wasm-idle 1.0.0 → 1.0.4

package/dist/playground/worker/boundedAssetResponse.d.ts

@@ -0,0 +1,14 @@
+interface BoundedAssetResponseOptions {
+    asset: string;
+    maxAssetBytes: number;
+    total?: number;
+    signal?: AbortSignal;
+    onProgress?: (loaded: number, total?: number) => void;
+}
+/**
+ * Wrap an already-authorized response without assembling the entire Wasm file in JS.
+ * URL, HTTP status and integrity checks belong to the caller. Count browser-decoded
+ * bytes before forwarding each chunk; transport Content-Length is not a size bound.
+ */
+export declare function createBoundedAssetResponse(response: Response, { asset, maxAssetBytes, total, signal, onProgress }: BoundedAssetResponseOptions): Promise<Response>;
+export {};

package/dist/playground/worker/boundedAssetResponse.js

@@ -0,0 +1,148 @@
+const abortReason = (signal) => signal.reason ?? new DOMException('Runtime asset load aborted', 'AbortError');
+const bestEffortCancel = (source, reason) => {
+    try {
+        void Promise.resolve(source.cancel(reason)).catch(() => undefined);
+    }
+    catch {
+        // Cancellation must not replace the original failure or hold up a consumer.
+    }
+};
+/**
+ * Wrap an already-authorized response without assembling the entire Wasm file in JS.
+ * URL, HTTP status and integrity checks belong to the caller. Count browser-decoded
+ * bytes before forwarding each chunk; transport Content-Length is not a size bound.
+ */
+export async function createBoundedAssetResponse(response, { asset, maxAssetBytes, total, signal, onProgress }) {
+    const sizeError = () => new Error(`Runtime asset ${asset} exceeds the ${maxAssetBytes} byte limit`);
+    try {
+        if (!Number.isSafeInteger(maxAssetBytes) || maxAssetBytes <= 0) {
+            throw new TypeError('Runtime asset maxAssetBytes must be a positive safe integer');
+        }
+        if (total !== undefined && (!Number.isSafeInteger(total) || total < 0)) {
+            throw new TypeError('Runtime asset total must be a non-negative safe integer');
+        }
+        if (total !== undefined && total > maxAssetBytes)
+            throw sizeError();
+        if (signal?.aborted)
+            throw abortReason(signal);
+    }
+    catch (error) {
+        if (response.body)
+            bestEffortCancel(response.body, error);
+        throw error;
+    }
+    // Preserve the old synthesized-response headers. In particular, do not propagate
+    // transport Content-Encoding or a compressed Content-Length onto decoded bytes.
+    const mimeType = response.headers.get('content-type');
+    const init = { status: 200, headers: mimeType ? { 'Content-Type': mimeType } : undefined };
+    if (!response.body) {
+        let cancelOnAbort;
+        const aborted = signal
+            ? new Promise((_resolve, reject) => {
+                cancelOnAbort = () => reject(abortReason(signal));
+                signal.addEventListener('abort', cancelOnAbort, { once: true });
+            })
+            : undefined;
+        try {
+            const pending = response.arrayBuffer();
+            const bytes = aborted ? await Promise.race([pending, aborted]) : await pending;
+            if (signal?.aborted)
+                throw abortReason(signal);
+            if (bytes.byteLength > maxAssetBytes)
+                throw sizeError();
+            onProgress?.(bytes.byteLength, total ?? bytes.byteLength);
+            if (signal?.aborted)
+                throw abortReason(signal);
+            return new Response(bytes, init);
+        }
+        finally {
+            if (cancelOnAbort)
+                signal?.removeEventListener('abort', cancelOnAbort);
+        }
+    }
+    const reader = response.body.getReader();
+    let settled = false;
+    let released = false;
+    let receivedLength = 0;
+    let outputController;
+    const release = () => {
+        if (released)
+            return;
+        released = true;
+        reader.releaseLock();
+    };
+    const detach = () => signal?.removeEventListener('abort', onAbort);
+    const stop = (reason) => {
+        if (settled)
+            return;
+        settled = true;
+        detach();
+        bestEffortCancel(reader, reason);
+        try {
+            release();
+        }
+        catch {
+            // Keep the cancellation, stream failure, or size violation authoritative.
+        }
+    };
+    const fail = (reason) => {
+        if (settled)
+            return;
+        stop(reason);
+        outputController.error(reason);
+    };
+    const onAbort = () => {
+        if (signal)
+            fail(abortReason(signal));
+    };
+    const body = new ReadableStream({
+        start(controller) {
+            outputController = controller;
+            signal?.addEventListener('abort', onAbort, { once: true });
+            if (signal?.aborted)
+                onAbort();
+        },
+        async pull(controller) {
+            if (settled)
+                return;
+            try {
+                const { done, value } = await reader.read();
+                // A cancelled reader may settle an outstanding read later. It must not
+                // enqueue bytes or emit successful completion after cancellation.
+                if (settled)
+                    return;
+                if (signal?.aborted)
+                    throw abortReason(signal);
+                if (done) {
+                    release();
+                    onProgress?.(receivedLength, total ?? receivedLength);
+                    if (settled)
+                        return;
+                    settled = true;
+                    detach();
+                    controller.close();
+                    return;
+                }
+                if (!value)
+                    return;
+                const nextLength = receivedLength + value.byteLength;
+                if (!Number.isSafeInteger(nextLength) || nextLength > maxAssetBytes) {
+                    throw sizeError();
+                }
+                receivedLength = nextLength;
+                onProgress?.(receivedLength, total);
+                if (!settled)
+                    controller.enqueue(value);
+            }
+            catch (error) {
+                fail(signal?.aborted ? abortReason(signal) : error);
+            }
+        },
+        cancel(reason) {
+            stop(reason);
+        }
+    }, 
+    // Pull only when the Wasm consumer asks for data; no eager read-ahead or tee.
+    { highWaterMark: 0 });
+    return new Response(body, init);
+}

