peachsim 0.1.1635 → 0.1.1640

package/src/swift-submit.ts

@@ -20,6 +20,7 @@
  * Browser-safe: node-only submitters live beside their call sites.
  */
 
+import { isRecord } from './is-record'
 import {
   isSwiftMetalLibrarySources,
   type SwiftMetalLibrarySource,
@@ -108,7 +109,8 @@ export const MAX_SWIFT_COMPILE_IMAGE_TOTAL_BYTES = 16 * 1024 * 1024
 // 45: confirmation dialogs present from a measured `presentationSource`, and a
 // refreshable's pull ends on the host's `refreshEnded` request.
 // 46: ImageRenderer produces shared CoreGraphics pixels through the isolated raster host.
-export const SWIFT_HOST_ABI = 46
+// 47: backing-layer masks composite the view, border and children through mask alpha.
+export const SWIFT_HOST_ABI = 47
 
 export interface SwiftImageUpload {
   /** the raster file picked for the asset (has the extension). */
@@ -294,10 +296,6 @@ export function httpSwiftCompileSubmit(
   }
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
 export function isSwiftNativeModules(value: unknown): value is SwiftNativeModules {
   return (
     isRecord(value) &&

package/src/swift-toolchain.ts

@@ -10,6 +10,7 @@ import { createHash } from 'node:crypto'
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 /** swiftpm's SDK directory option, shared by discovery and compilation. */
 export function swiftSdkOptions(): string[] {
@@ -18,20 +19,20 @@ export function swiftSdkOptions(): string[] {
 }
 
 // host archives include the official driver/runtime and the qualified patched frontend.
-export const SWIFT_HOST_COMPILER_RELEASE = 'swift-6.4.0-RELEASE-custom-91504a66b3f012ac'
-export const SWIFT_HOST_COMPILER_ID = '91504a66b3f012ac'
+export const SWIFT_HOST_COMPILER_RELEASE = 'swift-6.4.0-RELEASE-custom-0d775d32d7c74eae'
+export const SWIFT_HOST_COMPILER_ID = '0d775d32d7c74eae'
 const compilerArchives: Record<string, { checksum: string; manifest: string }> = {
   'darwin-arm64': {
-    checksum: '5d0ecbafd88c896beac74fd74c9d5fb20f973e0f58abbc1d2f27d5af0cbc4e59',
-    manifest: '827130a60b782ed413c9df41410afe7baf32dcb132b945a70ac0ff4c0594c690',
+    checksum: '957e85486f92327ee5cf8d3c5bb9336d17ab80145c87645c637c49130a50477a',
+    manifest: 'c63e2f81694e8d8ad046d10c71d0638dbae4e5a36601294ed670988d1cb5b6f1',
   },
   'linux-x64': {
-    checksum: '9d8491107efa347ccadf5f6974e80b2cff2b33cd8c34317dab777c5542512b3e',
-    manifest: '6221c024fa86b2201dcada23d9e13f6a11d7450cf22164a9708703f992de129f',
+    checksum: '6302230fb126b79c9af5fc2bc0208a936bb573c343da7ae949c5c1687e761cd2',
+    manifest: '31b507a6a8648a2266a187b9fed092e29a63cae99d57c5defdf2e82a7cbbc113',
   },
   'linux-arm64': {
-    checksum: '14f5c7b39b1e36a1d9ce426a875676182fdb5247763a7e99cb72f74957bc0d9a',
-    manifest: '57ff31b79f9b3d9a6c0fd51c73271cdd88088522c0fc6d7a28ade03d68008b68',
+    checksum: '9b40d39ea5ba82fd9a417868f0a449f5e98e37cf83acaac9cedd3a8b8d91a218',
+    manifest: 'fe07a29d4f4374cad47b29de70e90aa2e3b7664e08c8b53d304585e65637da24',
   },
 }
 
@@ -65,10 +66,12 @@ export function swiftCompilerRelease(release: string): string {
 
