@deepseek-ai/dsh-experimental-webworker-runtime 0.1.6-alpha.1

package/lib/types/client/apply-injections.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Page-side interpreter for the structured index injection table. The served
+ * form renders the same rows into index.html text; a static worker page has
+ * no served HTML, so it executes the table directly. Rows execute strictly in
+ * table order, so a global row lands before the scripts that read it.
+ */
+import type { IndexInjection } from '@deepseek-ai/dsh-host-webserver';
+/**
+ * Execute every row in table order.
+ * @param rows - Injection table from the boot payload.
+ * @param loadScript - Executes one script-src row; the tunnel's `loadBundle`,
+ * because the row URLs (`/plugins/...`) resolve only through the worker.
+ */
+export declare function applyIndexInjections(rows: readonly IndexInjection[], loadScript: (src: string) => Promise<void>): Promise<void>;
+//# sourceMappingURL=apply-injections.d.ts.map

package/lib/types/client/client.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Page half of the postMessage tunnel. It
+ * turns fetch-shaped calls into `req` frames and rebuilds Responses from the
+ * worker's `res` / `res-head`+`res-chunk`+`res-end` frames, so every consumer
+ * (boot payload, bundle transport, ApiClient, Typert RPC) speaks plain HTTP.
+ */
+import type { IndexInjection } from '@deepseek-ai/dsh-host-webserver';
+/** Boot payload of the tunnel bootstrap route. */
+export interface BootPayload {
+    /** Structured index injection table, executed by the page interpreter. */
+    injections: IndexInjection[];
+}
+/** Fetch-shaped transport the client tree consumes. */
+export type TunnelFetch = (input: URL | string, init?: RequestInit) => Promise<Response>;
+/** The page half of the tunnel: one `fetch`-shaped face over `postMessage`. */
+export declare class WorkerTunnel {
+    private readonly worker;
+    private nextId;
+    private readonly unary;
+    private readonly bodyStreams;
+    private readonly logicalStreams;
+    /**
+     * In-flight request descriptions, so a refusal names what was refused.
+     *
+     * A tunnel failure and a failure inside the host tree look identical from the
+     * page — both surface as one rejected fetch — and the acceptance run keeps the
+     * page console but not the frames. Warning here separates the two without
+     * recording anything on the normal path, where no refusal frame ever arrives.
+     */
+    private readonly inFlight;
+    /** Body-phase abort listeners, released when their stream settles. */
+    private readonly releases;
+    /**
+     * Attach to a spawned worker and start consuming response frames.
+     * @param worker - the host worker.
+     */
+    constructor(worker: Worker);
+    /**
+     * Open the tunnel: the worker assembles its host from this frame.
+     * @param image - VFS image URL the worker fetches.
+     * @param overlays - Ordered data overlay URLs applied before boot.
+     */
+    init(image: string, overlays?: readonly string[]): void;
+    /** Fetch-shaped entry: one request frame, one Response (streamed when the worker streams). */
+    readonly fetch: TunnelFetch;
+    /**
+     * Open one decoded Gateway Remote stream over the worker-local carrier.
+     * @param endpoint - canonical Gateway Remote endpoint.
+     * @param payload - decoded endpoint payload.
+     * @param signal - logical-stream cancellation.
+     * @returns decoded stream values from the worker Host.
+     */
+    open(endpoint: string, payload: unknown, signal: AbortSignal): AsyncGenerator;
+    /**
+     * Read the pre-cordis boot payload (the injection table).
+     * @returns The payload the page applies before the client tree loads.
+     */
+    bootPayload(): Promise<BootPayload>;
+    /**
+     * `loadBundle` seam: take one client bundle through the tunnel and execute it
+     * as a classic script, exactly like the shell's same-origin `<script src>`.
+     * The image packs each bundle with a trailing `sourceURL` naming its image
+     * path, so the blob shows under that name in the debugger instead of as an
+     * anonymous blob entry.
+     * @param url - Graph combo URL (`/plugins/??<id>/client.js&rev=...`).
+     */
+    loadBundle(url: string): Promise<void>;
+    private rejectOnAbort;
+    /**
+     * Tear down one request the page abandoned: the maps forget it, the worker
+     * is told, and a live body stream errors for its reader.
+     * @param id - request id being abandoned.
+     * @returns The abort error the caller surfaces.
+     */
+    private abortRequest;
+    /**
+     * Hold the caller's signal over the body phase: the head settled, so
+     * {@link rejectOnAbort}'s listener is about to go, but a stop must still
+     * end the stream. Released when the stream settles.
+     * @param id - request id whose body is still crossing.
+     * @param signal - the caller's signal.
+     */
+    private observeStreamAbort;
+    /** Release a body-phase abort listener a settled stream no longer needs. */
+    private releaseSignal;
+    /** Cancel a stream the consumer stopped reading (the head already resolved). */
+    private cancelStream;
+    /** Best-effort cancellation: a failed worker cannot receive the frame anyway. */
+    private abortWorkerOperation;
+    /**
+     * Report a refusal on the page console, where the acceptance run already keeps it.
+     *
+     * The prefix names the reporter, not the culprit: a 5xx can equally come from a
+     * handler inside the host tree. The message text decides — the worker expands
+     * nested causes into it, and its deepest layer is where the failure was thrown.
+     * @param id - request id the frame answers.
+     * @param outcome - what came back instead of a reply.
+     */
+    private warnRefusal;
+    private receive;
+}
+//# sourceMappingURL=client.d.ts.map

