests, and its
-SQLite storage keeps the database. With no binding, it is stateless:
-each isolate runs its own VM. A project deploys at each git push: the
-build step of the host makes `app.com` (`npx beam.com`), and the host
-runs it. A Phoenix app needs no secret and no variable: the VM
-makes `SECRET_KEY_BASE` one time and keeps it, and `PHX_HOST` is the
-host of the first request. [`examples/phoenix_demo`](examples/phoenix_demo)
-(stateful) and [`examples/worker`](examples/worker) (stateless) are such
-projects, with one-click buttons for both hosts. See "Deploy at
-each git push" in [`docs/WORKERS.md`](docs/WORKERS.md).
+The same `app.com` runs on Cloudflare Workers and Deno Deploy with
+`serve(app)` (see [Deploy to the edge](#deploy-to-the-edge)), and in a
+web page with `main.js` of the package.
 
 The release job of CI makes the generated part of the package
 (`runtime/`, with `scripts/npm.sh`) and publishes it with each tag `v*`.
@@ -313,7 +347,7 @@ the Erlang shell in your browser is at
 |---|---|
 | [`docs/PROGRAMS.md`](docs/PROGRAMS.md) | Run and build programs: the inputs, Hex packages, command line programs, native files (`--target`), distributed Erlang, a release in the zip, debugging. |
 | [`docs/ELIXIR.md`](docs/ELIXIR.md) | Elixir programs, the tools (`mix`, `iex`, `elixir`), Phoenix from source, the file watcher. |
-| [`docs/WORKERS.md`](docs/WORKERS.md) | Cloudflare Workers, Deno Deploy and web pages (`--target wasm32`): Durable Objects, Ecto SQLite, snapshots, tenants, limits. |
+| [`docs/WORKERS.md`](docs/WORKERS.md) | Cloudflare Workers, Deno Deploy and web pages: `app.com` with the npm package, Durable Objects, Ecto SQLite, HTTP through `fetch()`, snapshots, tenants, static sites (`--page`), and limits. |
 | [`docs/NOTEBOOKS.md`](docs/NOTEBOOKS.md) | The documentation as notebooks that run in your browser: a tour of beam.com, the WebAssembly VM, the anatomy of the file, WebAssembly programs, hosts and storage, networking, and building programs. |
 | [`docs/LIBRARIES.md`](docs/LIBRARIES.md) | Crypto and TLS, SQLite, and WebAssembly in Erlang code. |
 | [`docs/SANDBOX.md`](docs/SANDBOX.md) | `--allow-read`, `--allow-write`, `--allow-net`, `--allow-run`: a program that gives up what it does not need. |

package/js/beam.com.mjs

@@ -1,11 +1,86 @@
 #!/usr/bin/env node
 // npx beam.com ARGS: beam.com of the version of this package, with ARGS
 // (download.mjs). For example: npx beam.com app.erl -o app.com
+//
+// npx beam.com --snapshot APP.com [-o FILE] [--full] [--warm PATH]...
+// [--env NAME=VALUE]... [--no-compress]: the snapshot of the build of
+// APP.com for serve(app, { snapshot }) of a Worker (snapshot() of
+// node.mjs), in FILE (default APP.snapshot), with its pages in gzip (not
+// with --full: the global scope of a Worker cannot inflate). Give
+// the BEAM_ERL_FLAGS of the Worker with --env, or in the vars of
+// wrangler.jsonc of this directory: a Worker with other flags boots in
+// place of the snapshot. It runs here, with no download of beam.com.
 import { spawn } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { closeSync, openSync, readFileSync, readSync, statSync, writeFileSync } from 'node:fs';
 import { constants } from 'node:os';
 import { command, ensure } from './download.mjs';
 
