Add HEAD and ETag to storage service

.dockerignore

@@ -13,6 +13,7 @@ services/ws-wasm-agent/pkg/
 services/ws-modules/pywasm1/pkg/
 services/ws-modules/rdata1/pkg/webr/
 services/ws-modules/rcomm1/pkg/webr/
+services/ws-modules/js-data1/pkg/et_ws_js_data1.js
 services/ws-server/static/models/
 **/.zig-cache/
 **/zig-out/

.gitignore

@@ -9,6 +9,7 @@ services/ws-wasm-agent/pkg/
 services/ws-modules/pywasm1/pkg/
 services/ws-modules/rdata1/pkg/webr/
 services/ws-modules/rcomm1/pkg/webr/
+services/ws-modules/js-data1/pkg/et_ws_js_data1.js
 services/ws-server/static/models/
 .zig-cache/
 zig-out/

.mise/config.coverage.toml

@@ -27,7 +27,7 @@
 # It is set env-wide here because this env loads only under the coverage workflow; per-command RUSTFLAGS and
 # the minicov feature come from the wasm_cov / *_cov_feat vars so uninstrumented builds stay clean.
 [env]
-RUSTUP_TOOLCHAIN = "nightly"
+RUSTUP_TOOLCHAIN = "{{ vars.rust_nightly }}"
 # Resolve libonnxruntime at runtime from the mise install rather than from ort-sys's dylib copies.
 # ort-sys symlinks the ONNX Runtime dylibs next to the built binaries, but it derives that directory from
 # `OUT_DIR/../../..`, which nightly's `build/<pkg>/<hash>/out` layout shifts down to `<target>/debug/build`.
@@ -135,7 +135,7 @@ if [ -z "$(find "$covdir" -maxdepth 1 -name '*.profraw' -print -quit 2>/dev/null
   exit 0
 fi
 host="$(rustc -vV | goawk '/^host:/ { print $2 }')"
-bin="$(rustc +nightly --print sysroot)/lib/rustlib/$host/bin"
+bin="$(rustc +{{ vars.rust_nightly }} --print sysroot)/lib/rustlib/$host/bin"
 gut="$covdir/gut.awk"
 coreutils cat > "$gut" <<'AWK'
 /^target datalayout/ { next }
@@ -293,8 +293,8 @@ coreutils rm -f "$covdir/server-ready"
 wait "$server_pid" 2>/dev/null || true
 trap - EXIT
 
-host="$(rustc +nightly -vV | goawk '/^host:/ { print $2 }')"
-llbin="$(rustc +nightly --print sysroot)/lib/rustlib/$host/bin"
+host="$(rustc +{{ vars.rust_nightly }} -vV | goawk '/^host:/ { print $2 }')"
+llbin="$(rustc +{{ vars.rust_nightly }} --print sysroot)/lib/rustlib/$host/bin"
 gut="$covdir/gut.awk"
 coreutils cat > "$gut" <<'AWK'
 /^target datalayout/ { next }
@@ -386,8 +386,8 @@ export CHROMEDRIVER="$driver"
 export LLVM_PROFILE_FILE="{{ config_root }}/$covdir/pic-viewer-%p.profraw"
 cargo test -p et-ws-pic-viewer --features et-web/coverage --target wasm32-unknown-unknown --test show_image
 
-host="$(rustc +nightly -vV | goawk '/^host:/ { print $2 }')"
-llbin="$(rustc +nightly --print sysroot)/lib/rustlib/$host/bin"
+host="$(rustc +{{ vars.rust_nightly }} -vV | goawk '/^host:/ { print $2 }')"
+llbin="$(rustc +{{ vars.rust_nightly }} --print sysroot)/lib/rustlib/$host/bin"
 gut="$covdir/gut.awk"
 coreutils cat > "$gut" <<'AWK'
 /^target datalayout/ { next }

.mise/config.js.toml

@@ -80,6 +80,17 @@ description = "Build the face detection workflow WASM module"
 dir = "services/ws-modules/face-detection"
 run = "{{ vars.web_pack_cov }} {{ vars.no_opt }}{{ vars.web_cov_feat }} && {{ vars.et_cli }} module-package-json"
 