package/lib/types/client/index.d.ts

@@ -0,0 +1,66 @@
+import { WorkerTunnel } from './client.ts';
+export { WorkerTunnel, type TunnelFetch } from './client.ts';
+export { applyIndexInjections } from './apply-injections.ts';
+export { IMAGE_FILE_NAME } from '../image-layout.ts';
+export { parsePreviewFixtureManifest, PREVIEW_FIXTURE_MANIFEST_FILE, PREVIEW_FIXTURE_MANIFEST_VERSION, type PreviewFixtureManifest, type PreviewFixtureManifestEntry, } from '../fixture-manifest.ts';
+/** Inputs for {@link connectWorkerHost}. */
+export interface WorkerHostConnectOptions {
+    /**
+     * VFS image URL, the one deployment-shaped input. Defaults to
+     * {@link IMAGE_FILE_NAME} beside the page; a deployment that packs the
+     * image elsewhere passes its own URL. Data overlays are independent.
+     */
+    readonly image?: string | URL;
+    /** Ordered data overlay URLs, resolved against the page like the base image. */
+    readonly overlays?: readonly (string | URL)[];
+}
+/** Inputs for the optional pre-boot filesystem-source chooser. */
+export interface WorkerHostSourceOptions {
+    /** Base VFS image URL; defaults to {@link IMAGE_FILE_NAME} beside the page. */
+    readonly image?: string | URL;
+    /** Fixture catalog URL; defaults to {@link PREVIEW_FIXTURE_MANIFEST_FILE} beside the image. */
+    readonly fixtureManifest?: string | URL;
+}
+/** Filesystem inputs selected before {@link connectWorkerHost}. */
+export interface WorkerHostSource {
+    /** Ordered data overlays to pass through unchanged to the Host connection. */
+    readonly overlays: readonly URL[];
+}
+/** A page connected to a worker-hosted harness, ready to run a shell entry. */
+export interface WorkerHostConnection {
+    readonly worker: Worker;
+    readonly tunnel: WorkerTunnel;
+    /** Bundle transport for the shell's boot seam. */
+    loadBundle(url: string): Promise<void>;
+}
+/**
+ * Run the optional pre-boot source-selection stage. Calling this stage holds
+ * the stock shell until the caller passes its result to {@link connectWorkerHost};
+ * callers that need no chooser call `connectWorkerHost` directly and receive
+ * the base image with an empty overlay list.
+ * @param options - Base image and optional fixture-catalog locations.
+ * @returns The ordered overlays selected by the user.
+ */
+export declare function chooseWorkerHostSource(options?: WorkerHostSourceOptions): Promise<WorkerHostSource>;
+/**
+ * Connect a spawned host worker and complete the pre-Cordis handshake.
+ *
+ * The caller constructs the Worker so its bundler resolves the bundle URL
+ * statically; the opening `init` frame then carries the base image and ordered
+ * overlay locations.
+ *
+ * Order is fixed by the web boot protocol: the transport global must exist
+ * before any bundle executes; the injection table then reproduces the served
+ * boot rows — the `__ModuleLoader__` registration queue, the parser-preload
+ * bundles, `__DSH_BOOT__`, the theme bootstrap — in table order. The
+ * boot-readiness deferred (`__DSH_BOOT_READY__`) is installed before the
+ * first await and settles with the handshake, so a client entry evaluating
+ * concurrently in the same document holds at its pre-boot await until every
+ * row has taken effect, and surfaces a failed handshake instead of
+ * proceeding on missing globals.
+ * @param worker - The host worker.
+ * @param options - Base-image and overlay location overrides.
+ * @returns The connection; hand `loadBundle` to the shell entry's boot seam.
+ */
+export declare function connectWorkerHost(worker: Worker, options?: WorkerHostConnectOptions): Promise<WorkerHostConnection>;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/client/source-chooser.d.ts