package/dist/playground/worker/clang.js

@@ -2,6 +2,8 @@ import { normalizeDwarfWorkspacePath } from '@wasm-idle/llvm-core/clang';
 import { waitForBufferedStdin } from '../stdinBuffer';
 import { isSharedBufferBackedView } from '../sharedBuffer';
 import { configureWorkerRuntimeAssets, handleWorkerAssetMessage } from './assets';
+import { withVerifiedStreaming } from './clangStreaming';
+import { BUNDLED_CLANG_LANGUAGE_SYSROOT_PROFILES } from '../clangAssetIntegrity';
 self.document = {
     querySelectorAll() {
         return [];
@@ -13,10 +15,25 @@ let initialStdinClang = null;
 function postProgress(percent, stage) {
     postMessage({ progress: { percent, stage } });
 }
-async function loadClang(path, log, maxAssetBytes) {
+async function loadClang(path, log, maxAssetBytes, verifiedStreaming = false, languageSysrootProfiles = false) {
     const { BrowserClangRuntime, loadRuntimeManifest, resolveRuntimeManifestUrl } = await import('@wasm-idle/llvm-core/clang');
     const manifest = await loadRuntimeManifest(resolveRuntimeManifestUrl(path), fetch, undefined, maxAssetBytes);
-    clang = new BrowserClangRuntime({
+    const runtimeManifest = languageSysrootProfiles
+        ? {
+            ...manifest,
+            compiler: {
+                ...manifest.compiler,
+                sysroot: {
+                    ...manifest.compiler.sysroot,
+                    profiles: BUNDLED_CLANG_LANGUAGE_SYSROOT_PROFILES
+                }
+            }
+        }
+        : manifest;
+    const Runtime = verifiedStreaming
+        ? withVerifiedStreaming(BrowserClangRuntime, path, maxAssetBytes)
+        : BrowserClangRuntime;
+    clang = new Runtime({
         stdout: (output) => postMessage({ output }),
         onDebugEvent: (debugEvent) => postMessage({ debugEvent }),
         stdin: () => {
@@ -31,7 +48,7 @@ async function loadClang(path, log, maxAssetBytes) {
         log,
         maxAssetBytes,
         runtimeBaseUrl: path,
-        manifest
+        manifest: runtimeManifest
     });
     await clang.ready;
 }
@@ -44,7 +61,7 @@ self.onmessage = async (event) => {
         try {
             const runtimeAssets = assets;
             configureWorkerRuntimeAssets(runtimeAssets || null);
-            await loadClang(runtimeAssets?.baseUrl || path || '', log, maxAssetBytes);
+            await loadClang(runtimeAssets?.baseUrl || path || '', log, maxAssetBytes, event.data.verifiedStreaming === true, event.data.languageSysrootProfiles === true);
             postMessage({ load: true });
         }
         catch (error) {

