wasm-idle 0.7.2 → 1.0.0

package/dist/playground/worker/rust.js

@@ -1,34 +1,202 @@
 import { waitForBufferedStdin } from '../stdinBuffer';
+import { isSharedBufferBackedView } from '../sharedBuffer';
+import { snapshotRustNonDebugResourceLimits } from '../rustWorkerLimits';
+import { WASM_RUST_EXECUTABLE_GRAPH_PROFILE, WASM_RUST_RUNTIME_PROFILE } from '../wasmRustVersion';
+import { createRuntimeAssetDeliveryBudget } from '@wasm-idle/core';
+const lowercaseSha256Pattern = /^[0-9a-f]{64}$/u;
+const testOnlyCompilerModuleImporter = import.meta.env.MODE === 'test'
+    ? globalThis.__WASM_IDLE_TEST_ONLY_RUST_COMPILER_MODULE_IMPORTER__
+    : undefined;
+const importRustCompilerModule = typeof testOnlyCompilerModuleImporter === 'function'
+    ? testOnlyCompilerModuleImporter
+    : (url) => import(/* @vite-ignore */ url);
 self.document = {
     querySelectorAll() {
         return [];
     }
 };
 let stdinBufferRust = null;
+let debugBufferRust = null;
 let compilerUrl = '';
+let debugModuleUrl = '';
 let runtimeBaseUrl = '';
+let runtimeProfile = null;
+let verifiedModuleUrls = null;
+let executableGraphFingerprint = '';
 let loadedCompilerUrl = '';
+let loadedExecutableGraphFingerprint = '';
+let acceptedCompilerBootstrap = false;
+let activeExecution = false;
 let compilerPromise = null;
 let compiledArtifact = null;
 let compiledCacheKey = '';
-async function loadCompiler(url) {
-    if (!url) {
-        throw new Error('Rust runtime is not configured. Set PUBLIC_WASM_RUST_COMPILER_URL or runtimeAssets.rust.compilerUrl.');
+let compiledAssetDeliveryBudget = null;
+let loadedDebugModuleUrl = '';
+let debugInstrumenterPromise = null;
+function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function hasExactKeys(value, expected) {
+    return (JSON.stringify(Object.keys(value).sort(compareCodeUnits)) ===
+        JSON.stringify([...expected].sort(compareCodeUnits)));
+}
+function requireCanonicalBlobUrl(value, label) {
+    if (typeof value !== 'string')
+        throw new Error(`${label} must be a canonical Blob URL`);
+    let parsed;
+    try {
+        parsed = new URL(value);
     }
-    if (loadedCompilerUrl === url && compilerPromise) {
-        return await compilerPromise;
+    catch {
+        throw new Error(`${label} must be a canonical Blob URL`);
+    }
+    if (parsed.protocol !== 'blob:' ||
+        value.includes('?') ||
+        value.includes('#') ||
+        parsed.href !== value) {
+        throw new Error(`${label} must be a canonical Blob URL without a query or fragment`);
+    }
+    return value;
+}
+function snapshotRuntimeProfile(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('wasm-rust runtime profile must match the bundled receipt profile');
+    }
+    const profile = value;
+    if (!hasExactKeys(profile, [
+        'manifestFingerprint',
+        'manifestPath',
+        'manifestReceipt',
+        'moduleUrl',
+        'profileId',
+        'protocolVersion'
+    ]) ||
+        profile.profileId !== WASM_RUST_RUNTIME_PROFILE.profileId ||
+        profile.protocolVersion !== WASM_RUST_RUNTIME_PROFILE.protocolVersion ||
+        profile.manifestPath !== WASM_RUST_RUNTIME_PROFILE.manifestPath ||
+        profile.manifestFingerprint !== WASM_RUST_RUNTIME_PROFILE.manifestFingerprint ||
+        !profile.manifestReceipt ||
+        typeof profile.manifestReceipt !== 'object' ||
+        Array.isArray(profile.manifestReceipt)) {
+        throw new Error('wasm-rust runtime profile must match the bundled receipt profile');
+    }
+    const manifestReceipt = profile.manifestReceipt;
+    if (!hasExactKeys(manifestReceipt, ['bytes', 'sha256']) ||
+        manifestReceipt.bytes !== WASM_RUST_RUNTIME_PROFILE.manifestReceipt.bytes ||
+        manifestReceipt.sha256 !== WASM_RUST_RUNTIME_PROFILE.manifestReceipt.sha256) {
+        throw new Error('wasm-rust runtime profile receipt must match the bundled receipt profile');
     }
-    loadedCompilerUrl = url;
+    if (typeof profile.moduleUrl !== 'string') {
+        throw new Error('wasm-rust runtime profile module URL is invalid');
+    }
+    let moduleUrl;
     try {
-        runtimeBaseUrl = new URL('./runtime/', url).toString();
+        moduleUrl = new URL(profile.moduleUrl);