 /**
  * the bin directory of the toolchain for `release`, unverified. macOS: the
- * Xcode Toolchains directory, the user's before the system's. Linux: a
- * builder's `$CONTRAST_SWIFT_TOOLCHAINS/<release>`
+ * Xcode Toolchains directory, the user's before the system's. Linux:
+ * `$CONTRAST_SWIFT_TOOLCHAINS/<release>` when set
  * (packages/sootsim-swift/scripts/install-linux-toolchain.sh fills it), else
- * the cf-build image's `/opt/swift/<release>`, else the `swift` first on PATH.
+ * the cf-build image's `/opt/swift/<release>` when present, else a pinned
+ * compiler's user-writable `$PEACH_HOME/swift/toolchains/<release>`, else the
+ * `swift` first on PATH.
  */
 export function swiftToolchainBin(release: string): string {
   if (process.platform === 'darwin') {
@@ -81,8 +84,9 @@ export function swiftToolchainBin(release: string): string {
     return path.join(process.env.CONTRAST_SWIFT_TOOLCHAINS, release, 'usr/bin')
   }
   const image = path.join('/opt/swift', release, 'usr/bin')
-  if (release.includes('-custom-') || fs.existsSync(path.join(image, 'swift')))
-    return image
+  if (fs.existsSync(path.join(image, 'swift'))) return image
+  if (release.includes('-custom-'))
+    return path.join(peachHome(), 'swift', 'toolchains', release, 'usr/bin')
   return (
     (process.env.PATH ?? '')
       .split(path.delimiter)
@@ -90,6 +94,106 @@ export function swiftToolchainBin(release: string): string {
   )
 }
 
+// home-paths.ts's rnxHomeDir, repeated because this file imports node builtins only.
+function peachHome(): string {
+  const override = process.env.PEACH_HOME
+  return override ? path.resolve(override) : path.join(os.homedir(), '.peach')
+}
+
+let scratch: string | undefined
+let swiftHome: string | undefined
+/**
+ * keep the temporary files swift processes write (swiftpm's lock files and
+ * TemporaryDirectory folders, which it never removes) in a per-process
+ * directory under `root`, removed when this process exits, and on linux its
+ * home directory in `root/home`, kept so the caches persist. directories left
+ * by processes that no longer run are removed first. without this call swift
+ * inherits the caller's TMPDIR.
+ */
+export function confineSwiftScratch(root: string): void {
+  if (scratch) return
+  fs.mkdirSync(root, { recursive: true })
+  for (const name of fs.readdirSync(root)) {
+    const pid = Number(name)
+    if (Number.isInteger(pid) && pid > 0 && !processRuns(pid))
+      fs.rmSync(path.join(root, name), { recursive: true, force: true })
+  }
+  const dir = path.join(root, String(process.pid))
+  fs.mkdirSync(dir, { recursive: true })
+  scratch = dir
+  // swiftpm and clang write ~/.swiftpm and ~/.cache even with every path flag
+  // given; on linux no tool needs the real home, so they get a kept one here.
+  if (process.platform === 'linux') {
+    swiftHome = path.join(root, 'home')
+    fs.mkdirSync(swiftHome, { recursive: true })
+  }
+  // swiftpm makes ~/.swiftpm in the account's passwd home whatever HOME says;
+  // remove at exit only the entries swiftpm seeds there that were absent now:
+  // a cache link into a swiftpm cache folder and empty configuration and
+  // security folders. anything else, a link or file a user made included, stays.
+  const seeded = path.join(os.homedir(), '.swiftpm')
+  const dirAbsentBefore = lstatIfKnown(seeded) === null
+  const absentBefore = swiftpmSeeds.filter(
+    (name) => lstatIfKnown(path.join(seeded, name)) === null,
+  )
+  process.once('exit', () => {
+    fs.rmSync(dir, { recursive: true, force: true })
+    for (const name of absentBefore) removeSwiftpmSeed(path.join(seeded, name), name)
+    if (dirAbsentBefore && lstatIfKnown(seeded)?.isDirectory())
+      try {
+        fs.rmdirSync(seeded)
+      } catch {}
+  })
+}
+
+const swiftpmSeeds = ['cache', 'configuration', 'security']
+
+// only a missing path establishes absence; other lookup failures stay unknown.
+function lstatIfKnown(entry: string): fs.Stats | null | undefined {
+  try {
+    return fs.lstatSync(entry)
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') return null
+    return undefined
+  }
+}
+
+function removeSwiftpmSeed(entry: string, name: string): void {
+  const stat = lstatIfKnown(entry)
+  if (!stat) return
+  try {
+    if (name === 'cache') {
+      if (
+        stat.isSymbolicLink() &&
+        fs.readlinkSync(entry).endsWith('/.cache/org.swift.swiftpm')
+      )
+        fs.unlinkSync(entry)
+    } else if (stat.isDirectory()) {
+      fs.rmdirSync(entry)
+    }
+  } catch {}
+}
+
+function processRuns(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    return error instanceof Error && 'code' in error && error.code === 'EPERM'
+  }
+}
+
+/** the environment every swift process runs with: `base`, with TMPDIR in the
+ *  confined scratch directory when the caller set one. */
+export function swiftEnvironment(
+  base: NodeJS.ProcessEnv = process.env,
+): NodeJS.ProcessEnv {
+  if (!scratch) return base
+  return swiftHome
+    ? { ...base, TMPDIR: scratch, HOME: swiftHome }
+    : { ...base, TMPDIR: scratch }
+}
+
 /** the wasm SDK a release compiles with: its installed id, where it
  *  downloads from and its archive checksum (packages/sootsim-swift/toolchain.json). */
 export interface SwiftWasmSdk {
@@ -98,17 +202,13 @@ export interface SwiftWasmSdk {
   wasmSdkChecksum: string
 }
 