package/dist/playground/worker/clangStreaming.d.ts

@@ -0,0 +1,3 @@
+import type { BrowserClangRuntime } from '@wasm-idle/llvm-core/clang';
+/** Application-only adapter. The host opts in only for the built-in trust profile. */
+export declare function withVerifiedStreaming(Runtime: typeof BrowserClangRuntime, baseUrl: string, maxAssetBytes?: number): typeof BrowserClangRuntime;

package/dist/playground/worker/clangStreaming.js

@@ -0,0 +1,41 @@
+import { compileVerifiedWasmAsset } from '@wasm-idle/llvm-core/core/verified-wasm';
+import { BUNDLED_CLANG_ASSET_INTEGRITY } from '../clangAssetIntegrity';
+// Capture before configureWorkerRuntimeAssets installs its whole-buffer fetch shim.
+const nativeFetch = globalThis.fetch?.bind(globalThis);
+const toolNames = ['bin/clang.wasm.gz', 'bin/lld.wasm.gz'];
+/** Application-only adapter. The host opts in only for the built-in trust profile. */
+export function withVerifiedStreaming(Runtime, baseUrl, maxAssetBytes = 128 * 1024 * 1024) {
+    if (!nativeFetch || !globalThis.crypto?.subtle || typeof DecompressionStream !== 'function')
+        return Runtime;
+    const urls = new Map(toolNames.map((name) => [new URL(name, baseUrl).href, name]));
+    // Scope the two immutable tool modules to this one runtime construction, not globals.
+    const loads = new Map();
+    return class extends Runtime {
+        async getModule(url, progress, signal) {
+            const name = urls.get(url);
+            if (!name)
+                return super.getModule(url, progress, signal);
+            signal?.throwIfAborted();
+            const cached = signal ? undefined : loads.get(url);
+            if (cached)
+                return cached;
+            const operation = compileVerifiedWasmAsset(url, BUNDLED_CLANG_ASSET_INTEGRITY[name], {
+                fetch: nativeFetch,
+                maxAssetBytes,
+                signal,
+                onProgress(loaded, total) {
+                    progress?.set?.(loaded / total);
+                    globalThis.postMessage?.({ assetProgress: { asset: name, loaded, total } });
+                }
+            });
+            if (!signal) {
+                loads.set(url, operation);
+                void operation.catch(() => {
+                    if (loads.get(url) === operation)
+                        loads.delete(url);
+                });
+            }
+            return operation;
+        }
+    };
+}

package/dist/playground/worker/dotnet.js

@@ -56,6 +56,8 @@ workerSelf.onmessage = async (event) => {
                 console.log(`[wasm-idle:dotnet-worker] load moduleUrl=${moduleUrl}`);
             }
             await loadRuntime(moduleUrl);
+            // Older/custom runtime modules remain compatible without this optional API.
+            await compiler?.prepare?.({ language });
             postMessage({ load: true });
             return;
         }