     }
     catch {
-        runtimeBaseUrl = url;
+        throw new Error('wasm-rust runtime profile module URL is invalid');
+    }
+    const expectedQuery = `?v=${WASM_RUST_RUNTIME_PROFILE.manifestFingerprint}&rustManifestBytes=${WASM_RUST_RUNTIME_PROFILE.manifestReceipt.bytes}&rustManifestSha256=${WASM_RUST_RUNTIME_PROFILE.manifestReceipt.sha256}`;
+    if ((moduleUrl.protocol !== 'http:' && moduleUrl.protocol !== 'https:') ||
+        moduleUrl.username ||
+        moduleUrl.password ||
+        profile.moduleUrl.includes('#') ||
+        moduleUrl.href !== profile.moduleUrl ||
+        /%(?:2e|2f|5c)/iu.test(moduleUrl.pathname) ||
+        !moduleUrl.pathname.endsWith(`/${WASM_RUST_EXECUTABLE_GRAPH_PROFILE.entryPath}`) ||
+        moduleUrl.search !== expectedQuery) {
+        throw new Error('wasm-rust runtime profile module URL is invalid');
+    }
+    return Object.freeze({
+        profileId: WASM_RUST_RUNTIME_PROFILE.profileId,
+        protocolVersion: WASM_RUST_RUNTIME_PROFILE.protocolVersion,
+        manifestPath: WASM_RUST_RUNTIME_PROFILE.manifestPath,
+        manifestFingerprint: WASM_RUST_RUNTIME_PROFILE.manifestFingerprint,
+        manifestReceipt: Object.freeze({
+            bytes: WASM_RUST_RUNTIME_PROFILE.manifestReceipt.bytes,
+            sha256: WASM_RUST_RUNTIME_PROFILE.manifestReceipt.sha256
+        }),
+        moduleUrl: moduleUrl.href
+    });
+}
+function snapshotVerifiedModuleUrls(value, runtimeModuleUrl) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('wasm-rust verified module URL map is invalid');
+    }
+    const sourceModuleUrl = new URL(runtimeModuleUrl);
+    const sourceBaseUrl = new URL('./', sourceModuleUrl);
+    sourceBaseUrl.search = sourceModuleUrl.search;
+    const expectedNetworkUrls = Object.keys(WASM_RUST_EXECUTABLE_GRAPH_PROFILE.modules)
+        .sort(compareCodeUnits)
+        .map((modulePath) => {
+        const networkUrl = new URL(modulePath, sourceBaseUrl);
+        networkUrl.search = sourceModuleUrl.search;
+        return networkUrl.href;
+    })
+        .sort(compareCodeUnits);
+    const entries = Object.entries(value);
+    const actualNetworkUrls = entries.map(([networkUrl]) => networkUrl).sort(compareCodeUnits);
+    if (JSON.stringify(actualNetworkUrls) !== JSON.stringify(expectedNetworkUrls)) {
+        throw new Error('wasm-rust verified module URL map does not match the bundled graph');
+    }
+    const snapshot = {};
+    const blobUrls = new Set();
+    for (const [networkUrl, candidateBlobUrl] of entries) {
+        const blobUrl = requireCanonicalBlobUrl(candidateBlobUrl, 'wasm-rust verified module URL');
+        if (blobUrls.has(blobUrl)) {
+            throw new Error('wasm-rust verified module URLs must map one-to-one to Blob URLs');
+        }
+        blobUrls.add(blobUrl);
+        snapshot[networkUrl] = blobUrl;
+    }
+    return Object.freeze(snapshot);
+}
+function snapshotCompilerBootstrap(url, profileValue, moduleUrlsValue, graphFingerprint) {
+    const verifiedCompilerUrl = requireCanonicalBlobUrl(url, 'wasm-rust compiler URL');
+    if (graphFingerprint !== WASM_RUST_EXECUTABLE_GRAPH_PROFILE.fingerprint) {
+        throw new Error('wasm-rust executable graph fingerprint does not match the bundled receipt profile');
     }
+    const profile = snapshotRuntimeProfile(profileValue);
+    const moduleUrls = snapshotVerifiedModuleUrls(moduleUrlsValue, profile.moduleUrl);
+    if (moduleUrls[profile.moduleUrl] !== verifiedCompilerUrl) {
+        throw new Error('wasm-rust compiler URL must identify the bundled graph entry');
+    }
+    return Object.freeze({
+        compilerUrl: verifiedCompilerUrl,
+        profile,
+        moduleUrls,
+        graphFingerprint: WASM_RUST_EXECUTABLE_GRAPH_PROFILE.fingerprint
+    });
+}
+async function loadCompiler(url, profile = runtimeProfile, moduleUrls = verifiedModuleUrls, graphFingerprint = executableGraphFingerprint) {
+    if (!url) {
+        throw new Error('Rust runtime is not configured. Set PUBLIC_WASM_RUST_COMPILER_URL or runtimeAssets.rust.compilerUrl.');
+    }
+    const bootstrap = snapshotCompilerBootstrap(url, profile, moduleUrls, graphFingerprint);
+    if (loadedCompilerUrl === bootstrap.compilerUrl &&