+[tasks.build-ws-js-data1-module]
+description = "Bundle the js-data1 module (AWS SDK for JS v3) into pkg/ with esbuild"
+dir = "services/ws-modules/js-data1"
+# esbuild bundles @aws-sdk/client-s3 into one self-contained ESM.
+# Its @aws-sdk/* + @smithy/* graph uses bare-specifier imports that don't resolve as served static files, so
+# bundling is required; pnpm install brings the workspace deps in first. `node build.mjs` is invoked directly
+# rather than via `pnpm run build`, because mise's standalone pnpm does not put mise's node on PATH for the
+# script child on Windows (`'node' is not recognized`), whereas the mise task shell always has node (a `[tools]`
+# entry) resolvable -- the same way `pnpm` itself resolves here.
+run = "pnpm install && node build.mjs"
+
 [tasks.oxlint-check]
 description = "Lint JavaScript/TypeScript sources (oxlint)"
 # oxlint walks the working tree from CWD, honouring .gitignore; no path arg needed.

.mise/config.mingw.toml

@@ -43,7 +43,7 @@ version = "stable-x86_64-pc-windows-gnullvm"
 components = "rust-src,rustfmt"
 profile = "minimal"
 targets = "wasm32-unknown-unknown,wasm32-wasip2,x86_64-pc-windows-gnu"
-version = "nightly-x86_64-pc-windows-gnullvm"
+version = "{{ vars.rust_nightly }}-x86_64-pc-windows-gnullvm"
 
 [vars]
 # Clear config.windows.toml's et-ws-web-runner exclusion.

.mise/config.msvc.toml

@@ -26,7 +26,7 @@ version = "stable-x86_64-pc-windows-gnullvm"
 components = "rust-src,rustfmt"
 profile = "minimal"
 targets = "wasm32-unknown-unknown,wasm32-wasip2,x86_64-pc-windows-msvc"
-version = "nightly-x86_64-pc-windows-gnullvm"
+version = "{{ vars.rust_nightly }}-x86_64-pc-windows-gnullvm"
 
 [vars]
 # portable-msvc script pin: gist id + revision (immutable content address) + sha256 of that revision.

.mise/config.toml

@@ -185,7 +185,7 @@ components = "rust-src,rustfmt,llvm-tools"
 os = ["linux", "macos"]
 profile = "minimal"
 targets = "wasm32-unknown-unknown,wasm32-wasip2"
-version = "nightly"
+version = "{{ vars.rust_nightly }}"
 
 # Native rustpython binary built from upstream RustPython main.
 # Built with `freeze-stdlib` (so the binary embeds the Python stdlib and doesn't need a RUSTPYTHONPATH dance)
@@ -291,6 +291,16 @@ checksum = "sha256:6d97229c53cc0af09635bfd85b15169704ab9c07d5e23090252ac80746260
 url = "https://github.com/edge-toolkit/core/releases/download/augeas-v1/1.14.1-x86_64-pc-windows-mingw.tar.gz"
 
 [vars]
+# Rust nightly channel, pinned to a single version used for every nightly toolchain in the repo.
+# One value drives the coverage build + its llvm-tools, cargo-fmt, cargo-doc-check, the et-rest-client fmt, and
+# the Windows/mingw/msvc host toolchains, so no lane silently floats to a different nightly. Pinned because
+# the 2026-08-05 nightly (rustc 7608eb7b0) regressed wasm coverage codegen -- minicov's `capture_coverage` reads
+# the instrumented counter buffers out of bounds, so the guest traps with `wasm trap: out of bounds memory
+# access` in `coverage::dump` and the et-ws-wasi-runner coverage tests (wasi-comm1/wasi-data1) fail. The
+# 2026-08-04 nightly (rustc 1ed2df61a), which `nightly-2026-08-05` resolves to, is the last good one. minicov has
+# shipped no release since 0.3.8 to absorb the codegen change, so pinning the toolchain is the only lever. Unpin
+# (back to `nightly`) once a later nightly fixes the codegen or a new minicov handles it.
+rust_nightly = "nightly-2026-08-05"
 # Tier-`a_` prefix marks leaf values referenced by later vars.
 # a_* vars are referenced by later vars (face1_src), and mise renders [vars] in alphabetical order; `a_` sorts
 # before every non-prefixed var name so the reference resolves. Shared GitHub release tag for the HF-asset
@@ -677,10 +687,10 @@ run = "git ls-files '*Dockerfile' '*Dockerfile.*' | xargs hadolint --config conf
 run = "cargo check --workspace {{ vars.cargo_ws_excludes }}"
 
 [tasks.cargo-fmt]
-run = "cargo +nightly fmt"
+run = "cargo +{{ vars.rust_nightly }} fmt"
 