package/dist/playground/worker/java.js

@@ -1,3 +1,4 @@
+import { acceptCompiledTeaVmModule, loadStreamingJavaCompiler } from './javaStreaming';
 import { prepareJavaStdinInjection } from '../javaStdin';
 import { resolveJavaSourceIdentity } from '../javaSource';
 import { waitForBufferedStdin } from '../stdinBuffer';
@@ -15,6 +16,7 @@ let compiledCode = '';
 let compiledStdin = '';
 let compiledMainClass = '';
 let compiledWasm = null;
+let compiledDiagnostics = [];
 let compiledActivePath = '';
 let compiledWorkspaceFiles = [];
 let currentSourcePaths = new Set();
@@ -51,30 +53,52 @@ self.addEventListener('message', async (event) => {
             const runtimeAssets = assets;
             configureWorkerRuntimeAssets(runtimeAssets || null);
             const baseUrl = runtimeAssets?.baseUrl || '';
+            const streamCompiler = runtimeAssets?.streamCompiler === true;
             if (!compiler || loadedBaseUrl !== baseUrl) {
-                loadedBaseUrl = baseUrl;
-                const runtimeSource = decoder.decode((await loadWorkerRuntimeAsset('compiler.wasm-runtime.js')).bytes);
-                const runtimeUrl = URL.createObjectURL(new Blob([runtimeSource], { type: 'text/javascript;charset=utf-8' }));
-                const runtimeModule = await import(/* @vite-ignore */ runtimeUrl);
-                URL.revokeObjectURL(runtimeUrl);
-                const runtimeLoadFn = runtimeModule.load;
-                runtimeLoad = runtimeLoadFn;
-                const compilerWasm = (await loadWorkerRuntimeAsset('compiler.wasm')).bytes;
-                const compilerModule = await runtimeLoadFn(compilerWasm, {
-                    stackDeobfuscator: { enabled: false }
-                });
-                compilerLib = compilerModule.exports;
-                compiler = compilerLib.createCompiler();
-                const [sdk, runtimeClasslib] = await Promise.all([
+                // Observe every branch immediately: failed assets must not leave an
+                // unhandled rejection while another branch is still initializing Wasm.
+                const [nextRuntime, sdk, runtimeClasslib] = await Promise.all([
+                    (async () => {
+                        const [runtimeModule, compilerAsset] = await Promise.all([
+                            (async () => {
+                                let runtimeSource = decoder.decode((await loadWorkerRuntimeAsset('compiler.wasm-runtime.js')).bytes);
+                                if (streamCompiler)
+                                    runtimeSource = acceptCompiledTeaVmModule(runtimeSource);
+                                const runtimeUrl = URL.createObjectURL(new Blob([runtimeSource], { type: 'text/javascript;charset=utf-8' }));
+                                try {
+                                    return await import(/* @vite-ignore */ runtimeUrl);
+                                }
+                                finally {
+                                    URL.revokeObjectURL(runtimeUrl);
+                                }
+                            })(),
+                            (async () => {
+                                const module = streamCompiler ? await loadStreamingJavaCompiler(baseUrl, runtimeAssets?.maxAssetBytes ?? 128 * 1024 * 1024) : undefined;
+                                return module ? { bytes: module } : loadWorkerRuntimeAsset('compiler.wasm');
+                            })()
+                        ]);
+                        const load = runtimeModule.load;
+                        const module = await load(compilerAsset.bytes, {
+                            stackDeobfuscator: { enabled: false }
+                        });
+                        return { load, lib: module.exports, compiler: module.exports.createCompiler() };
+                    })(),
                     loadWorkerRuntimeAsset('compile-classlib-teavm.bin').then(({ bytes }) => toInt8Array(bytes)),