@@ -0,0 +1,8 @@
+/** Pre-boot filesystem-source chooser for static WebWorker previews. */
+/**
+ * Render the source chooser and wait for an enabled selection.
+ * @param manifestUrl - Built-in fixture catalog URL.
+ * @returns Ordered overlay URLs selected for the Worker mount.
+ */
+export declare function choosePreviewSource(manifestUrl: URL): Promise<readonly URL[]>;
+//# sourceMappingURL=source-chooser.d.ts.map

package/lib/types/compile/transform.d.ts

@@ -0,0 +1,39 @@
+/** One module the collector considered. */
+export interface LoweredModule {
+    /** Transformed body, or the input unchanged when nothing needed lowering. */
+    readonly code: string;
+    /** False means the entry may be packed as it is. */
+    readonly lowered: boolean;
+    /**
+     * Static module requests the body makes: import and re-export sources,
+     * literal dynamic imports and calls through `require`, plus module-scope
+     * direct literal calls through an imported `createRequire(import.meta.url)`.
+     * Computed and rebased requests resolve (and fail loud) at runtime only.
+     */
+    readonly moduleRequests: readonly string[];
+    /**
+     * Literal `import.meta.resolve()` requests. These are URL mappings, not
+     * loads: the pack sweep keeps a resolvable target and tolerates a missing
+     * one, and the loader answers or throws at the call site.
+     */
+    readonly metaResolveRequests: readonly string[];
+}
+/**
+ * Lower one module at image-pack time.
+ *
+ * The collector calls this for every JavaScript entry it packs and records
+ * `LOWERING_VERSION` in the image manifest; the loader then wraps those entries
+ * without parsing them. `lowered: false` reports that the transform would have
+ * returned the input verbatim (already CommonJS, no suspension point), so the
+ * entry may be packed as it is.
+ *
+ * Throwing is the intended failure mode: a module this transform cannot express
+ * must fail the build rather than ship an image that breaks at load.
+ * @param options - Virtual path inside the image and the module source.
+ * @returns The code to pack and whether it changed.
+ */
+export declare function lowerModuleSource(options: {
+    readonly filename: string;
+    readonly source: string;
+}): LoweredModule;
+//# sourceMappingURL=transform.d.ts.map