+if (process.argv[2] === '--snapshot') {
+  try {
+    await snapshotCommand(process.argv.slice(3));
+    process.exit(0);
+  } catch (e) {
+    console.error(`beam.com: ${e.message}`);
+    process.exit(1);
+  }
+}
+
+async function snapshotCommand(args) {
+  const opts = { env: {}, warm: [], kind: 'boot-point' };
+  let app = null, out = null;
+  while (args.length) {
+    const a = args.shift();
+    const value = () => {
+      if (!args.length) throw new Error(`${a} needs a value`);
+      return args.shift();
+    };
+    if (a === '-o') out = value();
+    else if (a === '--full') opts.kind = 'full';
+    else if (a === '--no-compress') opts.compress = false;
+    else if (a === '--warm') opts.warm.push(value());
+    else if (a === '--env') {
+      const v = value(), at = v.indexOf('=');
+      if (at < 1) throw new Error(`--env ${v}: not NAME=VALUE`);
+      opts.env[v.slice(0, at)] = v.slice(at + 1);
+    } else if (!a.startsWith('-') && !app) app = a;
+    else throw new Error(`--snapshot: unknown argument ${a}`);
+  }
+  if (!app) throw new Error('usage: npx beam.com --snapshot APP.com [-o FILE] [--full] [--warm PATH]... [--env NAME=VALUE]... [--no-compress]');
+  if (opts.warm.length && opts.kind !== 'full') throw new Error('--warm is for a full snapshot (--full)');
+  out ??= app.replace(/\.com$/, '') + '.snapshot';
+  // The flags of the Worker, when --env does not give them: the vars of
+  // its wrangler.jsonc. A Worker with other flags boots in place of the
+  // snapshot.
+  let source = '--env';
+  if (opts.env.BEAM_ERL_FLAGS === undefined) {
+    const { wranglerVars } = await import('./wrangler.mjs');
+    const w = wranglerVars('.');
+    if (typeof w?.vars.BEAM_ERL_FLAGS === 'string') {
+      opts.env.BEAM_ERL_FLAGS = w.vars.BEAM_ERL_FLAGS;
+      source = w.file;
+    }
+  }
+  const { snapshot } = await import('./node.mjs');
+  const t0 = performance.now();
+  const bytes = await snapshot(app, opts);
+  writeFileSync(out, bytes);
+  const flags = (opts.env.BEAM_ERL_FLAGS ?? '').split(/\s+/).filter(Boolean).join(' ');
+  console.error(`beam.com: wrote ${out} (${(bytes.length / 1048576).toFixed(1)} MB, ${opts.kind}, `
+    + `BEAM_ERL_FLAGS "${flags}"${flags ? ` of ${source}` : ''}, in ${Math.round(performance.now() - t0)} ms)`);
+  if (!flags) console.error('beam.com: a Worker with BEAM_ERL_FLAGS boots in place of this snapshot: give its flags with --env BEAM_ERL_FLAGS=..., or in the vars of wrangler.jsonc');
+  // A Worker can be at most 64 MiB, with all its modules (gzip does not
+  // count): the app file and the snapshot are most of it.
+  const total = statSync(app).size + bytes.length;
+  if (total > 56 * 1048576) {
+    // An APE file starts with "MZ"; a file of --target wasm32 is a zip.
+    const head = Buffer.alloc(2), fd = openSync(app, 'r');
+    try { readSync(fd, head, 0, 2, 0); } finally { closeSync(fd); }
+    const native = head.toString() === 'MZ';
+    console.error(`beam.com: warning: ${app} and ${out} are ${(total / 1048576).toFixed(1)} MiB, and a Worker can be at most 64 MiB`
+      + (native ? `. Build the app with -o FILE.com --target wasm32: a file with no native program, about 25 MB smaller` : ''));
+  }
+}
+
 let release = null;
 try {
   release = JSON.parse(readFileSync(new URL('../runtime/release.json', import.meta.url), 'utf8'));

package/js/download.mjs

@@ -14,6 +14,9 @@ import path from 'node:path';
 
 export const REPOSITORY = 'sntran/BEAM.com';
 
+// The time with no bytes that stops a download (ms).
+const IDLE = 60000;
+
 // The cache directory of beam.com (beam_com:cache_dir/0).
 export function cacheDir(env = process.env) {
   if (env.BEAM_COM_CACHE) return env.BEAM_COM_CACHE;
@@ -37,7 +40,8 @@ export function downloadUrl({ version }, env = process.env) {
 