+        loadedExecutableGraphFingerprint === bootstrap.graphFingerprint &&
+        compilerPromise) {
+        return await compilerPromise;
+    }
+    compilerUrl = bootstrap.compilerUrl;
+    runtimeProfile = bootstrap.profile;
+    verifiedModuleUrls = bootstrap.moduleUrls;
+    executableGraphFingerprint = bootstrap.graphFingerprint;
+    loadedCompilerUrl = bootstrap.compilerUrl;
+    loadedExecutableGraphFingerprint = bootstrap.graphFingerprint;
+    const runtimeModuleUrl = new URL(bootstrap.profile.moduleUrl);
+    const resolvedRuntimeBaseUrl = new URL('./runtime/', runtimeModuleUrl);
+    resolvedRuntimeBaseUrl.search = runtimeModuleUrl.search;
+    runtimeBaseUrl = resolvedRuntimeBaseUrl.toString();
     compiledArtifact = null;
     compiledCacheKey = '';
+    compiledAssetDeliveryBudget = null;
     compilerPromise = (async () => {
-        const module = await import(/* @vite-ignore */ url);
+        const module = await importRustCompilerModule(bootstrap.compilerUrl);
+        if (typeof module.configureVerifiedRuntimeExecutableModuleUrls !== 'function') {
+            throw new Error('wasm-rust module must export configureVerifiedRuntimeExecutableModuleUrls');
+        }
+        module.configureVerifiedRuntimeExecutableModuleUrls(bootstrap.moduleUrls, bootstrap.graphFingerprint);
         const factory = typeof module.createRustCompiler === 'function'
             ? module.createRustCompiler
             : typeof module.default === 'function'
@@ -41,33 +209,286 @@ async function loadCompiler(url) {
             throw new Error('wasm-rust module must export executeBrowserRustArtifact');
         }
         return {
-            compiler: await factory(),
+            compiler: await factory({
+                dependencies: { runtimeProfile: bootstrap.profile }
+            }),
             executeBrowserRustArtifact: module.executeBrowserRustArtifact
         };
     })();
     return await compilerPromise;
 }
+async function loadDebugInstrumenter(url) {
+    if (!url) {
+        throw new Error('Rust debugging is not configured. Set runtimeAssets.rust.debugModuleUrl.');
+    }
+    if (loadedDebugModuleUrl === url && debugInstrumenterPromise) {
+        return await debugInstrumenterPromise;
+    }
+    loadedDebugModuleUrl = url;
+    debugInstrumenterPromise = (async () => {
+        const module = (await import(/* @vite-ignore */ url));
+        if (typeof module.RUST_DEBUG_MARKER !== 'string' ||
+            typeof module.instrumentRustDebugSource !== 'function') {
+            throw new Error('Rust debug instrumenter must export RUST_DEBUG_MARKER and instrumentRustDebugSource.');
+        }
+        return module;
+    })().catch((error) => {
+        if (loadedDebugModuleUrl === url) {
+            loadedDebugModuleUrl = '';
+            debugInstrumenterPromise = null;
+        }
+        throw error;
+    });
+    return await debugInstrumenterPromise;
+}
+function normalizedBreakpointSet(values) {
+    return new Set([...(Array.isArray(values) ? values : [])]
+        .map((value) => Number(value))
+        .filter((value) => Number.isInteger(value) && value > 0));
+}
+function refreshRustDebugBreakpoints(state, control) {
+    const version = Atomics.load(control, 2);
+    if (state.breakpointVersion === version)
+        return;
+    state.breakpointVersion = version;
+    const count = Math.max(0, Math.min(Atomics.load(control, 3), control.length - 4));
+    const next = new Set();
+    for (let index = 0; index < count; index += 1) {
+        const line = Atomics.load(control, 4 + index);
+        if (Number.isInteger(line) && line > 0)
+            next.add(line);
+    }
+    state.breakpoints = next;
+}
+function waitForRustDebugCommand(state, control, locationKey, line, depth) {
+    while (true) {
+        const command = Atomics.exchange(control, 1, 0);
+        if (!command) {
+            const sequence = Atomics.load(control, 0);
+            Atomics.wait(control, 0, sequence, 100);
+            continue;
+        }
+        state.resumeSkip = locationKey;
+        state.stepMode = null;
+        state.nextDepth = null;
+        state.nextLine = null;
+        state.stepOutDepth = null;
+        if (command === 2) {