package/lib/types/fixture-manifest.d.ts

@@ -0,0 +1,26 @@
+/** Browser-readable catalog of built-in Preview filesystem overlays. */
+/** Manifest format version emitted beside the base VFS image. */
+export declare const PREVIEW_FIXTURE_MANIFEST_VERSION = 1;
+/** Leaf name resolved beside the base image. */
+export declare const PREVIEW_FIXTURE_MANIFEST_FILE = "fixtures.json";
+/** One selectable built-in fixture and its ordered overlay archives. */
+export interface PreviewFixtureManifestEntry {
+    readonly id: string;
+    readonly label: string;
+    readonly description: string;
+    readonly overlays: readonly string[];
+}
+/** Complete built-in fixture catalog consumed before Worker startup. */
+export interface PreviewFixtureManifest {
+    readonly version: number;
+    /** Required default fixture id, or null when the chooser should default to an empty overlay. */
+    readonly defaultFixture: string | null;
+    readonly fixtures: readonly PreviewFixtureManifestEntry[];
+}
+/**
+ * Validate the static fixture catalog before it controls Worker fetches.
+ * @param value - Parsed JSON response.
+ * @returns A detached manifest with unique ids and non-empty overlay lists.
+ */
+export declare function parsePreviewFixtureManifest(value: unknown): PreviewFixtureManifest;
+//# sourceMappingURL=fixture-manifest.d.ts.map

package/lib/types/image-layout.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Image layout contract shared by the packer and the worker host: the virtual
+ * root, where the composed config and the manifest sit inside the image, and
+ * the working directories every image carries empty. One definition, two
+ * consumers — the packer writes this layout, the worker host mounts it.
+ */
+/** Default virtual root; the runtime mounts the image here unless told otherwise. */
+export declare const DEFAULT_ROOT = "/dsh";
+/**
+ * Leaf name of the packed base image: one gzip member holding the ustar archive.
+ * The app build writes it beside the page and the page's boot fetches it from
+ * there, so the extension is part of what a deployment serves.
+ */
+export declare const IMAGE_FILE_NAME = "vfs-image.tar.gz";
+/** Image path the composed profile is written to; the runtime's Loader reads it. */
+export declare const IMAGE_CONFIG_PATH = "config/cordis.yml";
+/** Image path of the manifest the runtime reads before it wraps a single module. */
+export declare const IMAGE_MANIFEST_PATH = "config/vfs-manifest.json";
+/** Home directory under the root; the process shim's `DSH_HOME`/`HOME` default. */
+export declare const IMAGE_HOME_DIRECTORY = "home";
+/** Working directories the host tree expects to exist, empty. */
+export declare const IMAGE_EMPTY_DIRECTORIES: readonly string[];
+/**
+ * Top-level directories an overlay archive may populate. Runtime code,
+ * configuration, and the lowering manifest remain owned by the base image.
+ */
+export declare const IMAGE_OVERLAY_DIRECTORIES: readonly string[];
+/**
+ * Identity of the lowered code shape, recorded in the image manifest by the
+ * packer and required by the worker host: an image lowered by an older transform
+ * would otherwise run against newer wrapper semantics. Bump on any change to
+ * emitted code or to {@link WRAPPER_PARAMS}.
+ */
+export declare const LOWERING_VERSION = "dsh-worker-transform/1";
+/**
+ * Free variables a lowered body expects from its wrapper, in order.
+ *
+ * Part of the image layout rather than of the transform, because the loader
+ * wraps bodies it never parses: the packer emits against these names and the
+ * worker binds them, with no compiler in the worker bundle to agree with.
+ */
+export declare const WRAPPER_PARAMS: readonly ["exports", "require", "module", "__filename", "__dirname", "__dsh$meta", "__als"];
+//# sourceMappingURL=image-layout.d.ts.map