 // The path of a beam.com that runs. The file in the cache was checked when
 // it was downloaded: a file is in the cache only after the check.
-export async function ensure(release, { env = process.env, platform = process.platform, fetch = globalThis.fetch, log = () => {} } = {}) {
+// idle: the download stops when no bytes come in this time (ms).
+export async function ensure(release, { env = process.env, platform = process.platform, fetch = globalThis.fetch, log = () => {}, idle = IDLE } = {}) {
   if (env.BEAM_COM) return env.BEAM_COM;
   if (!release?.version || !/^[0-9a-f]{64}$/.test(release?.sha256 ?? '')) {
     throw new Error('this package has no release of beam.com (runtime/release.json): set BEAM_COM to the path of a beam.com');
@@ -46,16 +50,36 @@ export async function ensure(release, { env = process.env, platform = process.pl
   if (fs.existsSync(file)) return file;
   const url = downloadUrl(release, env);
   log(`beam.com: downloading ${url}`);
-  const response = await fetch(url);
-  if (!response.ok) throw new Error(`beam.com: ${url}: status ${response.status}`);
+  const ac = new AbortController();
+  let timer;
+  const wait = () => {
+    clearTimeout(timer);
+    timer = setTimeout(() => ac.abort(new Error(`beam.com: ${url}: no bytes in ${idle / 1000} s`)), idle);
+  };
+  wait();
+  let response;
+  try {
+    response = await fetch(url, { signal: ac.signal });
+  } catch (e) {
+    clearTimeout(timer);
+    throw ac.signal.aborted ? ac.signal.reason : e;
+  }
+  if (!response.ok) {
+    clearTimeout(timer);
+    throw new Error(`beam.com: ${url}: status ${response.status}`);
+  }
   fs.mkdirSync(path.dirname(file), { recursive: true });
   const part = `${file}.${process.pid}.part`;
   const out = fs.createWriteStream(part, { mode: 0o755 });
+  // An error of the file (a full disk): no drain comes after it.
+  const failed = new Promise((_, reject) => out.once('error', reject));
+  failed.catch(() => {});
   const hash = createHash('sha256');
   try {
     for await (const chunk of response.body) {
+      wait();
       hash.update(chunk);
-      if (!out.write(chunk)) await new Promise((r) => out.once('drain', r));
+      if (!out.write(chunk)) await Promise.race([new Promise((r) => out.once('drain', r)), failed]);
     }
     await new Promise((resolve, reject) => out.end((e) => (e ? reject(e) : resolve())));
     const got = hash.digest('hex');
@@ -64,7 +88,10 @@ export async function ensure(release, { env = process.env, platform = process.pl
     }
     fs.chmodSync(part, 0o755);
     fs.renameSync(part, file);
+  } catch (e) {
+    throw ac.signal.aborted ? ac.signal.reason : e;
   } finally {
+    clearTimeout(timer);
     out.destroy();
     fs.rmSync(part, { force: true });
   }

package/js/node.mjs

@@ -47,8 +47,9 @@ export function release(app) {
   return readApp(app, appRelease);
 }
 