                     loadWorkerRuntimeAsset('runtime-classlib-teavm.bin').then(({ bytes }) => toInt8Array(bytes))
                 ]);
-                compiler.setSdk(sdk);
-                compiler.setTeaVMClasslib(runtimeClasslib);
+                // Publish only a fully initialized compiler; a failed first attempt
+                // must retry instead of acknowledging a partially initialized runtime.
+                nextRuntime.compiler.setSdk(sdk);
+                nextRuntime.compiler.setTeaVMClasslib(runtimeClasslib);
+                compilerLib = nextRuntime.lib;
+                compiler = nextRuntime.compiler;
+                runtimeLoad = nextRuntime.load;
+                loadedBaseUrl = baseUrl;
                 compiledCode = '';
                 compiledStdin = '';
                 compiledMainClass = '';
                 compiledWasm = null;
+                compiledDiagnostics = [];
                 compiledActivePath = '';
                 compiledWorkspaceFiles = [];
                 currentSourcePaths = new Set();
@@ -106,17 +130,20 @@ self.addEventListener('message', async (event) => {
                 sourceFiles.some((file) => file.path === stdinInjection.helperSourcePath))) {
             throw new Error(`Java workspace conflicts with generated stdin helper: ${stdinInjection.helperSourcePath}`);
         }
-        if (prepare ||
-            compiledCode !== code ||
+        if (compiledCode !== code ||
             compiledStdin !== stdinInjection.stdinCacheKey ||
             workspaceChanged ||
             !compiledWasm) {
+            // A failed rebuild must never leave a previous artifact eligible for reuse.
+            compiledWasm = null;
+            compiledDiagnostics = [];
             const mainClass = sourceIdentity.mainClass;
             currentSourcePaths = new Set([sourcePath, ...sourceFiles.map((file) => file.path)].flatMap((path) => [
                 path,
                 path.split('/').pop() || path
             ]));
             const diagnosticLines = [];
+            const diagnosticMessages = [];
             const diagnosticRegistration = compiler.onDiagnostic((diagnostic) => {
                 const severity = diagnostic.severity
                     ? String(diagnostic.severity).toLowerCase()
@@ -129,7 +156,7 @@ self.addEventListener('message', async (event) => {
                 if (fileName && !currentSourcePaths.has(fileName)) {
                     return;
                 }
-                self.postMessage({
+                const diagnosticMessage = {
                     diagnostic: {
                         fileName,
                         lineNumber: Number(diagnostic.lineNumber) || 1,
@@ -141,7 +168,9 @@ self.addEventListener('message', async (event) => {
                                 : 'error',
                         message: String(diagnostic.message || '')
                     }
-                });
+                };
+                diagnosticMessages.push(diagnosticMessage);
+                self.postMessage(diagnosticMessage);
             });
             const disposeDiagnosticRegistration = () => {
                 if (typeof diagnosticRegistration === 'function') {
@@ -193,6 +222,12 @@ self.addEventListener('message', async (event) => {
             compiledWasm = new Uint8Array(compiler.getWebAssemblyOutputFile('app.wasm'));
             compiledActivePath = sourcePath;
             compiledWorkspaceFiles = sourceFiles.map((file) => ({ ...file }));
+            compiledDiagnostics = diagnosticMessages;
+        }
+        else {
+            // Every operation has its own diagnostic sink, even when compilation is reused.
+            for (const diagnostic of compiledDiagnostics)
+                self.postMessage(diagnostic);
         }
         if (prepare) {
             self.postMessage({ results: true });