-const verified = new Map<string, string>()
-
 /**
  * swiftToolchainBin, checked: its swift is exactly `release` and has the
  * pinned wasm SDK installed. anything else fails with one message naming the
  * release and the commands that install it.
  */
 export function swiftToolchain(release: string, sdk: SwiftWasmSdk): string {
-  const key = JSON.stringify([release, sdk.wasmSdkId, swiftSdkOptions()])
-  const cached = verified.get(key)
-  if (cached) return cached
+  validateSwiftSdkIdentity(sdk)
   let bin: string
   try {
     bin = swiftCompiler(release)
@@ -121,17 +221,218 @@ export function swiftToolchain(release: string, sdk: SwiftWasmSdk): string {
   const swift = path.join(bin, 'swift')
   const sdks = execFileSync(swift, ['sdk', 'list', ...swiftSdkOptions()], {
     encoding: 'utf8',
+    env: swiftEnvironment(),
     stdio: ['ignore', 'pipe', 'pipe'],
   })
   if (!sdks.split('\n').some((line) => line.trim() === sdk.wasmSdkId)) {
     throw new Error(
-      `peach compiles Swift with the ${sdk.wasmSdkId} SDK, which ${swift} does not have.\n${swiftInstallSteps(release, sdk)}`,
+      `peach compiles Swift with the ${sdk.wasmSdkId} SDK, which ${swift} does not have.\n${swiftSdkInstallStep(release, sdk)}`,
     )
   }
-  verified.set(key, bin)
+  try {
+    verifySwiftSdk(swift, sdk)
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error)
+    throw new Error(`${reason}\n${swiftSdkInstallStep(release, sdk)}`)
+  }
   return bin
 }
 