-// The release of app with get (appRelease, or appFiles: no copy).
-async function readApp(app, get) {
+// The release of app with get (appRelease, or appFiles: no copy), and the
+// options of get.
+async function readApp(app, get, options = {}) {
   const file = await fs.open(app);
   try {
     const { size } = await file.stat();
@@ -57,7 +58,7 @@ async function readApp(app, get) {
       const { bytesRead } = await file.read(b, 0, n, at);
       return b.subarray(0, bytesRead);
     };
-    return await get(read, size, { runtime: runtimeId });
+    return await get(read, size, { ...options, runtime: runtimeId });
   } finally {
     await file.close();
   }
@@ -66,10 +67,65 @@ async function readApp(app, get) {
 // The VM of an app.com, when it is ready. env: the variables of the VM.
 // There is no cache for snapshots in Node.js, so BEAM_SNAPSHOT is "off".
 // The VM keeps its state between requests (plain: false), as in Deno.
-export async function boot(app, { env = {} } = {}) {
-  const bin = await readApp(app, appFiles);
+// statics: false keeps the static files of a Phoenix app in the VM, as
+// serve(app) of a Worker does.
+export async function boot(app, { env = {}, statics = true } = {}) {
+  const bin = await readApp(app, appFiles, { statics });
   const { Vm } = await import(new URL('worker.js', runtimeUrl).href);
   const vm = new Vm({ BEAM_SNAPSHOT: 'off', ...env }, { release: bin, plain: false });
   await vm.ready;
   return vm;
 }
+
+// A snapshot of the build of an app.com, for serve(app, { snapshot }) of a
+// Worker (npx beam.com --snapshot). kind:
+// - 'boot-point' (the default): the VM loaded the modules of its boot, and
+//   the program did not start. It holds no variable of the app: each VM
+//   starts the program with the variables of its host.
+// - 'full': the VM after its boot and the warm-up requests (warm, paths).
+//   It holds the variables of env and the state of the program. A Phoenix
+//   app must give SECRET_KEY_BASE and PHX_HOST, and an app with Ecto
+//   SQLite cannot use it (its boot changes the database).
+// The header of the snapshot keeps BEAM_ERL_FLAGS of env: a Worker with
+// other flags boots in place of the snapshot. compress gives the pages in
+// gzip (BEAMSNZ1, about a quarter of the size). It is the default at the
+// boot point. A full snapshot has no gzip by default: a stateless Worker
+// restores it in the global scope, which cannot inflate.
+// Gives the bytes of the snapshot.
+export async function snapshot(app, { env = {}, warm = [], kind = 'boot-point', compress = kind !== 'full' } = {}) {
+  if (kind !== 'boot-point' && kind !== 'full') throw new Error(`the kind of snapshot is boot-point or full, not ${kind}`);
+  const bin = await readApp(app, appFiles);
+  const { Vm, releaseMeta, packSnapshot } = await import(new URL('worker.js', runtimeUrl).href);
+  const meta = releaseMeta(bin);
+  if (kind === 'full') {
+    if (meta.sql) throw new Error(`${app}: the app has Ecto SQLite: use a snapshot at the boot point`);
+    const missing = ['SECRET_KEY_BASE', 'PHX_HOST'].filter((k) => meta.env?.PHX_SERVER === 'true' && !env[k]);
+    if (missing.length) throw new Error(`${app}: a full snapshot of a Phoenix app needs ${missing.join(' and ')}`);
+  }
+  const vm = new Vm({ BEAM_SNAPSHOT: 'off', ...env }, { release: bin, plain: false, capture: kind });
+  let bytes;
+  if (kind === 'boot-point') {
+    // wasm_host says "ready", and then it stops at the boot point. A boot
+    // that fails rejects ready.
+    let timer;
+    const late = new Promise((resolve, reject) => {
+      timer = setTimeout(() => reject(new Error(`${app}: the VM did not stop at the boot point in 120 s`)), 120000);
+    });
+    try {
+      bytes = await Promise.race([vm.captured, vm.ready.then(() => vm.captured), late]);
+    } finally {
+      clearTimeout(timer);
+    }
+  } else {
+    await vm.ready;
+    await vm.listening(Number(env.PORT ?? meta.env?.PORT ?? 4000));
+    for (const path of warm) {
+      const r = await vm.fetch(new Request(new URL(path, 'http://localhost')));
+      await r.arrayBuffer();
+      if (r.status >= 500) throw new Error(`${app}: the warm-up request ${path} gave ${r.status}`);
+    }
+    bytes = await vm.snapshot(false);
+  }
+  if (!(bytes instanceof Uint8Array)) throw new Error(`${app}: no snapshot (${bytes}): the VM was not quiet`);
+  return compress ? packSnapshot(bytes) : bytes;
+}