package/dist/playground/worker/javaStreaming.d.ts

@@ -0,0 +1,9 @@
+/** No instance is created until EOF, exact length and SHA-256 have all passed. */
+export declare function compileVerifiedWasmResponse(response: Response, receipt: {
+    bytes: number;
+    sha256: string;
+}, maxAssetBytes: number, onProgress?: (loaded: number, total: number) => void): Promise<WebAssembly.Module>;
+/** Only enabled by the host for the pinned, non-custom-loader TeaVM profile. */
+export declare function loadStreamingJavaCompiler(baseUrl: string, maxAssetBytes: number): Promise<WebAssembly.Module | undefined>;
+/** Transform only the known verified loader, preserving TeaVM imports and exports. */
+export declare function acceptCompiledTeaVmModule(source: string): string;

package/dist/playground/worker/javaStreaming.js

@@ -0,0 +1,99 @@
+import { TEAVM_RUNTIME_ASSET_RECEIPTS } from '@wasm-idle/core';
+// Capture before the worker asset shim installs its buffered fetch adapter.
+const nativeFetch = globalThis.fetch?.bind(globalThis);
+const compilerReceipt = TEAVM_RUNTIME_ASSET_RECEIPTS['compiler.wasm'];
+/** No instance is created until EOF, exact length and SHA-256 have all passed. */
+export async function compileVerifiedWasmResponse(response, receipt, maxAssetBytes, onProgress) {
+    if (!Number.isSafeInteger(maxAssetBytes) || maxAssetBytes < 1 || receipt.bytes > maxAssetBytes ||
+        !Number.isSafeInteger(receipt.bytes) || receipt.bytes < 1 || !/^[a-f0-9]{64}$/.test(receipt.sha256)) {
+        void response.body?.cancel().catch(() => { });
+        throw new Error('Java compiler exceeds its asset limit or has an invalid receipt');
+    }
+    if (!response.ok || !response.body || !globalThis.crypto?.subtle) {
+        void response.body?.cancel().catch(() => { });
+        throw new Error('Java compiler streaming requires a successful body and Web Crypto');
+    }
+    const reader = response.body.getReader();
+    const snapshot = new Uint8Array(receipt.bytes);
+    let received = 0;
+    let released = false;
+    const release = () => { if (!released) {
+        released = true;
+        reader.releaseLock();
+    } };
+    const cancel = async (reason) => {
+        if (released)
+            return;
+        try {
+            await reader.cancel(reason);
+        }
+        finally {
+            release();
+        }
+    };
+    const body = new ReadableStream({
+        async pull(controller) {
+            try {
+                const { done, value } = await reader.read();
+                if (done) {
+                    if (received !== receipt.bytes)
+                        throw new Error('Java compiler length mismatch');
+                    const digest = await crypto.subtle.digest('SHA-256', snapshot);
+                    const actual = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');
+                    if (actual !== receipt.sha256)
+                        throw new Error('Java compiler SHA-256 mismatch');
+                    release();
+                    controller.close();
+                    return;
+                }
+                if (received + value.byteLength > receipt.bytes)
+                    throw new Error('Java compiler exceeds its receipt byte limit');
+                snapshot.set(value, received);
+                received += value.byteLength;
+                // Own every chunk: mutable producer views cannot change after hashing.
+                controller.enqueue(Uint8Array.from(value));
+                onProgress?.(received, receipt.bytes);
+            }
+            catch (error) {
+                controller.error(error);
+                await cancel(error).catch(() => { });
+            }
+        },
+        cancel
+    });
+    try {
+        return await WebAssembly.compileStreaming(new Response(body, { headers: { 'Content-Type': 'application/wasm' } }), { builtins: ['js-string'] });
+    }
+    catch (error) {
+        await cancel(error).catch(() => { });
+        throw error;
+    }
+}
+/** Only enabled by the host for the pinned, non-custom-loader TeaVM profile. */
+export async function loadStreamingJavaCompiler(baseUrl, maxAssetBytes) {
+    if (typeof WebAssembly.compileStreaming !== 'function' || !globalThis.crypto?.subtle || !nativeFetch)
+        return undefined;
+    const url = new URL('compiler.wasm', baseUrl);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash)
+        throw new Error('Invalid Java compiler URL');
+    const response = await nativeFetch(url.href, { credentials: 'omit', redirect: 'error', referrerPolicy: 'no-referrer' });
+    if (response.url && new URL(response.url).href !== url.href) {
+        void response.body?.cancel().catch(() => { });
+        throw new Error('Java compiler response URL mismatch');
+    }
+    // Static hosts without logical .wasm delivery retain the verified buffered path.
+    if (response.status === 404) {
+        void response.body?.cancel().catch(() => { });
+        return undefined;
+    }
+    return await compileVerifiedWasmResponse(response, compilerReceipt, maxAssetBytes, (loaded, total) => {
+        globalThis.postMessage?.({ assetProgress: { asset: 'compiler.wasm', loaded, total } });
+    });
+}
+/** Transform only the known verified loader, preserving TeaVM imports and exports. */
+export function acceptCompiledTeaVmModule(source) {
+    const anchor = 'async function b(e,t){if(typeof e!=="string")';
+    if (source.split(anchor).length !== 2)
+        throw new Error('Unsupported TeaVM loader for compiled-module input');
+    return source.replace(anchor, 'async function b(e,t){if(e instanceof WebAssembly.Module)return e;if(typeof e!=="string")');
+}