+// swiftpm's info.json describes SDK selection, not the archive it came from.
+function validateSwiftSdkIdentity(sdk: SwiftWasmSdk): void {
+  if (
+    !/^[a-zA-Z0-9._-]+$/.test(sdk.wasmSdkId) ||
+    !/^[a-f0-9]{64}$/.test(sdk.wasmSdkChecksum)
+  )
+    throw new Error('invalid Swift SDK identity or checksum')
+}
+
+function swiftSdkBundle(swift: string, id: string, options: string[]): string {
+  const configuration = execFileSync(
+    swift,
+    ['sdk', 'configure', ...options, '--show-configuration', id, 'wasm32-unknown-wasip1'],
+    { encoding: 'utf8', env: swiftEnvironment(), stdio: ['ignore', 'pipe', 'pipe'] },
+  )
+  const sysroot = /^sdkRootPath: (.+)$/m.exec(configuration)?.[1]?.trim()
+  if (!sysroot || !path.isAbsolute(sysroot))
+    throw new Error(`Swift SDK ${id} reports no absolute sdkRootPath`)
+  let bundle = sysroot
+  while (!bundle.endsWith('.artifactbundle')) {
+    const parent = path.dirname(bundle)
+    if (parent === bundle)
+      throw new Error(`Swift SDK ${id} is outside an artifact bundle`)
+    bundle = parent
+  }
+  return fs.realpathSync(bundle)
+}
+
+// stat changes invalidate file hashes; every lookup enumerates the entire bundle,
+// including additions, removals, executable modes and internal symlink targets.
+const sdkFileHashes = new Map<string, { stamp: string; checksum: string }>()
+function swiftSdkPayloadChecksum(bundle: string): string {
+  const hash = createHash('sha256')
+  function visit(relative: string): void {
+    const file = path.join(bundle, relative)
+    const stat = fs.lstatSync(file, { bigint: true })
+    if (stat.isSymbolicLink()) {
+      const resolved = path.relative(bundle, fs.realpathSync(file))
+      if (
+        resolved === '..' ||
+        resolved.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(resolved)
+      )
+        throw new Error(`Swift SDK symlink escapes its bundle: ${relative}`)
+      hash.update(JSON.stringify([relative, 'link', fs.readlinkSync(file)]) + '\n')
+    } else if (stat.isDirectory()) {
+      hash.update(JSON.stringify([relative, 'directory']) + '\n')
+      for (const name of fs.readdirSync(file).sort()) visit(path.join(relative, name))
+    } else if (stat.isFile()) {
+      const stamp = [stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].join(':')
+      let cached = sdkFileHashes.get(file)
+      if (cached?.stamp !== stamp) {
+        cached = { stamp, checksum: swiftFileChecksum(file) }
+        sdkFileHashes.set(file, cached)
+      }
+      hash.update(
+        JSON.stringify([relative, 'file', Number(stat.mode & 0o111n), cached.checksum]) +
+          '\n',
+      )
+    } else throw new Error(`unsupported Swift SDK payload entry: ${relative}`)
+  }
+  visit('')
+  return hash.digest('hex')
+}
+
+function swiftSdkVerificationFile(bundle: string, sdk: SwiftWasmSdk): string {
+  return path.join(
+    path.dirname(bundle),
+    '.peach-sdk-checksums',
+    `${sdk.wasmSdkId}-${sdk.wasmSdkChecksum}.json`,
+  )
+}
+