 [tasks.cargo-fmt-check]
-run = "cargo +nightly fmt -- --check"
+run = "cargo +{{ vars.rust_nightly }} fmt -- --check"
 
 [tasks.cargo-clippy-check]
 alias = ["cargo-clippy", "clippy", "clippy-check"]
@@ -720,7 +730,8 @@ env = { RUSTDOCFLAGS = "-Z unstable-options --check -D warnings" }
 run = """
 ort_build_dir="${CARGO_TARGET_DIR:-target}${CARGO_BUILD_TARGET:+/$CARGO_BUILD_TARGET}/debug/build"
 coreutils mkdir -p "$ort_build_dir/examples" "$ort_build_dir/deps"
-cargo +nightly doc --keep-going --workspace --no-deps --document-private-items {{ vars.cargo_ws_excludes }}
+tc="{{ vars.rust_nightly }}"
+cargo "+$tc" doc --keep-going --workspace --no-deps --document-private-items {{ vars.cargo_ws_excludes }}
 """
 shell = "bash -euo pipefail -c"
 
@@ -1192,7 +1203,7 @@ description = "Run et-int-gen: emit the language-agnostic WS specs (YAML/WIT/KDL
 run = """
 cargo run -q -p et-int-gen --bin et-int-gen -- generate core
 cargo run -q -p et-int-gen --bin et-int-gen -- generate rust
-cargo +nightly fmt -p et-rest-client
+cargo +{{ vars.rust_nightly }} fmt -p et-rest-client
 """
 shell = "bash -euo pipefail -c"
 

.mise/config.windows.toml

@@ -91,7 +91,7 @@ version = "stable-x86_64-pc-windows-gnullvm"
 components = "rust-src,rustfmt"
 profile = "minimal"
 targets = "wasm32-unknown-unknown,wasm32-wasip2"
-version = "nightly-x86_64-pc-windows-gnullvm"
+version = "{{ vars.rust_nightly }}-x86_64-pc-windows-gnullvm"
 
 [vars]
 # Forward-slashed mise installs root, for values spliced unquoted into bash task command lines.

.mise/config.zig.toml

@@ -83,7 +83,15 @@ llvm_ct="$(mise where 'github:mstorsjo/llvm-mingw')/bin/clang-tidy"
 git ls-files 'services/ws-web-runner/mingw-shim/*.c' |
   xargs -r -I{} "$llvm_ct" --config-file=config/clang-tidy.yaml {} -- --target=x86_64-w64-mingw32 -std=c11
 # set -- (POSIX positional params), not a bash array: busybox ash on the Windows lane has no arrays.
-set -- {{ vars.clang_resource_arg }} --target=wasm32-unknown-unknown -fwasm-exceptions -mexception-handling -fno-rtti
+# macOS clang-tidy can't auto-locate its resource dir, and the conda:clang-tools package no longer ships the
+# clang builtin headers (stddef.h etc.), so point -resource-dir at llvm-mingw's headers -- already installed for
+# the mingw pass above, and the same set the Windows lane's clang_resource_arg uses. Linux keeps conda-clangxx's.
+set -- --target=wasm32-unknown-unknown -fwasm-exceptions -mexception-handling -fno-rtti
+if [ "$(uname -s)" = "Darwin" ]; then
+  set -- -resource-dir "$(mise where 'github:mstorsjo/llvm-mingw')/lib/clang/22" "$@"
+else
+  set -- {{ vars.clang_resource_arg }} "$@"
+fi
 git ls-files 'services/ws-modules/zig-*/src/*.c' 'services/ws-modules/zig-*/src/*.cpp' |
   xargs -r -I{} clang-tidy --config-file=config/clang-tidy.yaml {} -- "$@"
 """
@@ -101,7 +109,15 @@ llvm_ct="$(mise where 'github:mstorsjo/llvm-mingw')/bin/clang-tidy"
 git ls-files 'services/ws-web-runner/mingw-shim/*.c' |
   xargs -r -I{} "$llvm_ct" --fix --config-file=config/clang-tidy.yaml {} -- --target=x86_64-w64-mingw32 -std=c11
 # set -- (POSIX positional params), not a bash array: busybox ash on the Windows lane has no arrays.
-set -- {{ vars.clang_resource_arg }} --target=wasm32-unknown-unknown -fwasm-exceptions -mexception-handling -fno-rtti
+# macOS clang-tidy can't auto-locate its resource dir, and the conda:clang-tools package no longer ships the
+# clang builtin headers (stddef.h etc.), so point -resource-dir at llvm-mingw's headers -- already installed for
+# the mingw pass above, and the same set the Windows lane's clang_resource_arg uses. Linux keeps conda-clangxx's.
+set -- --target=wasm32-unknown-unknown -fwasm-exceptions -mexception-handling -fno-rtti
+if [ "$(uname -s)" = "Darwin" ]; then
+  set -- -resource-dir "$(mise where 'github:mstorsjo/llvm-mingw')/lib/clang/22" "$@"
+else
+  set -- {{ vars.clang_resource_arg }} "$@"
+fi
 git ls-files 'services/ws-modules/zig-*/src/*.c' 'services/ws-modules/zig-*/src/*.cpp' |
   xargs -r -I{} clang-tidy --fix --config-file=config/clang-tidy.yaml {} -- "$@"
 """