+            state.stepMode = 'step';
+        }
+        else if (command === 3) {
+            state.stepMode = 'next';
+            state.nextDepth = depth;
+            state.nextLine = line;
+        }
+        else if (command === 4) {
+            state.stepMode = 'out';
+            state.stepOutDepth = Math.max(0, depth - 1);
+        }
+        return;
+    }
+}
+function createRustDebugHost(options) {
+    const state = {
+        breakpointVersion: Atomics.load(options.control, 2),
+        breakpoints: normalizedBreakpointSet(options.breakpoints),
+        pauseOnEntry: options.pauseOnEntry,
+        stepMode: null,
+        resumeSkip: null,
+        nextDepth: null,
+        nextLine: null,
+        stepOutDepth: null,
+        callStack: []
+    };
+    let stderrBuffer = '';
+    const markerPrefix = `${options.marker}:`;
+    const handleMarker = (line, functionName) => {
+        refreshRustDebugBreakpoints(state, options.control);
+        const normalizedFunctionName = functionName || 'main';
+        const currentFrame = state.callStack.at(-1);
+        if (!currentFrame) {
+            state.callStack.push({ functionName: normalizedFunctionName, line });
+        }
+        else if (currentFrame.functionName === normalizedFunctionName) {
+            currentFrame.line = line;
+        }
+        else {
+            let existingFrameIndex = -1;
+            for (let index = state.callStack.length - 2; index >= 0; index -= 1) {
+                if (state.callStack[index].functionName === normalizedFunctionName) {
+                    existingFrameIndex = index;
+                    break;
+                }
+            }
+            if (existingFrameIndex >= 0) {
+                state.callStack.length = existingFrameIndex + 1;
+                state.callStack[existingFrameIndex].line = line;
+            }
+            else {
+                state.callStack.push({ functionName: normalizedFunctionName, line });
+            }
+        }
+        const depth = state.callStack.length;
+        const skipKey = `${depth}:${normalizedFunctionName}:${line}`;
+        if (state.resumeSkip === skipKey)
+            return;
+        if (state.resumeSkip)
+            state.resumeSkip = null;
+        let reason = null;
+        if (state.pauseOnEntry) {
+            reason = 'entry';
+        }
+        else if (state.breakpoints.has(line)) {
+            reason = 'breakpoint';
+        }
+        else if (state.stepMode === 'step') {
+            reason = 'step';
+        }
+        else if (state.stepMode === 'next' &&
+            state.nextDepth !== null &&
+            depth <= state.nextDepth &&
+            (depth !== state.nextDepth || line !== state.nextLine)) {
+            reason = 'nextLine';
+        }
+        else if (state.stepMode === 'out' &&
+            state.stepOutDepth !== null &&
+            depth <= state.stepOutDepth) {
+            reason = 'stepOut';
+        }
+        if (!reason)
+            return;
+        state.pauseOnEntry = false;
+        state.stepMode = null;
+        state.nextDepth = null;
+        state.nextLine = null;
+        state.stepOutDepth = null;
+        const callStack = state.callStack.slice().reverse();
+        postMessage({
+            debugEvent: {
+                type: 'pause',
+                line,
+                reason,
+                locals: [],
+                callStack
+            }
+        });
+        waitForRustDebugCommand(state, options.control, skipKey, line, depth);
+    };
+    const consumeLine = (line, hasNewline) => {
+        if (line.startsWith(markerPrefix)) {
+            const payload = line.slice(markerPrefix.length);
+            const separator = payload.indexOf(':');
+            if (separator >= 0) {
+                handleMarker(Math.max(1, Number(payload.slice(0, separator) || 1)), payload.slice(separator + 1) || 'main');
+            }
+            return '';
+        }
+        return `${line}${hasNewline ? '\n' : ''}`;
+    };
+    return {
+        handleStderr(chunk) {
+            stderrBuffer += chunk;
+            const parts = stderrBuffer.split('\n');
+            stderrBuffer = parts.pop() || '';