package/lib/types/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Browser-only host runtime: the harness Cordis tree inside a dedicated Web Worker.
+ * @module @deepseek-ai/dsh-experimental-webworker-runtime
+ */
+export { createAlsRuntime, type AlsCausality, type AlsRuntime, type AlsSnapshot, type AlsToken, } from './polyfill/async-context/als-runtime.ts';
+export { parseInboundFrame, type TunnelAbortFrame, type TunnelInboundFrame, type TunnelOutboundFrame, type TunnelRequestFrame, type TunnelRequestId, type TunnelResponseChunkFrame, type TunnelResponseEndFrame, type TunnelResponseErrorFrame, type TunnelResponseFrame, type TunnelResponseHeadFrame, type TunnelStreamEndFrame, type TunnelStreamErrorFrame, type TunnelStreamItemFrame, type TunnelStreamOpenFrame, } from './transport/frames.ts';
+export { DEFAULT_CONDITIONS, requireActiveModuleLoader, setActiveModuleLoader, WorkerModuleLoader, type Resolution, type StaticModuleFactory, type WorkerModuleLoaderOptions, type WorkerRequire, } from './module-system/module-loader.ts';
+export * as posixPath from './module-system/posix-path.ts';
+export { MODULE_PROXIES, MODULE_PROXY_PREFIXES } from './module-proxies.ts';
+export { REPLACED_EXTERNAL_PACKAGES } from './node/external_packages/replaced-externals.ts';
+export { createSyntheticExchange, type RequestListener, type ResponseSink, type SyntheticExchange, } from './transport/synthetic-http.ts';
+export { lowerModuleSource, type LoweredModule } from './compile/transform.ts';
+export { API_PREFIX, SYNTHETIC_HOST, TunnelServer, type TunnelPort, type TunnelSeams, type TunnelServerOptions, } from './transport/tunnel.ts';
+export { installProcessGlobal, type ProcessShim, type ProcessShimOptions } from './node/globals/process.ts';
+export { createWorkerHost, type WorkerHost, type WorkerHostOptions, } from './worker-host.ts';
+export { DEFAULT_ROOT, IMAGE_CONFIG_PATH, IMAGE_EMPTY_DIRECTORIES, IMAGE_FILE_NAME, IMAGE_HOME_DIRECTORY, IMAGE_MANIFEST_PATH, IMAGE_OVERLAY_DIRECTORIES, LOWERING_VERSION, WRAPPER_PARAMS, } from './image-layout.ts';
+export { parsePreviewFixtureManifest, PREVIEW_FIXTURE_MANIFEST_FILE, PREVIEW_FIXTURE_MANIFEST_VERSION, type PreviewFixtureManifest, type PreviewFixtureManifestEntry, } from './fixture-manifest.ts';
+export { loadVfsImage, loadVfsOverlay, MemoryVfs } from './storage/memory.ts';
+export { inflateImage, inflateImageStream } from './storage/image-gzip.ts';
+export { packTar, parseTar, type TarEntry } from './storage/tar.ts';
+export { requireActiveVfs, setActiveVfs } from './storage/active.ts';
+export { type VfsDir, type VfsDirent, type VfsEncoding, type VfsError, type VfsFileHandle, type VfsReadOptions, type VfsStats, type VfsWriteOptions, } from './storage/types.ts';
+//# sourceMappingURL=index.d.ts.map

package/lib/types/module-proxies.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The worker bundle's module proxy table: the ONLY platform fork of the host
+ * tree. Entries replace Node builtins, external npm packages, and the native
+ * flock subpath; other workspace and vendored modules are mounted as they ship.
+ *
+ * The build turns these into bundler aliases, and `node/builtins.ts` turns the
+ * same modules into the loader's static table — one list, two consumers.
+ *
+ * The replacement path states the classification. `./node/builtin_modules/implemented/<module>.ts`
+ * carries the module's real semantics over a worker-side data source (VFS, the
+ * tunnel, a wasm codec, a browser primitive); `./node/builtin_modules/mock/<module>.ts` is a
+ * structural placeholder that mounts silently and reports the missing capability
+ * when a call finally reaches it. External npm replacements live in
+ * `./externals/`, named after the package they stand in for.
+ * @module @deepseek-ai/dsh-experimental-webworker-runtime/src/module-proxies
+ */
+/**
+ * Module proxy table — the ONLY platform fork of the worker host. Keys are
+ * exact module specifiers; the native system package's Landlock entry stays
+ * unmodified while its flock subpath is replaced.
+ */
+export declare const MODULE_PROXIES: Record<string, string>;
+/** pi-ai subpaths (`/providers/all`, `/api/*.lazy`) share the one structural stub. */
+export declare const MODULE_PROXY_PREFIXES: Record<string, string>;
+//# sourceMappingURL=module-proxies.d.ts.map