+function verifySwiftSdk(swift: string, sdk: SwiftWasmSdk): void {
+  const bundle = swiftSdkBundle(swift, sdk.wasmSdkId, swiftSdkOptions())
+  const file = swiftSdkVerificationFile(bundle, sdk)
+  if (!fs.existsSync(file))
+    throw new Error(
+      `Swift SDK ${sdk.wasmSdkId} has no verified archive binding for ${sdk.wasmSdkChecksum}. Hydrate it with installSwiftWasmSdk before compiling.`,
+    )
+  const receipt: unknown = JSON.parse(fs.readFileSync(file, 'utf8'))
+  if (
+    !receipt ||
+    typeof receipt !== 'object' ||
+    !('wasmSdkId' in receipt) ||
+    receipt.wasmSdkId !== sdk.wasmSdkId ||
+    !('wasmSdkChecksum' in receipt) ||
+    receipt.wasmSdkChecksum !== sdk.wasmSdkChecksum ||
+    !('payloadChecksum' in receipt) ||
+    receipt.payloadChecksum !== swiftSdkPayloadChecksum(bundle)
+  )
+    throw new Error(
+      `Swift SDK ${sdk.wasmSdkId} installed payload differs from its verified archive ${sdk.wasmSdkChecksum}`,
+    )
+}
+
+/** install or qualify existing bytes, serializing shared-store mutation without replacement. */
+function installSwiftSdkArchive(swift: string, sdk: SwiftWasmSdk, archive: string): void {
+  validateSwiftSdkIdentity(sdk)
+  const staging = fs.realpathSync(
+    fs.mkdtempSync(path.join(scratch ?? os.tmpdir(), 'peach-sdk-verification-')),
+  )
+  try {
+    if (swiftFileChecksum(archive) !== sdk.wasmSdkChecksum)
+      throw new Error('declared Swift SDK archive checksum mismatch')
+    const store = path.join(staging, 'sdks')
+    fs.mkdirSync(store)
+    execFileSync(
+      swift,
+      [
+        'sdk',
+        'install',
+        archive,
+        '--checksum',
+        sdk.wasmSdkChecksum,
+        '--swift-sdks-path',
+        store,
+      ],
+      { env: swiftEnvironment(), stdio: 'inherit' },
+    )
+    const stagedBundle = swiftSdkBundle(swift, sdk.wasmSdkId, [
+      '--swift-sdks-path',
+      store,
+    ])
+    const expected = swiftSdkPayloadChecksum(stagedBundle)
+    const directory = process.env.PEACH_SWIFT_SDKS_PATH
+    const locks = directory
+      ? path.join(path.resolve(directory), '.peach-locks')
+      : path.join(os.homedir(), '.swiftpm', 'builder-locks')
+    fs.mkdirSync(locks, { recursive: true })
+    execFileSync(
+      'perl',
+      [
+        '-e',
+        'use Fcntl qw(:flock); my ($lock, $id, $bundle, $swift, @options) = @ARGV; open(my $fd, ">>", $lock) or die $!; flock($fd, LOCK_EX) or die $!; open(my $list, "-|", $swift, "sdk", "list", @options) or die $!; my $found = 0; while (<$list>) { s/^\\s+|\\s+$//g; $found = 1 if $_ eq $id; } close($list) or die "swift sdk list failed"; unless ($found) { system($swift, "sdk", "install", $bundle, @options); exit(($? & 127) ? 128 + ($? & 127) : $? >> 8); }',
+        path.join(locks, 'wasm-sdk.lock'),
+        sdk.wasmSdkId,
+        stagedBundle,
+        swift,
+        ...swiftSdkOptions(),
+      ],
+      { env: swiftEnvironment(), stdio: 'inherit' },
+    )
+    const bundle = swiftSdkBundle(swift, sdk.wasmSdkId, swiftSdkOptions())