+            return parts.map((line) => consumeLine(line, true)).join('');
+        },
+        flush() {
+            if (!stderrBuffer)
+                return '';
+            const chunk = consumeLine(stderrBuffer, false);
+            stderrBuffer = '';
+            return chunk;
+        }
+    };
+}
 self.onmessage = async (event) => {
-    const { load, compilerUrl: nextCompilerUrl, buffer, code, prepare, args = [], targetTriple = 'wasm32-wasip1', log } = event.data;
+    const { load, compilerUrl: nextCompilerUrl, runtimeProfile: nextRuntimeProfile, verifiedModuleUrls: nextVerifiedModuleUrls, executableGraphFingerprint: nextExecutableGraphFingerprint, debugModuleUrl: nextDebugModuleUrl, buffer, debugBuffer, code, prepare, args = [], stdin, targetTriple = 'wasm32-wasip1', log, debug = false, debugMode: requestedDebugMode, breakpoints = [], pauseOnEntry = false, limits: executionLimits } = event.data;
+    let ownsExecution = false;
     try {
         if (load) {
+            if (acceptedCompilerBootstrap) {
+                throw new Error('wasm-rust application worker accepts exactly one bootstrap');
+            }
+            acceptedCompilerBootstrap = true;
             compilerUrl = nextCompilerUrl;
+            debugModuleUrl = nextDebugModuleUrl;
+            runtimeProfile = nextRuntimeProfile || null;
+            verifiedModuleUrls = nextVerifiedModuleUrls || null;
+            executableGraphFingerprint = nextExecutableGraphFingerprint || '';
             if (log) {
                 console.log(`[wasm-idle:rust-worker] load compilerUrl=${compilerUrl}`);
             }
-            await loadCompiler(compilerUrl);
+            await loadCompiler(compilerUrl, runtimeProfile, verifiedModuleUrls, executableGraphFingerprint);
             postMessage({ load: true });
             return;
         }
+        if (!acceptedCompilerBootstrap) {
+            throw new Error('wasm-rust application worker must be bootstrapped before execution');
+        }
+        if (activeExecution) {
+            throw new Error('wasm-rust application worker already has an active execution');
+        }
+        activeExecution = true;
+        ownsExecution = true;
+        const debugMode = requestedDebugMode === undefined ? (debug ? 'trace' : 'none') : requestedDebugMode;
+        if (debugMode !== 'none' && debugMode !== 'trace' && debugMode !== 'lldb') {
+            throw new Error(`Unsupported Rust debug mode: ${String(debugMode)}`);
+        }
+        const nonDebugResourceLimits = debugMode === 'none' ? snapshotRustNonDebugResourceLimits(executionLimits) : undefined;
         stdinBufferRust = new Int32Array(buffer);
+        debugBufferRust = debugBuffer ? new Int32Array(debugBuffer) : null;
+        if (debugMode === 'trace' &&
+            (!debugBufferRust || !isSharedBufferBackedView(debugBufferRust))) {
+            postMessage({ error: 'Rust debugging requires SharedArrayBuffer.' });
+            return;
+        }
         const runtime = await loadCompiler(compilerUrl);
-        const compileCacheKey = `${targetTriple}\n${code}`;
+        let debugInstrumenter = null;
+        if (debugMode === 'trace') {
+            postMessage({
+                progress: {
+                    stage: 'load-debug-instrumenter',
+                    percent: 1,
+                    message: 'Loading Rust debugger'
+                }
+            });
+            debugInstrumenter = await loadDebugInstrumenter(debugModuleUrl);
+            postMessage({
+                progress: {
+                    stage: 'load-debug-instrumenter',
+                    percent: 3,
+                    message: 'Rust debugger loaded'
+                }
+            });
+        }
+        const compileCode = debugInstrumenter
+            ? debugInstrumenter.instrumentRustDebugSource(code)
+            : code;
+        const compileCacheKey = [
+            executableGraphFingerprint,
+            debugMode,
+            targetTriple,
+            ...(nonDebugResourceLimits
+                ? [String(nonDebugResourceLimits.maxAssetDeliveryBytes)]
+                : []),
+            compileCode
+        ].join('\n');
         if (!compiledArtifact || compiledCacheKey !== compileCacheKey) {