package/lib/types/module-system/module-loader.d.ts

@@ -0,0 +1,177 @@
+/**
+ * CommonJS module loader over the worker VFS. It fills the `loader.internal`
+ * seam Cordis uses for every entry import, and backs the `node:module`
+ * `createRequire` proxy that `typert-loader`, `client-modules`, and the plugin
+ * package inventory resolve package metadata through.
+ *
+ * Resolution is a narrowed Node `require` algorithm: `exports` walk with a
+ * fixed condition order, extension probing, and one cache keyed by resolved
+ * absolute path. Module bodies are wrapped as the image holds them: lowering is
+ * the packer's job, so nothing here parses JavaScript.
+ * @module @deepseek-ai/dsh-experimental-webworker-runtime/src/module-system/module-loader
+ */
+import { type AlsCausality } from '../polyfill/async-context/als-runtime.ts';
+import type { MemoryVfs } from '../storage/memory.ts';
+/** Condition keys honoured in `exports`, in order; `node` is deliberately absent. */
+export declare const DEFAULT_CONDITIONS: readonly ["browser", "require", "import", "default"];
+/**
+ * One entry of the static-module table. The loader calls it when a `require`
+ * names that specifier and never before, so resolution alone — `require.resolve`
+ * or `import.meta.resolve` — evaluates nothing. Repeated requires of one
+ * specifier must answer the same module instance: callers depend on class
+ * identity across requires (`instanceof EventEmitter`, `Buffer.isBuffer`), so a
+ * factory that builds its value has to memoize it.
+ * @returns The module object served for that specifier.
+ */
+export type StaticModuleFactory = () => unknown;
+/** Where a specifier resolved to. */
+export type Resolution = {
+    readonly kind: 'static';
+    readonly specifier: string;
+    readonly factory: StaticModuleFactory;
+} | {
+    readonly kind: 'file';
+    readonly path: string;
+};
+/** Node-loader-compatible resolution returned through the Cordis internal seam. */
+export interface WorkerInternalResolution {
+    readonly format: 'builtin' | 'commonjs' | 'json';
+    /** File URL for VFS modules; the original bare specifier for builtins. */
+    readonly url: string;
+}
+/** Resolution helpers carried by a Worker-backed CommonJS require. */
+export interface WorkerRequireResolve {
+    /**
+     * Resolve one specifier without evaluating its module.
+     * @param specifier - Module request relative to the require base.
+     * @returns Static or VFS-backed module identity.
+     */
+    (specifier: string): string;
+    /**
+     * Return the directories this loader's Node-style package discovery searches.
+     * @param specifier - Module request whose lookup roots are requested.
+     * @returns Search roots, or null for a Worker-provided module.
+     */
+    paths(specifier: string): string[] | null;
+}
+/** The `require` function shape the roster consumes through `createRequire`. */
+export interface WorkerRequire {
+    (specifier: string): unknown;
+    readonly resolve: WorkerRequireResolve;
+}
+/** Construction inputs for {@link WorkerModuleLoader}. */
+export interface WorkerModuleLoaderOptions {
+    /** Filesystem holding package metadata and module sources. */
+    readonly vfs: MemoryVfs;
+    /** Virtual root whose `node_modules` bare specifiers resolve against. */
+    readonly root?: string;
+    /**
+     * Modules served from the worker bundle instead of the VFS: `node:*` proxies
+     * and the loud stubs for excluded npm packages, each behind a
+     * {@link StaticModuleFactory}.
+     */
+    readonly staticModules: Readonly<Record<string, StaticModuleFactory>>;
+    /**
+     * Prefix-matched proxies for packages whose subpaths are open-ended: a
+     * specifier starting with the key resolves to its module. Exact keys win, and
+     * the longest matching prefix wins among prefixes.
+     */
+    readonly staticModulePrefixes?: Readonly<Record<string, StaticModuleFactory>>;
+    /** Overrides {@link DEFAULT_CONDITIONS}. */
