Implement VM-scoped restricted registry transport

2026-10-07 04:04:32 -07:00
parent 1f7aa80130
commit 47fcb47d5c
10 changed files with 1051 additions and 5 deletions
@@ -0,0 +1,47 @@
+{ pkgs, core }:
+let
+  workerd = import ./workerd.nix { inherit pkgs; };
+  # Transaction-port/value adapters do not need the browser's CRDT/Wasm engine.
+  # Keep this surface explicit; it is bundled into checked restricted handlers.
+  sdk = pkgs.runCommand "quixos-restricted-sdk" { nativeBuildInputs = [ pkgs.esbuild ]; } ''
+    mkdir -p "$out"
+    cat > entry.mjs <<'JS'
+    export {definePortableRegistry,QxReject} from '${core}/dist/portable.js';
+    export {encodeArgument,decodeArgument,canonicalJson,parseJson} from '${core}/dist/value.js';
+    export {workspaceId,operationId,objectId,entryId,hashIdentity} from '${core}/dist/identity.js';
+    export {reference} from '${core}/dist/references.js';
+    export {CodecError,ExecutionError} from '${core}/dist/limits.js';
+    JS
+    esbuild entry.mjs --bundle --platform=neutral --format=esm --target=es2024 --outfile="$out/core.mjs"
+  '';
+  runtime =
+    pkgs.runCommand "quixos-restricted-execution" { nativeBuildInputs = [ pkgs.makeWrapper ]; }
+      ''
+        mkdir -p "$out/lib" "$out/bin"
+        cp ${./service.mjs} "$out/lib/service.mjs"
+        cp ${./worker.mjs} "$out/lib/worker.mjs"
+        makeWrapper ${pkgs.nodejs_24}/bin/node "$out/bin/quixos-restricted-registry" \
+          --add-flags "$out/lib/service.mjs" \
+          --set QUIXOS_RESTRICTED_WORKERD ${workerd}/bin/workerd \
+          --set QUIXOS_RESTRICTED_WORKER "$out/lib/worker.mjs"
+      '';
+  qualification =
+    pkgs.runCommand "quixos-restricted-execution-qualification"
+      {
+        nativeBuildInputs = [ pkgs.nodejs_24 ];
+        QUIXOS_TEST_WORKERD = "${workerd}/bin/workerd";
+        QUIXOS_TEST_SDK = "${sdk}/core.mjs";
+      }
+      ''
+        node --test ${./.}/service.test.mjs
+        touch "$out"
+      '';
+in
+{
+  inherit
+    workerd
+    sdk
+    runtime
+    qualification
+    ;
+}