CLAUDE.md

@@ -10,6 +10,17 @@ directory (which is already gitignored). Do **not** write to `/tmp`, `/var/tmp`,
 `~/scratch`, or any other path outside this working directory. `target/scratch/` is fine; create subdirectories
 under it freely and clean up when done.
 
+### NEVER reference a file that isn't in this repo
+
+Do not mention, link to, or write a path to any file that is not tracked in this repo -- not from a tracked file
+(source, `*.md`, config, a comment) and not in a commit message, PR body, or code-review note. A relative path
+that escapes the repo root, an absolute filesystem path, or prose like "see the write-up in the parent directory"
+is meaningless to everyone who clones the repo and reads as a dangling pointer. If the thing being referenced
+matters to the repo, it must live **inside** the repo; if it deliberately lives elsewhere (the operator keeps it
+outside the tree on purpose), then simply never point at it from inside. Creating or editing files outside the
+repo is fine when the operator wants that -- this rule is **only** about never referring to out-of-repo files
+from within the repo.
+
 ## On macOS: use homebrew bash for ad-hoc agent commands
 
 On macOS, every ad-hoc command the agent runs that is **not** a `mise run <task>` invocation -- investigations,
@@ -75,6 +86,32 @@ everything's settled (waiting for the user to push):
 `/loop` dynamic-mode wakeups are bounded [60, 3600] by the runtime, so each cadence maps directly: 1 min ->
 `delaySeconds: 60`, 5 min -> `delaySeconds: 300`, 20 min -> `delaySeconds: 1200`.
 
+## Reproduce a CI failure locally BEFORE fixing it
+
+When a CI check fails, reproduce the exact failure on your own machine **before** changing anything, then verify
+the fix against that reproduction. Do NOT push a fix you have only reasoned about -- a blind fix that "should work"
+wastes a full CI round-trip (10-30 min) per attempt and erodes trust when it lands still-red.
+
+"It passes when I run the task locally" is NOT a reproduction and NOT proof of a fix. CI runs on a **fresh**
+environment; your machine carries months of accumulated state that silently masks the failure. The failures that
+bite are environment differences your green local run hides:
+
+- **Floating toolchains/tools** (`nightly`, `latest`, unpinned `conda:`/`npm:`): CI installs today's version; yours is
+  whatever you installed weeks ago. A green local run just means your cached version predates the regression. To
+  reproduce, install the _exact_ version CI used (read it from the job log -- e.g. `rustc -Vv`, the `mise ... @X`
+  install lines) and run with that.
+- **Stale install artifacts:** old `mise`/package installs leave symlinks (`.../latest`), directories, and even
+  bundled headers that a **fresh** install no longer creates or ships. A hardcoded path that resolves locally can be
+  a dead path on CI. Reproduce by removing the stale artifact (or `mise uninstall <tool> && mise install`) so your
+  layout matches a clean runner, then re-run.
+- **OS-specific behaviour:** the failing lane may be macOS/Windows/Linux-specific. Reproduce on that OS (you are on
+  one of the tier-1 platforms); if you cannot, say so rather than guessing.
+
+The loop is: read the CI job log for the exact error + the exact versions -> recreate those conditions locally ->
+confirm you see the identical failure -> fix -> confirm the fix turns that same local reproduction green -> only then
+push. If you genuinely cannot reproduce locally (e.g. a lane you have no access to), say so explicitly and do not
+pass off an unverified change as a fix.
+
 ## Keep lines <= 120 characters
 
 `editorconfig-checker` (`ec`, wired into `mise run check` via the `editorconfig-check` task) enforces a 120-char