+    readonly conditions?: readonly string[];
+    /**
+     * Ambient-store snapshot face for the suspended `rewrite-await` route; it is
+     * read only when that route is the configured {@link lowering}.
+     */
+    readonly alsCausality?: AlsCausality;
+}
+/** Loader for one VFS mount; construct once per worker. */
+export declare class WorkerModuleLoader {
+    private readonly vfs;
+    private readonly root;
+    private readonly staticModules;
+    private readonly staticPrefixes;
+    private readonly conditions;
+    private readonly als;
+    private readonly modules;
+    private readonly manifests;
+    private readonly stack;
+    /**
+     * The Cordis module seam. `parentURL` positions relative specifiers;
+     * import attributes are ignored, as the client implementation does.
+     */
+    readonly internal: {
+        readonly version: 'worker';
+        import(specifier: string, parentURL?: string, attributes?: unknown): Promise<unknown>;
+        resolve(specifier: string, parentURL?: string, attributes?: unknown): Promise<WorkerInternalResolution>;
+        resolveSync(specifier: string, parentURL?: string, attributes?: unknown): WorkerInternalResolution;
+    };
+    constructor(options: WorkerModuleLoaderOptions);
+    private fail;
+    /** @returns Directory a base path or URL resolves specifiers from. */
+    private baseDirectoryOf;
+    private manifestOf;
+    /** Walk one `exports` value against the condition set and requested subpath. */
+    private selectExport;
+    /** Pick the first condition branch this runtime satisfies. */
+    private selectCondition;
+    /** Extension and directory probing for a concrete path. */
+    private probe;
+    /** @returns The Worker-provided implementation of a static specifier. */
+    private staticModule;
+    /**
+     * Resolve a specifier the way the module that requested it would.
+     * @param specifier - Bare name, relative path, absolute path, or file URL.
+     * @param fromDirectory - Directory of the requesting module.
+     * @returns Static module or the resolved VFS path.
+     */
+    resolve(specifier: string, fromDirectory: string): Resolution;
+    /**
+     * Load a resolved module, reusing the cache and tolerating cycles with
+     * CommonJS partial-export semantics.
+     * @param resolution - Result of {@link resolve}.
+     * @returns The module's exports.
+     */
+    load(resolution: Resolution): unknown;
+    /**
+     * Compile a body the image already lowered.
+     *
+     * Module syntax reaching here means the image was packed by something other
+     * than the packer, or its collector missed the entry. The worker carries no
+     * transform to recover with, so it names the image as the thing to rebuild.
+     * @param code - Module body as the image holds it.
+     * @param path - Resolved VFS path.
+     * @returns The wrapper factory.
+     */
+    private compile;
+    /**
+     * Build a `require` bound to a directory.
+     * @param fromDirectory - Directory relative specifiers resolve against.
+     * @returns Callable require with `resolve`.
+     */
+    requireFrom(fromDirectory: string): WorkerRequire;
+    /**
+     * `node:module` `createRequire` for the VFS.
+     * @param base - Module path, directory path, or `file:` URL.
+     * @returns Require bound to that base.
+     */
+    createRequire(base: string | URL): WorkerRequire;
+    /**
+     * Report what this loader has done, for the host's boot diagnostics.
+     * @returns How many module bodies it has run.
+     */
+    usage(): {
+        modules: number;
+    };
+}
+/**
+ * Publish the loader the `node:module` proxy resolves through.
+ * @param loader - Loader built by the worker entry.
+ */
+export declare function setActiveModuleLoader(loader: WorkerModuleLoader): void;
+/**
+ * Read the published loader.
+ * @returns The active loader.
+ */
+export declare function requireActiveModuleLoader(): WorkerModuleLoader;
+//# sourceMappingURL=module-loader.d.ts.map