+    if (swiftSdkPayloadChecksum(bundle) !== expected)
+      throw new Error(
+        `Swift SDK ${sdk.wasmSdkId} already exists with different payload bytes; select a separate --swift-sdks-path. No installed SDK was replaced.`,
+      )
+    const file = swiftSdkVerificationFile(bundle, sdk)
+    fs.mkdirSync(path.dirname(file), { recursive: true })
+    const temporary = `${file}.${process.pid}.tmp`
+    try {
+      fs.writeFileSync(
+        temporary,
+        JSON.stringify({
+          wasmSdkId: sdk.wasmSdkId,
+          wasmSdkChecksum: sdk.wasmSdkChecksum,
+          payloadChecksum: expected,
+        }) + '\n',
+      )
+      fs.renameSync(temporary, file)
+    } finally {
+      fs.rmSync(temporary, { force: true })
+    }
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true })
+    for (const file of sdkFileHashes.keys())
+      if (file.startsWith(staging + path.sep)) sdkFileHashes.delete(file)
+  }
+}
+
+/** verify the compiler and install a declared SDK under the shared store lock. */
+export function installSwiftWasmSdk(release: string, sdk: SwiftWasmSdk): void {
+  validateSwiftSdkIdentity(sdk)
+  try {
+    swiftToolchain(release, sdk)
+    return
+  } catch {
+    // an unverified existing SDK must be compared with the declared archive.
+  }
+  const swift = path.join(swiftCompiler(release), 'swift')
+  const staging = fs.mkdtempSync(path.join(scratch ?? os.tmpdir(), 'builder-swift-sdk-'))
+  const archive = path.join(staging, 'sdk.artifactbundle.tar.gz')
+  try {
+    if (sdk.wasmSdkUrl.startsWith('file:'))
+      fs.copyFileSync(fileURLToPath(sdk.wasmSdkUrl), archive)
+    else
+      execFileSync('curl', ['-fsSL', sdk.wasmSdkUrl, '-o', archive], { stdio: 'inherit' })
+    installSwiftSdkArchive(swift, sdk, archive)
+    swiftToolchain(release, sdk)
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true })
+  }
+}
+
 // stream large compiler binaries without retaining a second copy in memory.
 export function swiftFileChecksum(file: string): string {
   const hash = createHash('sha256')
@@ -170,7 +471,7 @@ export function verifySwiftHostCompiler(release: string, root: string): void {
     throw new Error(`Swift compiler identity mismatch at ${root}`)
   }
   const files = Object.entries(manifest.files)
-  if (files.length !== 15) throw new Error('incomplete Swift compiler manifest')
+  if (files.length !== 16) throw new Error('incomplete Swift compiler manifest')
   for (const [relative, checksum] of files) {
     if (
       relative.startsWith('/') ||
@@ -193,6 +494,7 @@ export function swiftCompiler(release: string): string {
     verifySwiftHostCompiler(release, path.resolve(bin, '../..'))
   const version = execFileSync(path.join(bin, 'swift'), ['--version'], {
     encoding: 'utf8',
+    env: swiftEnvironment(),
     stdio: ['ignore', 'pipe', 'pipe'],
   })
   if (!version.includes(`(${swiftCompilerRelease(release)})`))
@@ -201,41 +503,71 @@ export function swiftCompiler(release: string): string {
   return bin
 }
 