package/js/wrangler.mjs

@@ -0,0 +1,47 @@
+// The vars of the Wrangler file of a project (wrangler.jsonc, else
+// wrangler.json), for npx beam.com --snapshot: the snapshot gets the
+// BEAM_ERL_FLAGS of the Worker. Wrangler reads JSONC: comments (// and
+// /* */) and a comma before } or ]. wrangler.toml is not read.
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// {file, vars} of the first Wrangler file of dir, or null.
+export function wranglerVars(dir = '.') {
+  for (const name of ['wrangler.jsonc', 'wrangler.json']) {
+    let text;
+    try {
+      text = readFileSync(join(dir, name), 'utf8');
+    } catch {
+      continue;
+    }
+    const vars = jsonc(text).vars;
+    return { file: name, vars: vars && typeof vars === 'object' ? vars : {} };
+  }
+  return null;
+}
+
+// The value of a JSONC text.
+export function jsonc(text) {
+  let out = '';
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (c === '"') {
+      // A string, with its escapes, as it is.
+      let j = i + 1;
+      while (j < text.length && text[j] !== '"') j += text[j] === '\\' ? 2 : 1;
+      out += text.slice(i, j + 1);
+      i = j;
+    } else if (c === '/' && text[i + 1] === '/') {
+      while (i < text.length && text[i] !== '\n') i++;
+      out += '\n';
+    } else if (c === '/' && text[i + 1] === '*') {
+      const end = text.indexOf('*/', i + 2);
+      i = end < 0 ? text.length : end + 1;
+      out += ' ';
+    } else {
+      out += c;
+    }
+  }
+  // A comma before } or ] (outside the strings, which have no newline).
+  return JSON.parse(out.replace(/,(\s*[}\]])/g, '$1'));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beam.com",
-  "version": "0.1.0-rc.1",
+  "version": "0.1.0-rc.3",
   "description": "Erlang/OTP and Elixir in one executable file: npx beam.com, and the WebAssembly runtime for a native app.com",
   "license": "Apache-2.0",
   "repository": {

package/runtime/app-com.js

@@ -111,7 +111,8 @@ function gzipOf(raw, e) {
 }
 
 // The data of the entry e, in span (the bytes of the file from offset base).
-async function entryData(span, base, e) {
+// unzip: the inflate of a deflated entry.
+async function entryData(span, base, e, unzip = inflate) {
   const h = e.offset - base;
   if (h < 0 || h + 30 > span.length || u32(span, h) !== LOCAL) fail(`${e.name}: no local header`);
   const start = h + 30 + u16(span, h + 26) + u16(span, h + 28);
@@ -120,7 +121,7 @@ async function entryData(span, base, e) {
   if (e.method === DEFLATED && e.name.endsWith('.beam')) return gzipOf(raw, e);
   let d;
   if (e.method === STORED) d = raw;
-  else if (e.method === DEFLATED) d = await inflate(raw);
+  else if (e.method === DEFLATED) d = await unzip(raw);
   else fail(`${e.name}: the compression method ${e.method} is not supported`);
   if (d.length !== e.size || crc32(d) !== e.crc) fail(`${e.name}: the CRC-32 does not match`);
   return d;
@@ -134,7 +135,10 @@ export async function appRelease(read, size, options = {}) {
   return pack(meta, files);
 }
 
-export async function appFiles(read, size, { runtime, statics: split = true } = {}) {
+// options.inflate: the inflate of a deflated entry, (raw) => bytes. The
+// default uses DecompressionStream, which the global scope of a Worker
+// cannot use (cloudflare/release.js gives inflateRawSync of node:zlib).
+export async function appFiles(read, size, { runtime, statics: split = true, inflate: unzip = inflate } = {}) {
   const { entries, cdAt } = await zipEntries(read, size);
   const want = entries.filter((e) => inRelease(e.name) && !e.name.endsWith('/'));
   const json = want.find((e) => e.name === `${EDGE}.release.json`);
@@ -143,7 +147,7 @@ export async function appFiles(read, size, { runtime, statics: split = true } =
   const lo = Math.min(...want.map((e) => e.offset));
   const span = await read(lo, cdAt - lo);
   if (span.length !== cdAt - lo) fail('a short read of the release');
-  const meta = await entryData(span, lo, json);
+  const meta = await entryData(span, lo, json, unzip);
   const release = JSON.parse(text.decode(meta));
   if (runtime && release.runtime !== runtime) {
     fail(`it was built for the runtime ${String(release.runtime).slice(0, 12)}, and this runtime is ${runtime.slice(0, 12)}: `
@@ -164,9 +168,9 @@ export async function appFiles(read, size, { runtime, statics: split = true } =
       statics.set(e.name.slice(prefix.length - 1), staticEntry(span, lo, e));
       continue;
     }
-    files.set(e.name, await entryData(span, lo, e));
+    files.set(e.name, await entryData(span, lo, e, unzip));
   }
-  for (const e of want) if (e.name.startsWith(EDGE) && e !== json) files.set(e.name.slice(EDGE.length), await entryData(span, lo, e));
+  for (const e of want) if (e.name.startsWith(EDGE) && e !== json) files.set(e.name.slice(EDGE.length), await entryData(span, lo, e, unzip));
   const list = [...files];
   return {
     meta, files: list, statics,