package/dist/playground/worker/php.js

@@ -5,6 +5,17 @@ let stdinBufferPhp = null;
 let runtimeModuleUrl = '';
 let phpPromise = null;
 let workspaceDirty = false;
+// A superseded attempt must not send errors to a newer load or run's listener.
+class SupersededPhpStartup extends Error {
+}
+function disposePhp(php) {
+    try {
+        php.exit?.();
+    }
+    catch {
+        // Preserve the startup failure or replacement that triggered cleanup.
+    }
+}
 function postProgress(percent) {
     postMessage({ progress: { percent: Math.max(0, Math.min(100, percent)) } });
 }
@@ -12,25 +23,52 @@ async function loadPhp(moduleUrl, log = true) {
     if (!moduleUrl)
         throw new Error('PHP runtime module URL is not configured.');
     if (runtimeModuleUrl !== moduleUrl) {
+        const previous = phpPromise;
         runtimeModuleUrl = moduleUrl;
         phpPromise = null;
         workspaceDirty = false;
+        void previous?.then(disposePhp, () => { });
     }
     if (phpPromise)
         return await phpPromise;
-    phpPromise = (async () => {
-        postProgress(5);
-        const runtime = await importRuntimeModule(moduleUrl);
-        const php = await runtime.createPhp84();
-        postProgress(95);
-        php.mkdir('/workspace');
-        if (log) {
-            console.log('[wasm-idle:php-worker] PHP 8.4 ready');
+    const operation = Promise.resolve().then(async () => {
+        let php;
+        try {
+            postProgress(5);
+            const runtime = await importRuntimeModule(moduleUrl);
+            if (phpPromise !== operation || runtimeModuleUrl !== moduleUrl) {
+                throw new SupersededPhpStartup('PHP runtime startup was superseded.');
+            }
+            php = await runtime.createPhp84();
+            if (phpPromise !== operation || runtimeModuleUrl !== moduleUrl) {
+                throw new SupersededPhpStartup('PHP runtime startup was superseded.');
+            }
+            postProgress(95);
+            php.mkdir('/workspace');
+            if (log) {
+                console.log('[wasm-idle:php-worker] PHP 8.4 ready');
+            }
+            postProgress(100);
+            return php;
+        }
+        catch (error) {
+            if (php)
+                disposePhp(php);
+            throw error;
         }
-        postProgress(100);
-        return php;
-    })();
-    return await phpPromise;
+    });
+    phpPromise = operation;
+    try {
+        return await operation;
+    }
+    catch (error) {
+        // Failed speculative startup must not poison the later explicit Run.
+        // A stale attempt must never clear a newer configuration's runtime.
+        if (phpPromise !== operation)
+            throw new SupersededPhpStartup('PHP runtime startup was superseded.');
+        phpPromise = null;
+        throw error;
+    }
 }
 function prepareWorkspace(php) {
     if (workspaceDirty) {
@@ -253,6 +291,8 @@ self.onmessage = async (event) => {
         postMessage({ results: true });
     }
     catch (error) {
+        if (error instanceof SupersededPhpStartup)
+            return;
         if (log) {
             console.error('[wasm-idle:php-worker] failed', error);
         }