+/** the command that installs and qualifies the pinned SDK for an installed compiler. */
+export function swiftSdkInstallStep(release: string, wasmSdk: SwiftWasmSdk): string {
+  return `install the pinned SDK:\n  ${swiftSdkInstallCommand(release, wasmSdk)}`
+}
+
+function swiftSdkInstallCommand(release: string, wasmSdk: SwiftWasmSdk): string {
+  const { wasmSdkId, wasmSdkUrl, wasmSdkChecksum } = wasmSdk
+  const program = `import { installSwiftWasmSdk } from "peachsim/swift-toolchain"; installSwiftWasmSdk(${JSON.stringify(release)}, ${JSON.stringify({ wasmSdkId, wasmSdkUrl, wasmSdkChecksum })})`
+  const directory = process.env.PEACH_SWIFT_SDKS_PATH
+  const environment = directory
+    ? `PEACH_SWIFT_SDKS_PATH='${path.resolve(directory).replaceAll("'", "'\\''")}' `
+    : ''
+  return `${environment}node --input-type=module -e '${program.replaceAll("'", "'\\''")}'`
+}
+
 /** the commands that install the pinned compiler and SDK on this host. */
 export function swiftInstallSteps(release: string, wasmSdk: SwiftWasmSdk): string {
-  const sdkOptions = swiftSdkOptions()
-    .map((arg) => ` '${arg.replaceAll("'", "'\\''")}'`)
-    .join('')
+  const { note, commands } = swiftCompilerInstall(release)
+  return [
+    `install the pinned compiler and SDK${note}:`,
+    ...[...commands, swiftSdkInstallCommand(release, wasmSdk)].map((line) => `  ${line}`),
+  ].join('\n')
+}
+
+/** the commands that install the pinned compiler alone, for a caller that installs the SDK. */
+export function swiftCompilerInstallSteps(release: string): string {
+  const { note, commands } = swiftCompilerInstall(release)
+  return [
+    `install the pinned compiler${note}:`,
+    ...commands.map((line) => `  ${line}`),
+  ].join('\n')
+}
+
+function swiftCompilerInstall(release: string): { note: string; commands: string[] } {
   if (release.includes('-custom-')) {
     const archive = swiftHostCompilerArchive(release)
     const directory = path.resolve(swiftToolchainBin(release), '../..')
-    return [
-      'install the pinned compiler and SDK:',
-      `  curl -fsSL ${archive.url} -o compiler.tar.gz`,
-      `  echo '${archive.checksum}  compiler.tar.gz' | shasum -a 256 -c -`,
-      `  mkdir -p '${directory}'`,
-      `  tar -xzf compiler.tar.gz --strip-components=1 -C '${directory}'`,
-      `  '${directory}/usr/bin/swift' sdk install ${wasmSdk.wasmSdkUrl} --checksum ${wasmSdk.wasmSdkChecksum}${sdkOptions}`,
-    ].join('\n')
+    return {
+      note: '',
+      commands: [
+        `curl -fsSL ${archive.url} -o compiler.tar.gz`,
+        `echo '${archive.checksum}  compiler.tar.gz' | shasum -a 256 -c -`,
+        `mkdir -p '${directory}'`,
+        `tar -xzf compiler.tar.gz --strip-components=1 -C '${directory}'`,
+      ],
+    }
   }
   const version = release.replace(/^swift-/, '').toLowerCase()
   const downloads = `https://download.swift.org/swift-${version}`
-  const sdk = `swift sdk install ${wasmSdk.wasmSdkUrl} --checksum ${wasmSdk.wasmSdkChecksum}${sdkOptions}`
   if (process.platform === 'darwin') {
-    const swift = `~/Library/Developer/Toolchains/${release}.xctoolchain/usr/bin/swift`
-    return [
-      'install it:',
-      `  curl -fsSLO ${downloads}/xcode/${release}/${release}-osx.pkg`,
-      `  installer -pkg ${release}-osx.pkg -target CurrentUserHomeDirectory`,
-      `  ${swift} ${sdk.replace(/^swift /, '')}`,
-    ].join('\n')
+    return {
+      note: '',
+      commands: [
+        `curl -fsSLO ${downloads}/xcode/${release}/${release}-osx.pkg`,
+        `installer -pkg ${release}-osx.pkg -target CurrentUserHomeDirectory`,
+      ],
+    }
   }
   const platform = `debian12${process.arch === 'arm64' ? '-aarch64' : ''}`
   const name = `${release}-${platform}`
-  return [
-    'install it (Debian 12 shown; other distributions: https://www.swift.org/install/linux/):',
-    `  curl -fsSL ${downloads}/${platform}/${release}/${name}.tar.gz | tar -xz -C /opt`,
-    `  export PATH=/opt/${name}/usr/bin:$PATH`,
-    `  ${sdk}`,
-  ].join('\n')
+  return {
+    note: ' (Debian 12 shown; other distributions: https://www.swift.org/install/linux/)',
+    commands: [
+      `curl -fsSL ${downloads}/${platform}/${release}/${name}.tar.gz | tar -xz -C /opt`,
+      `export PATH=/opt/${name}/usr/bin:$PATH`,
+    ],
+  }
 }