+            const assetDeliveryBudget = nonDebugResourceLimits
+                ? createRuntimeAssetDeliveryBudget(nonDebugResourceLimits.maxAssetDeliveryBytes)
+                : undefined;
             if (log) {
-                console.log(`[wasm-idle:rust-worker] compile start prepare=${String(prepare)} target=${targetTriple} bytes=${code.length}`);
+                console.log(`[wasm-idle:rust-worker] compile start prepare=${String(prepare)} target=${targetTriple} bytes=${compileCode.length}`);
             }
             const result = await runtime.compiler.compile({
-                code,
+                code: compileCode,
+                debugMode,
+                ...(nonDebugResourceLimits
+                    ? {
+                        workerLimits: nonDebugResourceLimits.compilerLimits,
+                        assetDeliveryBudget
+                    }
+                    : {}),
                 edition: '2024',
                 crateType: 'bin',
                 targetTriple,
@@ -87,7 +508,9 @@ self.onmessage = async (event) => {
                 postMessage({ output: result.stdout });
             if (!result.success) {
                 throw new Error(result.stderr ||
-                    result.diagnostics?.map((diagnostic) => diagnostic.message).join('\n') ||
+                    result.diagnostics
+                        ?.map((diagnostic) => diagnostic.message)
+                        .join('\n') ||
                     'Rust compilation failed');
             }
             if (result.stderr)
@@ -97,6 +520,7 @@ self.onmessage = async (event) => {
             }
             compiledArtifact = result.artifact;
             compiledCacheKey = compileCacheKey;
+            compiledAssetDeliveryBudget = assetDeliveryBudget || null;
             if (log) {
                 console.log(`[wasm-idle:rust-worker] cached artifact target=${compiledArtifact.targetTriple} format=${compiledArtifact.format}`);
             }
@@ -108,15 +532,99 @@ self.onmessage = async (event) => {
             postMessage({ results: true });
             return;
         }
+        if (debugMode === 'lldb') {
+            if (compiledArtifact.targetTriple !== 'wasm32-wasip1' ||
+                compiledArtifact.format !== 'core-wasm') {
+                throw new Error('wasm-rust LLDB artifact must be wasm32-wasip1 core-wasm');
+            }
+            const descriptor = compiledArtifact.debug;
+            if (!descriptor ||
+                typeof descriptor !== 'object' ||
+                descriptor.kind !== 'dwarf' ||
+                descriptor.sourceRoot !== '/workspace') {
+                throw new Error('wasm-rust did not return an LLDB DWARF descriptor');
+            }
+            if (typeof descriptor.moduleSha256 !== 'string' ||
+                !lowercaseSha256Pattern.test(descriptor.moduleSha256)) {
+                throw new Error('wasm-rust LLDB descriptor has an invalid module SHA-256');
+            }
+            if (!Array.isArray(descriptor.files) ||
+                descriptor.files.length !== 1 ||
+                !descriptor.files[0] ||
+                typeof descriptor.files[0] !== 'object' ||
+                descriptor.files[0].path !== '/workspace/main.rs') {
+                throw new Error('wasm-rust LLDB descriptor must contain exactly one /workspace/main.rs source');
+            }
+            const sourceDescriptor = descriptor.files[0];
+            if (typeof sourceDescriptor.contentSha256 !== 'string' ||
+                !lowercaseSha256Pattern.test(sourceDescriptor.contentSha256)) {
+                throw new Error('wasm-rust LLDB descriptor has an invalid /workspace/main.rs SHA-256');
+            }
+            const compiler = descriptor.compiler;
+            if (!compiler ||
+                typeof compiler !== 'object' ||
+                compiler.name !== 'rustc' ||
+                [
+                    'version',
+                    'revision',
+                    'llvmVersion',
+                    'llvmRevision',
+                    'runtimeVersion',
+                    'hostTriple'
+                ].some((field) => typeof compiler[field] !== 'string' || compiler[field].trim().length === 0)) {