package/lib/types/module-system/posix-path.d.ts

@@ -0,0 +1,98 @@
+/**
+ * POSIX path helpers for the worker VFS: one absolute root, no drive letters,
+ * no symlinks.
+ *
+ * **Not a `node:path` substitute.** {@link dirname}, {@link basename}, and
+ * {@link parse} normalize first, because every caller here hands the result to
+ * the VFS, which keys files by normalized absolute path — `dirname('/a/b/..')`
+ * answers `/`, the directory that actually holds the entry. Node's three are
+ * purely lexical and answer `/a/b`. A `node:path` proxy owes callers Node's
+ * literal answers, so it needs its own port of Node's implementation rather than
+ * a facade over this module; measured over ~200 cases, the normalizing and
+ * lexical forms diverge in 45, all in these three functions. The Node-facing
+ * port is pinned separately by `../../tests/node/path-diff.spec.ts`.
+ * @module @deepseek-ai/dsh-experimental-webworker-runtime/src/module-system/posix-path
+ */
+/** Path separator of the virtual filesystem. */
+export declare const SEP = "/";
+/**
+ * Collapse `.` and `..` segments.
+ * @param path - Path with any number of separators.
+ * @returns Normalized path; a relative input keeps leading `..` segments.
+ */
+export declare function normalize(path: string): string;
+/**
+ * Join segments and normalize the result.
+ * @param segments - Path segments.
+ * @returns Joined path, `.` when nothing remains.
+ */
+export declare function join(...segments: string[]): string;
+/**
+ * Resolve segments right to left against a base directory.
+ * @param segments - Path segments; the first absolute one wins.
+ * @returns Absolute normalized path.
+ */
+export declare function resolve(...segments: string[]): string;
+/**
+ * Directory part of a path, after normalization (see the module note).
+ * @param path - Path to inspect.
+ * @returns Parent path; `/` for root children and `.` for bare names.
+ */
+export declare function dirname(path: string): string;
+/**
+ * Last segment of a path, after normalization (see the module note).
+ * @param path - Path to inspect.
+ * @param suffix - Optional suffix to strip.
+ * @returns Final segment.
+ */
+export declare function basename(path: string, suffix?: string): string;
+/**
+ * Extension of the last segment, dot included.
+ * @param path - Path to inspect.
+ * @returns Extension, or an empty string when there is none.
+ */
+export declare function extname(path: string): string;
+/**
+ * Report whether a path starts at the root.
+ * @param path - Path to inspect.
+ * @returns True for absolute paths.
+ */
+export declare function isAbsolute(path: string): boolean;
+/**
+ * Relative path from one absolute path to another.
+ * @param from - Source directory.
+ * @param to - Target path.
+ * @returns Relative path using `..` segments.
+ */
+export declare function relative(from: string, to: string): string;
+/**
+ * Split a path into components, after normalization (see the module note).
+ * @param path - Path to split.
+ * @returns Root, directory, base name, extension, and stem.
+ */
+export declare function parse(path: string): {
+    root: string;
+    dir: string;
+    base: string;
+    ext: string;
+    name: string;
+};
+/**
+ * Node's Windows-only namespaced-path conversion.
+ * @param path - the path to convert.
+ * @returns The path unchanged; namespaced paths are a Windows concept.
+ */
+export declare function toNamespacedPath(path: string): string;
+/**
+ * Convert a VFS path into a `file:` URL string.
+ * @param path - Absolute VFS path.
+ * @returns URL text with each segment percent-encoded.
+ */
+export declare function pathToFileUrl(path: string): string;
+/**
+ * Convert a `file:` URL back into a VFS path.
+ * @param url - URL text or URL instance.
+ * @returns Absolute VFS path.
+ */
+export declare function fileUrlToPath(url: string | URL): string;
+//# sourceMappingURL=posix-path.d.ts.map

package/lib/types/node/builtin_modules/implemented/abort-error.d.ts

@@ -0,0 +1,11 @@
+/** Build the Node-style cancellation error shared by abortable builtin APIs. */
+/**
+ * Create an `AbortError` carrying Node's stable error code.
+ * @param reason - Optional AbortSignal reason exposed as the error cause.
+ * @returns A Node-compatible abort error.
+ */
+export declare function abortError(reason?: unknown): Error & {
+    code: string;
+    cause?: unknown;
+};
+//# sourceMappingURL=abort-error.d.ts.map