package/src/worker-system-chunks.ts

@@ -242,10 +242,16 @@ const linkedChunks = new Set();
 function chunkBody(url) {
   let body = chunkBodies.get(url);
   if (!body) {
-    body = fetchWorkerChunk(url, { credentials: 'same-origin' }).then(response => {
+    body = (async () => {
+      if (deliveredChunkList && (await deliveredChunkList.promise).has(url)) {
+        const bytes = await deliveredChunk(url).promise;
+        deliveredChunks.delete(url);
+        return new TextDecoder().decode(bytes);
+      }
+      const response = await fetchWorkerChunk(url, { credentials: 'same-origin' });
       if (!response.ok) throw new Error(url + ': HTTP ' + response.status);
       return response.text();
-    });
+    })();
     body.catch(() => chunkBodies.delete(url));
     chunkBodies.set(url, body);
   }
@@ -261,16 +267,9 @@ const importModule = specifier => import(specifier);
 System.importModule = importModule;
 System.instantiate = async function(url) {
   if (url === workerEntryUrl) return workerEntryRegistration;
-  let source;
-  if (deliveredChunkList && (await deliveredChunkList.promise).has(url)) {
-    const body = await deliveredChunk(url).promise;
-    deliveredChunks.delete(url);
-    source = new TextDecoder().decode(body);
-  } else {
-    source = await chunkBody(url);
-    chunkBodies.delete(url);
-    linkedChunks.add(url);
-  }
+  const source = await chunkBody(url);
+  chunkBodies.delete(url);
+  linkedChunks.add(url);
   let registration;
   // minified module chunks assume strict block-scoped function semantics.
   new Function('System', '"use strict";\\n' + source)({

package/src/worklet-executable.ts

@@ -92,6 +92,7 @@ interface Scope {
 
 type Binding =
   | { kind: 'value'; init: SyntaxNode; scope: Scope }
+  | { kind: 'uninitialized' }
   // `key` is set when the parameter is a destructured member of that argument.
   | { kind: 'param'; fn: SyntaxNode; index: number; key?: string }
   | { kind: 'opaque' }
@@ -106,6 +107,9 @@ interface InitCollection {
   writes: Array<{ name: string; scope: Scope; value?: SyntaxNode }>
   // bindings written after their declaration; their value is not static.
   reassigned: Set<Binding>
+  // rolldown hoists declarations out of esm initializers. a single plain
+  // assignment still identifies the literal; multiple writes remain opaque.
+  assigned: Map<Binding, { value: SyntaxNode; scope: Scope } | null>
   // names the parsed source never declares but writes exactly once with a plain
   // assignment. a bundler that hoists a module's declarations out of its
   // initializer leaves only that write in the initializer.
@@ -227,6 +231,8 @@ function enter(node: SyntaxNode, scope: Scope): Scope {
         const name = identifierName(id)
         if (name !== undefined && isNode(init))
           declare(target, name, { kind: 'value', init, scope })
+        else if (name !== undefined && init === null)
+          declare(target, name, { kind: 'uninitialized' })
         else declareOpaque(target, patternNames(id))
       }
       return scope
@@ -311,12 +317,18 @@ function collectInitData(root: SyntaxNode): InitCollection {
     immediate: new Map(),
     writes: [],
     reassigned: new Set(),
+    assigned: new Map(),
     free: new Map(),
   }
   visit(root, newScope(undefined, true), collection)
   for (const { name, scope, value } of collection.writes) {
     const binding = lookup(scope, name)
-    if (binding) collection.reassigned.add(binding)
+    if (binding?.kind === 'uninitialized')
+      collection.assigned.set(
+        binding,
+        collection.assigned.has(binding) || !value ? null : { value, scope },
+      )
+    else if (binding) collection.reassigned.add(binding)
     else
       collection.free.set(
         name,
@@ -415,6 +427,12 @@ function resolveObject(
         : undefined
     }
     if (collection.reassigned.has(binding)) return undefined
+    if (binding.kind === 'uninitialized') {
+      const assigned = collection.assigned.get(binding)
+      return assigned
+        ? resolveObject(assigned.value, assigned.scope, collection, depth + 1)
+        : undefined
+    }
     if (binding.kind === 'value')
       return resolveObject(binding.init, binding.scope, collection, depth + 1)
     if (binding.kind === 'param') {