+                throw new Error('wasm-rust LLDB descriptor requires complete rustc compiler provenance');
+            }
+            const artifactBytes = compiledArtifact.wasm instanceof Uint8Array
+                ? compiledArtifact.wasm
+                : new Uint8Array(compiledArtifact.wasm);
+            postMessage({
+                lldbArtifact: {
+                    bytes: new Uint8Array(artifactBytes),
+                    descriptor,
+                    sources: [
+                        {
+                            path: '/workspace/main.rs',
+                            content: code,
+                            contentSha256: sourceDescriptor.contentSha256
+                        }
+                    ]
+                }
+            });
+            return;
+        }
+        postMessage({ runtimePhase: 'run' });
         if (log) {
             console.log(`[wasm-idle:rust-worker] runtime start target=${compiledArtifact.targetTriple} format=${compiledArtifact.format}`);
         }
+        const rustDebugHost = debugMode === 'trace' && debugBufferRust && debugInstrumenter
+            ? createRustDebugHost({
+                control: debugBufferRust,
+                breakpoints,
+                pauseOnEntry: !!pauseOnEntry,
+                marker: debugInstrumenter.RUST_DEBUG_MARKER
+            })
+            : null;
+        const hasInitialStdin = typeof stdin === 'string';
+        let initialStdin = hasInitialStdin ? stdin : null;
         const execution = await runtime.executeBrowserRustArtifact(compiledArtifact, runtimeBaseUrl, {
+            ...(debugMode === 'none' && compiledAssetDeliveryBudget
+                ? { assetDeliveryBudget: compiledAssetDeliveryBudget }
+                : {}),
             args,
             env: {
                 USER: 'jungol'
             },
             stdin: () => {
+                if (hasInitialStdin) {
+                    const chunk = initialStdin;
+                    initialStdin = null;
+                    if (log) {
+                        console.log(chunk == null
+                            ? '[wasm-idle:rust-stdin] fd_read(bytes=0, eof=true)'
+                            : `[wasm-idle:rust-stdin] fd_fill(bytes=${new TextEncoder().encode(chunk).byteLength}, text=${JSON.stringify(chunk)})`);
+                    }
+                    return chunk;
+                }
                 const chunk = waitForBufferedStdin(stdinBufferRust, () => postMessage({ buffer: true }));
                 if (chunk == null) {
                     if (log) {
@@ -135,11 +643,16 @@ self.onmessage = async (event) => {
                 }
             },
             stderr: (output) => {
-                if (output) {
-                    postMessage({ output });
-                }
+                const visibleOutput = rustDebugHost
+                    ? rustDebugHost.handleStderr(output)
+                    : output;
+                if (visibleOutput)
+                    postMessage({ output: visibleOutput });
             }
         });
+        const flushedDebugOutput = rustDebugHost?.flush();
+        if (flushedDebugOutput)
+            postMessage({ output: flushedDebugOutput });
         if (log) {
             console.log(`[wasm-idle:rust-worker] wasi run complete exitCode=${String(execution.exitCode)}`);
         }
@@ -154,6 +667,19 @@ self.onmessage = async (event) => {
         if (log) {
             console.error('[wasm-idle:rust-worker] failed', error);
         }
-        postMessage({ error: error?.message || String(error) });
+        const errorMessage = String(error?.message || error);
+        const maxErrorBytes = Number.isSafeInteger(executionLimits?.maxOutputBytes) &&
+            executionLimits.maxOutputBytes > 0
+            ? executionLimits.maxOutputBytes
+            : 1024 * 1024;
+        postMessage({
+            error: new TextEncoder().encode(errorMessage).byteLength <= maxErrorBytes
+                ? errorMessage
+                : `Rust worker error exceeded ${maxErrorBytes} bytes`
+        });
+    }
+    finally {
+        if (ownsExecution)
+            activeExecution = false;
     }
 };

package/dist/playground/worker/sqlite.d.ts

@@ -0,0 +1 @@
+export {};